Documentation

The shared edge gate against a configured inbound token: with none configured the edge is open; with one configured the request's forwarded bearer must match it exactly. Deny-by-default: a missing or mismatched bearer is rejected. The match is constant-time: Secret equality compares over the full UTF-8 bytes without a content-dependent early out, so this gate does not leak the configured token's prefix length through timing.

The packument, tarball, and publish paths all apply the same gate, so it is factored here rather than duplicated per route. It takes the already-extracted bearer (forwardedToken) rather than the request, so a handler that also forwards the credential upstream scans the headers for it once and reuses the one extraction for both.

The HTTP status a brief-wait admission shed renders across the read and publish paths: 503 Service Unavailable, the server-capacity signal (not a 429 rate limit). Shared so every shed site renders the identical status rather than re-spelling the reason phrase.

The Retry-After header a shed 503 carries, in whole seconds equal to the admission wait budget (admissionWaitMicros, divided by the microseconds in a second): a shed client is never told to come back sooner than the interval a queued request waits in-process, and the two cannot drift because the hint is derived from the budget.