@westbayberry/dg 1.3.2 → 2.0.0

package/dist/proxy/server.js

@@ -0,0 +1,909 @@
+import { createHash } from "node:crypto";
+import { EventEmitter } from "node:events";
+import { BufferBudgetError, collectBounded } from "./buffer-budget.js";
+import { readFileSync } from "node:fs";
+import { createServer, request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { connect } from "node:net";
+import { createSecureContext, createServer as createTlsServer, connect as tlsConnect } from "node:tls";
+import { createEphemeralCertificateAuthority } from "./ca.js";
+import { shouldMitmHost } from "./classify-host.js";
+import { enforceProtectedInstall } from "./enforcement.js";
+import { artifactDisplayName, artifactUrlHash, extractRegistryMetadataIdentities, isRegistryIndexRequest, resolveArtifactIdentity } from "./metadata-map.js";
+import { authorityFor, connectViaUpstreamProxy, selectUpstreamProxy } from "./upstream-proxy.js";
+import { redactSecrets } from "../launcher/output-redaction.js";
+import { envAuthToken } from "../auth/env-token.js";
+export async function startProductionHttpProxy(options) {
+    const ca = createEphemeralCertificateAuthority(options.session.files.ca);
+    const state = {
+        ready: false,
+        port: 0,
+        decisions: [],
+        inflight: [],
+        hashes: [],
+        identities: [],
+        events: []
+    };
+    const activeSockets = new Set();
+    const server = createServer((request, response) => {
+        handleProxyRequest(request, response, options, state).catch((error) => {
+            const decision = recordDecision(options, state, {
+                verdict: "block",
+                packageName: options.classification.manager,
+                cause: "proxy-setup-failure",
+                reason: error instanceof Error ? error.message : "proxy request failed"
+            });
+            sendBlocked(response, decision);
+        });
+    });
+    server.on("connection", (socket) => trackSocket(activeSockets, socket));
+    server.on("connect", (request, socket, head) => {
+        const clientSocket = socket;
+        handleConnectRequest(request, clientSocket, head, options, state, ca, activeSockets).catch((error) => {
+            const decision = recordDecision(options, state, {
+                verdict: "block",
+                packageName: request.url ?? options.classification.manager,
+                cause: "proxy-setup-failure",
+                reason: error instanceof Error ? error.message : "TLS CONNECT proxying failed"
+            });
+            clientSocket.end(`HTTP/1.1 502 Bad Gateway\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nDependency Guardian blocked ${redactSecrets(decision.packageName)}: ${redactSecrets(decision.reason)}\n`);
+        });
+    });
+    await listen(server, options.listenHost ?? "127.0.0.1", options.listenPort ?? 0);
+    const address = server.address();
+    if (typeof address !== "object" || address === null) {
+        throw new Error("production proxy did not bind a TCP port");
+    }
+    state.ready = true;
+    state.port = address.port;
+    writeProxyState(options.session, state);
+    return {
+        port: address.port,
+        close: () => closeServer(server, activeSockets)
+    };
+}
+export function readProxySessionState(session) {
+    try {
+        const parsed = JSON.parse(readFileSync(session.files.proxy, "utf8"));
+        return {
+            ready: parsed.ready === true,
+            port: typeof parsed.port === "number" ? parsed.port : 0,
+            decisions: Array.isArray(parsed.decisions) ? parsed.decisions : [],
+            inflight: Array.isArray(parsed.inflight) ? parsed.inflight.filter((name) => typeof name === "string") : [],
+            hashes: Array.isArray(parsed.hashes) ? parsed.hashes : [],
+            identities: Array.isArray(parsed.identities) ? parsed.identities : [],
+            events: Array.isArray(parsed.events) ? parsed.events.filter((event) => typeof event === "string") : []
+        };
+    }
+    catch {
+        return {
+            ready: false,
+            port: 0,
+            decisions: [],
+            inflight: [],
+            hashes: [],
+            identities: [],
+            events: []
+        };
+    }
+}
+function listen(server, host, port) {
+    return new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(port, host, () => {
+            server.off("error", reject);
+            resolve();
+        });
+    });
+}
+function closeServer(server, activeSockets) {
+    for (const socket of activeSockets) {
+        socket.destroy();
+    }
+    return new Promise((resolve) => {
+        server.close(() => resolve());
+    });
+}
+function trackSocket(activeSockets, socket) {
+    activeSockets.add(socket);
+    socket.once("close", () => {
+        activeSockets.delete(socket);
+    });
+}
+async function handleProxyRequest(request, response, options, state) {
+    const target = parseProxyTarget(request);
+    if (!target || (target.protocol !== "http:" && target.protocol !== "https:")) {
+        const decision = recordDecision(options, state, {
+            verdict: "block",
+            packageName: target?.hostname ?? "unknown-artifact",
+            cause: "proxy-setup-failure",
+            reason: "proxy request did not include a supported HTTP(S) artifact URL"
+        });
+        sendBlocked(response, decision);
+        return;
+    }
+    await handleArtifactRequest(request, response, target, options, state);
+}
+async function handleConnectRequest(request, clientSocket, head, options, state, ca, activeSockets) {
+    const target = parseConnectTarget(request.url);
+    if (!target) {
+        clientSocket.end("HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n");
+        return;
+    }
+    if (!shouldMitmHost(target.hostname, options.env)) {
+        state.events = [...state.events, `tunnel:${redactSecrets(authorityFor(target))}`];
+        writeProxyState(options.session, state);
+        await blindTunnel(clientSocket, head, target, options, activeSockets);
+        return;
+    }
+    state.events = [...state.events, `mitm:${redactSecrets(target.hostname)}`];
+    writeProxyState(options.session, state);
+    await mitmTunnel(clientSocket, head, target, options, state, ca, activeSockets);
+}
+const REDIRECT_LIMIT = 5;
+function isRedirectStatus(statusCode) {
+    return [301, 302, 303, 307, 308].includes(statusCode);
+}
+function isPrivateNetworkHost(url) {
+    const host = url.hostname.toLowerCase().replace(/^\[/, "").replace(/\]$/, "");
+    if (host === "localhost" || host.endsWith(".localhost") || host === "0.0.0.0" || host === "::" || host === "::1") {
+        return true;
+    }
+    if (/^(127|10|0)\./.test(host) || /^192\.168\./.test(host) || /^169\.254\./.test(host) || /^172\.(1[6-9]|2[0-9]|3[01])\./.test(host)) {
+        return true;
+    }
+    if (/^::ffff:(127|10|0)\./.test(host) || /^::ffff:192\.168\./.test(host) || /^::ffff:169\.254\./.test(host) || /^::ffff:172\.(1[6-9]|2[0-9]|3[01])\./.test(host)) {
+        return true;
+    }
+    return /^(fe80|f[cd][0-9a-f]{2}):/.test(host);
+}
+function syntheticGetRequest(headers) {
+    const request = new EventEmitter();
+    request.method = "GET";
+    request.headers = headers;
+    request.complete = true;
+    process.nextTick(() => request.emit("end"));
+    return request;
+}
+function redirectHopHeaders(request, from, next) {
+    const headers = { ...request.headers };
+    if (from.host !== next.host) {
+        delete headers.authorization;
+        delete headers.cookie;
+    }
+    return headers;
+}
+async function fetchUpstreamFollowingRedirects(request, target, env) {
+    let current = target;
+    let upstream = await fetchUpstream(request, current, env);
+    for (let hop = 0; isRedirectStatus(upstream.statusCode); hop += 1) {
+        if (hop >= REDIRECT_LIMIT) {
+            throw new Error(`registry redirect chain exceeded ${REDIRECT_LIMIT} hops for ${current.host}`);
+        }
+        const location = headerValue(upstream.headers.location);
+        if (!location) {
+            throw new Error(`registry returned a ${upstream.statusCode} redirect with no Location header for ${current.host}`);
+        }
+        const next = new URL(location, current);
+        if (next.protocol !== "http:" && next.protocol !== "https:") {
+            throw new Error(`registry redirected to unsupported protocol ${next.protocol}`);
+        }
+        if (isPrivateNetworkHost(next) && !isPrivateNetworkHost(target)) {
+            throw new Error(`registry redirected a public artifact request into a private address (${next.hostname})`);
+        }
+        upstream = await fetchUpstream(syntheticGetRequest(redirectHopHeaders(request, current, next)), next, env);
+        current = next;
+    }
+    return upstream;
+}
+const ARTIFACT_CONDITIONAL_HEADERS = ["range", "if-range", "if-none-match", "if-modified-since"];
+async function handleArtifactRequest(request, response, target, options, state) {
+    if (!isRegistryIndexRequest(target)) {
+        for (const header of ARTIFACT_CONDITIONAL_HEADERS) {
+            delete request.headers[header];
+        }
+    }
+    const upstream = await fetchUpstreamFollowingRedirects(request, target, options.env).catch((error) => {
+        const message = error instanceof Error ? error.message : "registry request failed";
+        const decision = recordDecision(options, state, {
+            verdict: "block",
+            packageName: packageNameFromUrl(target),
+            cause: error instanceof BufferBudgetError ? "proxy-setup-failure" : "registry-timeout",
+            reason: message
+        });
+        sendBlocked(response, decision);
+        return null;
+    });
+    if (!upstream) {
+        return;
+    }
+    const metadataIdentities = extractRegistryMetadataIdentities(target, upstream);
+    if (metadataIdentities.length > 0 || isRegistryIndexRequest(target)) {
+        if (metadataIdentities.length > 0) {
+            state.identities = mergeIdentities(state.identities, metadataIdentities);
+            state.events = [...state.events, `metadata:${target.hostname}:${metadataIdentities.length}`];
+        }
+        else {
+            state.events = [...state.events, `index:${target.hostname}`];
+        }
+        writeProxyState(options.session, state);
+        response.writeHead(upstream.statusCode, upstream.headers);
+        response.end(upstream.body);
+        return;
+    }
+    if (upstream.statusCode === 206) {
+        const decision = recordDecision(options, state, {
+            verdict: "block",
+            packageName: packageNameFromUrl(target),
+            cause: "policy",
+            reason: "registry returned partial content — a partial artifact cannot be verified"
+        });
+        sendBlocked(response, decision);
+        return;
+    }
+    if (upstream.statusCode < 200 || upstream.statusCode >= 300) {
+        // A non-success status is the registry's own error (e.g. 404 for a version
+        // that does not exist) — not an installable artifact. Pass it through so the
+        // package manager handles it (404s drive version resolution); scanning an
+        // error body as if it were a package would mis-identify it.
+        state.events = [...state.events, `passthrough:${upstream.statusCode}:${target.hostname}`];
+        writeProxyState(options.session, state);
+        response.writeHead(upstream.statusCode, upstream.headers);
+        response.end(upstream.body);
+        return;
+    }
+    const sha256 = createHash("sha256").update(upstream.body).digest("hex");
+    const identity = resolveArtifactIdentity(target, state.identities, options.classification);
+    if (identity.kind === "ambiguous") {
+        state.hashes = [...state.hashes, {
+                url: redactSecrets(target.toString()),
+                sha256
+            }];
+        const decision = recordDecision(options, state, {
+            verdict: "block",
+            packageName: identity.packageName,
+            cause: "policy",
+            reason: identity.reason
+        });
+        sendBlocked(response, decision);
+        return;
+    }
+    state.hashes = [...state.hashes, {
+            url: redactSecrets(target.toString()),
+            sha256,
+            identity: identity.identity
+        }];
+    const inflightName = artifactDisplayName(identity.identity);
+    state.inflight = [...state.inflight, inflightName];
+    writeProxyState(options.session, state);
+    const verdict = await lookupVerdict(options, target, sha256, upstream, identity.identity).catch((error) => ({
+        verdict: "block",
+        packageName: artifactDisplayName(identity.identity),
+        cause: "api-timeout",
+        reason: error instanceof Error ? error.message : "Dependency Guardian API verdict lookup failed"
+    }));
+    state.inflight = removeFirst(state.inflight, inflightName);
+    const decision = recordDecision(options, state, verdict);
+    if (decision.action === "block") {
+        sendBlocked(response, decision);
+        return;
+    }
+    response.writeHead(upstream.statusCode, upstream.headers);
+    response.end(upstream.body);
+}
+async function blindTunnel(clientSocket, head, target, options, activeSockets) {
+    const upstreamProxy = selectUpstreamProxy(target, options.env);
+    const upstreamSocket = upstreamProxy
+        ? await connectViaUpstreamProxy(target, upstreamProxy)
+        : await connectDirect(target);
+    trackSocket(activeSockets, upstreamSocket);
+    clientSocket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+    if (head.length > 0) {
+        upstreamSocket.write(head);
+    }
+    upstreamSocket.pipe(clientSocket);
+    clientSocket.pipe(upstreamSocket);
+}
+async function mitmTunnel(clientSocket, head, target, options, state, ca, activeSockets) {
+    const leaf = ca.leafForHost(target.hostname);
+    const secureContext = createSecureContext({
+        cert: leaf.certPem,
+        key: leaf.keyPem
+    });
+    const innerHttp = createServer((request, response) => {
+        const artifactTarget = new URL(`${target.protocol}//${target.host}${request.url ?? "/"}`);
+        handleArtifactRequest(request, response, artifactTarget, options, state).catch((error) => {
+            const decision = recordDecision(options, state, {
+                verdict: "block",
+                packageName: artifactTarget.hostname,
+                cause: "proxy-setup-failure",
+                reason: error instanceof Error ? error.message : "MITM request failed"
+            });
+            sendBlocked(response, decision);
+        });
+    });
+    const tlsServer = createTlsServer({
+        SNICallback: (_servername, callback) => callback(null, secureContext),
+        cert: leaf.certPem,
+        key: leaf.keyPem,
+        ALPNProtocols: ["http/1.1"]
+    }, (tlsSocket) => {
+        trackSocket(activeSockets, tlsSocket);
+        innerHttp.emit("connection", tlsSocket);
+    });
+    tlsServer.once("tlsClientError", () => {
+        clientSocket.destroy();
+    });
+    clientSocket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+    if (head.length > 0) {
+        clientSocket.unshift(head);
+    }
+    tlsServer.emit("connection", clientSocket);
+}
+function parseProxyTarget(request) {
+    const rawUrl = request.url ?? "";
+    try {
+        if (/^https?:\/\//.test(rawUrl)) {
+            return new URL(rawUrl);
+        }
+        const host = request.headers.host;
+        if (!host) {
+            return null;
+        }
+        return new URL(`http://${host}${rawUrl.startsWith("/") ? rawUrl : `/${rawUrl}`}`);
+    }
+    catch {
+        return null;
+    }
+}
+function parseConnectTarget(authority) {
+    if (!authority) {
+        return null;
+    }
+    try {
+        const normalized = authority.startsWith("[")
+            ? authority
+            : authority.replace(/^([^:]+)$/, "$1:443");
+        return new URL(`https://${normalized}`);
+    }
+    catch {
+        return null;
+    }
+}
+function connectDirect(target) {
+    return new Promise((resolve, reject) => {
+        const socket = connect(Number(target.port || "443"), upstreamHostname(target));
+        socket.once("connect", () => resolve(socket));
+        socket.once("error", reject);
+    });
+}
+function upstreamHostname(target, env = process.env) {
+    const hostname = target.hostname.replace(/^\[(.*)\]$/, "$1");
+    return testUpstreamHostMap(env).get(hostname) ?? hostname;
+}
+function testUpstreamHostMap(env) {
+    const entries = (env.DG_TEST_UPSTREAM_HOST_MAP ?? "")
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter(Boolean)
+        .map((entry) => {
+        const separator = entry.indexOf("=");
+        if (separator <= 0) {
+            return null;
+        }
+        return [entry.slice(0, separator), entry.slice(separator + 1)];
+    })
+        .filter((entry) => entry !== null);
+    return new Map(entries);
+}
+function fetchUpstream(request, target, env) {
+    const upstreamProxy = selectUpstreamProxy(target, env);
+    if (upstreamProxy && target.protocol === "http:") {
+        return fetchHttpViaProxy(request, target, upstreamProxy);
+    }
+    if (upstreamProxy && target.protocol === "https:") {
+        return fetchHttpsViaProxy(request, target, upstreamProxy, env);
+    }
+    if (target.protocol === "https:") {
+        return fetchHttpsDirect(request, target, env);
+    }
+    return new Promise((resolve, reject) => {
+        const upstream = httpRequest({
+            hostname: upstreamHostname(target, env),
+            port: target.port ? Number(target.port) : 80,
+            path: `${target.pathname}${target.search}`,
+            method: request.method,
+            headers: request.headers
+        }, (upstreamResponse) => {
+            collectBounded(upstreamResponse, { label: target.toString() })
+                .then((body) => resolve({
+                statusCode: upstreamResponse.statusCode ?? 502,
+                headers: responseHeaders(upstreamResponse),
+                body
+            }))
+                .catch(reject);
+        });
+        upstream.on("error", reject);
+        request.on("data", (chunk) => upstream.write(chunk));
+        request.on("end", () => upstream.end());
+        request.on("error", reject);
+        request.once("close", () => {
+            if (!request.complete) {
+                upstream.destroy();
+            }
+        });
+    });
+}
+function fetchHttpViaProxy(request, target, upstreamProxy) {
+    return new Promise((resolve, reject) => {
+        const headers = {
+            ...request.headers,
+            ...(upstreamProxy.authorizationHeader ? { "Proxy-Authorization": upstreamProxy.authorizationHeader } : {})
+        };
+        const upstream = httpRequest({
+            hostname: upstreamProxy.url.hostname,
+            port: upstreamProxy.url.port ? Number(upstreamProxy.url.port) : 80,
+            path: target.toString(),
+            method: request.method,
+            headers
+        }, (upstreamResponse) => {
+            collectBounded(upstreamResponse, { label: target.toString() })
+                .then((body) => resolve({
+                statusCode: upstreamResponse.statusCode ?? 502,
+                headers: responseHeaders(upstreamResponse),
+                body
+            }))
+                .catch(reject);
+        });
+        upstream.on("error", reject);
+        request.on("data", (chunk) => upstream.write(chunk));
+        request.on("end", () => upstream.end());
+        request.on("error", reject);
+        request.once("close", () => {
+            if (!request.complete) {
+                upstream.destroy();
+            }
+        });
+    });
+}
+function fetchHttpsDirect(request, target, env) {
+    return new Promise((resolve, reject) => {
+        const upstream = httpsRequest({
+            hostname: upstreamHostname(target, env),
+            port: target.port ? Number(target.port) : 443,
+            path: `${target.pathname}${target.search}`,
+            method: request.method,
+            headers: upstreamRequestHeaders(request, target),
+            ...upstreamTlsOptions(env)
+        }, (upstreamResponse) => {
+            collectBounded(upstreamResponse, { label: target.toString() })
+                .then((body) => resolve({
+                statusCode: upstreamResponse.statusCode ?? 502,
+                headers: responseHeaders(upstreamResponse),
+                body
+            }))
+                .catch(reject);
+        });
+        upstream.on("error", reject);
+        request.on("data", (chunk) => upstream.write(chunk));
+        request.on("end", () => upstream.end());
+        request.on("error", reject);
+        request.once("close", () => {
+            if (!request.complete) {
+                upstream.destroy();
+            }
+        });
+    });
+}
+async function fetchHttpsViaProxy(request, target, upstreamProxy, env) {
+    const tunnel = await connectViaUpstreamProxy(target, upstreamProxy);
+    const tlsSocket = await connectTlsOverSocket(tunnel, target, env);
+    const requestBody = await readRequestBody(request);
+    const rawResponse = await writeRawHttpRequest(tlsSocket, request, target, requestBody);
+    return parseRawHttpResponse(rawResponse);
+}
+function connectTlsOverSocket(socket, target, env) {
+    return new Promise((resolve, reject) => {
+        const tlsSocket = tlsConnect({
+            socket,
+            servername: target.hostname,
+            ALPNProtocols: ["http/1.1"],
+            ...upstreamTlsOptions(env)
+        }, () => resolve(tlsSocket));
+        tlsSocket.once("error", reject);
+    });
+}
+function writeRawHttpRequest(tlsSocket, request, target, requestBody) {
+    return new Promise((resolve, reject) => {
+        collectBounded(tlsSocket, { label: target.toString() }).then(resolve).catch(reject);
+        const headers = upstreamRequestHeaders(request, target);
+        const lines = [
+            `${request.method ?? "GET"} ${target.pathname}${target.search} HTTP/1.1`,
+            ...Object.entries(headers).flatMap(([key, value]) => headerLines(key, value)),
+            "Connection: close",
+            "",
+            ""
+        ];
+        tlsSocket.write(lines.join("\r\n"));
+        if (requestBody.length > 0) {
+            tlsSocket.write(requestBody);
+        }
+        tlsSocket.end();
+    });
+}
+function parseRawHttpResponse(raw) {
+    const headerEnd = raw.indexOf("\r\n\r\n");
+    if (headerEnd === -1) {
+        throw new Error("upstream registry returned a malformed HTTP response");
+    }
+    const head = raw.subarray(0, headerEnd).toString("latin1");
+    const body = raw.subarray(headerEnd + 4);
+    const [statusLine = "", ...headerLinesRaw] = head.split("\r\n");
+    const status = /^HTTP\/1\.[01] (\d{3})\b/.exec(statusLine)?.[1];
+    const headers = {};
+    for (const line of headerLinesRaw) {
+        const separator = line.indexOf(":");
+        if (separator === -1) {
+            continue;
+        }
+        const key = line.slice(0, separator).toLowerCase();
+        const value = line.slice(separator + 1).trim();
+        const existing = headers[key];
+        headers[key] = existing === undefined ? value : `${headerValue(existing)},${value}`;
+    }
+    return {
+        statusCode: status ? Number(status) : 502,
+        headers,
+        body: headerValue(headers["transfer-encoding"]).toLowerCase() === "chunked" ? decodeChunkedBody(body) : body
+    };
+}
+function upstreamRequestHeaders(request, target) {
+    const headers = {};
+    for (const [key, value] of Object.entries(request.headers)) {
+        const normalized = key.toLowerCase();
+        if (["proxy-authorization", "proxy-connection", "connection", "host"].includes(normalized) || value === undefined) {
+            continue;
+        }
+        headers[key] = Array.isArray(value) ? [...value] : value;
+    }
+    headers.Host = target.host;
+    return headers;
+}
+function headerLines(key, value) {
+    if (value === undefined) {
+        return [];
+    }
+    if (Array.isArray(value)) {
+        return value.map((entry) => `${key}: ${entry}`);
+    }
+    return [`${key}: ${value}`];
+}
+function upstreamTlsOptions(env) {
+    const caPath = env.DG_UPSTREAM_CA_CERT ?? env.NODE_EXTRA_CA_CERTS;
+    if (!caPath) {
+        return {};
+    }
+    try {
+        return {
+            ca: readFileSync(caPath, "utf8")
+        };
+    }
+    catch {
+        return {};
+    }
+}
+function readRequestBody(request) {
+    return collectBounded(request, { label: "proxied request body" });
+}
+function decodeChunkedBody(body) {
+    const chunks = [];
+    let offset = 0;
+    while (offset < body.length) {
+        const lineEnd = body.indexOf("\r\n", offset);
+        if (lineEnd === -1) {
+            break;
+        }
+        const size = Number.parseInt(body.subarray(offset, lineEnd).toString("latin1"), 16);
+        if (!Number.isFinite(size) || size < 0) {
+            break;
+        }
+        if (size === 0) {
+            return Buffer.concat(chunks);
+        }
+        const start = lineEnd + 2;
+        const end = start + size;
+        chunks.push(body.subarray(start, end));
+        offset = end + 2;
+    }
+    return Buffer.concat(chunks);
+}
+async function lookupVerdict(options, target, sha256, upstream, identity) {
+    if (shouldUseScanTarball(options, target, identity)) {
+        return lookupScanTarballVerdict(options, target, sha256, upstream, identity);
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), options.verdictTimeoutMs ?? installVerdictTimeoutMs(options.env));
+    try {
+        const response = await fetch(`${options.apiBaseUrl}/v1/install-verdict`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json"
+            },
+            body: JSON.stringify({
+                manager: options.classification.manager,
+                action: options.classification.action,
+                url: target.toString(),
+                artifactUrlHash: artifactUrlHash(target),
+                ecosystem: identity.ecosystem,
+                name: identity.name,
+                version: identity.version,
+                registryHost: identity.registryHost,
+                sourceKind: identity.sourceKind,
+                sha256,
+                statusCode: upstream.statusCode,
+                contentType: headerValue(upstream.headers["content-type"])
+            }),
+            signal: controller.signal
+        });
+        if (response.status === 402 || response.status === 429) {
+            return {
+                verdict: "block",
+                packageName: artifactDisplayName(identity),
+                cause: "quota-exceeded",
+                reason: "You've reached your monthly scan limit. Upgrade at westbayberry.com/pricing or wait for it to reset."
+            };
+        }
+        if (!response.ok) {
+            return {
+                verdict: "block",
+                packageName: artifactDisplayName(identity),
+                cause: "api-unavailable",
+                reason: `Dependency Guardian API returned ${response.status}. Run 'dg doctor' and 'dg login' to verify API access.`
+            };
+        }
+        return normalizeVerdict(await response.json(), target, identity, sha256);
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+async function lookupScanTarballVerdict(options, target, sha256, upstream, identity) {
+    const body = upstream.body ?? Buffer.alloc(0);
+    const uploadPolicy = scanTarballUploadPolicy(options.env);
+    if (!uploadPolicy.enabled) {
+        return {
+            verdict: "block",
+            packageName: artifactDisplayName(identity),
+            cause: "private-upload-disabled",
+            reason: `private artifact scan upload is disabled for ${target.hostname}`
+        };
+    }
+    if (!uploadPolicy.token) {
+        return {
+            verdict: "block",
+            packageName: artifactDisplayName(identity),
+            cause: "private-upload-disabled",
+            reason: "private artifact scan upload requires DG_API_TOKEN"
+        };
+    }
+    if (body.length > uploadPolicy.maxBytes) {
+        return {
+            verdict: "block",
+            packageName: artifactDisplayName(identity),
+            cause: "private-upload-disabled",
+            reason: `private artifact is ${body.length} bytes, above the ${uploadPolicy.maxBytes} byte scan-tarball upload limit`
+        };
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), uploadPolicy.timeoutMs);
+    try {
+        const response = await fetch(`${options.apiBaseUrl}/v1/scan-tarball`, {
+            method: "POST",
+            headers: {
+                "Authorization": `Bearer ${uploadPolicy.token}`,
+                "Content-Type": "application/octet-stream",
+                "X-DG-Action": options.classification.action,
+                "X-DG-Artifact-SHA256": sha256,
+                "X-DG-Artifact-URL-Hash": artifactUrlHash(target),
+                "X-DG-Cache-Key": `sha256:${sha256}`,
+                "X-DG-Ecosystem": identity.ecosystem,
+                "X-DG-Manager": options.classification.manager,
+                "X-DG-Package-Name": identity.name,
+                "X-DG-Package-Version": identity.version,
+                "X-DG-Privacy": "private-artifact",
+                "X-DG-Registry-Host": identity.registryHost,
+                "X-DG-Source-Kind": identity.sourceKind
+            },
+            body,
+            signal: controller.signal
+        });
+        if (!response.ok) {
+            throw new Error(`Dependency Guardian scan-tarball API returned ${response.status}`);
+        }
+        return normalizeScanTarballVerdict(await response.json(), target, identity, sha256);
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+function normalizeVerdict(value, target, identity, streamedSha256) {
+    if (!isRecord(value)) {
+        throw new Error("Dependency Guardian API returned a malformed verdict");
+    }
+    const verdict = value.verdict;
+    if (verdict !== "pass" && verdict !== "warn" && verdict !== "block") {
+        throw new Error("Dependency Guardian API returned a malformed verdict");
+    }
+    const scannedSha256 = typeof value.scannedSha256 === "string" ? value.scannedSha256.toLowerCase() : "";
+    if (scannedSha256.length > 0 && scannedSha256 !== streamedSha256) {
+        return {
+            verdict: "block",
+            packageName: artifactDisplayName(identity),
+            cause: "hash-mismatch",
+            reason: `server scanned SHA-256 ${scannedSha256} did not match streamed artifact SHA-256 ${streamedSha256}`
+        };
+    }
+    const cause = typeof value.cause === "string" ? value.cause : undefined;
+    return {
+        verdict,
+        packageName: typeof value.packageName === "string" ? value.packageName : artifactDisplayName(identity) || packageNameFromUrl(target),
+        ...(isProxyCause(cause) ? { cause } : {}),
+        reason: typeof value.reason === "string" ? value.reason : `API verdict ${verdict}`,
+        ...(typeof value.dashboardUrl === "string" ? { dashboardUrl: value.dashboardUrl } : {}),
+        ...(value.unauthenticated === true ? { unauthenticated: true } : {})
+    };
+}
+function normalizeScanTarballVerdict(value, target, identity, streamedSha256) {
+    if (!isRecord(value) || typeof value.scannedSha256 !== "string" || value.scannedSha256.length === 0) {
+        throw new Error("Dependency Guardian scan-tarball API did not return scannedSha256");
+    }
+    return normalizeVerdict(value, target, identity, streamedSha256);
+}
+function shouldUseScanTarball(options, target, identity) {
+    if (identity.sourceKind !== "url-fallback") {
+        return false;
+    }
+    return hostMatchesList(target.hostname, options.env.DG_PRIVATE_REGISTRY_HOSTS ?? "");
+}
+function scanTarballUploadPolicy(env) {
+    return {
+        enabled: env.DG_SCAN_TARBALL_UPLOAD === "1" || env.DG_SCAN_TARBALL_UPLOAD === "true",
+        maxBytes: parsePositiveInteger(env.DG_SCAN_TARBALL_MAX_BYTES, 50 * 1024 * 1024),
+        timeoutMs: parsePositiveInteger(env.DG_SCAN_TARBALL_TIMEOUT_MS, 5_000),
+        token: envAuthToken(env) ?? ""
+    };
+}
+function installVerdictTimeoutMs(env) {
+    return parsePositiveInteger(env.DG_INSTALL_VERDICT_TIMEOUT_MS, 30_000);
+}
+function parsePositiveInteger(value, fallback) {
+    if (!value) {
+        return fallback;
+    }
+    const parsed = Number.parseInt(value, 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+function hostMatchesList(host, rawList) {
+    const normalized = normalizeHost(host);
+    return rawList.split(",").map((entry) => entry.trim()).filter(Boolean).some((pattern) => hostMatchesPattern(normalized, pattern));
+}
+function hostMatchesPattern(host, pattern) {
+    const normalized = normalizeHost(pattern);
+    if (normalized.startsWith("*.")) {
+        const suffix = normalized.slice(1);
+        return host.endsWith(suffix) && host.length > suffix.length;
+    }
+    return host === normalized;
+}
+function normalizeHost(host) {
+    return host.replace(/^\[/, "").replace(/\]$/, "").replace(/\.$/, "").toLowerCase();
+}
+function mergeIdentities(existing, next) {
+    const merged = [...existing];
+    for (const identity of next) {
+        if (!merged.some((candidate) => candidate.tarballUrl === identity.tarballUrl
+            && candidate.ecosystem === identity.ecosystem
+            && candidate.name === identity.name
+            && candidate.version === identity.version
+            && candidate.registryHost === identity.registryHost)) {
+            merged.push(identity);
+        }
+    }
+    return merged;
+}
+function recordDecision(options, state, verdict) {
+    const decision = enforceProtectedInstall({
+        classification: options.classification,
+        env: options.env,
+        proxyVerdict: verdict,
+        ...(options.forceOverride ? { forceOverride: options.forceOverride } : {})
+    });
+    state.decisions = [...state.decisions, decision];
+    state.events = [...state.events, `${decision.action}:${decision.cause}:${redactSecrets(decision.packageName)}`];
+    writeProxyState(options.session, state);
+    return decision;
+}
+function sendBlocked(response, decision) {
+    const body = `Dependency Guardian blocked ${redactSecrets(decision.packageName)}: ${redactSecrets(decision.reason)}\n`;
+    response.writeHead(403, {
+        "Content-Type": "text/plain; charset=utf-8",
+        "Content-Length": Buffer.byteLength(body)
+    });
+    response.end(body);
+}
+function responseHeaders(response) {
+    const headers = {};
+    for (const [key, value] of Object.entries(response.headers)) {
+        if (value !== undefined) {
+            headers[key] = Array.isArray(value) ? [...value] : value;
+        }
+    }
+    return headers;
+}
+function headerValue(value) {
+    if (Array.isArray(value)) {
+        return value.join(",");
+    }
+    if (typeof value === "number") {
+        return String(value);
+    }
+    if (typeof value === "string") {
+        return value;
+    }
+    return "";
+}
+function packageNameFromUrl(url) {
+    const name = url.pathname.split("/").filter(Boolean).pop();
+    return name ? decodeURIComponent(name) : url.hostname;
+}
+function writeProxyState(session, state) {
+    mkdirSync(dirname(session.files.proxy), {
+        recursive: true,
+        mode: 0o700
+    });
+    const tempPath = `${session.files.proxy}.${process.pid}.${process.hrtime.bigint().toString(36)}.tmp`;
+    try {
+        writeFileSync(tempPath, `${JSON.stringify(state, null, 2)}\n`, {
+            encoding: "utf8",
+            flag: "wx",
+            mode: 0o600
+        });
+        renameSync(tempPath, session.files.proxy);
+    }
+    catch (error) {
+        rmSync(tempPath, {
+            force: true
+        });
+        throw error;
+    }
+}
+function removeFirst(items, value) {
+    const index = items.indexOf(value);
+    if (index === -1) {
+        return [...items];
+    }
+    return [...items.slice(0, index), ...items.slice(index + 1)];
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+function isProxyCause(value) {
+    return [
+        "pass",
+        "warn",
+        "malware",
+        "policy",
+        "license",
+        "hash-mismatch",
+        "private-upload-disabled",
+        "api-unavailable",
+        "quota-exceeded",
+        "api-timeout",
+        "registry-timeout",
+        "analysis-incomplete",
+        "unsupported-manager",
+        "proxy-setup-failure"
+    ].includes(value ?? "");
+}