The trust provenance of an upstream's contribution to the merge. The split is decided by the caller -- by which upstream a document came from -- and applied before merging, never derived here.

The constructors are named *Source rather than the bare Trusted/Gated because Ecluse.Core.Package already exports a Trust constructor named Trusted; a bare name would collide for the many callers that import Ecluse.Core.Package openly.

The Ord instance is the trust order itself -- TrustedSource compares __less than__ GatedSource so that "smallest wins" gives trusted precedence; the merge's resolution leans on this directly (see mergePackuments).

A stable identifier for one input to a single mergePackuments call: the 0-based index of that (Provenance, PackageInfo) in the input list.

The serve layer needs to take a surviving version's object from the raw Value of whichever source won it, so the plan must name that source. Provenance alone is not enough: it identifies a source only while there is exactly one input per provenance (the npm topology today -- one trusted, one gated). The input index stays unambiguous even when several inputs share a provenance (e.g. an aggregating private upstream plus a first-party source, both TrustedSource), which keeps the plan correct for the multi-source case without a new type. The caller pairs each SourceId back to the raw Value it passed at that position.

The outcome of reasoning over a set of upstream packuments: a plan the serve layer replays onto the raw upstream Values to assemble the lossless served body. It carries exactly the decisions the merge owns -- never a finished, re-serialisable document (see this module's header, "Decision surface, not served surface").

A detected integrity conflict: a version key present in more than one source whose copies contradict on a shared algorithm -- an algorithm both expose carries disagreeing digests. The trusted copy wins the merge; this record preserves both fingerprints so the caller can log, meter, and decide policy (serve-with-private-winning vs fail-closed). It is the merge's supply-chain signal -- surfaced, never silently reconciled.

Ord is derived purely to let MergePlan carry divergences as a Set: the ordering is structural (over the version key and the two fingerprints) and has no meaning beyond deduplication and a stable presentation.

An order-independent fingerprint of a version's artifact integrity: the sorted multiset of (artifact filename, resolved algorithm, comparable digest body) triples across all of the version's artifacts. Each digest is keyed first by the artifact it fingerprints (its filename, the stable identity a registry serves a file under), then by the algorithm it asserts (assertedAlg -- a hex Hash's tag, or the algorithm an SRI string embeds), not by its raw HashAlg wrapper tag, so an sha256-… SRI and a hex SHA-256 digest bucket together under SHA256 while an sha256-… and an sha512-… SRI bucket apart. A digest that asserts no algorithm (a bare or malformed SRI) keys under Nothing -- its own bucket -- so an unknown digest never merges with a real algorithm (the fail-closed reading). The body is the comparable digest: an SRI's base64 body (without its <alg>- prefix) or a hex digest's raw value, which is uniform within any shared resolved algorithm, so comparing bodies is sound. The comparison ignores artifact ordering and the non-identity fields (URL, size) that legitimately vary between mirrors of the same bytes.

Two copies diverge when they __contradict on a shared artifact under a shared resolved algorithm__: a file both serve, under an algorithm both assert for it, carries disagreeing bodies. An asymmetric pair does not diverge on that account -- one copy asserting an algorithm the other omits (including a mirror that recomputed integrity under a different algorithm), or one copy serving a file the other does not carry (a multi-artifact ecosystem's private mirror holding fewer wheels than the public index, or a file renamed between mirrors). Only a shared file's shared algorithm disagreeing is the tampering signal; a differing file set describes availability, not substituted bytes. So a mirror serving a modern digest alongside a legacy one agrees with a mirror serving only the modern digest, as long as that shared digest matches -- and a mirror carrying a subset of a version's files agrees with the full index on exactly the files it carries.

Opaque so the comparison used for divergence detection cannot be sidestepped; read the triples back with integrityHashes when logging or metering a Divergence. Ord is derived (structurally, over the sorted triples) only so a Divergence may live in a Set; it carries no domain meaning beyond that, and in particular is not the divergence test (which is the shared-key contradiction above, never structural inequality of the whole set).

The (artifact filename, resolved algorithm, comparable digest body) triples of a fingerprint, sorted, for an audit trail. The algorithm is the one each digest asserts (Nothing when it asserts none); the body is its comparable form (an SRI's base64 body, a hex digest's raw value).

Reason over several upstream packuments, by Provenance, and emit the MergePlan the serve layer replays onto the raw Values. Pure and total.

The merge is a fold with the degenerate identity at one input: a single packument yields a plan whose survivors are all of its versions (all won by source 0), with its tags and times reconciled and no divergences, so 0/1-upstream deployments need no special case. It is realised as a foldMap of each input's contribute into the lawful Merge Monoid, projected by planFrom. The model:

• Union by version key, with TrustedSource winning a collision over GatedSource (the private upstream is the authority). The winning input's SourceId is recorded for the survivor. A collision whose copies contradict on a shared integrity algorithm is recorded as a Divergence; the winner is still kept.
• 'dist-tags' reconciled over the union. latest is resolved by selectLatest -- keep-unless-denied, stable-preferring, and unparseable-safe -- from the precedence-winning source's tagged latest and the surviving versions; any other tag pointing at a version absent from the union is dropped. Collisions on the same tag are resolved by provenance (trusted wins), consistent with the version fold, so the plan does not depend on caller input order.
• time reconstructed from the survivors: each survivor's publish instant is read off the same winning candidate whose manifest is served, so a version's served time always comes from the source that won its manifest, never fabricated from a different source. A winner with no known publish time contributes no entry.

The plan's identity (mpName) is carried from the contributions; callers fetch one package across its upstreams and each contribution's name has been validated against the requested one before reaching here, so all inputs share that one identity and it is never a substituted value. An empty input list yields Nothing -- there is nothing to serve.

The operator's policy for a served version a cross-upstream integrity Divergence was detected on. The signal itself -- the WARNING log line and the ecluse.registry.merge.divergence counter -- fires under both policies; the policy decides only whether the contested version is additionally withheld from the served listing.

The merge never consults this: mergePackuments always records the divergence and lets the trusted copy win, and applyDivergencePolicy is a separate projection the serve layer runs over the finished plan. That keeps the merge a pure, policy-free function and leaves the availability-vs-strictness trade with the operator (ECLUSE_INTEGRITY__DIVERGENCE_POLICY).

Parse an operator-supplied divergence policy (the ECLUSE_INTEGRITY__DIVERGENCE_POLICY value): warn or fail-closed, case-insensitively and tolerant of fail_closed/failclosed spellings. Any other value is a Left naming the offending input.

Apply a DivergencePolicy to a finished MergePlan -- a projection the serve layer runs after it has logged and metered the plan's divergences. Warn is the identity. FailClosed drops every version key a Divergence was detected on from the served surface, coherently: removed from mpSurvivors and mpTime, and any mpDistTags target (including latest) that resolved to a dropped version removed too, so the projected plan still assembles a self-consistent document. mpDivergences is left intact -- it is the audit record, already actioned by the caller's log and metric. Dropping every surviving version leaves an empty mpSurvivors; the caller takes the same no-survivors terminal mergePackuments already guards for.

The monoidal accumulator the merge folds into. It holds, unresolved, every candidate offered for every version key, plus the ranked dist-tags contributions; resolution to a single winner per key, and the divergence set, happens once in planFrom. The served time map needs no axis here: each version's publish instant rides inside its Candidate (on candDetails), so planFrom reads it off the same winner the manifest is taken from. Keeping candidates unresolved is what makes (<>) associative: a pairwise winner-vs-loser decision taken during the fold is not associative once three or more copies of a key collide, because divergence is a property of the whole set of distinct fingerprints, not of any one step.

Each accumulator also carries the count of inputs it represents, so that (<>) can __re-index the right operand's SourceIds by the left operand's input count__. This positional re-indexing is what makes a SourceId name an input's list position after a foldMap of single-input contributions -- and it is the sole reason the instance is non-commutative (see the Semigroup instance).

One input's contribution to the accumulator, at local SourceId 0: every version becomes a candidate (carrying its own publish time on candDetails), every dist-tags target a ranked value at this input's provenance, and the package name is offered as the identity. foldMap contribute over the inputs then re-indexes each to its list position via the Semigroup offset, so the absolute SourceId of a single-input contribution is its index in the foldMap.

Project the resolved MergePlan from a folded Merge. Resolves each version key to its precedence winner, derives the divergence Set from the shared-algorithm contradictions among each key's distinct fingerprints, reconciles dist-tags over the survivors, and reconstructs the served time map from each survivor's winning candidate. Returns Nothing only for the empty merge (mempty), which has no name and so nothing to serve; equivalently, the empty input list.