@astrasyncai/verification-gateway 5.9.0 → 5.11.0

package/dist/enrolment-store-8DyaIOLe.d.mts

@@ -0,0 +1,26 @@
+/**
+ * Where fleet enrolment and the cached signed policy live.
+ *
+ * Machine scope (written by `astrasync guard enroll --system` / MDM) WINS
+ * over user scope. The machine-scope fleet.json is world-readable (0644) —
+ * the hook runs as the developer and must read the device credential; that
+ * credential can only heartbeat and fetch this device's signed policy, never
+ * alter it. User scope lives under ~/.astrasync/fleet/ at 0600.
+ *
+ * The policy cache + runtime state are user-scope (the hook must be able to
+ * refresh them); tampering is caught by the signature check against the JWKS
+ * pinned in the enrolment, and a missing cache is re-fetched or fails closed.
+ */
+
+interface FleetPaths {
+    machineDevice: string;
+    machinePolicy: string;
+    userDir: string;
+    userDevice: string;
+    userPolicy: string;
+    /** Signed key-rotation chain (untrusted storage: each link is verified from the pin). */
+    userKeyChain: string;
+    state: string;
+}
+
+export type { FleetPaths as F };

package/dist/enrolment-store-8DyaIOLe.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Where fleet enrolment and the cached signed policy live.
+ *
+ * Machine scope (written by `astrasync guard enroll --system` / MDM) WINS
+ * over user scope. The machine-scope fleet.json is world-readable (0644) —
+ * the hook runs as the developer and must read the device credential; that
+ * credential can only heartbeat and fetch this device's signed policy, never
+ * alter it. User scope lives under ~/.astrasync/fleet/ at 0600.
+ *
+ * The policy cache + runtime state are user-scope (the hook must be able to
+ * refresh them); tampering is caught by the signature check against the JWKS
+ * pinned in the enrolment, and a missing cache is re-fetched or fails closed.
+ */
+
+interface FleetPaths {
+    machineDevice: string;
+    machinePolicy: string;
+    userDir: string;
+    userDevice: string;
+    userPolicy: string;
+    /** Signed key-rotation chain (untrusted storage: each link is verified from the pin). */
+    userKeyChain: string;
+    state: string;
+}
+
+export type { FleetPaths as F };

package/dist/gateway/gateway.js

@@ -3748,7 +3748,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.9.0";
+var SDK_VERSION = "5.11.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -4067,6 +4067,24 @@ async function callVerifyAccessAPI(config, request) {
         }
       };
     }
+    if (response.status === 400 && data?.error === "INVALID_AGENT_ID") {
+      const message = typeof data?.message === "string" ? data.message : "Agent identifier must be a canonical ASTRA-* id.";
+      return {
+        success: true,
+        attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0,
+        access: {
+          allowed: false,
+          reason: "invalid_agent_id",
+          failures: [
+            {
+              dimension: "identity.invalid_agent_id",
+              message,
+              guidance: typeof data?.guidance === "string" ? data.guidance : "Present your canonical ASTRA-* id (discover it via GET /api/agents/request-registration/{requestId} after owner approval)."
+            }
+          ]
+        }
+      };
+    }
     if (!response.ok) {
       if (response.status === 401) {
         return {