The trust provenance of an upstream's contribution to the merge. The split is decided by the caller — by which upstream a document came from — and applied before merging, never derived here.

The constructors are named *Source rather than the bare Trusted/Gated because Ecluse.Package already exports a Trust constructor named Trusted; a bare name would collide for the many callers that import Ecluse.Package openly.

The Ord instance is the trust order itself — TrustedSource compares __less than__ GatedSource so that "smallest wins" gives trusted precedence; the merge's resolution leans on this directly (see mergePackuments).

A stable identifier for one input to a single mergePackuments call: the 0-based index of that (Provenance, PackageInfo) in the input list.

The serve layer needs to take a surviving version's object from the raw Value of whichever source won it, so the plan must name that source. Provenance alone is not enough: it identifies a source only while there is exactly one input per provenance (the npm topology today — one trusted, one gated). The input index stays unambiguous even when several inputs share a provenance (e.g. an aggregating private upstream plus a first-party source, both TrustedSource), which keeps the plan robust for the multi-source case without a new type. The caller pairs each SourceId back to the raw Value it passed at that position.

The outcome of reasoning over a set of upstream packuments: a plan the serve layer replays onto the raw upstream Values to assemble the lossless served body. It carries exactly the decisions the merge owns — never a finished, re-serialisable document (see this module's header, "Decision surface, not served surface").

A detected integrity conflict: a version key present in more than one source whose copies contradict on a shared algorithm — an algorithm both expose carries disagreeing digests. The trusted copy wins the merge; this record preserves both fingerprints so the caller can log, meter, and decide policy (serve-with-private-winning vs fail-closed). It is the merge's supply-chain signal — surfaced, never silently reconciled.

Ord is derived purely to let MergePlan carry divergences as a Set: the ordering is structural (over the version key and the two fingerprints) and has no meaning beyond deduplication and a stable presentation.

An order-independent fingerprint of a version's artifact integrity: the sorted multiset of (algorithm, digest) pairs across all of the version's artifacts. The comparison ignores artifact ordering and non-integrity fields (filename, URL, size) that legitimately vary between mirrors of the same bytes.

Two copies diverge when they contradict on a shared algorithm: an algorithm present in both carries disagreeing digests. An asymmetric pair — one copy exposing an algorithm the other omits — does not diverge on that account; only a shared algorithm whose digests disagree does. So a mirror serving a modern digest alongside a legacy one agrees with a mirror serving only the modern digest, as long as that shared digest matches.

Opaque so the comparison used for divergence detection cannot be sidestepped; read the pairs back with integrityHashes when logging or metering a Divergence. Ord is derived (structurally, over the sorted pairs) only so a Divergence may live in a Set; it carries no domain meaning beyond that, and in particular is not the divergence test (which is the shared-algorithm contradiction above, never structural inequality of the whole set).

The (algorithm, digest) pairs of a fingerprint, sorted, for an audit trail.

Reason over several upstream packuments, by Provenance, and emit the MergePlan the serve layer replays onto the raw Values. Pure and total.

The merge is a fold with the degenerate identity at one input: a single packument yields a plan whose survivors are all of its versions (all won by source 0), with its tags and times reconciled and no divergences, so 0/1-upstream deployments need no special case. It is realised as a foldMap of each input's contribute into the lawful Merge Monoid, projected by planFrom. The model:

• Union by version key, with TrustedSource winning a collision over GatedSource (the private upstream is the authority). The winning input's SourceId is recorded for the survivor. A collision whose copies contradict on a shared integrity algorithm is recorded as a Divergence; the winner is still kept.
• 'dist-tags' reconciled over the union. latest is resolved by selectLatest — keep-unless-denied, stable-preferring, and unparseable-safe — from the precedence-winning source's tagged latest and the surviving versions; any other tag pointing at a version absent from the union is dropped. Collisions on the same tag are resolved by provenance (trusted wins), consistent with the version fold, so the plan does not depend on caller input order.
• time restricted to the union, with per-version collisions also resolved by provenance — publish times for versions that did not survive are dropped.

The plan's identity (mpName) is carried from the contributions; callers fetch one package across its upstreams and each contribution's name has been validated against the requested one before reaching here, so all inputs share that one identity and it is never a substituted value. An empty input list yields Nothing — there is nothing to serve.

The monoidal accumulator the merge folds into. It holds, unresolved, every candidate offered for every version key, plus the ranked dist-tags and time contributions; resolution to a single winner per key, and the divergence set, happens once in planFrom. Keeping candidates unresolved is what makes (<>) associative: a pairwise winner-vs-loser decision taken during the fold is not associative once three or more copies of a key collide, because divergence is a property of the whole set of distinct fingerprints, not of any one step.

Each accumulator also carries the count of inputs it represents, so that (<>) can __re-index the right operand's SourceIds by the left operand's input count__. This positional re-indexing is what makes a SourceId name an input's list position after a foldMap of single-input contributions — and it is the sole reason the instance is non-commutative (see the Semigroup instance).

One input's contribution to the accumulator, at local SourceId 0: every version becomes a candidate, every dist-tags target and time instant a ranked value at this input's provenance, and the package name is offered as the identity. foldMap contribute over the inputs then re-indexes each to its list position via the Semigroup offset, so the absolute SourceId of a single-input contribution is its index in the foldMap.

Project the resolved MergePlan from a folded Merge. Resolves each version key to its precedence winner, derives the divergence Set from the shared-algorithm contradictions among each key's distinct fingerprints, and reconciles dist-tags/time over the survivors. Returns Nothing only for the empty merge (mempty), which has no name and so nothing to serve — equivalently, the empty input list.