@clear-capabilities/agentic-security-scanner 0.174.0 → 0.176.0

package/dist/2923.index.js

@@ -316,6 +316,16 @@ function _splitHostPort(v) {
   return { host: _safeIdentifierOrNull(host), port };
 }
 
+// Identity is recorded ONLY as a keyed-hash token, and only when the importer supplied the tokenizer (`context.tokenizeIdentity`).
+// This module stays zero-import and holds no key: with no tokenizer, identity is dropped, never stored raw and never hashed without a
+// key (an unkeyed hash of a username is reversible by guessing). A raw value that is not a plausible identity string is dropped too.
+function _identityToken(context, raw) {
+  if (typeof context?.tokenizeIdentity !== 'function') return null;
+  if (typeof raw !== 'string' || raw.length === 0 || raw.length > 256 || /[\u0000-\u001f]/.test(raw)) return null;
+  const t = context.tokenizeIdentity(raw);
+  return typeof t === 'string' && /^idt_[0-9a-f]{16}$/.test(t) ? t : null;
+}
+
 function _draftBase(context, environmentOverride) {
   const { version, adapter, source, environment, windowStart, windowEnd, importedAt, retention } = context;
   return {
@@ -409,6 +419,7 @@ function parseOtelJsonObservations(text, context) {
         if (storeService) attributes['destination.service'] = storeService;
 
         if (Object.keys(attributes).length === 0) continue; // nothing safe to report for this span
+        { const idt = _identityToken(context, a['enduser.id']); if (idt) attributes['identity.token'] = idt; }
 
         const at = _isoFromUnixNano(span.startTimeUnixNano) ?? context.windowStart;
         drafts.push({
@@ -558,6 +569,7 @@ function parseK8sAuditLogObservations(text, context) {
     }
 
     if (Object.keys(attributes).length === 0) continue;
+    { const idt = _identityToken(context, _isPlainObject(record.user) ? record.user.username : undefined); if (idt) attributes['identity.token'] = idt; }
 
     const observedAt = typeof record.requestReceivedTimestamp === 'string' && Number.isFinite(Date.parse(record.requestReceivedTimestamp))
       ? record.requestReceivedTimestamp
@@ -621,6 +633,7 @@ function parseHttpAccessLogObservations(text, context) {
     if (scheme) attributes['destination.scheme'] = scheme;
 
     if (Object.keys(attributes).length === 0) continue;
+    { const idt = _identityToken(context, record.user ?? record.remote_user ?? record.authenticated_user); if (idt) attributes['identity.token'] = idt; }
 
     const ts = record.timestamp ?? record.time;
     const observedAt = typeof ts === 'string' && Number.isFinite(Date.parse(ts)) ? ts : context.windowStart;

package/dist/2946.index.js

@@ -0,0 +1,81 @@
+export const id = 2946;
+export const ids = [2946];
+export const modules = {
+
+/***/ 52946:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   verifyWithCosign: () => (/* binding */ verifyWithCosign)
+/* harmony export */ });
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+/* harmony import */ var node_os__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(48161);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(76760);
+/* harmony import */ var _sandbox_supervise_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(74676);
+/* harmony import */ var _sandbox_trust_domains_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(38832);
+// Signature verification by DELEGATION to cosign (PRD 5, requirement 5: "Sigstore, cosign"). This module does not implement keyless
+// verification (certificate chains, transparency-log proofs, identity matching); cosign does, and this runs it and reads its answer.
+//
+// The state is one of verified | invalid | missing | unavailable, and the rules are conservative:
+//   * the check is bound to the DIGEST we scanned (`<repo>@sha256:...`), never to a tag, so a signature for some other image cannot
+//     be mistaken for this one;
+//   * `verified` needs cosign to exit 0 AND its output to name that exact digest in a signature payload. Exit 0 with a different (or no)
+//     digest is `invalid`;
+//   * a cosign that is not installed, that timed out, or that could not reach what it needed is `unavailable` and says so. It is never
+//     read as verified, and never as invalid either: a check that did not run is not a failed check;
+//   * the key is passed as a temporary file (mode 0600, removed afterwards) and the child gets a scrubbed environment.
+
+
+
+
+
+
+const DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
+const REPO_RE = /^[A-Za-z0-9][A-Za-z0-9.\-_/:]{0,300}$/;
+
+function findTool(name, pathEnv = process.env.PATH || '') {
+  for (const dir of pathEnv.split(node_path__WEBPACK_IMPORTED_MODULE_2__.delimiter)) {
+    if (!dir) continue;
+    const p = node_path__WEBPACK_IMPORTED_MODULE_2__.join(dir, name);
+    try { node_fs__WEBPACK_IMPORTED_MODULE_0__.accessSync(p, node_fs__WEBPACK_IMPORTED_MODULE_0__.constants.X_OK); if (node_fs__WEBPACK_IMPORTED_MODULE_0__.statSync(p).isFile()) return node_fs__WEBPACK_IMPORTED_MODULE_0__.realpathSync(p); } catch { /* next */ }
+  }
+  return null;
+}
+
+/** @param {{repository: string, digest: string, publicKeyPem?: string, certificateIdentity?: string, certificateOidcIssuer?: string}} o */
+async function verifyWithCosign({ repository, digest, publicKeyPem = null, certificateIdentity = null, certificateOidcIssuer = null, timeoutMs = 60_000, signal, pathEnv = process.env.PATH } = {}) {
+  const na = (reason) => ({ state: 'unavailable', via: 'cosign', reason });
+  if (!DIGEST_RE.test(String(digest))) return na('there is no sha256 image digest to verify a signature against');
+  if (!REPO_RE.test(String(repository ?? '')) || String(repository).includes('..') || String(repository).startsWith('-')) return na('the repository name is not valid');
+  const keyless = !!(certificateIdentity && certificateOidcIssuer);
+  if (!publicKeyPem && !keyless) return na('no verification material: give a public key, or a certificate identity and OIDC issuer for keyless verification');
+  if (publicKeyPem && keyless) return na('give either a public key or a keyless identity, not both');
+  const bin = findTool('cosign', pathEnv);
+  if (!bin) return na('cosign is not installed; nothing was verified');
+  const dir = node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(node_path__WEBPACK_IMPORTED_MODULE_2__.join(node_os__WEBPACK_IMPORTED_MODULE_1__.tmpdir(), 'cosign-'));
+  try {
+    const args = ['verify'];
+    if (publicKeyPem) { const kf = node_path__WEBPACK_IMPORTED_MODULE_2__.join(dir, 'key.pub'); node_fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(kf, publicKeyPem, { mode: 0o600 }); args.push('--key', kf); } else args.push('--certificate-identity', certificateIdentity, '--certificate-oidc-issuer', certificateOidcIssuer);
+    args.push(`${repository}@${digest}`);
+    const r = await (0,_sandbox_supervise_js__WEBPACK_IMPORTED_MODULE_3__/* .superviseSpawn */ .u)(bin, args, { cwd: dir, env: (0,_sandbox_trust_domains_js__WEBPACK_IMPORTED_MODULE_4__/* .scrubEnv */ .LK)(process.env), timeoutMs, signal, maxOutputBytes: 2 * 1024 * 1024 });
+    if (r.spawnError) return na(`could not start cosign: ${r.spawnError}`);
+    if (r.timedOut) return na('cosign did not answer in time');
+    if (r.cancelled) return na('cancelled');
+    const err = String(r.stderr).toLowerCase();
+    if (r.exitCode === 0) {
+      let payloads = [];
+      try { const j = JSON.parse(r.stdout); payloads = Array.isArray(j) ? j : [j]; } catch { /* handled below */ }
+      const matching = payloads.filter((p) => p?.critical?.image?.['docker-manifest-digest'] === digest);
+      if (matching.length) return { state: 'verified', via: 'cosign', mode: keyless ? 'keyless' : 'key', signatures: matching.length, identity: keyless ? certificateIdentity : null, reason: null };
+      return { state: 'invalid', via: 'cosign', reason: 'cosign reported success but none of the verified signatures names this image digest' };
+    }
+    if (/no signatures found|no matching signatures|no signatures associated|manifest unknown/.test(err)) return { state: 'missing', via: 'cosign', reason: 'no signature exists for this digest' };
+    if (/invalid signature|signature verification failed|crypto\/ecdsa|verification failed|certificate identity|none of the expected identities/.test(err)) return { state: 'invalid', via: 'cosign', reason: 'cosign rejected the signature or the identity' };
+    return na(`cosign could not complete the check (exit ${r.exitCode}): ${String(r.stderr).trim().split('\n').pop()?.slice(0, 160) ?? ''}`);
+  } finally { try { node_fs__WEBPACK_IMPORTED_MODULE_0__.rmSync(dir, { recursive: true, force: true }); } catch { /* best effort */ } }
+}
+
+
+/***/ })
+
+};

package/dist/3196.index.js

@@ -0,0 +1,27 @@
+export const id = 3196;
+export const ids = [3196];
+export const modules = {
+
+/***/ 33196:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   makeIdentityTokenizer: () => (/* binding */ makeIdentityTokenizer)
+/* harmony export */ });
+/* harmony import */ var _posture_integrity_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(71130);
+// A keyed-hash token for an authenticated identity (PRD 2 section 1, "authenticated identity"). The observation contract is closed-world
+// and refuses raw identities, so what is stored is `idt_` + 16 hex of an HMAC under the per-install key:
+//   * the same identity always yields the same token on this install, so "the same identity used these paths" can be answered;
+//   * without the install key the token cannot be reversed or confirmed by guessing usernames (an unkeyed hash could);
+//   * tokens from two installs do not match, which is deliberate: they are not a portable identifier.
+// It is a pseudonym, not anonymity: someone who holds the install key and a candidate username can confirm a match.
+
+
+function makeIdentityTokenizer() {
+  return (raw) => (typeof raw === 'string' && raw.length > 0 ? `idt_${(0,_posture_integrity_js__WEBPACK_IMPORTED_MODULE_0__/* .signLastScan */ .lU)(`identity-token:v1:${raw}`).slice(0, 16)}` : null);
+}
+
+
+/***/ })
+
+};

package/dist/3727.index.js

@@ -0,0 +1,292 @@
+export const id = 3727;
+export const ids = [3727];
+export const modules = {
+
+/***/ 73727:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  RegistryError: () => (/* binding */ RegistryError),
+  fetchImage: () => (/* binding */ fetchImage)
+});
+
+// UNUSED EXPORTS: REGISTRY_LIMITS, parseReference, resolveCredentials
+
+// EXTERNAL MODULE: external "node:fs"
+var external_node_fs_ = __webpack_require__(73024);
+// EXTERNAL MODULE: external "node:os"
+var external_node_os_ = __webpack_require__(48161);
+// EXTERNAL MODULE: external "node:path"
+var external_node_path_ = __webpack_require__(76760);
+// EXTERNAL MODULE: external "node:crypto"
+var external_node_crypto_ = __webpack_require__(77598);
+;// CONCATENATED MODULE: ./src/artifact/oci-layout.js
+// Assemble an OCI image-layout archive (a plain tar) from a manifest, a config and layer blobs that were already fetched and
+// digest-verified. The result is exactly the shape `image-archive.js` reads from a local `oci-archive`, so a remote image and a local
+// one go through ONE parser and the same size and path guards. Nothing is extracted to disk.
+
+
+const BLOCK = 512;
+
+function octal(n, len) { return n.toString(8).padStart(len - 1, '0') + '\0'; }
+
+/** A single ustar entry. Names here are generated by this module (`blobs/sha256/<hex>`), never taken from the network. */
+function tarEntry(name, data) {
+  if (Buffer.byteLength(name) > 100) throw new Error('tar entry name too long');
+  const header = Buffer.alloc(BLOCK, 0);
+  header.write(name, 0, 'utf8');
+  header.write(octal(0o644, 8), 100);
+  header.write(octal(0, 8), 108); header.write(octal(0, 8), 116);
+  header.write(octal(data.length, 12), 124);
+  header.write(octal(0, 12), 136);
+  header.fill(0x20, 148, 156);
+  header.write('0', 156);
+  header.write('ustar\0', 257); header.write('00', 263);
+  let sum = 0; for (const b of header) sum += b;
+  header.write(octal(sum, 7), 148); header[155] = 0x20;
+  const pad = (BLOCK - (data.length % BLOCK)) % BLOCK;
+  return Buffer.concat([header, data, Buffer.alloc(pad, 0)]);
+}
+
+const sha256Hex = (buf) => external_node_crypto_.createHash('sha256').update(buf).digest('hex');
+
+/**
+ * @param {{manifest: Buffer, config: Buffer, layers: Buffer[]}} img  bytes exactly as the registry served them
+ * @returns {{tar: Buffer, manifestDigest: string}}
+ */
+function buildOciArchive({ manifest, config, layers, mediaType = 'application/vnd.oci.image.manifest.v1+json' }) {
+  const manifestHex = sha256Hex(manifest);
+  const index = Buffer.from(JSON.stringify({ schemaVersion: 2, manifests: [{ mediaType, digest: `sha256:${manifestHex}`, size: manifest.length }] }));
+  const parts = [
+    tarEntry('oci-layout', Buffer.from(JSON.stringify({ imageLayoutVersion: '1.0.0' }))),
+    tarEntry('index.json', index),
+    tarEntry(`blobs/sha256/${manifestHex}`, manifest),
+    tarEntry(`blobs/sha256/${sha256Hex(config)}`, config),
+  ];
+  const seen = new Set([manifestHex, sha256Hex(config)]);
+  for (const l of layers) { const h = sha256Hex(l); if (seen.has(h)) continue; seen.add(h); parts.push(tarEntry(`blobs/sha256/${h}`, l)); }
+  parts.push(Buffer.alloc(BLOCK * 2, 0));
+  return { tar: Buffer.concat(parts), manifestDigest: `sha256:${manifestHex}` };
+}
+
+;// CONCATENATED MODULE: ./src/artifact/registry.js
+// A minimal OCI Distribution (v2) client for ONE purpose: fetching a single image the operator named explicitly
+// (`image scan --registry <ref>`), so it can be scanned like a local archive (PRD 5, requirement 1: "explicit remote OCI reference").
+//
+// It is deliberately small and deliberately strict. It is hostile-input handling first:
+//   * a reference is parsed, not interpolated: no scheme, no userinfo, no whitespace, no path tricks;
+//   * transport is HTTPS. Plain HTTP is accepted only for a loopback registry (a local test or a local mirror); anything else is refused;
+//   * every redirect is followed by hand, at most 5 hops, to an HTTPS (or loopback) target, and the credential is NOT sent to a host
+//     other than the registry's own, which is what keeps a blob redirected to a CDN from receiving it;
+//   * every body is digest-verified against what the manifest said, and size-capped while it streams, so a registry that lies about
+//     a size or sends endless bytes is cut off, not buffered;
+//   * the manifest a registry returns for a tag is hashed and checked against `Docker-Content-Digest` when one is sent, and for a
+//     digest reference against the reference itself;
+//   * credentials come from the environment or the Docker config for that registry only, are never logged, never put in an error,
+//     and live in an object that refuses to serialize.
+// Nothing is executed and nothing is extracted to disk; the result is an OCI-layout archive in memory for `image-archive.js`.
+
+
+
+
+
+class RegistryError extends Error {
+  constructor(message, code) { super(message); this.name = 'RegistryError'; this.code = code; }
+}
+
+const REGISTRY_LIMITS = Object.freeze({ maxManifestBytes: 1024 * 1024, maxConfigBytes: 4 * 1024 * 1024, maxLayerBytes: 512 * 1024 * 1024, maxTotalBytes: 1024 * 1024 * 1024, maxLayers: 128, maxRedirects: 5, requestTimeoutMs: 60_000, totalTimeoutMs: 15 * 60_000 });
+
+const MANIFEST_ACCEPT = [
+  'application/vnd.oci.image.index.v1+json', 'application/vnd.docker.distribution.manifest.list.v2+json',
+  'application/vnd.oci.image.manifest.v1+json', 'application/vnd.docker.distribution.manifest.v2+json',
+].join(', ');
+const INDEX_TYPES = new Set(['application/vnd.oci.image.index.v1+json', 'application/vnd.docker.distribution.manifest.list.v2+json']);
+const MANIFEST_TYPES = new Set(['application/vnd.oci.image.manifest.v1+json', 'application/vnd.docker.distribution.manifest.v2+json']);
+const LOOPBACK_HOST = /^(?:localhost|127(?:\.\d{1,3}){3}|\[::1\])$/i;
+const DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
+
+/** Credentials that cannot be printed: `JSON.stringify`, `String()` and `util.inspect` all give a placeholder. */
+class Credentials {
+  #basic = null; #bearer = null;
+  constructor({ user, password, token }) { if (token) this.#bearer = token; else if (user && password) this.#basic = Buffer.from(`${user}:${password}`).toString('base64'); }
+  get present() { return !!(this.#basic || this.#bearer); }
+  basicHeader() { return this.#basic ? `Basic ${this.#basic}` : null; }
+  bearerHeader() { return this.#bearer ? `Bearer ${this.#bearer}` : null; }
+  toJSON() { return '[credentials]'; }
+  toString() { return '[credentials]'; }
+  [Symbol.for('nodejs.util.inspect.custom')]() { return '[credentials]'; }
+}
+
+/** The registry's own credentials: environment first, then the Docker config entry for exactly this registry. Never another host's. */
+function resolveCredentials(registry, { env = process.env, dockerConfig = external_node_path_.join(external_node_os_.homedir(), '.docker', 'config.json') } = {}) {
+  if (env.AGENTIC_SECURITY_REGISTRY_TOKEN) return new Credentials({ token: env.AGENTIC_SECURITY_REGISTRY_TOKEN });
+  if (env.AGENTIC_SECURITY_REGISTRY_USER && env.AGENTIC_SECURITY_REGISTRY_PASSWORD) return new Credentials({ user: env.AGENTIC_SECURITY_REGISTRY_USER, password: env.AGENTIC_SECURITY_REGISTRY_PASSWORD });
+  try {
+    const cfg = JSON.parse(external_node_fs_.readFileSync(dockerConfig, 'utf8'));
+    const keys = [registry, `https://${registry}`, ...(registry === 'registry-1.docker.io' ? ['https://index.docker.io/v1/', 'docker.io'] : [])];
+    for (const k of keys) {
+      const auth = cfg.auths?.[k]?.auth;
+      if (typeof auth === 'string') { const [user, ...rest] = Buffer.from(auth, 'base64').toString('utf8').split(':'); if (user && rest.length) return new Credentials({ user, password: rest.join(':') }); }
+    }
+  } catch { /* no usable Docker config */ }
+  return new Credentials({});
+}
+
+/** @returns {{registry: string, repository: string, reference: string, isDigest: boolean, loopback: boolean}} */
+function parseReference(input) {
+  const raw = String(input ?? '');
+  if (!raw || raw.length > 300 || /[\s\0\\]/.test(raw) || /^[a-z][a-z0-9+.-]*:\/\//i.test(raw) || raw.includes('@') && !/@sha256:[0-9a-f]{64}$/.test(raw) || raw.includes('..') || raw.startsWith('-')) throw new RegistryError('not a valid image reference', 'bad_reference');
+  let rest = raw; let reference = 'latest'; let isDigest = false;
+  const at = rest.indexOf('@');
+  if (at !== -1) { reference = rest.slice(at + 1); rest = rest.slice(0, at); isDigest = true; }
+  const parts = rest.split('/');
+  let registry = 'registry-1.docker.io';
+  if (parts.length > 1 && (parts[0].includes('.') || parts[0].includes(':') || parts[0] === 'localhost')) registry = parts.shift();
+  let repo = parts.join('/');
+  if (!isDigest) { const colon = repo.lastIndexOf(':'); if (colon !== -1) { reference = repo.slice(colon + 1); repo = repo.slice(0, colon); } }
+  if (registry === 'registry-1.docker.io' && !repo.includes('/')) repo = `library/${repo}`;
+  if (registry === 'docker.io' || registry === 'index.docker.io') registry = 'registry-1.docker.io';
+  if (!/^[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*(?:\/[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*)*$/.test(repo)) throw new RegistryError('not a valid repository name', 'bad_reference');
+  if (!isDigest && !/^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/.test(reference)) throw new RegistryError('not a valid tag', 'bad_reference');
+  if (isDigest && !DIGEST_RE.test(reference)) throw new RegistryError('only sha256 digests are supported', 'bad_reference');
+  if (!/^(?:\[::1\]|[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?)(?::\d{1,5})?$/.test(registry)) throw new RegistryError('not a valid registry host', 'bad_reference');
+  const host = registry.replace(/:\d+$/, '');
+  return { registry, repository: repo, reference, isDigest, loopback: LOOPBACK_HOST.test(host) };
+}
+
+const scrubUrl = (u) => { try { const x = new URL(u); return `${x.protocol}//${x.host}${x.pathname}`; } catch { return '[url]'; } };
+
+async function fetchImage(input, { platform = 'linux/amd64', credentials = null, fetchImpl = globalThis.fetch, limits = REGISTRY_LIMITS, signal = null, env = process.env, allowLoopbackHttp = false } = {}) {
+  const ref = parseReference(input);
+  const L = { ...REGISTRY_LIMITS, ...limits };
+  const creds = credentials ?? resolveCredentials(ref.registry, { env });
+  const scheme = ref.loopback && allowLoopbackHttp ? 'http' : 'https';
+  const origin = `${scheme}://${ref.registry}`;
+  const deadline = Date.now() + L.totalTimeoutMs;
+  let authHeader = null; let total = 0;
+  const allowedUrl = (u) => { try { const x = new URL(u); return x.protocol === 'https:' || (x.protocol === 'http:' && LOOPBACK_HOST.test(x.hostname)); } catch { return false; } };
+
+  async function request(url, { accept, auth = true, maxBytes, expectDigest = null } = {}) {
+    let current = url; let sendAuth = auth;
+    for (let hop = 0; hop <= L.maxRedirects; hop++) {
+      if (!allowedUrl(current)) throw new RegistryError(`refusing a non-HTTPS target: ${scrubUrl(current)}`, 'insecure_transport');
+      if (Date.now() > deadline) throw new RegistryError('the total time budget was exhausted', 'timeout');
+      if (signal?.aborted) throw new RegistryError('the request was cancelled', 'network');
+      const sameOrigin = new URL(current).origin === new URL(origin).origin;
+      const headers = { 'user-agent': 'agentic-security-image-scan', ...(accept ? { accept } : {}) };
+      if (sendAuth && sameOrigin) { const h = authHeader ?? creds.bearerHeader(); if (h) headers.authorization = h; }
+      const ctl = new AbortController();
+      const t = setTimeout(() => ctl.abort(), L.requestTimeoutMs);
+      const onAbort = () => ctl.abort(); signal?.addEventListener('abort', onAbort, { once: true });
+      let res;
+      try { res = await fetchImpl(current, { headers, redirect: 'manual', signal: ctl.signal }); }
+      catch (e) { throw new RegistryError(ctl.signal.aborted ? 'the request timed out or was cancelled' : `request failed: ${String(e.cause?.code ?? e.code ?? e.message).slice(0, 80)}`, 'network'); }
+      finally { clearTimeout(t); signal?.removeEventListener('abort', onAbort); }
+      if (res.status >= 300 && res.status < 400 && res.headers.get('location')) {
+        const next = new URL(res.headers.get('location'), current).toString();
+        if (new URL(next).origin !== new URL(origin).origin) sendAuth = false; // never carry the registry credential to another host
+        current = next; continue;
+      }
+      if (res.status === 401 && sameOrigin && !authHeader) return { status: 401, challenge: res.headers.get('www-authenticate') ?? '' };
+      if (res.status === 404) throw new RegistryError('not found in the registry', 'not_found');
+      if (res.status === 401 || res.status === 403) throw new RegistryError('the registry refused access (authentication required or not permitted)', 'unauthorized');
+      if (!res.ok) throw new RegistryError(`the registry answered ${res.status}`, 'registry_error');
+      const declared = Number(res.headers.get('content-length'));
+      if (Number.isFinite(declared) && declared > maxBytes) throw new RegistryError(`a response larger than the ${maxBytes}-byte limit`, 'too_large');
+      const chunks = []; let got = 0;
+      for await (const c of res.body) {
+        got += c.length; total += c.length;
+        if (got > maxBytes || total > L.maxTotalBytes) { try { await res.body.cancel(); } catch { /* closing */ } throw new RegistryError('the response exceeded its size limit', 'too_large'); }
+        chunks.push(c);
+      }
+      const body = Buffer.concat(chunks);
+      if (expectDigest && `sha256:${sha256Hex(body)}` !== expectDigest) throw new RegistryError('a downloaded blob does not match its digest', 'digest_mismatch');
+      return { status: res.status, body, headers: res.headers };
+    }
+    throw new RegistryError('too many redirects', 'redirect_loop');
+  }
+
+  async function authed(url, opts) {
+    let r = await request(url, opts);
+    if (r.status !== 401) return r;
+    const basic = creds.basicHeader();
+    if (/^Basic\b/i.test(r.challenge)) {
+      if (!basic) throw new RegistryError('the registry requires authentication and none is configured', 'unauthorized');
+      authHeader = basic;
+      r = await request(url, opts);
+      if (r.status === 401) throw new RegistryError('the registry rejected the credentials', 'unauthorized');
+      return r;
+    }
+    const m = /^Bearer\s+(.*)$/i.exec(r.challenge);
+    if (!m) throw new RegistryError(basic ? 'the registry asked for a scheme this client does not support' : 'the registry requires authentication and none is configured', 'unauthorized');
+    const params = Object.fromEntries([...m[1].matchAll(/(\w+)="([^"]*)"/g)].map((x) => [x[1], x[2]]));
+    if (!params.realm) throw new RegistryError('the authentication challenge named no token endpoint', 'unauthorized');
+    const tokenUrl = new URL(params.realm);
+    if (params.service) tokenUrl.searchParams.set('service', params.service);
+    tokenUrl.searchParams.set('scope', params.scope || `repository:${ref.repository}:pull`);
+    if (!allowedUrl(tokenUrl.toString())) throw new RegistryError('refusing a non-HTTPS token endpoint', 'insecure_transport');
+    // the token endpoint may be a different host (Docker Hub's is); the registry credential goes only to the host the challenge named, over HTTPS
+    const headers = { 'user-agent': 'agentic-security-image-scan', ...(basic ? { authorization: basic } : {}) };
+    let tr;
+    try { tr = await fetchImpl(tokenUrl.toString(), { headers, redirect: 'error' }); } catch { throw new RegistryError('the token request failed', 'network'); }
+    if (!tr.ok) throw new RegistryError(`the token endpoint answered ${tr.status}`, 'unauthorized');
+    let tj; try { tj = JSON.parse((await tr.text()).slice(0, 65536)); } catch { throw new RegistryError('the token endpoint returned something that is not JSON', 'unauthorized'); }
+    const token = tj.token ?? tj.access_token;
+    if (typeof token !== 'string' || !token) throw new RegistryError('the token endpoint returned no token', 'unauthorized');
+    authHeader = `Bearer ${token}`;
+    r = await request(url, opts);
+    if (r.status === 401) throw new RegistryError('the registry rejected the token', 'unauthorized');
+    return r;
+  }
+
+  const base = `${origin}/v2/${ref.repository}`;
+  let m = await authed(`${base}/manifests/${ref.reference}`, { accept: MANIFEST_ACCEPT, maxBytes: L.maxManifestBytes, ...(ref.isDigest ? { expectDigest: ref.reference } : {}) });
+  let manifestBytes = m.body;
+  const topDigest = `sha256:${sha256Hex(m.body)}`;
+  const headerDigest = m.headers.get('docker-content-digest');
+  if (headerDigest && headerDigest !== `sha256:${sha256Hex(manifestBytes)}`) throw new RegistryError('the manifest does not match the digest the registry reported for it', 'digest_mismatch');
+  let doc = parseJson(manifestBytes, 'manifest');
+  let mediaType = doc.mediaType ?? m.headers.get('content-type')?.split(';')[0];
+  let selected = null;
+  if (INDEX_TYPES.has(mediaType) || Array.isArray(doc.manifests)) {
+    const [os_, arch] = platform.split('/');
+    const entries = (doc.manifests ?? []).filter((e) => e?.platform && e.platform.os === os_ && e.platform.architecture === arch && DIGEST_RE.test(String(e.digest)));
+    if (!entries.length) throw new RegistryError(`the image has no ${platform} variant (available: ${(doc.manifests ?? []).map((e) => `${e?.platform?.os}/${e?.platform?.architecture}`).filter((x) => !x.includes('undefined')).slice(0, 12).join(', ') || 'none'})`, 'platform_not_found');
+    selected = entries[0];
+    m = await authed(`${base}/manifests/${selected.digest}`, { accept: MANIFEST_ACCEPT, maxBytes: L.maxManifestBytes, expectDigest: selected.digest });
+    manifestBytes = m.body; doc = parseJson(manifestBytes, 'platform manifest'); mediaType = doc.mediaType ?? selected.mediaType;
+  }
+  if (!MANIFEST_TYPES.has(mediaType) && !(Array.isArray(doc.layers) && doc.config)) throw new RegistryError('the registry returned a manifest of a kind this client does not read', 'unsupported_manifest');
+  if (!doc.config || !DIGEST_RE.test(String(doc.config.digest)) || !Array.isArray(doc.layers)) throw new RegistryError('the manifest is malformed', 'malformed_manifest');
+  if (doc.layers.length > L.maxLayers) throw new RegistryError(`the image has more than ${L.maxLayers} layers`, 'too_large');
+  for (const l of doc.layers) {
+    if (!DIGEST_RE.test(String(l.digest))) throw new RegistryError('a layer has no sha256 digest', 'malformed_manifest');
+    if (/foreign|nondistributable/i.test(String(l.mediaType)) || Array.isArray(l.urls)) throw new RegistryError('the image has a foreign (externally hosted) layer, which is not fetched', 'unsupported_manifest');
+    if (!Number.isInteger(l.size) || l.size < 0 || l.size > L.maxLayerBytes) throw new RegistryError(`a layer is larger than the ${L.maxLayerBytes}-byte limit`, 'too_large');
+  }
+  const blob = async (desc, cap) => {
+    if (Number.isInteger(desc.size) && desc.size > cap) throw new RegistryError('a blob is larger than its limit', 'too_large');
+    const r = await authed(`${base}/blobs/${desc.digest}`, { maxBytes: cap, expectDigest: desc.digest });
+    if (Number.isInteger(desc.size) && r.body.length !== desc.size) throw new RegistryError('a blob is not the size its manifest declared', 'digest_mismatch');
+    return r.body;
+  };
+  const config = await blob(doc.config, L.maxConfigBytes);
+  const layers = [];
+  for (const l of doc.layers) layers.push(await blob(l, L.maxLayerBytes));
+  const built = buildOciArchive({ manifest: manifestBytes, config, layers, mediaType: MANIFEST_TYPES.has(mediaType) ? mediaType : 'application/vnd.oci.image.manifest.v1+json' });
+  return {
+    tar: built.tar, manifestDigest: built.manifestDigest,
+    source: { kind: 'registry', registry: ref.registry, repository: ref.repository, reference: ref.reference, platform: selected ? `${selected.platform.os}/${selected.platform.architecture}` : null, indexDigest: selected ? topDigest : null, bytes: total, authenticated: creds.present },
+  };
+}
+
+function parseJson(buf, what) {
+  try { const j = JSON.parse(buf.toString('utf8')); if (!j || typeof j !== 'object' || Array.isArray(j)) throw new Error('not an object'); return j; } catch { throw new RegistryError(`the ${what} is not valid JSON`, 'malformed_manifest'); }
+}
+
+
+/***/ })
+
+};