The closed domains the config sections draw their atom values from.

These live in one module rather than in each owning section because defenum/2 pattern-matches its second argument as a literal list at expansion time — handed @types it sees a Module.__get_attribute__ AST and raises invalid fields for enum. A module also cannot use a macro it defines itself. So a section cannot both declare its own enum and read the keys back for validation; the declaration has to sit somewhere it can be required from.

Everything defenum/2 generates is a macro, which is what makes that work: Enums.compose_keys() expands to the literal list inside a validates/2 option list at compile time, so the domain is written once and the validator and the type cannot drift apart.

Order is load-bearing for compose. defenum/2 numbers keys by position, so [:none, :podman, :docker] makes rank a comparison — Svelixir.Config.Container.at_least/2 relies on it.