Documentation

The resolved application configuration, one sub-record per document group so a field's home says what it governs (the document schema and this type mirror each other one to one).

The server group: the inbound edge Écluse itself presents.

The queue group: the mirror queue's destination and the in-memory rollover's depth cap. The backend is derived from the URL's shape (Ecluse.Config.QueueTarget), never named here.

The limits group: the hostile-input bounds. The structural counts are pinned policy defaults; the byte-valued caps are computed from the memory plan when unset (Ecluse.Composition.MemoryPlan), a configured value always winning.

The cache group: the metadata cache's TTL and its computed-by-default bounds.

The integrity group: the global integrity floors and divergence policy (minTrusted and divergencePolicy refinable per mount).

The egress group: the operator's additions to the blocked target ranges.

The advisories group: the OSV/CVE pipeline's bucket, cadences, and bounds.

The runtime group: the process-sizing overrides. Every field is optional; unset, each is computed from the runtime posture (cgroups, RTS, file-descriptor limit) with its provenance boot-logged.

The observability group: log shape and telemetry switch.

Whether a mount mirrors, derived from its declared endpoints: a declared mirrorTarget makes the mount Mirrored (and its private upstream is then required, so the mirror can be read back), an absent one makes it ServeOnly (never writes anywhere; the private upstream is optional, and a mount with neither is the pure public gate). The coupling is structural, so a mirrored mount without a readable private leg is unrepresentable.

A mirrored mount's two required halves: the readable private upstream and the mirror target married to its derived write credential.

The mount's private upstream, when it has one: total over both modes, so call sites read as before while the compiler makes them face the serve-only absence.

The mount's mirror target (with its derived credential), when it mirrors.

The mirror-write credential, derived from the mirror-target URL so a token can never be paired with an endpoint it was not minted for. A CodeArtifact endpoint encodes its whole identity in its host, so that identity is parsed straight from the URL; any other host is written with an operator-supplied static bearer. The choice is made once, at config load (resolveMirrorCredential), and carried here so the pairing is correct by construction.

Load the full configuration: defaults, the optional operator document, and the environment overlay, merged strongest-last, then parsed, activated, and resolved.

A mount is active when the operator overlay (the document or the ECLUSE_MOUNTS__* environment variables) declares any key under mounts.<ecosystem>; the mounts shipped in config/default.yaml are dormant per-ecosystem templates until then. The enabled key is itself a declaration, so enabled: true alone activates a mount against its template public upstream (the serve-only pure public gate), and enabled: false switches a mount off without removing its other keys.

Whether an active mount mirrors is derived from its declared endpoints: a mirrorTarget makes it mirrored (its private upstream is then required, so the mirror can be read back: MountMissingPrivateUpstream), and an absent one makes it serve-only (never writing anywhere; a mirror-write setting left behind is refused per key as MirrorSettingWithoutWrite rather than silently ignored). The boot log names each mount's resolved posture, so an unintentionally dropped mirrorTarget is visible at start-up.

Boot-time advisory: one warning per pair of an active mount's resolved registry endpoints that point at the same registry. Each collapse is supported by the proxy (declaring the mirror target equal to the private upstream is a valid arrangement), but a distinct registry per endpoint is the recommended posture, so every collision is surfaced once at boot. A publication target equal to the private upstream is the documented publish arrangement and is not warned. Comparison is textual on the validated URL, insensitive to trailing slashes.

Boot-time posture: one line per served mount naming its derived mode and its consequence. The mode is derived from the declared endpoints (see loadConfig), so this is the loud counterpart of that inference: an unintentionally dropped mirrorTarget shows up here as "serve-only" at the very next boot rather than silently un-mirroring.

One line per resolved leaf of the merged configuration: the dotted path, the rendered value (secret-typed keys redacted), and the layer that supplied it (environment > document > default, mirroring the merge precedence). Derived and computed values are deliberately absent: they are not configuration, and their resolvers log their own provenance lines (the runtime posture, the memory plan, the queue selection). Renders nothing if the layers fail to parse; callers dump provenance only after a successful loadConfig.