npm's route table: the list of routes an npm mount serves.

Each entry is one Route record, carrying its method condition, its path template, what to do when it matches, its prose, and the ResponseContract that admits every response it can emit. npmRouter folds the list into the mount's router (first match wins; no match is the deny-by-default 404) and npmRouteSpecs projects the same list for the capability manifest, so the routed surface, the emitted responses, and the documented ones are all readings of one declaration.

Each response body is a codec (npmErrorCodec for a denial) or a named hand-authored schema (the merged packument, the publish document), so the wire body and the documented schema are one source. The package, artifact, and publish routes name the shared data-plane handlers (Ecluse.Core.Server.Pipeline); the meta-routes answer locally through their declared outcome.

A PUT /{pkg} is the npm publish request, so the method is part of the match: a PUT over a bare-package path publishes, while a read (GET, or its bodiless HEAD) over the same path fetches the packument. Those three methods are the only ones the front door answers; any other (POST, DELETE, …) matches no route and denies.

The model is deny by default. Three npm-specific facts shape the matching, all from the protocol research (see docs/research/reverse-engineering/npm.md §2 and §7):

• Reserved meta-routes (/-/…) are matched first. A real package name can never begin with '-', so a leading "-" segment is unambiguously a meta-route.
• Scoped names arrive in two encodings. The path is percent-decoded before it reaches us, so a scoped name arrives either as one decoded segment (@scope/pkg) or as two (@scope, pkg). Both are normalised to the same PackageName here.
• A tarball path is /{pkg}/-/{file}.tgz. tarballCoordinate is the npm-side parse of the artifact coordinate; a basename that does not match the package is a path-confusion attempt and denies.

Mount dispatch, prefix-stripping, and the liveness/readiness routes are handled in the agnostic web layer (see docs/architecture/web-layer.md); this table only ever sees the npm-native request.