An npm scope, stored without its leading '@' (the scope of @myorg/pkg is "myorg"). mkScope normalises away a leading '@', so equality does not depend on how the scope was written.

Build a Scope, tolerating an optional leading '@'.

The bare scope text, without the leading '@'.

Render a scope in npm wire form, with the leading '@'.

A package identity, decoupled from any registry's wire format and built with mkPackageName. Equality and ordering read (pkgEcosystem, pkgNamespace, pkgCanonical) only, so Flask and flask are one PyPI package and two npm ones.

Build a PackageName, normalising the canonical key for the ecosystem: PEP 503 for PyPI, verbatim for npm and RubyGems.

The ecosystem this name belongs to.

The scope, if scoped (npm @scope/name). Nothing for PyPI/RubyGems.

The normalised matching key: PEP 503 for PyPI, verbatim for npm and RubyGems.

The base name with any @scope/ prefix dropped. It is not part of identity. Read it back through unscopedName.

Render a package name in its native wire form (the display name).

The unscoped (base) name as Text: @babel/code-frame reads back as code-frame.

Whether one component of a package name is ASCII with no control character: the boundary every ecosystem's grammar rests on, because an invisible codepoint renders two names as one.

Normalise a display name into its canonical matching key for an ecosystem. An ecosystem with a normalisation grammar keeps it in its own module.

Whether installing a version executes code (the cross-ecosystem unification of npm install scripts, PyPI sdist builds, and RubyGems native extensions).

Whether a version is offered, advisory-deprecated, or withdrawn.

One distribution file for a version. A version owns a NonEmpty list of these: npm has exactly one, PyPI has an sdist plus many wheels, RubyGems has one per platform.

An artifact digest validated by mkHash. Record updates must preserve its encoding and length.

The algorithm the digest was computed with.

The digest itself, in the algorithm's wire encoding (e.g. hex, or the single sha512-… component for SRI).

Validate encoding and digest length, preserving the wire spelling. Strength is a separate admission decision.

Split SRI components, rejecting the whole string when empty or when any component is malformed.

A hash algorithm an integrity digest is computed with. The Ord instance is integrity authority, not constructor order: SRI < MD5 < SHA1 < SHA256 < SHA384 < Blake2b < SHA512.

The canonical lowercase name, also used in configuration and error text.

Parse canonical names and single-dash aliases, ignoring case and surrounding whitespace. SRI is not selectable.

The token before the first dash. Without a dash, the entire string is the prefix.

The body after the first dash, or empty text when there is no dash.

Resolve an SRI prefix. An unsupported prefix asserts no algorithm and clears no integrity floor.

Digest computation for verifiable algorithms. MD5 cannot prove integrity, and SRI must first resolve its algorithm.

Whether the worker can compute and verify the algorithm.

The ecosystem-agnostic snapshot of one package version: the signals a rule sees and the artifact facts that merge, admission, serving and the mirror read. Adapters project into it.

The packument-level view of a package (PackageDetails is the per-version snapshot embedded within it). A registry adapter projects its packument into this type, so the proxy core never sees the wire format.

A single registry-document entry a projection dropped as malformed rather than failing the whole document, kept so an operator can see that an upstream served one, and which.

Record a dropped entry, reducing every URL in the key and the value to its authority: an upstream-supplied artifact location can carry a credential, and this record reaches a log line.

Which kind of registry-document entry a dropped InvalidEntry came from. A dropped manifest or index file loses a serve candidate, a dropped tag, time or listing only its own datum.

The operator-facing label for a drop kind. It is the bucket key an operator filters on, so it is held stable as this text rather than the constructor name.

How many entries dropped under each kind's label. Only the kinds actually seen appear, so a document's drop profile carries no bucket its ecosystem has no entries for.