Fields

• srAdmission :: ServeAdmission

  The process-wide brief-wait bound around metadata materialisation (Ecluse.Core.Server.Admission). A private tarball hit and the artifact streaming pump stay outside it; packument work and a tarball miss's public metadata gate acquire a slot, waiting briefly for one under load.

• srPublicManager :: Manager

  The validating-TLS data-plane manager for the untrusted public-upstream metadata fetch and every artifact stream.

• srPrivateManager :: Manager

  The manager for the trusted private upstream. The same validating TLS manager; the private origin differs in credential handling, not in the manager.

• srMetadataCache :: MetadataCache

  The short-TTL, size-bounded metadata cache shared by the serve paths (see Ecluse.Core.Server.Cache).

• srQueue :: MirrorQueue

  The mirror-queue handle: the durable, best-effort hand-off from the serve path to the mirror worker.

• srMetrics :: MetricsPort

  The metric-recording port the serve path emits the ecluse.* catalogue through.

• srTracing :: TracingPort

  The tracing port the serve path opens its hand-added domain spans through.

Fields

• pdPrivateBaseUrl :: Maybe Text

  The private upstream base URL; under passthrough, reads forward the client's credential. Nothing when the mount has no private upstream (a serve-only pure public gate): the private leg is structurally absent, never fetched, and a tarball request is a clean private miss straight to the public leg.

• pdPublicBaseUrl :: Text

  The public upstream base URL; reads are anonymous (no client credential).

• pdMountBaseUrl :: Text

  The mount's externally-visible base URL, under which served dist.tarball URLs are rewritten so artifacts are fetched back through the gate.

• pdMirror :: MirrorServePlan

  Whether an admitted public artifact is enqueued for the demand-driven mirror, and the declared destination when it is (MirrorOnAdmit); a serve-only mount carries NoMirrorWrite and never enqueues.

• pdRules :: [PreparedRule]

  The mount's resolved rule set as the engine's prepared runtime rules (Ecluse.Core.Rules.PreparedRule), evaluated against every public version. The built-in rules run directly; an effectful rule carries a resilience policy. The composition root prepares it (and logs its boot order) once.

• pdAdditionalBlockedRanges :: [IPRange]

  The operator-configured ranges (ECLUSE_EGRESS__ADDITIONAL_BLOCKED_RANGES) extending the fixed literal internal-range block when gating an honoured artifact location (tarballHostAllowed), the cheap pure defence-in-depth that complements the host allowlist. Empty by default.

• pdTarballHostGate :: TarballHostGate

  The mount-constant inputs to the per-request tarball-host gate (TarballHostGate): the canonicalised host:port allowlist and the private and public upstream authorities, extracted once at the composition root from the base URLs above. The hot artifact path reads these fields rather than rebuilding the allowlist set and re-parsing the base URLs on every request (only the dynamic public dist.tarball authority is parsed per request).

  Invariant: this is a cached projection of pdPrivateBaseUrl, pdPublicBaseUrl, and pdMirror; whoever changes one of those after construction must re-derive it via tarballHostGate or the gate goes stale. The composition root builds the deps once, so production never does; a test that record-updates a URL field must rebuild the gate (the serve-path test harness does this centrally).

• pdLimits :: Limits

  The response-bound budget enforced on every upstream metadata fetch and decode (ECLUSE_LIMITS__MAX_RESPONSE_BYTES/ECLUSE_LIMITS__MAX_VERSION_COUNT/ECLUSE_LIMITS__MAX_NESTING_DEPTH): the body-size, version-count, and JSON-nesting ceilings of Limits. The data plane reads the metadata body through boundedRead against maxBodyBytes, checks checkNestingDepth at the JSON-decode boundary, and checkVersionCount after projection; a breach degrades the contribution to nothing (the fail-closed parse-failure path), so a pathological upstream document is refused, never partially served (security.md invariant 4).

• pdInboundToken :: Maybe Secret

  The optional inbound token a client must present (ECLUSE_SERVER__AUTH_TOKEN); Nothing leaves the edge open (the network layer guards it).

• pdNow :: IO UTCTime

  The wall-clock "now" for the rules' EvalContext. Injected so the time-sensitive age gate is deterministic under test.

• pdAdvisoryEtag :: IO (Maybe DbEtag)

  A non-pinning read of the active advisory database's DbEtag for the per-request EvalContext (the same value rdCurrentAdvisoryEtag provides, bridged onto these deps because the serve gate is where the context is built). Nothing when no database is loaded.

• pdHelp :: Maybe HelpMessage

  The operator help message appended to every denial body, if configured.

• pdMinIntegrity :: MinIntegrity

  The minimum integrity algorithm a public (untrusted) version's digest must meet to be admitted (the global ECLUSE_INTEGRITY__MIN_PUBLIC floor, default SHA-256). The public gate refuses a version whose strongest digest is below this; it is hard-floored at SHA-256 and never lowerable (see Ecluse.Core.Package.Integrity). The trusted private path consults pdMinTrustedIntegrity instead.

• pdMinTrustedIntegrity :: MinTrustedIntegrity

  The minimum integrity hash required for a trusted upstream dependency.

• pdDivergencePolicy :: DivergencePolicy

  What to do with a served version a cross-upstream integrity divergence was detected on (ECLUSE_INTEGRITY__DIVERGENCE_POLICY, default Warn). The signal (the WARNING log and the ecluse.registry.merge.divergence counter) fires regardless; this only decides whether the contested version is additionally withheld from the served listing (FailClosed).

• pdNewMetadataClient :: TracingPort -> MetricsPort -> Upstream -> ManifestCaching -> (PackageName -> MetadataError -> IO ()) -> (PackageName -> [InvalidEntry] -> IO ()) -> (PackageName -> IO ()) -> Limits -> Manager -> Text -> Maybe Secret -> MetadataClient

  Build a per-request metadata client for one origin, given the per-fetch parameters. The composition root closes over the ecosystem's raw fetch primitives; the pipeline supplies only the per-request runtime parameters.

• pdBuildArtifactRequestByFile :: Limits -> Manager -> Text -> Maybe Secret -> PackageName -> Text -> Either UrlFormationError Request

  Build an artifact request by conventional filename path for the private (trusted) leg.

• pdBuildArtifactRequestByUrl :: Limits -> Manager -> Text -> Maybe Secret -> Text -> Either UrlFormationError Request

  Build an artifact request by authoritative URL for the public leg.

• pdAssemble :: Text -> Map SourceId CachedDoc -> MergePlan -> Maybe CachedDoc -> CachedDoc

  Assemble the served document (CachedDoc) from a merge plan and the raw source documents: rebuild the plan-owned keys onto the precedence-winning base document (Nothing when there is none) from the winning sources, rewriting each surviving version's artifact URL under the given mount base in the same pass. The adapter reads the documents; the pipeline threads them opaquely.

• pdSerialise :: CachedDoc -> LByteString

  Encode an assembled served document (CachedDoc) to its wire bytes, through the adapter's own representation, so the serve tail materialises the served body without reading the document.

• pdEgressUrl :: Text -> Either Text RegistryUrl

  Form the validated egress witness for an artifact URL about to leave the process on a MirrorJob. The composition root wires the https-only mkRegistryUrl; the loopback test harness substitutes its flag-gated dev former. On the production path every public artifact URL was already normalised to https at projection, so a Left here is unreachable -- it fails the best-effort enqueue closed rather than letting an unwitnessed URL travel to the worker.

Fields

• pubTargetUrl :: Text

  The publication target endpoint (ECLUSE_PUBLICATION_TARGET) a client npm publish is relayed to. The package path is appended to it.

• pubScopes :: [Scope]

  The configured publish allow-list (ECLUSE_MOUNTS{ECOSYSTEM}PUBLISH_ALLOW; for npm, a list of scopes) -- the anti-shadowing guard. A publish whose package name is not within one of these scopes is refused before any upstream write, so a client cannot publish a name that shadows an existing public package (a dependency-confusion vector). Never empty when a publication target is configured (config validation rejects that).

• pubStaticToken :: Maybe Secret

  The static fallback credential (ECLUSE_PUBLICATION_TARGET_TOKEN) forwarded to the publication target only when the client sends no token of its own. The default model is passthrough -- the publisher's own token -- so this is Nothing on the common path.

• pubInboundToken :: Maybe Secret

  The optional inbound edge token a client must present (ECLUSE_SERVER__AUTH_TOKEN), the same gate the read paths apply; Nothing leaves the edge open.

• pubLimits :: Limits

  The response-bound budget enforced on the publication target's response, carried for symmetry with the read paths.

• pubBodyBudget :: ByteAdmission

  The process-wide aggregate byte-admission buffered publish bodies are reserved against before the body is read, shared by every mount; sized from the memory plan's publish tenant. Exhaustion sheds (503), exactly as the unit-slot admission does on the read path.

• pubMaxRequestBytes :: Int

  The per-request publish-body cap, in bytes, enforced by the publish route at the read site: a declared Content-Length over it fails closed before any byte is read, and a chunked body is bounded by a counted read against it. It is also the pessimistic weight a chunked body (no declared length) reserves against the aggregate body-byte budget.

• pubHelp :: Maybe HelpMessage

  The operator help message appended to a publish denial, if configured.

• pubRelayPublish :: Limits -> Manager -> Text -> Maybe Secret -> PackageName -> ByteString -> IO (Either PublishRelayFault PublishRelayResponse)

  Relay a publish document to the publication target, returning its response.

• pubCanonicaliseName :: Text -> Maybe PackageName

  Canonicalise a raw package-name string to a PackageName, or Nothing if it cannot be parsed. Used by the body-name agreement guard.

• pubDeclaredNames :: LByteString -> [Text]

  Extract every package name a publish body declares as its own identity, the ecosystem's own reading of its publish-document schema (publishDeclaredNames). The body-name agreement guard canonicalises each and refuses any that disagrees with the URL-path name, so the pipeline compares names without knowing the wire schema. A body that declares no readable name yields [].

Fields

• bindingPrefix :: NonEmpty Text

  The leading path segments this mount is served under; never empty.

• bindingRouter :: MountRouter

  The ecosystem's whole routing decision: what this mount's native path names, and what serving it amounts to (an RouteAction). The adapter derives it from its own route table, so the web layer holds no ecosystem's path grammar of its own.

• bindingPackumentDeps :: PackumentDeps

  The packument-serve dependencies. Not optional: a mount exists only for an ecosystem with a registered adapter, and the composition root builds these from that adapter, so a bound mount always serves packuments and artifacts. Only publish is a genuine opt-in (bindingPublishDeps).

• bindingPublishDeps :: Maybe PublishDeps

  The first-party publish dependencies, when a publication target is configured; Nothing is the opt-out -- a PUT /{pkg} is then 405 (no implicit write path).

Fields

• ctxRuntime :: ServeRuntime

  The request runtime -- the data-plane managers, the caches and queue, the recording ports.

• ctxMount :: MountBinding

  The mount the request matched, carrying its complete ecosystem wiring.