@westbayberry/dg 2.3.3 → 2.3.4

package/dist/proxy/server.js

@@ -7,23 +7,22 @@ import { Agent as HttpsAgent, request as httpsRequest } from "node:https";
 import { mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { connect } from "node:net";
-import { lookup as dnsLookup } from "node:dns";
 import { createSecureContext, createServer as createTlsServer, connect as tlsConnect, rootCertificates } from "node:tls";
 import { createEphemeralCertificateAuthority } from "./ca.js";
 import { shouldMitmHost } from "./classify-host.js";
 import { generateProxyAuthToken, proxyAuthorizationValue, verifyProxyAuthorization, writeProxyAuthToken } from "./auth.js";
 import { enforceProtectedInstall, noteEnforcementSideEffectFailure } from "./enforcement.js";
-import { cooldownRequestParam, isCooldownExemptByDgFile } from "../policy/cooldown.js";
 import { loadUserConfig } from "../config/settings.js";
-import { artifactDisplayName, artifactUrlHash, extractRegistryMetadataIdentities, isRegistryIndexRequest, resolveArtifactIdentity } from "./metadata-map.js";
-import { loadPreverifiedMap, preverifiedKey } from "./preverified.js";
+import { artifactDisplayName, extractRegistryMetadataIdentities, isRegistryIndexRequest, resolveArtifactIdentity } from "./metadata-map.js";
 import { authorityFor, connectViaUpstreamProxy, selectUpstreamProxy } from "./upstream-proxy.js";
 import { redactSecrets } from "../launcher/output-redaction.js";
-import { sanitize } from "../security/sanitize.js";
-import { envAuthToken } from "../auth/env-token.js";
-import { identityHeaders } from "../api/analyze.js";
-import { dgVersion } from "../commands/version.js";
 import { recordHeldPackage } from "../state/index.js";
+import { assertTargetEgressAllowed, isLinkLocalHost, isPrivateNetworkHost, lookupForTarget } from "../gate/egress-guard.js";
+import { hostMatchesList, testUpstreamHostMap } from "../gate/host-match.js";
+import { packageNameFromUrl } from "../gate/verdict-core.js";
+import { lookupVerdict } from "../gate/verdict-fetch.js";
+export { isBlockedResolvedIp, isLinkLocalHost, isPrivateNetworkHost } from "../gate/egress-guard.js";
+export { isProxyCause } from "../gate/verdict-core.js";
 export async function startProductionHttpProxy(options) {
     const onCaRotate = options.onCaRotate;
     const ca = createEphemeralCertificateAuthority(options.session.files.ca, onCaRotate ? { onRotate: (caCertPem) => safeCaRotateCallback(onCaRotate, caCertPem) } : {});
@@ -277,6 +276,12 @@ async function fetchUpstreamHeadersFollowingRedirects(request, target, env) {
         if (next.protocol !== "http:" && next.protocol !== "https:") {
             throw new Error(`registry redirected to unsupported protocol ${next.protocol}`);
         }
+        // A link-local / cloud-metadata hop is NEVER a legitimate redirect target, even
+        // from an already-private registry (the public->private guard below would not
+        // fire when both ends are private). Refuse it on every hop, as the origin door does.
+        if (isLinkLocalHost(next)) {
+            throw new Error(`registry redirected to a link-local/metadata address (${next.hostname})`);
+        }
         if (isPrivateNetworkHost(next) && !isPrivateNetworkHost(target)) {
             throw new Error(`registry redirected a public artifact request into a private address (${next.hostname})`);
         }
@@ -296,6 +301,7 @@ function fetchUpstreamHeaders(request, target, env) {
             path: `${target.pathname}${target.search}`,
             method: request.method,
             agent: isHttps ? upstreamHttpsAgent : upstreamHttpAgent,
+            lookup: lookupForTarget(target, env),
             headers: isHttps ? upstreamRequestHeaders(request, target) : stripProxyHopHeaders(request.headers),
             ...(isHttps ? upstreamTlsOptions(env) : {})
         }, (upstreamResponse) => {
@@ -414,124 +420,6 @@ async function streamArtifactWithTailHold(response, target, options, state, live
 function isRedirectStatus(statusCode) {
     return [301, 302, 303, 307, 308].includes(statusCode);
 }
-// Node's WHATWG URL parser canonicalizes an IPv4-mapped IPv6 literal to the hex
-// hextet form ([::ffff:169.254.169.254] -> [::ffff:a9fe:a9fe]), so a guard that
-// only string-matches the dotted-decimal form silently lets the cloud-metadata
-// IP through as "public". Recover the embedded IPv4 (both forms) before
-// classifying so the IPv4 ranges below cover the mapped address too.
-function hextetsToIpv4(hi, lo) {
-    const h = parseInt(hi, 16);
-    const l = parseInt(lo, 16);
-    return `${(h >> 8) & 0xff}.${h & 0xff}.${(l >> 8) & 0xff}.${l & 0xff}`;
-}
-// Recover an IPv4 address embedded in an IPv6 literal so the IPv4 ranges below
-// also cover it. Covers IPv4-mapped (::ffff:), IPv4-compatible (::), 6to4
-// (2002::/16), and NAT64 (64:ff9b::/96) — each a way to smuggle 169.254.169.254
-// past a guard that only string-matches the dotted-decimal form.
-function recoverIpv4MappedHost(host) {
-    const mappedDotted = /^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i.exec(host);
-    if (mappedDotted?.[1])
-        return mappedDotted[1];
-    const mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(host);
-    if (mappedHex?.[1] && mappedHex[2])
-        return hextetsToIpv4(mappedHex[1], mappedHex[2]);
-    const compatDotted = /^::(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i.exec(host);
-    if (compatDotted?.[1])
-        return compatDotted[1];
-    const compatHex = /^::([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(host);
-    if (compatHex?.[1] && compatHex[2])
-        return hextetsToIpv4(compatHex[1], compatHex[2]);
-    const sixToFour = /^2002:([0-9a-f]{1,4}):([0-9a-f]{1,4}):/i.exec(host);
-    if (sixToFour?.[1] && sixToFour[2])
-        return hextetsToIpv4(sixToFour[1], sixToFour[2]);
-    const nat64Dotted = /^64:ff9b::(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i.exec(host);
-    if (nat64Dotted?.[1])
-        return nat64Dotted[1];
-    const nat64Hex = /^64:ff9b::([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(host);
-    if (nat64Hex?.[1] && nat64Hex[2])
-        return hextetsToIpv4(nat64Hex[1], nat64Hex[2]);
-    return host;
-}
-// Block a RESOLVED address (the actual connect target), so a public hostname
-// whose A/AAAA record points at an internal/metadata IP — DNS-rebinding SSRF —
-// is refused at connect time, not just literal-IP targets.
-export function isBlockedResolvedIp(ip) {
-    const host = recoverIpv4MappedHost(ip.toLowerCase().replace(/^\[/, "").replace(/\]$/, ""));
-    if (host === "0.0.0.0" || host === "::" || host === "::1") {
-        return true;
-    }
-    if (isPrivateIpv4(host)) {
-        return true;
-    }
-    return /^(fe80|f[cd][0-9a-f]{2}):/.test(host);
-}
-function guardedLookup(hostname, options, callback) {
-    const opts = typeof options === "object" && options !== null ? options : {};
-    dnsLookup(hostname, { ...opts, all: true }, (err, addresses) => {
-        if (err) {
-            callback(err, "", 0);
-            return;
-        }
-        const list = addresses;
-        const blocked = list.find((entry) => isBlockedResolvedIp(entry.address));
-        if (blocked) {
-            callback(new Error(`refusing to connect to ${hostname}: resolves to blocked address ${blocked.address}`), "", 0);
-            return;
-        }
-        if (opts.all === true) {
-            callback(null, list);
-            return;
-        }
-        const first = list[0];
-        if (!first) {
-            callback(new Error(`no address found for ${hostname}`), "", 0);
-            return;
-        }
-        callback(null, first.address, first.family);
-    });
-}
-// The resolved-IP guard exists for DNS rebinding — a PUBLIC hostname whose A/AAAA
-// record points at an internal IP. It must not fire for: an explicitly-configured
-// private registry (DG_PRIVATE_REGISTRY_HOSTS) whose name legitimately resolves to
-// a private IP; a test host-map target; or a target that is ALREADY a private/
-// loopback literal (the user/test pointed there directly — not rebinding, and the
-// link-local/metadata literal is still blocked at the artifact path).
-function lookupForTarget(target, env) {
-    const host = target.hostname.replace(/^\[(.*)\]$/, "$1");
-    if (hostMatchesList(target.hostname, env.DG_PRIVATE_REGISTRY_HOSTS ?? "")) {
-        return undefined;
-    }
-    if (testUpstreamHostMap(env).has(host)) {
-        return undefined;
-    }
-    if (isPrivateNetworkHost(target)) {
-        return undefined;
-    }
-    return guardedLookup;
-}
-function isPrivateIpv4(host) {
-    return (/^(127|10|0)\./.test(host) ||
-        /^192\.168\./.test(host) ||
-        /^169\.254\./.test(host) ||
-        /^172\.(1[6-9]|2[0-9]|3[01])\./.test(host) ||
-        /^100\.(6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])\./.test(host));
-}
-export function isPrivateNetworkHost(url) {
-    const raw = url.hostname.toLowerCase().replace(/^\[/, "").replace(/\]$/, "");
-    const host = recoverIpv4MappedHost(raw);
-    if (host === "localhost" || host.endsWith(".localhost") || host === "0.0.0.0" || host === "::" || host === "::1") {
-        return true;
-    }
-    if (isPrivateIpv4(host)) {
-        return true;
-    }
-    return /^(fe80|f[cd][0-9a-f]{2}):/.test(host);
-}
-export function isLinkLocalHost(url) {
-    const raw = url.hostname.toLowerCase().replace(/^\[/, "").replace(/\]$/, "");
-    const host = recoverIpv4MappedHost(raw);
-    return /^169\.254\./.test(host) || /^fe80:/.test(host);
-}
 function syntheticGetRequest(headers) {
     const request = new EventEmitter();
     request.method = "GET";
@@ -563,6 +451,12 @@ async function fetchUpstreamFollowingRedirects(request, target, env) {
         if (next.protocol !== "http:" && next.protocol !== "https:") {
             throw new Error(`registry redirected to unsupported protocol ${next.protocol}`);
         }
+        // A link-local / cloud-metadata hop is NEVER a legitimate redirect target, even
+        // from an already-private registry (the public->private guard below would not
+        // fire when both ends are private). Refuse it on every hop, as the origin door does.
+        if (isLinkLocalHost(next)) {
+            throw new Error(`registry redirected to a link-local/metadata address (${next.hostname})`);
+        }
         if (isPrivateNetworkHost(next) && !isPrivateNetworkHost(target)) {
             throw new Error(`registry redirected a public artifact request into a private address (${next.hostname})`);
         }
@@ -620,8 +514,29 @@ async function handleArtifactRequest(request, response, target, options, state)
     if (!upstream) {
         return;
     }
+    // Metadata is JSON.parse'd / regex-scanned in memory to extract identities; a
+    // near-gigabyte body from a malicious/MITM registry would burn the worker (the
+    // origin door caps this the same way). Legit packuments/indexes are KB-to-MB.
+    // Cap by metadata classification, not the spoofable content-type, so an HTML
+    // PyPI Simple index (not application/json) is bounded too.
+    const looksLikeMetadata = /\bjson\b/i.test(headerValue(upstream.headers["content-type"])) || isRegistryIndexRequest(target);
+    if (looksLikeMetadata && upstream.body.length > maxMetadataBytes(options.env)) {
+        const decision = recordDecision(options, state, {
+            verdict: "block",
+            packageName: packageNameFromUrl(target),
+            cause: "policy",
+            reason: `registry metadata exceeded the ${maxMetadataBytes(options.env)}-byte limit`
+        });
+        sendBlocked(response, decision);
+        return;
+    }
     const metadataIdentities = extractRegistryMetadataIdentities(target, upstream);
-    if (metadataIdentities.length > 0 || isRegistryIndexRequest(target)) {
+    // An index-shaped path (npm `/-/…`, PyPI `/simple/…`, `…/json`, `.metadata`)
+    // is served ungated as metadata — but classify by the response BYTES, not the
+    // path or the spoofable content-type. A tarball/wheel a malicious packument
+    // points at an index-shaped URL (e.g. dist.tarball=/-/payload.tgz) starts with
+    // an archive magic, so it falls through to the verdict gate instead.
+    if (metadataIdentities.length > 0 || (isRegistryIndexRequest(target) && !bodyLooksLikeArchive(upstream.body))) {
         if (metadataIdentities.length > 0) {
             state.identities = mergeIdentities(state.identities, metadataIdentities);
             state.events = [...state.events, `metadata:${target.hostname}:${metadataIdentities.length}`];
@@ -696,6 +611,9 @@ async function handleArtifactRequest(request, response, target, options, state)
 }
 async function blindTunnel(clientSocket, head, target, options, activeSockets) {
     const upstreamProxy = selectUpstreamProxy(target, options.env);
+    if (upstreamProxy) {
+        await assertTargetEgressAllowed(target, options.env);
+    }
     const upstreamSocket = upstreamProxy
         ? await connectViaUpstreamProxy(target, upstreamProxy)
         : await connectDirect(target, options.env);
@@ -784,24 +702,6 @@ function upstreamHostname(target, env = process.env) {
     const hostname = target.hostname.replace(/^\[(.*)\]$/, "$1");
     return testUpstreamHostMap(env).get(hostname) ?? hostname;
 }
-function testUpstreamHostMap(env) {
-    if (env.NODE_ENV !== "test") {
-        return new Map();
-    }
-    const entries = (env.DG_TEST_UPSTREAM_HOST_MAP ?? "")
-        .split(",")
-        .map((entry) => entry.trim())
-        .filter(Boolean)
-        .map((entry) => {
-        const separator = entry.indexOf("=");
-        if (separator <= 0) {
-            return null;
-        }
-        return [entry.slice(0, separator), entry.slice(separator + 1)];
-    })
-        .filter((entry) => entry !== null);
-    return new Map(entries);
-}
 function fetchUpstream(request, target, env) {
     const upstreamProxy = selectUpstreamProxy(target, env);
     if (upstreamProxy && target.protocol === "http:") {
@@ -843,7 +743,8 @@ function fetchUpstream(request, target, env) {
         });
     });
 }
-function fetchHttpViaProxy(request, target, upstreamProxy, env) {
+async function fetchHttpViaProxy(request, target, upstreamProxy, env) {
+    await assertTargetEgressAllowed(target, env);
     return new Promise((resolve, reject) => {
         const headers = {
             ...stripProxyHopHeaders(request.headers),
@@ -909,6 +810,7 @@ function fetchHttpsDirect(request, target, env) {
     });
 }
 async function fetchHttpsViaProxy(request, target, upstreamProxy, env) {
+    await assertTargetEgressAllowed(target, env);
     const tunnel = await connectViaUpstreamProxy(target, upstreamProxy);
     const tlsSocket = await connectTlsOverSocket(tunnel, target, env);
     const requestBody = await readRequestBody(request);
@@ -956,9 +858,14 @@ function writeRawHttpRequest(tlsSocket, request, target, requestBody) {
     return new Promise((resolve, reject) => {
         collectBounded(tlsSocket, { label: target.toString() }).then(resolve).catch(reject);
         const headers = upstreamRequestHeaders(request, target);
+        // Frame the request from the body the proxy actually writes, never the
+        // client's forwarded Transfer-Encoding / Content-Length (those are dropped in
+        // upstreamRequestHeaders). Emitting the original framing while re-writing the
+        // body is a TE/CL request-smuggling desync.
         const lines = [
             `${request.method ?? "GET"} ${target.pathname}${target.search} HTTP/1.1`,
             ...Object.entries(headers).flatMap(([key, value]) => headerLines(key, value)),
+            ...(requestBody.length > 0 ? [`Content-Length: ${requestBody.length}`] : []),
             "Connection: close",
             "",
             ""
@@ -970,7 +877,7 @@ function writeRawHttpRequest(tlsSocket, request, target, requestBody) {
         tlsSocket.end();
     });
 }
-function parseRawHttpResponse(raw) {
+export function parseRawHttpResponse(raw) {
     const headerEnd = raw.indexOf("\r\n\r\n");
     if (headerEnd === -1) {
         throw new Error("upstream registry returned a malformed HTTP response");
@@ -990,17 +897,33 @@ function parseRawHttpResponse(raw) {
         const existing = headers[key];
         headers[key] = existing === undefined ? value : `${headerValue(existing)},${value}`;
     }
+    const codings = headerValue(headers["transfer-encoding"]).toLowerCase()
+        .split(",")
+        .map((coding) => coding.trim())
+        .filter((coding) => coding.length > 0);
+    const chunkedIndex = codings.indexOf("chunked");
+    const isChunked = chunkedIndex !== -1 && chunkedIndex === codings.length - 1;
+    if (chunkedIndex !== -1 && !isChunked) {
+        // chunked must be the final transfer-coding (RFC 7230 §3.3.1); a non-final
+        // chunked is unframeable, so reject rather than guess where the body ends.
+        throw new Error("upstream registry response declared chunked as a non-final transfer-coding");
+    }
+    if (isChunked && headers["content-length"] !== undefined) {
+        // RFC 7230 framing ambiguity (request/response smuggling surface): never
+        // guess which one frames the gated bytes — reject the response.
+        throw new Error("upstream registry response declared both Transfer-Encoding and Content-Length");
+    }
     return {
         statusCode: status ? Number(status) : 502,
         headers,
-        body: headerValue(headers["transfer-encoding"]).toLowerCase() === "chunked" ? decodeChunkedBody(body) : body
+        body: isChunked ? decodeChunkedBody(body) : body
     };
 }
 function upstreamRequestHeaders(request, target) {
     const headers = {};
     for (const [key, value] of Object.entries(request.headers)) {
         const normalized = key.toLowerCase();
-        if (["proxy-authorization", "proxy-connection", "connection", "host"].includes(normalized) || value === undefined) {
+        if (["proxy-authorization", "proxy-connection", "connection", "host", "transfer-encoding", "content-length"].includes(normalized) || value === undefined) {
             continue;
         }
         headers[key] = Array.isArray(value) ? [...value] : value;
@@ -1041,278 +964,33 @@ function readRequestBody(request) {
     return collectBounded(request, { label: "proxied request body" });
 }
 function decodeChunkedBody(body) {
+    // Any malformation throws rather than returning a prefix: the decoded body is
+    // hashed + scanned to gate the install, so silently truncating it would let an
+    // attacker hide payload in a tail the scanner never sees.
     const chunks = [];
     let offset = 0;
     while (offset < body.length) {
         const lineEnd = body.indexOf("\r\n", offset);
         if (lineEnd === -1) {
-            break;
+            throw new Error("upstream registry returned a chunked response with no chunk-size terminator");
         }
-        const size = Number.parseInt(body.subarray(offset, lineEnd).toString("latin1"), 16);
-        if (!Number.isFinite(size) || size < 0) {
-            break;
+        const sizeToken = (body.subarray(offset, lineEnd).toString("latin1").split(";")[0] ?? "").trim();
+        if (!/^[0-9a-fA-F]+$/.test(sizeToken)) {
+            throw new Error("upstream registry returned a malformed chunk size");
         }
+        const size = Number.parseInt(sizeToken, 16);
         if (size === 0) {
             return Buffer.concat(chunks);
         }
         const start = lineEnd + 2;
         const end = start + size;
+        if (end > body.length) {
+            throw new Error("upstream registry returned a chunk shorter than its declared size");
+        }
         chunks.push(body.subarray(start, end));
         offset = end + 2;
     }
-    return Buffer.concat(chunks);
-}
-async function lookupVerdict(options, target, sha256, upstream, identity) {
-    if (shouldUseScanTarball(options, target, identity)) {
-        return lookupScanTarballVerdict(options, target, sha256, upstream, identity);
-    }
-    const preverified = preverifiedVerdict(options, target, sha256, identity);
-    if (preverified) {
-        return preverified;
-    }
-    const cooldown = resolveCooldownRequest(options, identity);
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), options.verdictTimeoutMs ?? installVerdictTimeoutMs(options.env));
-    try {
-        const response = await fetch(`${options.apiBaseUrl}/v1/install-verdict`, {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/json",
-                "X-Dg-Version": dgVersion(),
-                ...identityHeaders(options.env)
-            },
-            body: JSON.stringify({
-                manager: options.classification.manager,
-                action: options.classification.action,
-                url: redactSecrets(target.toString()),
-                artifactUrlHash: artifactUrlHash(target),
-                ecosystem: identity.ecosystem,
-                name: identity.name,
-                version: identity.version,
-                registryHost: identity.registryHost,
-                sourceKind: identity.sourceKind,
-                sha256,
-                statusCode: upstream.statusCode,
-                contentType: headerValue(upstream.headers["content-type"]),
-                ...(cooldown ? { cooldown } : {})
-            }),
-            signal: controller.signal
-        });
-        if (response.status === 402 || response.status === 429) {
-            const body = (await response.json().catch(() => ({})));
-            return {
-                verdict: "block",
-                packageName: artifactDisplayName(identity),
-                cause: "quota-exceeded",
-                reason: "You've reached your monthly scan limit. Upgrade at westbayberry.com/pricing or wait for it to reset.",
-                ...(typeof body.resetsAt === "string" ? { resetsAt: sanitize(body.resetsAt) } : {}),
-                quotaBehavior: body.quotaBehavior === "pass" ? "pass" : "block"
-            };
-        }
-        if (response.status === 401) {
-            return {
-                verdict: "block",
-                packageName: artifactDisplayName(identity),
-                cause: "needs-login",
-                unauthenticated: true,
-                reason: "Checking a package from the registry before it installs requires sign-in."
-            };
-        }
-        if (!response.ok) {
-            return {
-                verdict: "block",
-                packageName: artifactDisplayName(identity),
-                cause: "api-unavailable",
-                reason: `Dependency Guardian API returned ${response.status}. Run 'dg doctor' and 'dg login' to verify API access.`
-            };
-        }
-        return normalizeVerdict(await response.json(), target, identity, sha256);
-    }
-    finally {
-        clearTimeout(timeout);
-    }
-}
-async function lookupScanTarballVerdict(options, target, sha256, upstream, identity) {
-    const body = upstream.body ?? Buffer.alloc(0);
-    const uploadPolicy = scanTarballUploadPolicy(options.env);
-    if (!uploadPolicy.enabled) {
-        return {
-            verdict: "block",
-            packageName: artifactDisplayName(identity),
-            cause: "private-upload-disabled",
-            reason: `private artifact scan upload is disabled for ${target.hostname}`
-        };
-    }
-    if (!uploadPolicy.token) {
-        return {
-            verdict: "block",
-            packageName: artifactDisplayName(identity),
-            cause: "private-upload-disabled",
-            reason: "private artifact scan upload requires DG_API_TOKEN"
-        };
-    }
-    if (body.length > uploadPolicy.maxBytes) {
-        return {
-            verdict: "block",
-            packageName: artifactDisplayName(identity),
-            cause: "private-upload-disabled",
-            reason: `private artifact is ${body.length} bytes, above the ${uploadPolicy.maxBytes} byte scan-tarball upload limit`
-        };
-    }
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), uploadPolicy.timeoutMs);
-    try {
-        const response = await fetch(`${options.apiBaseUrl}/v1/scan-tarball`, {
-            method: "POST",
-            headers: {
-                "Authorization": `Bearer ${uploadPolicy.token}`,
-                "Content-Type": "application/octet-stream",
-                "X-DG-Action": options.classification.action,
-                "X-DG-Artifact-SHA256": sha256,
-                "X-DG-Artifact-URL-Hash": artifactUrlHash(target),
-                "X-DG-Cache-Key": `sha256:${sha256}`,
-                "X-DG-Ecosystem": identity.ecosystem,
-                "X-DG-Manager": options.classification.manager,
-                "X-DG-Package-Name": identity.name,
-                "X-DG-Package-Version": identity.version,
-                "X-DG-Privacy": "private-artifact",
-                "X-DG-Registry-Host": identity.registryHost,
-                "X-DG-Source-Kind": identity.sourceKind
-            },
-            body,
-            signal: controller.signal
-        });
-        if (!response.ok) {
-            throw new Error(`Dependency Guardian scan-tarball API returned ${response.status}`);
-        }
-        return normalizeScanTarballVerdict(await response.json(), target, identity, sha256);
-    }
-    finally {
-        clearTimeout(timeout);
-    }
-}
-// A preflight batch-analyze already verdicted this exact name@version (and the
-// user accepted any warns), so a per-artifact API round-trip would re-answer
-// the same question. Trust it only when the identity came from registry
-// metadata and the preflight applied the same cooldown gate the proxy would;
-// the synthesized verdict goes through normalizeVerdict so the scanned-SHA
-// cross-check blocks tampered bytes exactly like a server response would.
-function preverifiedVerdict(options, target, streamedSha256, identity) {
-    if (identity.sourceKind !== "registry-metadata") {
-        return null;
-    }
-    const entry = loadPreverifiedMap(options.session.dir).get(preverifiedKey(identity.ecosystem, identity.name, identity.version));
-    if (!entry) {
-        return null;
-    }
-    if (!entry.cooldownEvaluated && resolveCooldownRequest(options, identity) !== undefined) {
-        return null;
-    }
-    if (!entry.scannedSha256) {
-        // No byte-level fingerprint to cross-check against the streamed artifact, so
-        // a preverified pass/warn can't prove the downloaded bytes match what was
-        // screened (a metadata-only preflight, or a registry swap between preflight
-        // and fetch). Fall through to a real scan of the streamed bytes — TOCTOU
-        // defense — rather than honoring the verdict for whatever now arrives.
-        return null;
-    }
-    return normalizeVerdict({
-        verdict: entry.action,
-        cause: entry.action,
-        packageName: `${identity.name}@${identity.version}`,
-        reason: entry.reason ?? (entry.action === "pass" ? "verified before install" : "flagged for review"),
-        ...(entry.scannedSha256 ? { scannedSha256: entry.scannedSha256 } : {})
-    }, target, identity, streamedSha256);
-}
-function normalizeVerdict(value, target, identity, streamedSha256) {
-    if (!isRecord(value)) {
-        throw new Error("Dependency Guardian API returned a malformed verdict");
-    }
-    const verdict = value.verdict;
-    if (verdict !== "pass" && verdict !== "warn" && verdict !== "block") {
-        throw new Error("Dependency Guardian API returned a malformed verdict");
-    }
-    const scannedSha256 = typeof value.scannedSha256 === "string" ? value.scannedSha256.toLowerCase() : "";
-    if (scannedSha256.length > 0 && scannedSha256 !== streamedSha256) {
-        return {
-            verdict: "block",
-            packageName: artifactDisplayName(identity),
-            cause: "hash-mismatch",
-            reason: `server scanned SHA-256 ${scannedSha256} did not match streamed artifact SHA-256 ${streamedSha256}`
-        };
-    }
-    const cause = typeof value.cause === "string" ? value.cause : undefined;
-    const cooldown = parseCooldownInfo(value.cooldown);
-    const dashboardUrl = safeDashboardUrl(value.dashboardUrl);
-    return {
-        verdict,
-        packageName: typeof value.packageName === "string" ? sanitize(value.packageName) : artifactDisplayName(identity) || packageNameFromUrl(target),
-        ...(isProxyCause(cause) ? { cause } : {}),
-        reason: typeof value.reason === "string" ? sanitize(value.reason) : `API verdict ${verdict}`,
-        ...(dashboardUrl ? { dashboardUrl } : {}),
-        ...(value.unauthenticated === true ? { unauthenticated: true } : {}),
-        ...(cooldown ? { cooldown } : {})
-    };
-}
-function safeDashboardUrl(value) {
-    if (typeof value !== "string") {
-        return undefined;
-    }
-    try {
-        const url = new URL(sanitize(value));
-        return url.protocol === "https:" ? url.toString() : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-function resolveCooldownRequest(options, identity) {
-    if (identity.ecosystem === "unknown" || identity.version === "unknown") {
-        return undefined;
-    }
-    if (isCooldownExemptByDgFile(identity.name, identity.ecosystem, options.cooldownExemptions ?? [])) {
-        return undefined;
-    }
-    try {
-        return cooldownRequestParam(loadUserConfig(options.env), options.env, identity.ecosystem, identity.name);
-    }
-    catch {
-        return undefined;
-    }
-}
-function parseCooldownInfo(value) {
-    if (!isRecord(value) || typeof value.requiredDays !== "number" || !Number.isFinite(value.requiredDays)) {
-        return undefined;
-    }
-    return {
-        requiredDays: value.requiredDays,
-        ...(typeof value.ageDays === "number" && Number.isFinite(value.ageDays) ? { ageDays: value.ageDays } : {}),
-        ...(typeof value.publishedAt === "string" ? { publishedAt: sanitize(value.publishedAt) } : {}),
-        ...(typeof value.eligibleAt === "string" ? { eligibleAt: sanitize(value.eligibleAt) } : {})
-    };
-}
-function normalizeScanTarballVerdict(value, target, identity, streamedSha256) {
-    if (!isRecord(value) || typeof value.scannedSha256 !== "string" || value.scannedSha256.length === 0) {
-        throw new Error("Dependency Guardian scan-tarball API did not return scannedSha256");
-    }
-    return normalizeVerdict(value, target, identity, streamedSha256);
-}
-function shouldUseScanTarball(options, target, identity) {
-    if (identity.sourceKind !== "url-fallback") {
-        return false;
-    }
-    return hostMatchesList(target.hostname, options.env.DG_PRIVATE_REGISTRY_HOSTS ?? "");
-}
-function scanTarballUploadPolicy(env) {
-    return {
-        enabled: env.DG_SCAN_TARBALL_UPLOAD === "1" || env.DG_SCAN_TARBALL_UPLOAD === "true",
-        maxBytes: parsePositiveInteger(env.DG_SCAN_TARBALL_MAX_BYTES, 50 * 1024 * 1024),
-        timeoutMs: parsePositiveInteger(env.DG_SCAN_TARBALL_TIMEOUT_MS, 5_000),
-        token: envAuthToken(env) ?? ""
-    };
-}
-function installVerdictTimeoutMs(env) {
-    return parsePositiveInteger(env.DG_INSTALL_VERDICT_TIMEOUT_MS, 240_000);
+    throw new Error("upstream registry returned an unterminated chunked response");
 }
 function parsePositiveInteger(value, fallback) {
     if (!value) {
@@ -1321,20 +999,8 @@ function parsePositiveInteger(value, fallback) {
     const parsed = Number.parseInt(value, 10);
     return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
 }
-function hostMatchesList(host, rawList) {
-    const normalized = normalizeHost(host);
-    return rawList.split(",").map((entry) => entry.trim()).filter(Boolean).some((pattern) => hostMatchesPattern(normalized, pattern));
-}
-function hostMatchesPattern(host, pattern) {
-    const normalized = normalizeHost(pattern);
-    if (normalized.startsWith("*.")) {
-        const suffix = normalized.slice(1);
-        return host.endsWith(suffix) && host.length > suffix.length;
-    }
-    return host === normalized;
-}
-function normalizeHost(host) {
-    return host.replace(/^\[/, "").replace(/\]$/, "").replace(/\.$/, "").toLowerCase();
+function maxMetadataBytes(env) {
+    return parsePositiveInteger(env.DG_ORIGIN_MAX_METADATA_BYTES, 64 * 1024 * 1024);
 }
 function mergeIdentities(existing, next) {
     const merged = [...existing];
@@ -1408,9 +1074,24 @@ function headerValue(value) {
     }
     return "";
 }
-function packageNameFromUrl(url) {
-    const name = url.pathname.split("/").filter(Boolean).pop();
-    return name ? decodeURIComponent(name) : url.hostname;
+// True when the body begins with a package-archive magic (gzip .tgz/.tar.gz, zip
+// .whl/.zip, bzip2, xz). Registry index/API responses are JSON or text, so this
+// distinguishes a real artifact from metadata by content rather than by a
+// path shape or a content-type header an upstream can forge.
+function bodyLooksLikeArchive(body) {
+    if (body.length < 4) {
+        return false;
+    }
+    const [b0, b1, b2, b3] = body;
+    if ((b0 === 0x1f && b1 === 0x8b) ||
+        (b0 === 0x50 && b1 === 0x4b && (b2 === 0x03 || b2 === 0x05 || b2 === 0x07)) ||
+        (b0 === 0x42 && b1 === 0x5a && b2 === 0x68) ||
+        (b0 === 0xfd && b1 === 0x37 && b2 === 0x7a && b3 === 0x58)) {
+        return true;
+    }
+    // Uncompressed POSIX/GNU tar carries the `ustar` magic at offset 257; without
+    // this an index-shaped URL serving a plain .tar artifact passes through ungated.
+    return body.length >= 263 && body.subarray(257, 262).toString("ascii") === "ustar";
 }
 function writeProxyState(session, state) {
     try {
@@ -1445,26 +1126,3 @@ function removeFirst(items, value) {
     }
     return [...items.slice(0, index), ...items.slice(index + 1)];
 }
-function isRecord(value) {
-    return typeof value === "object" && value !== null;
-}
-export function isProxyCause(value) {
-    return [
-        "pass",
-        "warn",
-        "malware",
-        "policy",
-        "license",
-        "hash-mismatch",
-        "private-upload-disabled",
-        "needs-login",
-        "api-unavailable",
-        "quota-exceeded",
-        "api-timeout",
-        "registry-timeout",
-        "analysis-incomplete",
-        "cooldown",
-        "unsupported-manager",
-        "proxy-setup-failure"
-    ].includes(value ?? "");
-}