What the SQS backend needs. The batch size, long-poll window, and visibility timeout are provider knobs (see Ecluse.Core.Queue) with defaults in defaultSqsConfig.

Where an SQS-compatible endpoint lives, for pointing the backend at a non-default host: a local emulator (ministack) in tests, or a VPC endpoint. A non-default host: a local emulator (ministack) in tests, or a VPC endpoint.

A SqsConfig for a queue URL and region with the provider knobs at sane defaults: a full batch of 10, the maximum 20-second long poll, and a 30-second visibility timeout. Override the record fields to tune them, or set sqsEndpoint to target an emulator.

Build an SQS-backed MirrorQueue. The amazonka Env is constructed once here -- region-scoped, and pointed at sqsEndpoint with its throwaway credentials when one is given, otherwise discovering the ambient AWS credential chain -- and captured by the returned handle's closures.

The fields of a received SQS message the backend reads. Lifting them out of the amazonka Message keeps the QueueMessage mapping (and its drop decision) free of the AWS type, so the receive path's drop behaviour is exercised directly in tests.

Lift a received batch into deliverable QueueMessages, logging each dropped message (a missing body or receipt, or an undecodable body) at DebugS so a poison message is visible rather than cycling silently until the queue's max-receive count. A dropped message is omitted from the result and left un-acked, so redelivery and dead-letter behaviour are unchanged.

Encode a MirrorJob as the JSON text of an SQS message body. The inverse of decodeJob: the package identity is split into its ecosystem, optional scope, and bare name so it round-trips through mkPackageName, and the version keeps its raw string. The serve-time-admitted artifact's filename rides as a plain field: it is the selection key the worker's ingest re-evaluation gates by, and the only thing of the artifact the wire carries -- the digests and size the worker verifies and publishes with are derived from current metadata, never the payload.

Decode an SQS message body back into a MirrorJob, or a human-readable error if the body is not the JSON object encodeJob produces (a missing field, an unknown ecosystem, an artifact URL the egress former refuses, malformed JSON).

The queue payload is a trust boundary, so the artifact URL is re-formed into its RegistryUrl egress witness on decode through the given former -- the composition root passes the https-only mkRegistryUrl; the loopback test harnesses pass their flag-gated dev former. A URL the former refuses fails the decode, so a tampered or misproduced message can never hand the worker's fetch an unwitnessed URL (it redelivers and falls to the dead-letter queue, like any undecodable body).