The mirror-queue handle: a record of functions over a backend whose state the closures capture. Every operation reports failure as an TransportFault value.

The inert queue a deployment with zero mirroring mounts carries, so the composition-root Env keeps its shape. Reached anyway, enqueue refuses with a typed fault rather than crashing.

Everything the worker needs to back-fill one artifact into the mirror target. The payload is a trust boundary: it carries selection keys and never authority, so no digest, no size.

The traceparent and tracestate of the enqueueing span, verbatim. The queue never parses them, so an unparseable carrier yields no span link rather than a decode failure.

A received message: the job to process and the handle that settles this delivery.

Encode a MirrorJob as the JSON text of a queue message body, the inverse of decodeJob. The identity rides as a namespace and a base name, so a namespaced name round-trips on any ecosystem.

Decode a queue message body back into a MirrorJob. The payload is a trust boundary, so the name, the filename, and the artifact URL each go back through their own gate.

The backend's own delivery token (an SQS receipt handle, a Pub/Sub ackId). The constructor is hidden, so worker code only takes one from a QueueMessage that receive returned.

Wrap a backend's delivery token. For backend implementations only.

Recover a backend's delivery token to pass back to it. For backend implementations only.

A duration in whole seconds, for extendVisibility. A 'newtype', so a raw Int of seconds cannot pass for some other count.

What one delivery's lease grants: the window it stays hidden for, when that window lapses, and the ceiling the backend holds the whole receipt under.

Whether a queue has somewhere that captures a message the worker can never mirror. Without one the message cycles until the queue's retention window discards it unseen.

How many deliveries of one message a queue grants before the worker itself retires it. A 'newtype', so no caller confuses a count of receives with some other Int.

The redelivery budget a backend holds when the operator configures none: five deliveries, SQS's own redrive convention, pinned to this same value in config/default.yaml.

The budget the worker enforces: the configured floor, raised past an attached terminus's capture count, so the dead-letter queue always captures a poison message first.

The delivery a budget retires on: the configured value, floored at two, so a first delivery never spends it. The verdict and the worker's alarm read this one number, so they cannot disagree.

Whether this delivery spends the queue's redelivery budget. A backend supplies the count (msgReceiveCount), never the verdict.