CHW-2308 ArtifactURLUndeclared

Default message: download refused: this path’s encoded upstream URL is not one the package’s metadata declares for that version, so the proxy will not fetch it; re-resolve the dependency (composer update / pod install / dart pub get) so the URL comes from current metadata
HTTP status: 403 (client)
Reason: ARTIFACT_URL_UNDECLARED

Problem. A composer, CocoaPods or pub download returned 403. Cause. These formats’ metadata is rewritten so each download URL becomes a proxy path carrying the original URL as a base64 token (dists/<vendor>/<name>/<version>/encoded/<token>/…, pods/<name>/<version>/source/<token>, pub/<name>/<version>/archive/<token>). The proxy judges the package named in the path and fetches the URL in the token, so before fetching it reads that package’s metadata (p2 document, CDN podspec, or api/packages/<name>) the way it serves it to clients and requires the requested path to be one of the download URLs listed there. This one was not: the token was built by hand, or the URL came from a lock file written against metadata that has since changed — a Composer dev branch that moved on, or a version the registry no longer lists. (A composer version the proxy withholds from its metadata because it is vulnerable is checked against the registry’s own document instead, and then judged by policy like any download.) Fix. Re-resolve the dependency (composer update <pkg>, pod update <pod>, dart pub upgrade <pkg>) so the URL comes from current metadata. If a genuine client keeps hitting this, an operator can set CHAINSAW_DIST_URL_BINDING=log to log the refusals and serve while it is investigated. HTTP 403.