Run the supervised mirror worker over the composition-root Env: the consume → fetch → verify → publish → ack loop, in the App orchestration monad.

This is a self-contained service entry over the shared Env (the split-ready shape the single-process program runs alongside the server). It does not return under normal operation; its caller brackets it for shutdown.

The continuous consume loop: long-poll for a batch, process it, repeat.

Each iteration is wrapped so a single failure — a receive that throws, a fetch or publish error, an undecodable body — is caught and logged, then the loop backs off briefly and continues, so one bad iteration cannot kill the worker thread. A successful poll advances the heartbeat (whether or not the batch was empty), so a liveness probe sees the loop is alive; an idle queue is a healthy empty poll, not a stall.

Process one received batch sequentially, so each job gets the full visibility budget rather than competing with its batch-mates for it. A batch is at most the queue's configured batch size (≤ 10), so sequential processing is a deliberate throughput-vs-budget choice, not a scaling bottleneck.

Process one mirror job end to end: fetch the artifact, verify it against the job's serve-time-admitted integrity digest, and — only on a match — publish it to the mirror target. Returns the JobOutcome that decides ack vs. redeliver.

The receipt handle is taken so a long publish can extendVisibility to hold the message before its window lapses. The rules are not re-run: the job was gated at serve time.

The terminal outcome of processing one mirror job, deciding whether the message is acked or left to redeliver.

How long the worker's last successful poll may be stale before the loop is considered stalled — the staleness threshold the liveness probe applies.

It is a generous multiple of the long-poll cadence: a healthy idle worker still completes a poll at least every sqsWaitSeconds (≤ 20s by default), so a gap several times that is a genuine stall, not an idle queue. Set well above one poll window so liveness never flaps on normal scheduling jitter.

Whether the worker's consume loop is healthy as of now, given its last successful poll. This is the liveness signal the single-process /livez probe folds in (see Ecluse.Server), distinct from HTTP readiness.

• Nothing (no poll yet) is healthy: the worker is still starting, not stalled.
• A poll within workerHeartbeatStaleAfter is healthy.
• A poll older than that is unhealthy: the loop has gone quiet for too long.

>>> import Data.Time (UTCTime (UTCTime), fromGregorian, secondsToDiffTime)
>>> let t0 = UTCTime (fromGregorian 2020 1 1) (secondsToDiffTime 0)
>>> heartbeatHealthy t0 Nothing
True

>>> let now = UTCTime (fromGregorian 2020 1 1) (secondsToDiffTime 10)
>>> heartbeatHealthy now (Just t0)
True

>>> let later = UTCTime (fromGregorian 2020 1 1) (secondsToDiffTime 300)
>>> heartbeatHealthy later (Just t0)
False

Read the worker heartbeat and decide liveness against the current wall clock — the IO wrapper the liveness probe calls. True while the consume loop is alive (or still starting); False once the last successful poll is staler than workerHeartbeatStaleAfter.

The result of verifying fetched bytes against the admitted integrity digests. A sum type, not a Bool, so the mismatch carries the detail an operator needs to explain why a publish was refused.

Verify fetched artifact bytes against the most authoritative integrity digest the version carries — never against a weaker one while a stronger is present.

A real npm version carries both a modern SRI sha512 digest and the legacy SHA-1 shasum. Passing on any match would let an artifact that matches the weak SHA-1 but fails the strong sha512 through — and SHA-1 collision resistance is broken, so that is exploitable. So the gate ranks the admitted digests by algorithm authority (strongest first: sha512 / blake2b > sha384 > sha256 > sha1 > md5), and checks the bytes against the strongest one present: the bytes pass iff that digest matches. A weaker digest can neither override nor rescue a failed strong one.

If the strongest digest present is in an algorithm the worker cannot compute, the gate fails closed rather than falling back to a weaker digest — a tampered artifact must never be admitted on the strength of a hash an attacker could forge.

This is the tamper gate before a publish: a mismatch fails the job and never publishes a corrupt or substituted artifact into the private upstream.

>>> import Ecluse.Package (mkHash, HashAlg (SHA1))
>>> fmap (\h -> verifyIntegrity (h :| []) "Hello World") (mkHash SHA1 "0a4d55a8d778e5022fab701977c5d840bbc486d0")
Right IntegrityVerified

>>> fmap (\h -> verifyIntegrity (h :| []) "Hello World") (mkHash SHA1 "da39a3ee5e6b4b0d3255bfef95601890afd80709")
Right (IntegrityMismatch "the SHA1 digest did not match the fetched bytes")