@westbayberry/dg 2.3.3 → 2.3.4

package/dist/gate/egress-guard.js

@@ -0,0 +1,185 @@
+import { lookup as dnsLookup } from "node:dns";
+import { hostMatchesList, testUpstreamHostMap } from "./host-match.js";
+// Node's WHATWG URL parser canonicalizes an IPv4-mapped IPv6 literal to the hex
+// hextet form ([::ffff:169.254.169.254] -> [::ffff:a9fe:a9fe]), so a guard that
+// only string-matches the dotted-decimal form silently lets the cloud-metadata
+// IP through as "public". Recover the embedded IPv4 (both forms) before
+// classifying so the IPv4 ranges below cover the mapped address too.
+function hextetsToIpv4(hi, lo) {
+    const h = parseInt(hi, 16);
+    const l = parseInt(lo, 16);
+    return `${(h >> 8) & 0xff}.${h & 0xff}.${(l >> 8) & 0xff}.${l & 0xff}`;
+}
+// Recover an IPv4 address embedded in an IPv6 literal so the IPv4 ranges below
+// also cover it. Covers IPv4-mapped (::ffff:), IPv4-compatible (::), 6to4
+// (2002::/16), and NAT64 (64:ff9b::/96) — each a way to smuggle 169.254.169.254
+// past a guard that only string-matches the dotted-decimal form.
+function recoverIpv4MappedHost(host) {
+    const mappedDotted = /^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i.exec(host);
+    if (mappedDotted?.[1])
+        return mappedDotted[1];
+    const mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(host);
+    if (mappedHex?.[1] && mappedHex[2])
+        return hextetsToIpv4(mappedHex[1], mappedHex[2]);
+    const compatDotted = /^::(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i.exec(host);
+    if (compatDotted?.[1])
+        return compatDotted[1];
+    const compatHex = /^::([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(host);
+    if (compatHex?.[1] && compatHex[2])
+        return hextetsToIpv4(compatHex[1], compatHex[2]);
+    const sixToFour = /^2002:([0-9a-f]{1,4}):([0-9a-f]{1,4}):/i.exec(host);
+    if (sixToFour?.[1] && sixToFour[2])
+        return hextetsToIpv4(sixToFour[1], sixToFour[2]);
+    const nat64Dotted = /^64:ff9b::(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i.exec(host);
+    if (nat64Dotted?.[1])
+        return nat64Dotted[1];
+    const nat64Hex = /^64:ff9b::([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(host);
+    if (nat64Hex?.[1] && nat64Hex[2])
+        return hextetsToIpv4(nat64Hex[1], nat64Hex[2]);
+    return host;
+}
+// Block a RESOLVED address (the actual connect target), so a public hostname
+// whose A/AAAA record points at an internal/metadata IP — DNS-rebinding SSRF —
+// is refused at connect time, not just literal-IP targets.
+export function isBlockedResolvedIp(ip) {
+    const host = recoverIpv4MappedHost(ip.toLowerCase().replace(/^\[/, "").replace(/\]$/, ""));
+    if (host === "0.0.0.0" || host === "::" || host === "::1") {
+        return true;
+    }
+    if (isPrivateIpv4(host)) {
+        return true;
+    }
+    return /^(fe80|f[cd][0-9a-f]{2}|ff[0-9a-f]{2}):/.test(host);
+}
+function guardedLookup(hostname, options, callback) {
+    const opts = typeof options === "object" && options !== null ? options : {};
+    dnsLookup(hostname, { ...opts, all: true }, (err, addresses) => {
+        if (err) {
+            callback(err, "", 0);
+            return;
+        }
+        const list = addresses;
+        const blocked = list.find((entry) => isBlockedResolvedIp(entry.address));
+        if (blocked) {
+            callback(new Error(`refusing to connect to ${hostname}: resolves to blocked address ${blocked.address}. If this is a private/tailnet registry you trust, add its host to DG_PRIVATE_REGISTRY_HOSTS.`), "", 0);
+            return;
+        }
+        if (opts.all === true) {
+            callback(null, list);
+            return;
+        }
+        const first = list[0];
+        if (!first) {
+            callback(new Error(`no address found for ${hostname}`), "", 0);
+            return;
+        }
+        callback(null, first.address, first.family);
+    });
+}
+// The resolved-IP guard exists for DNS rebinding — a PUBLIC hostname whose A/AAAA
+// record points at an internal IP. It must not fire for: an explicitly-configured
+// private registry (DG_PRIVATE_REGISTRY_HOSTS) whose name legitimately resolves to
+// a private IP; a test host-map target; or a target that is ALREADY a private/
+// loopback literal (the user/test pointed there directly — not rebinding, and the
+// link-local/metadata literal is still blocked at the artifact path).
+export function lookupForTarget(target, env) {
+    const host = target.hostname.replace(/^\[(.*)\]$/, "$1");
+    if (hostMatchesList(target.hostname, env.DG_PRIVATE_REGISTRY_HOSTS ?? "")) {
+        return undefined;
+    }
+    if (testUpstreamHostMap(env).has(host)) {
+        return undefined;
+    }
+    if (isPrivateNetworkHost(target)) {
+        return undefined;
+    }
+    return guardedLookup;
+}
+// The direct connect paths run the resolve-and-classify rebind guard via
+// lookupForTarget's custom lookup. When an upstream HTTP/HTTPS proxy is used the
+// proxy resolves the target itself, so that guard never runs — pre-resolve here
+// and refuse a public target that resolves into a blocked range, mirroring the
+// same exemptions (private registry / test host-map / already-private literal).
+// Best-effort: a resolution failure surfaces later as the real connect error.
+export async function assertTargetEgressAllowed(target, env) {
+    if (lookupForTarget(target, env) === undefined) {
+        return;
+    }
+    const host = target.hostname.replace(/^\[(.*)\]$/, "$1");
+    const addresses = await new Promise((resolve) => {
+        dnsLookup(host, { all: true }, (err, list) => {
+            resolve(err ? [] : list);
+        });
+    });
+    const blocked = addresses.find((entry) => isBlockedResolvedIp(entry.address));
+    if (blocked) {
+        throw new Error(`refusing to connect to ${host} via the upstream proxy: resolves to blocked address ${blocked.address}. If this is a private/tailnet registry you trust, add its host to DG_PRIVATE_REGISTRY_HOSTS.`);
+    }
+}
+// Non-globally-routable / special-purpose IPv4 ranges. None is ever a legitimate
+// public registry, so a public hostname resolving into one is SSRF, and a direct
+// literal target there is the user's own choice (handled by the callers). Covers
+// RFC1918 + loopback + link-local + CGNAT, plus the special-purpose ranges that
+// are still connectable: 198.18/15 benchmarking, 192.0.0/24 IETF, the TEST-NET
+// documentation blocks, and multicast / reserved 224.0.0.0/3 (224-255).
+function isPrivateIpv4(host) {
+    return (/^(127|10|0)\./.test(host) ||
+        /^192\.168\./.test(host) ||
+        /^169\.254\./.test(host) ||
+        /^172\.(1[6-9]|2[0-9]|3[01])\./.test(host) ||
+        /^100\.(6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])\./.test(host) ||
+        /^198\.1[89]\./.test(host) ||
+        /^192\.0\.0\./.test(host) ||
+        /^192\.0\.2\./.test(host) ||
+        /^198\.51\.100\./.test(host) ||
+        /^203\.0\.113\./.test(host) ||
+        /^(22[4-9]|23[0-9]|24[0-9]|25[0-5])\./.test(host));
+}
+export function isPrivateNetworkHost(url) {
+    const raw = url.hostname.toLowerCase().replace(/^\[/, "").replace(/\]$/, "");
+    const host = recoverIpv4MappedHost(raw);
+    if (host === "localhost" || host.endsWith(".localhost") || host === "0.0.0.0" || host === "::" || host === "::1") {
+        return true;
+    }
+    if (isPrivateIpv4(host)) {
+        return true;
+    }
+    return /^(fe80|f[cd][0-9a-f]{2}|ff[0-9a-f]{2}):/.test(host);
+}
+// Zero-expand a compressed IPv6 literal to its eight bare-hextet form so an
+// exact metadata-address compare matches regardless of "::" placement. Returns
+// the input unchanged for anything that is not a plain IPv6 literal.
+function normalizeIpv6(host) {
+    if (host.includes(".") || !host.includes(":") || !/^[0-9a-f:]+$/i.test(host)) {
+        return host;
+    }
+    const sides = host.split("::");
+    if (sides.length > 2) {
+        return host;
+    }
+    const head = sides[0] ? sides[0].split(":") : [];
+    const tail = sides.length === 2 && sides[1] ? sides[1].split(":") : [];
+    let parts;
+    if (sides.length === 2) {
+        const missing = 8 - head.length - tail.length;
+        if (missing < 0)
+            return host;
+        parts = [...head, ...Array(missing).fill("0"), ...tail];
+    }
+    else {
+        parts = head;
+    }
+    if (parts.length !== 8) {
+        return host;
+    }
+    return parts.map((part) => parseInt(part, 16).toString(16)).join(":");
+}
+// The AWS IPv6 IMDS endpoint is a ULA (fd00::/8), so it is not caught by the
+// fe80 link-local check; match the exact metadata literal only — broadening to
+// all of fd00::/8 would refuse legitimate private/tailnet registries.
+const IPV6_METADATA_HOST = "fd00:ec2:0:0:0:0:0:254";
+export function isLinkLocalHost(url) {
+    const raw = url.hostname.toLowerCase().replace(/^\[/, "").replace(/\]$/, "");
+    const host = recoverIpv4MappedHost(raw);
+    return /^169\.254\./.test(host) || /^fe80:/.test(host) || normalizeIpv6(host) === IPV6_METADATA_HOST;
+}

package/dist/gate/host-match.js

@@ -0,0 +1,48 @@
+export function hostMatchesList(host, rawList) {
+    const normalized = normalizeHost(host);
+    return rawList.split(",").map((entry) => entry.trim()).filter(Boolean).some((pattern) => hostMatchesPattern(normalized, pattern));
+}
+function hostMatchesPattern(host, pattern) {
+    const normalized = normalizeHost(pattern);
+    if (normalized.startsWith("*.")) {
+        const suffix = normalized.slice(1);
+        return host.endsWith(suffix) && host.length > suffix.length;
+    }
+    return host === normalized;
+}
+function normalizeHost(host) {
+    return host.replace(/^\[/, "").replace(/\]$/, "").replace(/\.$/, "").toLowerCase();
+}
+export function testUpstreamHostMap(env) {
+    if (env.NODE_ENV !== "test") {
+        return new Map();
+    }
+    const entries = (env.DG_TEST_UPSTREAM_HOST_MAP ?? "")
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter(Boolean)
+        .map((entry) => {
+        const separator = entry.indexOf("=");
+        if (separator <= 0) {
+            return null;
+        }
+        const target = entry.slice(separator + 1);
+        // The seam only exists to point a public host at a LOOPBACK mock in tests.
+        // Refusing any non-loopback target stops an attacker who can set
+        // NODE_ENV=test from redirecting a registry fetch to an external/internal
+        // host (SSRF) and from disabling the egress DNS guard for it.
+        if (!isLoopbackHost(target)) {
+            return null;
+        }
+        return [entry.slice(0, separator), target];
+    })
+        .filter((entry) => entry !== null);
+    return new Map(entries);
+}
+export function isLoopbackHost(value) {
+    const host = normalizeHost(value);
+    // Only the 127.0.0.0/8 IPv4 literal range is loopback — anchor to a full dotted
+    // quad so a hostname like 127.evil.com (which resolves anywhere) is NOT treated
+    // as loopback and cannot slip past the SSRF confinement.
+    return host === "localhost" || host === "::1" || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}(?::\d+)?$/.test(host);
+}

package/dist/gate/verdict-core.js

@@ -0,0 +1,101 @@
+import { sanitize } from "../security/sanitize.js";
+import { artifactDisplayName, safeDecodeUriComponent } from "../proxy/metadata-map.js";
+export function normalizeVerdict(value, target, identity, streamedSha256) {
+    if (!isRecord(value)) {
+        throw new Error("Dependency Guardian API returned a malformed verdict");
+    }
+    const verdict = value.verdict;
+    if (verdict !== "pass" && verdict !== "warn" && verdict !== "block") {
+        throw new Error("Dependency Guardian API returned a malformed verdict");
+    }
+    const scannedSha256 = typeof value.scannedSha256 === "string" ? value.scannedSha256.toLowerCase() : "";
+    if (scannedSha256.length > 0 && scannedSha256 !== streamedSha256) {
+        return {
+            verdict: "block",
+            packageName: artifactDisplayName(identity),
+            cause: "hash-mismatch",
+            reason: `server scanned SHA-256 ${scannedSha256} did not match streamed artifact SHA-256 ${streamedSha256}`
+        };
+    }
+    const cause = typeof value.cause === "string" ? value.cause : undefined;
+    const cooldown = parseCooldownInfo(value.cooldown);
+    const provenance = parseProvenance(value.provenance);
+    const dashboardUrl = safeDashboardUrl(value.dashboardUrl);
+    return {
+        verdict,
+        packageName: typeof value.packageName === "string" ? sanitize(value.packageName) : artifactDisplayName(identity) || packageNameFromUrl(target),
+        ...(isProxyCause(cause) ? { cause } : {}),
+        reason: typeof value.reason === "string" ? sanitize(value.reason) : `API verdict ${verdict}`,
+        ...(dashboardUrl ? { dashboardUrl } : {}),
+        ...(value.unauthenticated === true ? { unauthenticated: true } : {}),
+        ...(cooldown ? { cooldown } : {}),
+        ...(provenance ? { provenance } : {})
+    };
+}
+export function safeDashboardUrl(value) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    try {
+        const url = new URL(sanitize(value));
+        return url.protocol === "https:" ? url.toString() : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function parseCooldownInfo(value) {
+    if (!isRecord(value) || typeof value.requiredDays !== "number" || !Number.isFinite(value.requiredDays)) {
+        return undefined;
+    }
+    return {
+        requiredDays: value.requiredDays,
+        ...(typeof value.ageDays === "number" && Number.isFinite(value.ageDays) ? { ageDays: value.ageDays } : {}),
+        ...(typeof value.publishedAt === "string" ? { publishedAt: sanitize(value.publishedAt) } : {}),
+        ...(typeof value.eligibleAt === "string" ? { eligibleAt: sanitize(value.eligibleAt) } : {})
+    };
+}
+function parseProvenance(value) {
+    if (!isRecord(value)) {
+        return undefined;
+    }
+    const status = value.status;
+    if (status !== "attested" && status !== "none" && status !== "unknown") {
+        return undefined;
+    }
+    const downgrade = isRecord(value.downgrade) && typeof value.downgrade.fromVersion === "string"
+        ? { fromVersion: sanitize(value.downgrade.fromVersion) }
+        : undefined;
+    return {
+        status,
+        ...(typeof value.predicateType === "string" ? { predicateType: sanitize(value.predicateType) } : {}),
+        ...(downgrade ? { downgrade } : {})
+    };
+}
+export function packageNameFromUrl(url) {
+    const name = url.pathname.split("/").filter(Boolean).pop();
+    return name ? safeDecodeUriComponent(name) : url.hostname;
+}
+export function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+export function isProxyCause(value) {
+    return [
+        "pass",
+        "warn",
+        "malware",
+        "policy",
+        "license",
+        "hash-mismatch",
+        "private-upload-disabled",
+        "needs-login",
+        "api-unavailable",
+        "quota-exceeded",
+        "api-timeout",
+        "registry-timeout",
+        "analysis-incomplete",
+        "cooldown",
+        "unsupported-manager",
+        "proxy-setup-failure"
+    ].includes(value ?? "");
+}

package/dist/gate/verdict-fetch.js

@@ -0,0 +1,214 @@
+import { isRecord, normalizeVerdict } from "./verdict-core.js";
+import { resolveCooldownRequest } from "./cooldown-request.js";
+import { hostMatchesList } from "./host-match.js";
+import { artifactDisplayName, artifactUrlHash } from "../proxy/metadata-map.js";
+import { loadPreverifiedMap, preverifiedKey } from "../proxy/preverified.js";
+import { sanitize } from "../security/sanitize.js";
+import { identityHeaders } from "../api/analyze.js";
+import { dgVersion } from "../commands/version.js";
+import { redactSecrets } from "../launcher/output-redaction.js";
+import { envAuthToken } from "../auth/env-token.js";
+export async function lookupVerdict(options, target, sha256, upstream, identity) {
+    if (shouldUseScanTarball(options, target, identity)) {
+        return lookupScanTarballVerdict(options, target, sha256, upstream, identity);
+    }
+    const preverified = preverifiedVerdict(options, target, sha256, identity);
+    if (preverified) {
+        return preverified;
+    }
+    const cooldown = resolveCooldownRequest(options, identity);
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), options.verdictTimeoutMs ?? installVerdictTimeoutMs(options.env));
+    try {
+        const response = await fetch(`${options.apiBaseUrl}/v1/install-verdict`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "X-Dg-Version": dgVersion(),
+                ...identityHeaders(options.env)
+            },
+            body: JSON.stringify({
+                manager: options.classification.manager,
+                action: options.classification.action,
+                url: redactSecrets(target.toString()),
+                artifactUrlHash: artifactUrlHash(target),
+                ecosystem: identity.ecosystem,
+                name: identity.name,
+                version: identity.version,
+                registryHost: identity.registryHost,
+                sourceKind: identity.sourceKind,
+                sha256,
+                statusCode: upstream.statusCode,
+                contentType: headerValue(upstream.headers["content-type"]),
+                ...(cooldown ? { cooldown } : {})
+            }),
+            signal: controller.signal
+        });
+        if (response.status === 402 || response.status === 429) {
+            const body = (await response.json().catch(() => ({})));
+            return {
+                verdict: "block",
+                packageName: artifactDisplayName(identity),
+                cause: "quota-exceeded",
+                reason: "You've reached your monthly scan limit. Upgrade at westbayberry.com/pricing or wait for it to reset.",
+                ...(typeof body.resetsAt === "string" ? { resetsAt: sanitize(body.resetsAt) } : {}),
+                quotaBehavior: body.quotaBehavior === "pass" ? "pass" : "block"
+            };
+        }
+        if (response.status === 401) {
+            return {
+                verdict: "block",
+                packageName: artifactDisplayName(identity),
+                cause: "needs-login",
+                unauthenticated: true,
+                reason: "Checking a package from the registry before it installs requires sign-in."
+            };
+        }
+        if (!response.ok) {
+            return {
+                verdict: "block",
+                packageName: artifactDisplayName(identity),
+                cause: "api-unavailable",
+                reason: `Dependency Guardian API returned ${response.status}. Run 'dg doctor' and 'dg login' to verify API access.`
+            };
+        }
+        return normalizeVerdict(await response.json(), target, identity, sha256);
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+async function lookupScanTarballVerdict(options, target, sha256, upstream, identity) {
+    const body = upstream.body ?? Buffer.alloc(0);
+    const uploadPolicy = scanTarballUploadPolicy(options.env);
+    if (!uploadPolicy.enabled) {
+        return {
+            verdict: "block",
+            packageName: artifactDisplayName(identity),
+            cause: "private-upload-disabled",
+            reason: `private artifact scan upload is disabled for ${target.hostname}`
+        };
+    }
+    if (!uploadPolicy.token) {
+        return {
+            verdict: "block",
+            packageName: artifactDisplayName(identity),
+            cause: "private-upload-disabled",
+            reason: "private artifact scan upload requires DG_API_TOKEN"
+        };
+    }
+    if (body.length > uploadPolicy.maxBytes) {
+        return {
+            verdict: "block",
+            packageName: artifactDisplayName(identity),
+            cause: "private-upload-disabled",
+            reason: `private artifact is ${body.length} bytes, above the ${uploadPolicy.maxBytes} byte scan-tarball upload limit`
+        };
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), uploadPolicy.timeoutMs);
+    try {
+        const response = await fetch(`${options.apiBaseUrl}/v1/scan-tarball`, {
+            method: "POST",
+            headers: {
+                "Authorization": `Bearer ${uploadPolicy.token}`,
+                "Content-Type": "application/octet-stream",
+                "X-DG-Action": options.classification.action,
+                "X-DG-Artifact-SHA256": sha256,
+                "X-DG-Artifact-URL-Hash": artifactUrlHash(target),
+                "X-DG-Cache-Key": `sha256:${sha256}`,
+                "X-DG-Ecosystem": identity.ecosystem,
+                "X-DG-Manager": options.classification.manager,
+                "X-DG-Package-Name": identity.name,
+                "X-DG-Package-Version": identity.version,
+                "X-DG-Privacy": "private-artifact",
+                "X-DG-Registry-Host": identity.registryHost,
+                "X-DG-Source-Kind": identity.sourceKind
+            },
+            body,
+            signal: controller.signal
+        });
+        if (!response.ok) {
+            throw new Error(`Dependency Guardian scan-tarball API returned ${response.status}`);
+        }
+        return normalizeScanTarballVerdict(await response.json(), target, identity, sha256);
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+// A preflight batch-analyze already verdicted this exact name@version (and the
+// user accepted any warns), so a per-artifact API round-trip would re-answer
+// the same question. Trust it only when the identity came from registry
+// metadata and the preflight applied the same cooldown gate the proxy would;
+// the synthesized verdict goes through normalizeVerdict so the scanned-SHA
+// cross-check blocks tampered bytes exactly like a server response would.
+function preverifiedVerdict(options, target, streamedSha256, identity) {
+    if (identity.sourceKind !== "registry-metadata") {
+        return null;
+    }
+    const entry = loadPreverifiedMap(options.session.dir).get(preverifiedKey(identity.ecosystem, identity.name, identity.version));
+    if (!entry) {
+        return null;
+    }
+    if (!entry.cooldownEvaluated && resolveCooldownRequest(options, identity) !== undefined) {
+        return null;
+    }
+    if (!entry.scannedSha256) {
+        // No byte-level fingerprint to cross-check against the streamed artifact, so
+        // a preverified pass/warn can't prove the downloaded bytes match what was
+        // screened (a metadata-only preflight, or a registry swap between preflight
+        // and fetch). Fall through to a real scan of the streamed bytes — TOCTOU
+        // defense — rather than honoring the verdict for whatever now arrives.
+        return null;
+    }
+    return normalizeVerdict({
+        verdict: entry.action,
+        cause: entry.action,
+        packageName: `${identity.name}@${identity.version}`,
+        reason: entry.reason ?? (entry.action === "pass" ? "verified before install" : "flagged for review"),
+        ...(entry.scannedSha256 ? { scannedSha256: entry.scannedSha256 } : {})
+    }, target, identity, streamedSha256);
+}
+function normalizeScanTarballVerdict(value, target, identity, streamedSha256) {
+    if (!isRecord(value) || typeof value.scannedSha256 !== "string" || value.scannedSha256.length === 0) {
+        throw new Error("Dependency Guardian scan-tarball API did not return scannedSha256");
+    }
+    return normalizeVerdict(value, target, identity, streamedSha256);
+}
+function shouldUseScanTarball(options, target, identity) {
+    if (identity.sourceKind !== "url-fallback") {
+        return false;
+    }
+    return hostMatchesList(target.hostname, options.env.DG_PRIVATE_REGISTRY_HOSTS ?? "");
+}
+function scanTarballUploadPolicy(env) {
+    return {
+        enabled: env.DG_SCAN_TARBALL_UPLOAD === "1" || env.DG_SCAN_TARBALL_UPLOAD === "true",
+        maxBytes: parsePositiveInteger(env.DG_SCAN_TARBALL_MAX_BYTES, 50 * 1024 * 1024),
+        timeoutMs: parsePositiveInteger(env.DG_SCAN_TARBALL_TIMEOUT_MS, 5_000),
+        token: envAuthToken(env) ?? ""
+    };
+}
+function installVerdictTimeoutMs(env) {
+    return parsePositiveInteger(env.DG_INSTALL_VERDICT_TIMEOUT_MS, 240_000);
+}
+function parsePositiveInteger(value, fallback) {
+    if (!value) {
+        return fallback;
+    }
+    const parsed = Number.parseInt(value, 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+function headerValue(value) {
+    if (Array.isArray(value)) {
+        return value.join(",");
+    }
+    if (typeof value === "number") {
+        return String(value);
+    }
+    if (typeof value === "string") {
+        return value;
+    }
+    return "";
+}