Documentation

An operator-configured http(s) URL, whitespace-trimmed. mkUrl is the only builder, so no value exists carrying credential material, another scheme, or an authority the egress gate misses.

Build a Url from a configuration key and the value written under it, the key naming every refusal. The credential refusal runs first, because the two refusals below it quote the value.

The stored URL text.

The scheme a configured http(s) URL writes.

Split a URL into the scheme it writes and the text after the separator, or Nothing for neither http nor https. It is the one scheme check the configuration layer shares.

Which store backend an endpoint names. The operator declares it as the one key under the endpoint, and the load validates the URL against it rather than guessing it from a host shape.

The tag as an operator writes it, and as a refusal names it.

An endpoint as a mount declares it: the tag naming its store, and the URL under that tag.

A private read endpoint with maintenance authority used only by Dredger.

Whether the operator consented to ecluse dredger deleting from a Verdaccio store. It is a declaration about that one store, so it exists under no other tag.

How a mount's mirror write authenticates, one arm per tag. The mirror write is Écluse's one standing credential, so a minting tag carries no static token and a non-minting tag requires one.

A declared mirrorTarget: where the mirror writes, and how that write authenticates.

The mirror endpoint as the collision rules read it. The tag comes from meWrite.

A declared publicationTarget: where a client publish is relayed, and the static credential forwarded only when the publishing client sends none.

How a mount's mirror write authenticates, projected from its resolved StoreBackend.

The control plane a mount's store offers, the face ecluse dredger deletes through.

A mount's store backend, resolved once at load (Ecluse.Config.Target), so no two roles infer a different one. The tag discriminates, so no arm pairs one store's mint with another's plane.

The tag a backend was declared under.

How the mirror write to this backend authenticates.

The control plane this build reaches for a backend.

The namespaces a mount's deployment owns, one arm per ecosystem, read only in that registry's own naming shape. Every consumer of the privilege derives its predicate from this one value.

A mount's refinements of the global integrity group, under its own integrity key so the mount groups them exactly as the top level does. Each is Nothing at the global setting.

One mount as the document declares it, before Ecluse.Config resolves it into a Mount.

The resolved application configuration, one sub-record per document group. The document schema and this type mirror each other one to one.

The server group: the inbound edge Écluse itself presents.

A recognised mirror-queue destination, parsed from the queue URL's shape.

queue.url as parsed at load (mkQueueUrl): the value as written, with the backend its shape names, or no backend when only the SQS endpoint override can dial it.

The value as written, trimmed.

The backend the value's shape names, Nothing when it names none.

The queue group: the mirror queue's destination, depth cap, and redelivery budget. The URL's shape decides the backend, and the load derives it once (Ecluse.Config.QueueTarget).

A recognised advisory-database store, parsed from the URL's scheme. It carries the bucket and the optional key prefix under which the compiled artifacts live.

advisories.url as parsed at load (mkAdvisoryStoreUrl): the value as written, with the store its scheme names.

The value as written, trimmed.

The store the value's scheme names.

The limits group: the hostile-input bounds. The memory plan computes the tenant-sized caps when unset (Ecluse.Composition.MemoryPlan), a configured value winning, and the rest stay pinned.

The cache group: the metadata cache's TTL and its computed-by-default bounds.

Global integrity floors. A mount can refine the trusted floor through MountIntegrity.

The egress group: the operator's additions to the blocked target ranges.

The advisories group: the OSV/CVE pipeline's store, cadences, and upstream feeds.

The runtime group: the process-sizing overrides. Unset, each is computed from the runtime posture (cgroups, RTS, file-descriptor limit), with its provenance boot-logged.

The observability group: log shape, log level, and telemetry switch.

The dredger group: how the mirror sweep paces itself, how much one cycle may delete, and which names it carries. Only ecluse dredger reads it, and every other role carries it unread.

One store's declared request capacity. It supplies the capacity a backend publishes none of, and a shared scope joins two endpoints of one pool so the sweep paces them together.

A resolved mount's endpoints: the public upstream it gates, and what it does with the rest.

Whether a mount mirrors, derived from its declared endpoints. A declared mirrorTarget makes it Mirrored, which carries the private upstream the mirror is read back through, never without.

A mirrored mount's two required halves: the readable private upstream and the mirror target married to its derived write credential.

The mount's private upstream, when it has one. It is total over both mount modes.

The mount's mirror target (with its derived credential), when it mirrors.

A mirror target married to the backend resolved from the tag it was declared under.

One resolved mount: its ecosystem, its endpoints, and the rules in precedence order.

The mounts a load resolved, keyed by the ecosystem each was declared under.

A completed load: the document's settings and the mounts resolved against them.

Why a load was refused. renderConfigError writes each one as the boot reports it.