The registry-protocol handle — a record of functions over a backend whose private state the closures capture. The effectful fields return IO (decoupled from the core); the parse* fields are pure. See the module header.

A raw response fetched from a registry — the unparsed bytes of a metadata document or an artifact, as returned by fetchMetadata / fetchArtifact. It is kept opaque-of-bytes here so the protocol/data plane (fetch) is separate from parsing: a parse* field turns a RegistryResponse into a domain type.

Why parsing a RegistryResponse into a domain type failed. Parsing is the boundary that turns untrusted wire data into the proxy's precise types, so a failure is reported (not thrown): the caller decides how to respond.

Why publishing an artifact to a registry failed — a genuine write fault reported by publishArtifact (an Queue job is then left un-acked and retried; see docs/architecture/cloud-backends.md).

This is the write-path fault and nothing more: forming the request URL is a separate concern (a UrlFormationError), so a read-path fetch can no longer surface a failure mislabelled as a publish.

Why a publish could not complete, surfaced as a value rather than thrown so the mirror worker decides retry vs. drop by an exhaustive pattern match rather than by catching (and re-classifying) an exception. The two cases differ in exactly that — retryability — which is the whole reason this is a value: one is worth redelivering and the other never is.

Why an upstream request URL could not be formed from configuration and an already-parsed PackageName.

This is a protocol-independent fault shared by every request an adapter builds — metadata fetch, artifact fetch, and publish alike — so a read-path failure is reported as what it is rather than borrowing the write-path's PublishError. It is distinct from Ecluse.Security's UrlError: that is the pure SSRF/identifier guard (which also rejects unsafe name components), whereas this is the effectful adapter's report that the configured base URL is unusable.