@westbayberry/dg 2.3.2 → 2.3.4

package/dist/origin/server.js

@@ -0,0 +1,611 @@
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { mkdirSync, renameSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { Agent as HttpAgent, createServer, request as httpRequest } from "node:http";
+import { Agent as HttpsAgent, request as httpsRequest } from "node:https";
+import { collectBounded } from "../proxy/buffer-budget.js";
+import { isLinkLocalHost, isPrivateNetworkHost, lookupForTarget } from "../gate/egress-guard.js";
+import { lookupVerdict } from "../gate/verdict-fetch.js";
+import { enforceProtectedInstall } from "../proxy/enforcement.js";
+import { artifactDisplayName, extractRegistryMetadataIdentities, isRegistryIndexRequest, resolveArtifactIdentity } from "../proxy/metadata-map.js";
+import { redactSecrets } from "../launcher/output-redaction.js";
+import { lookupCachedArtifact, storeCachedArtifact } from "./artifact-cache.js";
+const DEFAULT_UPSTREAMS = {
+    npmRegistry: "https://registry.npmjs.org",
+    pypiSimple: "https://pypi.org",
+    pypiFiles: "https://files.pythonhosted.org",
+    cargoIndex: "https://index.crates.io",
+    cargoStatic: "https://static.crates.io"
+};
+const upstreamHttpAgent = new HttpAgent({ keepAlive: true, maxSockets: 64 });
+const upstreamHttpsAgent = new HttpsAgent({ keepAlive: true, maxSockets: 64 });
+export async function startOriginServer(options) {
+    const host = options.host ?? "127.0.0.1";
+    const requests = [];
+    const server = createServer();
+    await listen(server, host, options.port ?? 0);
+    const address = server.address();
+    if (typeof address !== "object" || address === null) {
+        throw new Error("origin server did not bind a TCP port");
+    }
+    const base = `http://${host}:${address.port}`;
+    const resolved = {
+        ecosystem: options.ecosystem,
+        strategy: options.npmTarballStrategy ?? "canonical",
+        upstreams: { ...DEFAULT_UPSTREAMS, ...options.upstreams },
+        base,
+        ...(options.onRequest ? { onRequest: options.onRequest } : {}),
+        ...(options.gate ? { gate: options.gate } : {}),
+        ...(options.onDecision ? { onDecision: options.onDecision } : {}),
+        ...(options.cacheDir ? { cacheDir: options.cacheDir } : {}),
+        ...(options.stateFile ? { stateFile: options.stateFile } : {}),
+        downloadSecret: randomBytes(32),
+        requests,
+        identities: [],
+        decisions: [],
+        hashes: [],
+        events: [],
+        port: address.port
+    };
+    // Initial ready state so a launcher polling the state file (the proxy's
+    // waitForProxyReady) detects the origin is bound before routing an install.
+    writeOriginState(resolved);
+    server.on("request", (request, response) => {
+        const path = request.url ?? "/";
+        requests.push(`${request.method} ${path}`);
+        resolved.onRequest?.(request.method ?? "GET", path);
+        handle(resolved, request, response).catch((error) => {
+            sendError(response, 502, `origin error: ${error instanceof Error ? error.message : String(error)}`);
+        });
+    });
+    return {
+        port: address.port,
+        url: base,
+        requests,
+        close: () => new Promise((resolve) => server.close(() => resolve()))
+    };
+}
+function listen(server, host, port) {
+    return new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(port, host, () => {
+            server.off("error", reject);
+            resolve();
+        });
+    });
+}
+async function handle(origin, request, response) {
+    const path = request.url ?? "/";
+    // A distinctive marker so a doctor probe can prove THIS port is dg's origin
+    // (routing target), not the real registry — liveness alone does not.
+    if (path === "/-/dg-origin-health") {
+        serveJson(response, 200, { origin: "dependency-guardian", ecosystem: origin.ecosystem, gated: Boolean(origin.gate) });
+        return;
+    }
+    const target = new URL(`${origin.base}${path}`);
+    const accept = headerValue(request.headers.accept);
+    if (origin.ecosystem === "npm") {
+        return handleNpm(origin, target, accept, response);
+    }
+    if (origin.ecosystem === "pypi") {
+        return handlePypi(origin, target, accept, response);
+    }
+    return handleCargo(origin, target, accept, response);
+}
+// Metadata (packument / simple index / config.json) is re-serialized in memory
+// (JSON.parse, string split), so cap it well below the 1 GiB artifact budget — a
+// near-gigabyte packument from a malicious registry would otherwise OOM the
+// worker. Legit packuments are KB-to-MB; the proxy caps its decode at 32 MiB.
+function maxMetadataBytes(env) {
+    return positiveInt(env.DG_ORIGIN_MAX_METADATA_BYTES, 64 * 1024 * 1024);
+}
+function metadataTooLarge(origin, upstream, response) {
+    const limit = maxMetadataBytes(origin.gate?.env ?? process.env);
+    if (upstream.body.length > limit) {
+        sendError(response, 502, `registry metadata exceeded the ${limit}-byte limit`);
+        return true;
+    }
+    return false;
+}
+async function handleNpm(origin, target, accept, response) {
+    const path = target.pathname;
+    const upstreamUrl = new URL(`${origin.upstreams.npmRegistry}${path}${target.search}`);
+    // npm reserves /-/ for registry API endpoints (/-/npm/v1/keys, audits, search):
+    // normally metadata. But the URL shape alone is not trustworthy — a hostile /
+    // MITM packument can point a (rewritten) tarball at a /-/-prefixed path, so
+    // classify by the RESPONSE: pass a JSON API body through, gate any non-JSON body
+    // as an artifact instead of serving it ungated.
+    if (path.startsWith("/-/")) {
+        const apiResponse = await guardedFetch(upstreamUrl, accept, origin.gate?.env);
+        if (metadataTooLarge(origin, apiResponse, response)) {
+            return;
+        }
+        // Don't trust the upstream Content-Type — an artifact mislabeled
+        // application/json must still be gated. Require the body to actually parse as
+        // JSON to serve it as a metadata/API response; otherwise gate it as an artifact.
+        if (!bodyIsParseableJson(apiResponse)) {
+            return gateBytes(origin, target, apiResponse, response);
+        }
+        return serve(response, apiResponse);
+    }
+    if (serveCacheHit(origin, target, response)) {
+        return;
+    }
+    const upstream = await guardedFetch(upstreamUrl, accept, origin.gate?.env);
+    // Classify by the RESPONSE, not the URL: only a JSON body is a packument
+    // (metadata, re-serialized). ANY non-JSON body is an artifact (tarball) and is
+    // gated — a malicious/MITM packument can point dist.tarball at an off-path URL
+    // lacking the /-/ marker, so the URL shape cannot be trusted to find tarballs.
+    if (!isJson(upstream)) {
+        return gateBytes(origin, target, upstream, response);
+    }
+    if (metadataTooLarge(origin, upstream, response)) {
+        return;
+    }
+    rememberIdentities(origin, target, upstream);
+    const doc = JSON.parse(upstream.body.toString("utf8"));
+    if (origin.strategy === "loopback") {
+        rewriteNpmTarballs(doc, origin.base);
+    }
+    serveJson(response, upstream.status, doc);
+}
+async function handlePypi(origin, target, accept, response) {
+    const path = target.pathname;
+    // Download URLs the origin rewrote into the simple index route back here, so
+    // EVERY wheel/sdist on ANY host is gated — a compromised or MITM'd index can
+    // list files off files.pythonhosted.org, and the manager would fetch those
+    // directly, un-gated. The original URL is base64url-encoded in the path.
+    if (path.startsWith("/__dl/")) {
+        const rest = path.slice("/__dl/".length);
+        const separator = rest.indexOf("/");
+        const base = separator < 0 ? null : verifiedDownloadBase(origin, rest.slice(0, separator));
+        if (!base) {
+            sendError(response, 400, "invalid download reference");
+            return;
+        }
+        let filename = rest.slice(separator + 1);
+        const isSidecar = filename.endsWith(".metadata");
+        if (isSidecar) {
+            filename = filename.slice(0, -".metadata".length);
+        }
+        let original;
+        try {
+            original = new URL(`${filename}${target.search}`, base);
+        }
+        catch {
+            sendError(response, 400, "invalid download reference");
+            return;
+        }
+        // The filename echoes back what the origin itself wrote into the index; pin it
+        // to the encoded host so a crafted path can never redirect the fetch off-host.
+        if (original.origin !== base.origin || (original.protocol !== "http:" && original.protocol !== "https:")) {
+            sendError(response, 400, "invalid download reference");
+            return;
+        }
+        // A public index that lists a download on a private/internal address is an
+        // SSRF attempt — the origin must not be turned into a request proxy into the
+        // internal network. A fully-private upstream (a corporate index, or a test
+        // server) legitimately serves private downloads, so only refuse when the
+        // index host itself is public (mirrors the redirect guard's public->private
+        // rule).
+        if (isPrivateNetworkHost(original) && !isPrivateNetworkHost(new URL(origin.upstreams.pypiSimple))) {
+            sendError(response, 400, "refusing to fetch a download from a private address listed by a public index");
+            return;
+        }
+        if (isSidecar) {
+            // PEP 658 metadata sidecar — resolution metadata, pass through ungated. The
+            // sidecar lives at the artifact PATH + ".metadata"; append to the pathname,
+            // not the full URL string (which would drop ".metadata" into a query string
+            // when the download URL carries one).
+            const sidecarUrl = new URL(original.toString());
+            sidecarUrl.pathname += ".metadata";
+            return serve(response, await guardedFetch(sidecarUrl, accept, origin.gate?.env));
+        }
+        return gateOrServe(origin, original, original, accept, response);
+    }
+    if (path.startsWith("/simple/")) {
+        const indexUrl = new URL(`${origin.upstreams.pypiSimple}${path}${target.search}`);
+        const upstream = await guardedFetch(indexUrl, accept, origin.gate?.env);
+        if (metadataTooLarge(origin, upstream, response)) {
+            return;
+        }
+        rememberIdentities(origin, target, upstream);
+        const body = rewritePypiIndex(origin, upstream, indexUrl);
+        serve(response, { status: upstream.status, headers: { "content-type": headerValue(upstream.headers["content-type"]) || "text/html" }, body });
+        return;
+    }
+    if (isRegistryIndexRequest(target)) {
+        return serve(response, await guardedFetch(new URL(`${origin.upstreams.pypiFiles}${path}${target.search}`), accept, origin.gate?.env));
+    }
+    return gateOrServe(origin, new URL(`${origin.upstreams.pypiFiles}${path}${target.search}`), target, accept, response);
+}
+// The /__dl indirection is a loopback forward-fetcher; without proof the origin
+// itself emitted the reference, any local process could drive it to fetch an
+// arbitrary host (an SSRF open relay). The base host is HMAC-bound to a
+// per-process secret, so only hosts this origin actually rewrote into a served
+// index are fetchable. The host-pin + private-network guards below still apply.
+function verifiedDownloadBase(origin, segment) {
+    const dot = segment.lastIndexOf(".");
+    if (dot <= 0) {
+        return null;
+    }
+    const encoded = segment.slice(0, dot);
+    if (!signaturesMatch(segment.slice(dot + 1), signDownloadBase(origin.downloadSecret, encoded))) {
+        return null;
+    }
+    return decodeDownloadBase(encoded);
+}
+function signDownloadBase(secret, encoded) {
+    return createHmac("sha256", secret).update(encoded).digest("base64url");
+}
+function signaturesMatch(provided, expected) {
+    const a = Buffer.from(provided);
+    const b = Buffer.from(expected);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+function decodeDownloadBase(encoded) {
+    try {
+        const url = new URL(Buffer.from(decodeURIComponent(encoded), "base64url").toString("utf8"));
+        if (url.protocol !== "http:" && url.protocol !== "https:") {
+            return null;
+        }
+        return url;
+    }
+    catch {
+        return null;
+    }
+}
+// Rewrite EVERY download href in a simple index (PEP 503 HTML or PEP 691 JSON) to
+// the origin's /__dl/ indirection, preserving the #sha256 fragment / hashes pip
+// binds to, so no wheel can be fetched off-origin regardless of its host.
+function rewritePypiIndex(origin, upstream, indexUrl) {
+    if (/json/i.test(headerValue(upstream.headers["content-type"]))) {
+        try {
+            const doc = JSON.parse(upstream.body.toString("utf8"));
+            if (Array.isArray(doc.files)) {
+                for (const file of doc.files) {
+                    if (file && typeof file === "object" && typeof file.url === "string") {
+                        file.url = rewritePypiHref(file.url, indexUrl, origin);
+                    }
+                }
+            }
+            return Buffer.from(JSON.stringify(doc));
+        }
+        catch {
+            return upstream.body;
+        }
+    }
+    // Match href values in any quote style HTML permits — double, single, and
+    // unquoted — because pip's tolerant parser accepts all three; a malicious index
+    // that single-quotes its hrefs must not slip a wheel past the rewrite. The
+    // rewritten value is always emitted double-quoted.
+    const html = upstream.body
+        .toString("utf8")
+        .replace(/(href\s*=\s*)("([^"]*)"|'([^']*)'|([^\s"'>]+))/gi, (_m, pre, _value, dq, sq, uq) => {
+        const href = dq ?? sq ?? uq ?? "";
+        return `${pre}"${rewritePypiHref(href, indexUrl, origin)}"`;
+    });
+    return Buffer.from(html);
+}
+function rewritePypiHref(href, indexUrl, origin) {
+    const hashIndex = href.indexOf("#");
+    const urlPart = hashIndex >= 0 ? href.slice(0, hashIndex) : href;
+    const fragment = hashIndex >= 0 ? href.slice(hashIndex) : "";
+    let absolute;
+    try {
+        absolute = new URL(urlPart, indexUrl);
+    }
+    catch {
+        return href;
+    }
+    if (absolute.protocol !== "http:" && absolute.protocol !== "https:") {
+        return href;
+    }
+    // Keep the real filename as the LAST path segment — pip/uv parse the package
+    // name + version from it — and encode only the directory prefix (host + dirs).
+    const segments = absolute.pathname.split("/");
+    const filename = segments.pop() ?? "";
+    if (!filename) {
+        return href;
+    }
+    const base = `${absolute.origin}${segments.join("/")}/`;
+    const encoded = Buffer.from(base, "utf8").toString("base64url");
+    const signature = signDownloadBase(origin.downloadSecret, encoded);
+    return `${origin.base}/__dl/${encoded}.${signature}/${filename}${absolute.search}${fragment}`;
+}
+async function handleCargo(origin, target, accept, response) {
+    const path = target.pathname;
+    if (path === "/config.json") {
+        const upstream = await guardedFetch(new URL(`${origin.upstreams.cargoIndex}/config.json`), accept, origin.gate?.env);
+        if (metadataTooLarge(origin, upstream, response)) {
+            return;
+        }
+        const config = JSON.parse(upstream.body.toString("utf8"));
+        config.dl = `${origin.base}/crates`;
+        serveJson(response, upstream.status, config);
+        return;
+    }
+    if (path.startsWith("/crates/")) {
+        return gateOrServe(origin, new URL(`${origin.upstreams.cargoStatic}${path}${target.search}`), target, accept, response);
+    }
+    const upstream = await guardedFetch(new URL(`${origin.upstreams.cargoIndex}${path}${target.search}`), accept, origin.gate?.env);
+    serve(response, upstream);
+}
+// Buffer the artifact fully (bounded), verdict-gate it, and release only on an
+// allow. A block is a clean fetch error — never an altered or truncated body
+// masquerading as the artifact. Without gate options the bytes pass through.
+// Serve a previously-allowed artifact from the warm cache (no re-download, no
+// re-scan); the content hash is the proof it passed. Records a pass decision so
+// finalize accounts for it. Returns true when it served a hit.
+function serveCacheHit(origin, clientTarget, response) {
+    if (!origin.gate || !origin.cacheDir) {
+        return false;
+    }
+    const cached = lookupCachedArtifact(origin.cacheDir, clientTarget.toString());
+    if (!cached) {
+        return false;
+    }
+    recordOriginVerdict(origin, clientTarget, cached.sha256, {
+        verdict: "pass",
+        cause: "pass",
+        packageName: clientTarget.pathname,
+        reason: "already verified (content-addressed cache hit)"
+    });
+    response.writeHead(200, { "content-type": "application/octet-stream", "content-length": cached.bytes.length });
+    response.end(cached.bytes);
+    return true;
+}
+async function gateOrServe(origin, upstreamUrl, clientTarget, accept, response) {
+    if (serveCacheHit(origin, clientTarget, response)) {
+        return;
+    }
+    const upstream = await guardedFetch(upstreamUrl, accept, origin.gate?.env);
+    return gateBytes(origin, clientTarget, upstream, response);
+}
+// Verdict-gate an ALREADY-FETCHED artifact body. A block is a clean 403, never
+// altered or truncated bytes. Used both for known artifact paths (via gateOrServe)
+// and for any non-JSON npm response (so an off-path dist.tarball cannot evade the
+// gate). Without gate options the bytes pass through.
+async function gateBytes(origin, clientTarget, upstream, response) {
+    if (origin.gate && upstream.status === 206) {
+        // A partial artifact cannot be verified — the proxy blocks 206 too.
+        recordOriginVerdict(origin, clientTarget, "", {
+            verdict: "block",
+            cause: "policy",
+            packageName: clientTarget.pathname,
+            reason: "registry returned partial content — a partial artifact cannot be verified"
+        });
+        sendError(response, 403, `Dependency Guardian blocked ${redactSecrets(clientTarget.pathname)}: registry returned partial content`);
+        return;
+    }
+    if (!origin.gate || upstream.status < 200 || upstream.status >= 300) {
+        serve(response, upstream);
+        return;
+    }
+    const gate = origin.gate;
+    const sha256 = createHash("sha256").update(upstream.body).digest("hex");
+    const resolution = resolveArtifactIdentity(clientTarget, origin.identities, gate.classification);
+    const identity = resolution.kind === "resolved" ? resolution.identity : undefined;
+    const verdict = identity
+        ? await lookupVerdict(gate, clientTarget, sha256, { statusCode: upstream.status, headers: upstream.headers, body: upstream.body }, identity).catch((error) => ({
+            verdict: "block",
+            packageName: artifactDisplayName(identity),
+            cause: "api-timeout",
+            reason: error instanceof Error ? error.message : "verdict lookup failed"
+        }))
+        : { verdict: "block", packageName: resolution.kind === "ambiguous" ? resolution.packageName : clientTarget.pathname, cause: "policy", reason: resolution.kind === "ambiguous" ? resolution.reason : "could not resolve artifact identity" };
+    const decision = enforceProtectedInstall({ classification: gate.classification, env: gate.env, proxyVerdict: verdict });
+    origin.decisions.push(decision);
+    origin.hashes.push({ url: redactSecrets(clientTarget.toString()), sha256 });
+    origin.events.push(`${decision.action}:${decision.cause}:${redactSecrets(decision.packageName)}`);
+    writeOriginState(origin);
+    origin.onDecision?.(decision);
+    if (decision.action === "block") {
+        sendError(response, 403, `Dependency Guardian blocked ${redactSecrets(decision.packageName)}: ${redactSecrets(decision.reason)}`);
+        return;
+    }
+    if (origin.cacheDir) {
+        storeCachedArtifact(origin.cacheDir, clientTarget.toString(), upstream.body, sha256);
+    }
+    serve(response, upstream);
+}
+function recordOriginVerdict(origin, target, sha256, verdict) {
+    if (!origin.gate) {
+        return;
+    }
+    const decision = enforceProtectedInstall({ classification: origin.gate.classification, env: origin.gate.env, proxyVerdict: verdict });
+    origin.decisions.push(decision);
+    origin.hashes.push({ url: redactSecrets(target.toString()), sha256 });
+    origin.events.push(`${decision.action}:${decision.cause}:${redactSecrets(decision.packageName)}`);
+    writeOriginState(origin);
+    origin.onDecision?.(decision);
+}
+function rememberIdentities(origin, metadataUrl, upstream) {
+    if (!origin.gate) {
+        return;
+    }
+    const found = extractRegistryMetadataIdentities(metadataUrl, { headers: upstream.headers, body: upstream.body });
+    for (const identity of found) {
+        if (!origin.identities.some((existing) => existing.tarballUrl === identity.tarballUrl && existing.version === identity.version)) {
+            origin.identities.push(identity);
+        }
+    }
+}
+function rewriteNpmTarballs(doc, base) {
+    const versions = doc.versions;
+    if (!isRecord(versions)) {
+        return;
+    }
+    for (const version of Object.values(versions)) {
+        if (!isRecord(version)) {
+            continue;
+        }
+        const dist = version.dist;
+        if (isRecord(dist) && typeof dist.tarball === "string") {
+            dist.tarball = `${base}${new URL(dist.tarball).pathname}`;
+        }
+    }
+}
+const REDIRECT_LIMIT = 5;
+function upstreamIdleTimeoutMs(env) {
+    return positiveInt(env.DG_UPSTREAM_IDLE_TIMEOUT_MS, 30_000);
+}
+function upstreamTotalTimeoutMs(env) {
+    return positiveInt(env.DG_UPSTREAM_TOTAL_TIMEOUT_MS, 300_000);
+}
+function positiveInt(raw, fallback) {
+    const parsed = Number.parseInt(raw ?? "", 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+// Fetch upstream over a guarded DNS lookup (refuses a public host that resolves
+// to an internal/metadata IP — DNS-rebinding SSRF), with an idle + total timeout
+// so a hanging or slow-drip upstream cannot stall the install forever, following
+// redirects ourselves (with the private-redirect guard the proxy uses) so a 3xx
+// is never handed to the manager to follow un-gated. Identity encoding so the
+// bytes are never mislabelled when re-served.
+async function guardedFetch(target, accept, env = process.env) {
+    let current = target;
+    for (let hop = 0;; hop += 1) {
+        const response = await guardedFetchOnce(current, accept, env);
+        if (![301, 302, 303, 307, 308].includes(response.status)) {
+            return response;
+        }
+        if (hop >= REDIRECT_LIMIT) {
+            throw new Error(`registry redirect chain exceeded ${REDIRECT_LIMIT} hops for ${current.host}`);
+        }
+        const location = headerValue(response.headers.location);
+        if (!location) {
+            throw new Error(`registry returned a ${response.status} redirect with no Location for ${current.host}`);
+        }
+        const next = new URL(location, current);
+        if (next.protocol !== "http:" && next.protocol !== "https:") {
+            throw new Error(`registry redirected to unsupported protocol ${next.protocol}`);
+        }
+        if (isPrivateNetworkHost(next) && !isPrivateNetworkHost(target)) {
+            throw new Error(`registry redirected a public artifact request into a private address (${next.hostname})`);
+        }
+        current = next;
+    }
+}
+function guardedFetchOnce(target, accept, env) {
+    if (isLinkLocalHost(target)) {
+        return Promise.reject(new Error(`refusing to fetch from link-local/metadata address ${target.hostname}`));
+    }
+    const isHttps = target.protocol === "https:";
+    const requester = isHttps ? httpsRequest : httpRequest;
+    return new Promise((resolve, reject) => {
+        let stream = null;
+        const request = requester({
+            hostname: target.hostname,
+            port: target.port ? Number(target.port) : isHttps ? 443 : 80,
+            path: `${target.pathname}${target.search}`,
+            method: "GET",
+            agent: isHttps ? upstreamHttpsAgent : upstreamHttpAgent,
+            lookup: lookupForTarget(target, env),
+            headers: { "accept-encoding": "identity", ...(accept ? { accept } : {}) }
+        }, (upstream) => {
+            stream = upstream;
+            collectBounded(upstream, { label: target.toString(), env })
+                .then((body) => resolve({ status: upstream.statusCode ?? 502, headers: responseHeaders(upstream), body }))
+                .catch(reject);
+        });
+        const expire = (detail) => {
+            const error = new Error(`upstream registry request for ${target.host} timed out: ${detail}`);
+            stream?.destroy(error);
+            request.destroy(error);
+            reject(error);
+        };
+        request.setTimeout(upstreamIdleTimeoutMs(env), () => expire(`no data for ${upstreamIdleTimeoutMs(env)}ms`));
+        const totalTimer = setTimeout(() => expire(`exceeded the ${upstreamTotalTimeoutMs(env)}ms total budget`), upstreamTotalTimeoutMs(env));
+        totalTimer.unref();
+        request.once("close", () => clearTimeout(totalTimer));
+        request.once("error", reject);
+        request.end();
+    });
+}
+function serve(response, upstream) {
+    const headers = {
+        "content-type": headerValue(upstream.headers["content-type"]) || "application/octet-stream",
+        "content-length": upstream.body.length
+    };
+    const etag = headerValue(upstream.headers["etag"]);
+    if (etag) {
+        headers.etag = etag;
+    }
+    response.writeHead(upstream.status, headers);
+    response.end(upstream.body);
+}
+function serveJson(response, status, doc) {
+    const body = Buffer.from(JSON.stringify(doc));
+    response.writeHead(status, { "content-type": "application/json", "content-length": body.length });
+    response.end(body);
+}
+// Emit the proxy's ProxySessionState shape (readProxySessionState reads it), so
+// dg doctor and telemetry see one decision/hash/event stream whichever door ran.
+function writeOriginState(origin) {
+    if (!origin.stateFile) {
+        return;
+    }
+    const state = {
+        ready: true,
+        port: origin.port,
+        decisions: origin.decisions,
+        inflight: [],
+        hashes: origin.hashes,
+        identities: origin.identities,
+        events: origin.events
+    };
+    try {
+        mkdirSync(dirname(origin.stateFile), { recursive: true, mode: 0o700 });
+        const tmp = `${origin.stateFile}.${process.pid}.tmp`;
+        writeFileSync(tmp, `${JSON.stringify(state, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+        renameSync(tmp, origin.stateFile);
+    }
+    catch {
+        // telemetry is best-effort and must never break an install.
+    }
+}
+function sendError(response, status, message) {
+    if (response.headersSent) {
+        response.destroy();
+        return;
+    }
+    const body = `${message}\n`;
+    response.writeHead(status, { "content-type": "text/plain; charset=utf-8", "content-length": Buffer.byteLength(body) });
+    response.end(body);
+}
+function responseHeaders(response) {
+    const headers = {};
+    for (const [key, value] of Object.entries(response.headers)) {
+        if (value !== undefined) {
+            headers[key] = Array.isArray(value) ? [...value] : value;
+        }
+    }
+    return headers;
+}
+function isJson(upstream) {
+    return /json/i.test(headerValue(upstream.headers["content-type"]));
+}
+// Content-Type is upstream-controlled and spoofable; the /-/ pass-through proves
+// a body is metadata by actually parsing it (the size cap is applied first).
+function bodyIsParseableJson(upstream) {
+    try {
+        JSON.parse(upstream.body.toString("utf8"));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function headerValue(value) {
+    if (Array.isArray(value)) {
+        return value.join(",");
+    }
+    if (typeof value === "number") {
+        return String(value);
+    }
+    return value ?? "";
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/origin/spike-worker.js

@@ -0,0 +1,35 @@
+import { appendFileSync } from "node:fs";
+import { startOriginServer } from "./server.js";
+// Standalone entry so the P0 spike origin runs as its OWN process. The spawned
+// package manager connects to this process's loopback port; a manager spawned by
+// the test worker cannot reach a port the test worker itself holds, so the origin
+// must not be in-process. Prints `READY <url>` once bound.
+async function main() {
+    const ecosystem = (process.argv[2] ?? "npm");
+    const strategy = (process.argv[3] ?? "canonical");
+    // The test reads request routing from this file AFTER spawnSync returns. A
+    // file (not stderr) is required because spawnSync blocks the event loop, so
+    // the worker's async stderr is not processed until after the test's
+    // synchronous assertions run.
+    const requestLog = process.env.DG_ORIGIN_REQUEST_LOG;
+    const handle = await startOriginServer({
+        ecosystem,
+        npmTarballStrategy: strategy,
+        onRequest: (method, path) => {
+            process.stderr.write(`REQ ${method} ${path}\n`);
+            if (requestLog) {
+                appendFileSync(requestLog, `${method} ${path}\n`);
+            }
+        }
+    });
+    process.stdout.write(`READY ${handle.url}\n`);
+    const shutdown = () => {
+        handle.close().finally(() => process.exit(0));
+    };
+    process.on("SIGTERM", shutdown);
+    process.on("SIGINT", shutdown);
+}
+main().catch((error) => {
+    process.stderr.write(`origin worker failed: ${error instanceof Error ? error.message : String(error)}\n`);
+    process.exit(1);
+});