Documentation

A completed load: the document's settings and the mounts resolved against them.

The resolved application configuration, one sub-record per document group. The document schema and this type mirror each other one to one.

The server group: the inbound edge Écluse itself presents.

The queue group: the mirror queue's destination, depth cap, and redelivery budget. The URL's shape decides the backend, and the load derives it once (Ecluse.Config.QueueTarget).

The limits group: the hostile-input bounds. The memory plan computes the tenant-sized caps when unset (Ecluse.Composition.MemoryPlan), a configured value winning, and the rest stay pinned.

The cache group: the metadata cache's TTL and its computed-by-default bounds.

Global integrity floors. A mount can refine the trusted floor through MountIntegrity.

The egress group: the operator's additions to the blocked target ranges.

The advisories group: the OSV/CVE pipeline's store, cadences, and upstream feeds.

The runtime group: the process-sizing overrides. Unset, each is computed from the runtime posture (cgroups, RTS, file-descriptor limit), with its provenance boot-logged.

The observability group: log shape, log level, and telemetry switch.

The dredger group: how the mirror sweep paces itself, how much one cycle may delete, and which names it carries. Only ecluse dredger reads it, and every other role carries it unread.

One store's declared request capacity. It supplies the capacity a backend publishes none of, and a shared scope joins two endpoints of one pool so the sweep paces them together.

The mounts a load resolved, keyed by the ecosystem each was declared under.

One resolved mount: its ecosystem, its endpoints, and the rules in precedence order.

A resolved mount's endpoints: the public upstream it gates, and what it does with the rest.

Whether a mount mirrors, derived from its declared endpoints. A declared mirrorTarget makes it Mirrored, which carries the private upstream the mirror is read back through, never without.

A mirrored mount's two required halves: the readable private upstream and the mirror target married to its derived write credential.

The mount's private upstream, when it has one. It is total over both mount modes.

The mount's mirror target (with its derived credential), when it mirrors.

A mirror target married to the backend resolved from the tag it was declared under.

Which store backend an endpoint names. The operator declares it as the one key under the endpoint, and the load validates the URL against it rather than guessing it from a host shape.

The tag as an operator writes it, and as a refusal names it.

An endpoint as a mount declares it: the tag naming its store, and the URL under that tag.

A private read endpoint with maintenance authority used only by Dredger.

Whether the operator consented to ecluse dredger deleting from a Verdaccio store. It is a declaration about that one store, so it exists under no other tag.

How a mount's mirror write authenticates, one arm per tag. The mirror write is Écluse's one standing credential, so a minting tag carries no static token and a non-minting tag requires one.

A declared mirrorTarget: where the mirror writes, and how that write authenticates.

The mirror endpoint as the collision rules read it. The tag comes from meWrite.

A declared publicationTarget: where a client publish is relayed, and the static credential forwarded only when the publishing client sends none.

How a mount's mirror write authenticates, projected from its resolved StoreBackend.

The control plane a mount's store offers, the face ecluse dredger deletes through.

A mount's store backend, resolved once at load (Ecluse.Config.Target), so no two roles infer a different one. The tag discriminates, so no arm pairs one store's mint with another's plane.

The tag a backend was declared under.

How the mirror write to this backend authenticates.

The control plane this build reaches for a backend.

The namespaces a mount's deployment owns, one arm per ecosystem, read only in that registry's own naming shape. Every consumer of the privilege derives its predicate from this one value.

A mount's refinements of the global integrity group, under its own integrity key so the mount groups them exactly as the top level does. Each is Nothing at the global setting.

One mount as the document declares it, before Ecluse.Config resolves it into a Mount.

An operator-configured http(s) URL, whitespace-trimmed. mkUrl is the only builder, so no value exists carrying credential material, another scheme, or an authority the egress gate misses.

The stored URL text.

A recognised mirror-queue destination, parsed from the queue URL's shape.

queue.url as parsed at load (mkQueueUrl): the value as written, with the backend its shape names, or no backend when only the SQS endpoint override can dial it.

The value as written, trimmed.

The backend the value's shape names, Nothing when it names none.

A recognised advisory-database store, parsed from the URL's scheme. It carries the bucket and the optional key prefix under which the compiled artifacts live.

advisories.url as parsed at load (mkAdvisoryStoreUrl): the value as written, with the store its scheme names.

The value as written, trimmed.

The store the value's scheme names.

The bucket the store names.

The object key one compiled artifact takes in the store: the configured prefix ahead of the artifact's own file name.

A declared rules object: one RuleEntry per rule name it names.

One rule's declared keys, every one optional. Which of them the entry may set depends on the rule type, and refuseStrayParameters refuses the rest.

A resolved rule set, keyed by the rule name an operator patches it under.

Why one declared rule was refused. A load reports every one it accumulated.

One refusal as the boot reports it, naming the rule it was declared under.

The policy a load starts from before the shipped defaults are applied.

The rule policy embedded in the shipped configuration.

Why a load was refused. renderConfigError writes each one as the boot reports it.

Load the merged configuration: the defaults, the operator document, then the environment overlay, strongest-last. A mount is active only where that overlay declares a key under it.

Whether two configured endpoints name the same registry. The authority folds to lower case with its default port applied, and the path is compared exactly past a trailing slash.

Mount modes followed by the live-environment limits of check-config, shared with boot.

One mount's effective maximum advisory push age, derived from that mount's own rules. An explicit advisories.maxAgeSeconds overrides the derivation on every mount.

Require enrichment when this mount's resolved policy contains an EPSS rule.

The names of this mount's rules that deny on the advisory database, in policy order. A non-empty list is what makes an advisory store mandatory and the mount's readiness wait for one.

Whether this mount must hold an advisory database before it can serve anything.

The effective maximum push age of every mount whose rules read the advisory database, with the basis that produced it. With no store configured nothing syncs, so nothing has an age.

Each mount's EPSS requirement, which Pilot and that mount's advisory consumers apply alike. It is reported with no store too, because pilot compile runs under it without uploading.

One line per resolved leaf of the merged configuration: the dotted path, the redacted value, and its layer. Empty when a layer fails to parse, and a boot-computed key has no leaf to report.