Validates raw configuration with the contract JSON Schema and derives runtime policy maps.
Validates raw configuration with the contract JSON Schema and derives runtime policy maps.
(admitted-workspace-entries config)(admitted-workspace-entries config env)Applicable explicit catalog entries admitted by the configured jail, in order. This is the shared admission decision for enforcement and project Path globals; the implicit Vis state directory is not an explicit project registration.
Applicable explicit catalog entries admitted by the configured jail, in order. This is the shared admission decision for enforcement and project Path globals; the implicit Vis state directory is not an explicit project registration.
(applicable-entries entries)(applicable-entries entries env)The catalog entries that apply to this host, in declaration order: a when
that does not match and an optional root whose path is absent are dropped.
The catalog entries that apply to this host, in declaration order: a `when` that does not match and an `optional` root whose path is absent are dropped.
(assert-config! config)(assert-config! config source)Validate raw string-keyed configuration with the contract JSON Schema.
Validate raw string-keyed configuration with the contract JSON Schema.
(assert-process-jail-config! policy)Validate and return the internal policy consumed by process-jail.
Validate and return the internal policy consumed by process-jail.
(entry-draft-policy entry)The catalog entry draft policy as a keyword. Defaults to :shared.
The catalog entry draft policy as a keyword. Defaults to `:shared`.
(entry-mount-status entry)(entry-mount-status entry {:keys [os exists?]})Why a catalog entry does or does not mount on this host:
:mounted — declared, present, admitted.
:os-mismatch — when.os names other platforms.
:when-absent — when.exists names a path that is not there.
:optional-absent — optional: true and the root itself is missing.
:missing — admitted, but the root does not exist yet.
Why a catalog entry does or does not mount on this host: `:mounted` — declared, present, admitted. `:os-mismatch` — `when.os` names other platforms. `:when-absent` — `when.exists` names a path that is not there. `:optional-absent` — `optional: true` and the root itself is missing. `:missing` — admitted, but the root does not exist yet.
(entry-mounted? entry)(entry-mounted? entry env)True when the entry belongs in THIS host's catalog.
True when the entry belongs in THIS host's catalog.
(entry-read-only? entry)True when the catalog entry explicitly declares read-only access.
True when the catalog entry explicitly declares read-only access.
(explain-problems config)Readable field errors produced from Skjema's JSON Schema diagnostics.
Readable field errors produced from Skjema's JSON Schema diagnostics.
(host-os)This host's when.os token: macos, windows, wsl (Linux under WSL),
linux, or unknown when the platform can't be identified.
This host's `when.os` token: `macos`, `windows`, `wsl` (Linux under WSL), `linux`, or `unknown` when the platform can't be identified.
(mount-env)Current host facts used to evaluate a when clause.
Current host facts used to evaluate a `when` clause.
(network-config config)Derive the keyword-keyed internal egress policy from validated YAML config.
Egress filtering is one facet of the process jail: jail.enabled is the single
gate. When the jail is off the policy is empty (egress open); when on, the
jail.network block (allowed/denied/exclude domains, allow_private, rules)
is enforced alongside the filesystem and inbound-port confinement.
Derive the keyword-keyed internal egress policy from validated YAML config. Egress filtering is one facet of the process jail: `jail.enabled` is the single gate. When the jail is off the policy is empty (egress open); when on, the `jail.network` block (allowed/denied/exclude domains, `allow_private`, rules) is enforced alongside the filesystem and inbound-port confinement.
(normalize-api-style value)Normalize a declared provider API style to the keyword used by the router.
Normalize a declared provider API style to the keyword used by the router.
(process-jail-config config)(process-jail-config config env)Derive process-jail policy from schema-validated configuration. A disabled jail admits the full applicable workspace catalog; an enabled jail admits only named roots. The session-state root is always included.
Derive process-jail policy from schema-validated configuration. A disabled jail admits the full applicable workspace catalog; an enabled jail admits only named roots. The session-state root is always included.
The implicit session-state root, excluded from default search.
The implicit session-state root, excluded from default search.
(without-invalid-derived config)Drop invalid machine-derived blocks so the next write can rebuild them.
Drop invalid machine-derived blocks so the next write can rebuild them.
(without-project-scoped config)Drop checkout-owned configuration before writing the machine store.
Drop checkout-owned configuration before writing the machine store.
(workspace-draft-policies config)(workspace-draft-policies config env){catalog-path -> policy} for every declared root that opts OUT of the default
:shared behaviour. Independent of jail.filesystem.allow: the policy governs
draft isolation, which applies whether or not the OS jail is enabled. Roots
this host does not mount never appear.
`{catalog-path -> policy}` for every declared root that opts OUT of the default
`:shared` behaviour. Independent of `jail.filesystem.allow`: the policy governs
draft isolation, which applies whether or not the OS jail is enabled. Roots
this host does not mount never appear.(workspace-mount-diagnostics config)(workspace-mount-diagnostics config env)One message per declared root that did NOT mount as written: conditional roots
the host skipped (:info) and admitted roots whose path is missing (:warn,
or :info when optional: true). Empty when every root is present, so it
doubles as the startup hint and the doctor check.
One message per declared root that did NOT mount as written: conditional roots the host skipped (`:info`) and admitted roots whose path is missing (`:warn`, or `:info` when `optional: true`). Empty when every root is present, so it doubles as the startup hint and the `doctor` check.
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |