Fields

• srAdmission :: ServeAdmission

  Bounds concurrent metadata work, excluding private artifact reads and artifact relay.

• srMemoryMeter :: MemoryMeter

  The memory budget metadata requests pay into as they read and build.

• srPublicManager :: Manager

  The validating-TLS data-plane manager for the untrusted public-upstream metadata fetch and every artifact stream.

• srPrivateManager :: Manager

  The manager for the trusted private upstream. It is the same validating TLS manager: the private origin differs in credential handling, not in the manager.

• srMetadataCache :: MetadataCache

  The short-TTL, size-bounded metadata cache shared by the serve paths (see Ecluse.Core.Server.Cache).

• srQueue :: MirrorQueue

  The mirror-queue handle: the durable, best-effort hand-off from the serve path to the mirror worker.

• srMetrics :: MetricsPort

  The metric-recording port the serve path emits the ecluse.* catalogue through.

• srTracing :: TracingPort

  The tracing port the serve path opens its hand-added domain spans through.

Fields

• pdUpstreams :: MountUpstreams

  Upstreams bound to their derived host gate, so their authorities cannot diverge.

• pdFirstParty :: PackageName -> Bool

  Whether a name belongs to a namespace this deployment owns, derived once at the composition root and deny by default. Its one authority is the private upstream: the public leg is never entered, and a private miss is 404.

• pdMountBaseUrl :: Text

  The mount's externally-visible base URL, under which served dist.tarball URLs are rewritten so artifacts are fetched back through the gate.

• pdRules :: [PreparedRule]

  Rules prepared at boot and evaluated against every public version.

• pdAdditionalBlockedRanges :: [IPRange]

  Extra blocked IP ranges for untrusted artifact locations. Empty by default.

• pdLimits :: Limits

  Fetch and decode limits. A breach discards the whole upstream contribution.

• pdInboundToken :: Maybe Secret

  The optional inbound token a client must present (ECLUSE_SERVER__AUTH_TOKEN). Nothing leaves the edge open, and the network layer guards it.

• pdNow :: IO UTCTime

  The wall-clock "now" for the rules' EvalContext. Injected so the time-sensitive quarantine is deterministic under test.

• pdAdvisoryEtag :: IO (Maybe DbEtag)

  Non-pinning read of the active advisory etag. Nothing means no database is loaded.

• pdNoteAdmission :: AdmissionIdentity -> IO Bool

  Whether the gate logs an admission's skipped-check evidence, once per identity for the life of the advisory source's outage (noteAdmission).

• pdHelp :: Maybe HelpMessage

  The operator help message appended to every denial body, if configured.

• pdMinIntegrity :: MinIntegrity

  Public integrity floor, at least SHA-256. Private reads use pdMinTrustedIntegrity.

• pdMinTrustedIntegrity :: MinTrustedIntegrity

  The minimum integrity hash required for a trusted upstream dependency.

• pdMetadata :: AdapterMetadata

  The mount ecosystem's metadata capability, carried whole (AdapterMetadata), never copied field by field.

• pdArtifact :: AdapterArtifact

  The mount ecosystem's artifact request formation, carried whole (AdapterArtifact), never copied field by field.

• pdEgressUrl :: Text -> Either Text RegistryUrl

  Validate an artifact URL before enqueueing it. A Left prevents the mirror job.

Fields

• pubTargetUrl :: RegistryUrl

  The publication target endpoint (mounts.npm.publicationTarget) a client npm publish is relayed to, as the https-only witness. The package path is appended to it.

• pubAllowed :: PackageName -> Bool

  Whether this package may publish here, refused before any upstream write: the same first-party predicate the serve path reads as pdFirstParty.

• pubStaticToken :: Maybe Secret

  Replaces the authenticated edge token on publishes. Requires pubInboundToken at boot.

• pubInboundToken :: Maybe Secret

  The optional inbound edge token a client must present (ECLUSE_SERVER__AUTH_TOKEN), the same gate the read paths apply. Nothing leaves the edge open.

• pubLimits :: Limits

  Separate client request and registry response bounds for publication.

• pubBodyBudget :: ByteAdmission

  Shared body-byte budget reserved before reading. Exhaustion sheds a 503.

• pubHelp :: Maybe HelpMessage

  The operator help message appended to a publish denial, if configured.

• pubProjectName :: ProjectName

  The ecosystem's own name parser, which the anti-shadowing guard reads a declared name through.

• pubAdapter :: AdapterPublish

  The mount ecosystem's publish capability, carried whole (AdapterPublish), never copied field by field.

Fields

• bindingPrefix :: NonEmpty Text

  The leading path segments this mount is served under. Never empty.

• bindingRouter :: MountRouter

  This mount's routing decision, derived from the adapter's own route table.

• bindingCredential :: CredentialMapping

  How a client of this mount presents its credential, and how the proxy carries one upstream. The adapter declares it, so the serve path holds no credential scheme of its own.

• bindingPackumentDeps :: PackumentDeps

  The packument-serve dependencies. A bound mount always serves packuments and artifacts, because a mount exists only for a registered adapter. Only publish is opt-in.

• bindingPublishDeps :: Maybe PublishDeps

  Optional first-party publish dependencies. Nothing makes PUT /{pkg} answer 405.

Fields

• ctxRuntime :: ServeRuntime

  The request runtime: the data-plane managers, the caches and queue, and the recording ports.

• ctxMount :: MountBinding

  The mount the request matched, carrying its complete ecosystem wiring.