Module config 

Private/custom PyPI index resolution — --index-url/--extra-index-url (requirements.txt), Poetry [[tool.poetry.source]], and uv [tool.uv.index]/[tool.uv.sources].

Security model (read before touching this module)

A requirements.txt/pyproject.toml index declaration is attacker-controlled the moment a hostile repository is cloned and opened — this LSP parses on file open, before any build ever runs. Phase 1 carries no authentication at all (spec Out of Scope: no URL userinfo, no keyring/.netrc), which closes the credential half of the threat model this module would otherwise have to solve, but two things still apply:

• No credential-shaped value is ever parsed. PypiIndexUrl::new rejects any URL carrying username()/password() outright (FR-006/FR-011) — there is no expansion step for PyPI config (unlike npm’s ${VAR}), so InvalidEntry::raw and every tracing::warn! here name the as-written value with any embedded userinfo stripped first (see redact_userinfo) — the raw value is otherwise preserved so a warning or a DependencySource::CustomRegistry naming an unresolved primary/named source still shows the user what they actually typed, minus the credential.
• FR-005’s resolution order is the load-bearing security invariant of this whole feature. Case (a) (an explicit --index-url/Poetry primary/uv default): the explicit primary is checked first, then extras — a deliberate user choice, no disclosure risk. Case (b) (no explicit primary, extras only): declared extras are checked before the implicit public pypi.org fallback, never the reverse — this is what stops a private package’s name from being sent to pypi.org before the user’s own declared index has had a chance, and what stops a same-named public package from silently shadowing a private one. See PypiIndexConfig::resolve_source_for and ResolvedChain’s docs.

See specs/033-pypi-private-index-support/spec.md FR-001–FR-014 and specs/033-pypi-private-index-support/plan.md §1/§3 for the design review this module implements.

Structs

InvalidEntry

A present-but-unusable index entry — an invalid URL, a policy-blocked host, or a well-formed-but-non-https/userinfo-bearing value.

PypiIndexConfig

Resolved index configuration for one requirements.txt/pyproject.toml file.

PypiIndexUrl

A validated, normalized, https-only PyPI-protocol index URL with no embedded userinfo.

ResolvedChain

One fully-resolved, ready-to-register routing chain — produced by PypiIndexConfig::resolved_chains, consumed by PypiRegistry::register_chain/register_named_source.

Enums

PypiIndexUrlError

Why a candidate index URL failed PypiIndexUrl::new’s validation.