pangea-core 0.2.0 → 0.3.0

data/lib/pangea/resource_registry.rb

@@ -17,51 +17,60 @@
 require 'set'
 
 module Pangea
-  # Global registry for resource modules that auto-register when loaded
+  # Global registry for resource modules that auto-register when loaded.
+  # Thread-safe: all mutation and read paths are guarded by a Mutex.
   module ResourceRegistry
     @registered_modules = Set.new
     @provider_modules = Hash.new { |h, k| h[k] = Set.new }
+    @mutex = Mutex.new
 
     class << self
       # Register a module to be available in template contexts
       def register_module(mod)
-        @registered_modules.add(mod)
+        @mutex.synchronize { @registered_modules.add(mod) }
       end
 
       # Get all registered modules
       def registered_modules
-        @registered_modules.to_a
+        @mutex.synchronize { @registered_modules.to_a }
       end
 
       # Clear registry (useful for testing)
       def clear!
-        @registered_modules.clear
+        @mutex.synchronize do
+          @registered_modules.clear
+          @provider_modules.clear
+        end
       end
 
       # Check if a module is registered
       def registered?(mod)
-        @registered_modules.include?(mod)
+        @mutex.synchronize { @registered_modules.include?(mod) }
       end
 
       # Support provider-based registration used by individual resources
       def register(provider, mod)
-        @provider_modules[provider].add(mod)
-        # Also add to global registry for backward compatibility
-        @registered_modules.add(mod)
+        @mutex.synchronize do
+          @provider_modules[provider].add(mod)
+          # Also add to global registry for backward compatibility
+          @registered_modules.add(mod)
+        end
       end
-      
+
       # Get modules for a specific provider
       def modules_for(provider)
-        @provider_modules[provider].to_a
+        @mutex.synchronize { @provider_modules[provider].to_a }
       end
 
       # Get registry statistics
       def stats
-        {
-          total_modules: @registered_modules.size,
-          modules: @registered_modules.map(&:name),
-          by_provider: @provider_modules.transform_values(&:size)
-        }
+        @mutex.synchronize do
+          {
+            total_modules: @registered_modules.size,
+            modules: @registered_modules.map(&:name),
+            by_provider: @provider_modules.transform_values(&:size)
+          }
+        end
       end
     end
   end

data/lib/pangea/resources/base_attributes.rb

@@ -28,12 +28,24 @@ module Pangea
       # terraform references (they will be resolved at plan/apply time).
       TERRAFORM_REF_PATTERN = /\$\{.*\}/.freeze
 
+      # NOTE: No self.new override. Terraform references are handled at the
+      # SERIALIZATION BOUNDARY by ResourceInput, not in the type system.
+      # Types stay pure. ResourceBuilder partitions refs from literals
+      # before validation, merges them back during Terraform JSON emission.
+
+      # Override in subclasses to use a different reference pattern
+      # (e.g., Pulumi uses different interpolation syntax).
+      def self.reference_pattern
+        TERRAFORM_REF_PATTERN
+      end
+
       # Returns true if the value contains a terraform/HCL interpolation reference.
       # Works for both class-level (self.terraform_reference?) and instance-level usage.
+      # Uses the overridable reference_pattern so providers can customize detection.
       def self.terraform_reference?(value)
         return false unless value.is_a?(String)
 
-        value.match?(TERRAFORM_REF_PATTERN)
+        value.match?(reference_pattern)
       end
 
       def terraform_reference?(value)

data/lib/pangea/resources/reference.rb

@@ -16,6 +16,7 @@
 
 require 'dry-struct'
 require 'pangea/resources/types'
+require 'pangea/resources/reference_generator'
 
 module Pangea
   module Resources
@@ -76,7 +77,7 @@ module Pangea
 
       # Generate terraform reference for any attribute
       def ref(attribute_name)
-        "${#{type}.#{name}.#{attribute_name}}"
+        ReferenceGenerator::RESOURCE_REF.call(type, name, attribute_name)
       end
 
       # Alias for ref - more natural syntax
@@ -101,7 +102,8 @@ module Pangea
         end
       end
 
-      # Method delegation to outputs, computed properties, and computed attributes
+      # Method delegation to outputs, computed properties, computed attributes,
+      # and finally a catch-all that generates a Terraform attribute reference.
       def method_missing(method_name, *args, &block)
         if outputs.key?(method_name)
           outputs[method_name]
@@ -111,6 +113,8 @@ module Pangea
           computed[method_name]
         elsif computed_attributes.respond_to?(method_name)
           computed_attributes.public_send(method_name, *args, &block)
+        elsif method_name.to_s.match?(/\A[a-z_][a-z0-9_]*\z/) && args.empty?
+          ref(method_name)
         else
           super
         end
@@ -121,17 +125,18 @@ module Pangea
           computed_properties&.key?(method_name) ||
           computed&.key?(method_name) ||
           computed_attributes.respond_to?(method_name, include_private) ||
+          method_name.to_s.match?(/\A[a-z_][a-z0-9_]*\z/) ||
           super
       end
 
       # Convert to hash for terraform-synthesizer integration
       def to_h
-        {
+        @_to_h ||= {
           type: type,
           name: name,
           attributes: resource_attributes,  # Use 'attributes' as key for compatibility
           outputs: outputs
-        }
+        }.freeze
       end
     end
   end

data/lib/pangea/resources/reference_generator.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Pangea
+  module Resources
+    module ReferenceGenerator
+      RESOURCE_REF = ->(type, name, attr) { "${#{type}.#{name}.#{attr}}" }.freeze
+      DATA_REF = ->(type, name, attr) { "${data.#{type}.#{name}.#{attr}}" }.freeze
+
+      def terraform_ref(type, name, attr)
+        RESOURCE_REF.call(type, name, attr)
+      end
+
+      def data_ref(type, name, attr)
+        DATA_REF.call(type, name, attr)
+      end
+    end
+  end
+end

data/lib/pangea/resources/resource_builder.rb

@@ -4,105 +4,140 @@ module Pangea
   module Resources
     # Declarative DSL for defining terraform resource methods.
     #
-    # Eliminates the validate→build→return boilerplate that every resource
-    # module repeats. Each attribute is classified as:
+    # Types are PURE — they model the domain (CIDRs, ports, arrays).
+    # Terraform references are handled at the serialization boundary
+    # via ResourceInput, not in the type definitions.
     #
+    # Each attribute is classified as:
     #   map:         always set on the resource block
     #   map_present: set only when non-nil
-    #   map_bool:    set only when non-nil (explicit boolean check — !val.nil?)
+    #   map_bool:    set only when non-nil (explicit boolean check)
     #   labels:      set when hash is non-empty (.any?)
     #   tags:        set when hash is non-empty (.any?)
     #
-    # Usage:
-    #   module GoogleComputeNetwork
-    #     include Pangea::Resources::ResourceBuilder
-    #
-    #     define_resource :google_compute_network,
-    #       attributes_class: Google::Types::ComputeNetworkAttributes,
-    #       outputs: { id: :id, self_link: :self_link },
-    #       map: [:name],
-    #       map_present: [:project, :description, :routing_mode, :mtu],
-    #       map_bool: [:auto_create_subnetworks, :delete_default_routes_on_create]
-    #   end
-    #
     module ResourceBuilder
       def self.included(base)
         base.extend(ClassMethods)
       end
 
       module ClassMethods
-        # Define a terraform resource method on this module.
-        #
-        # @param tf_type [Symbol]         Terraform resource type (e.g. :google_compute_network)
-        # @param attributes_class [Class]  Dry::Struct class for attribute validation
-        # @param outputs [Hash]            { friendly_name => terraform_attribute } — defaults to { id: :id }
-        # @param map [Array<Symbol>]       Attributes always set on the resource
-        # @param map_present [Array<Symbol>] Attributes set only when non-nil
-        # @param map_bool [Array<Symbol>]  Boolean attributes set only when non-nil (uses !val.nil?)
-        # @param labels [Symbol, nil]      Attribute name for labels hash (set when .any?)
-        # @param tags [Symbol, nil]        Attribute name for tags hash (set when .any?)
-        # @param custom_block [Proc]       Optional block receiving (resource_dsl, attrs) for complex resources
-        #
         def define_resource(tf_type, attributes_class:, outputs: { id: :id },
                             map: [], map_present: [], map_bool: [],
                             tags: nil, labels: nil, &custom_block)
           @_resource_definitions ||= {}
-          @_resource_definitions[tf_type] = {
-            attributes_class: attributes_class,
-            outputs: outputs,
-            map: map,
-            map_present: map_present,
-            map_bool: map_bool,
-            tags: tags,
-            labels: labels
-          }
+          @_resource_definitions[tf_type] = _store_definition(attributes_class, outputs, map, map_present, map_bool, tags, labels)
 
           define_method(tf_type) do |name, attributes = {}|
-            attrs = attributes_class.new(attributes)
+            meta_args = {}
+            resource_attrs = attributes
+            if attributes.is_a?(Hash)
+              meta_keys = %i[lifecycle depends_on count for_each provider provisioner]
+              meta_args = attributes.select { |k, _| meta_keys.include?(k.to_sym) }
+              resource_attrs = attributes.reject { |k, _| meta_keys.include?(k.to_sym) }
 
-            resource(tf_type, name) do
-              map.each { |attr| __send__(attr, attrs.public_send(attr)) }
-
-              map_present.each do |attr|
-                val = attrs.public_send(attr)
-                __send__(attr, val) if val
+              # Unknown key detection runs on ALL keys (including ref-carrying ones)
+              known = attributes_class.schema.map { |k| k.name }.to_set
+              unknown = resource_attrs.keys.map(&:to_sym) - known.to_a
+              unless unknown.empty?
+                raise ArgumentError,
+                  "#{tf_type}: unknown attributes #{unknown.inspect}. " \
+                  "Valid attributes: #{known.to_a.sort.inspect}. " \
+                  "Typo? Check Terraform docs for the correct attribute name."
               end
+            end
 
-              map_bool.each do |attr|
-                val = attrs.public_send(attr)
-                __send__(attr, val) unless val.nil?
-              end
+            # Partition into validated literals + opaque refs.
+            # Types stay pure. Refs handled at serialization boundary.
+            input = ResourceInput.partition(attributes_class, resource_attrs)
+            _synthesize_block(:resource, tf_type, name, input, map, map_present, map_bool, tags, labels, custom_block, meta_args)
+            _build_reference(tf_type.to_s, name, input, outputs)
+          end
+        end
 
-              if tags
-                tag_val = attrs.public_send(tags)
-                __send__(tags, tag_val) if tag_val&.any?
-              end
+        def define_data(tf_type, attributes_class:, outputs: { id: :id },
+                        map: [], map_present: [], map_bool: [],
+                        tags: nil, labels: nil, &custom_block)
+          method_name = :"data_#{tf_type}"
+          @_data_definitions ||= {}
+          @_data_definitions[tf_type] = _store_definition(attributes_class, outputs, map, map_present, map_bool, tags, labels)
 
-              if labels
-                label_val = attrs.public_send(labels)
-                __send__(labels, label_val) if label_val&.any?
+          define_method(method_name) do |name, attributes = {}|
+            if attributes.is_a?(Hash)
+              known = attributes_class.schema.map { |k| k.name }.to_set
+              unknown = attributes.keys.map(&:to_sym) - known.to_a
+              unless unknown.empty?
+                raise ArgumentError,
+                  "data.#{tf_type}: unknown attributes #{unknown.inspect}. " \
+                  "Valid attributes: #{known.to_a.sort.inspect}."
               end
-
-              instance_exec(self, attrs, &custom_block) if custom_block
-            end
-
-            output_hash = outputs.each_with_object({}) do |(friendly, tf_attr), h|
-              h[friendly] = "${#{tf_type}.#{name}.#{tf_attr}}"
             end
-
-            ResourceReference.new(
-              type: tf_type.to_s,
-              name: name,
-              resource_attributes: attrs.to_h,
-              outputs: output_hash
-            )
+            input = ResourceInput.partition(attributes_class, attributes)
+            _synthesize_block(:data, tf_type, name, input, map, map_present, map_bool, tags, labels, custom_block)
+            _build_reference("data.#{tf_type}", name, input, outputs)
           end
         end
 
-        # Introspect registered resource definitions.
         def resource_definitions
           @_resource_definitions || {}
         end
+
+        def data_definitions
+          @_data_definitions || {}
+        end
+
+        private
+
+        def _store_definition(attributes_class, outputs, map, map_present, map_bool, tags, labels)
+          { attributes_class: attributes_class, outputs: outputs, map: map,
+            map_present: map_present, map_bool: map_bool, tags: tags, labels: labels }.freeze
+        end
+      end
+
+      private
+
+      def _synthesize_block(block_type, tf_type, name, input, map, map_present, map_bool, tags, labels, custom_block, meta_args = {})
+        # `_emit` bypasses Ruby's normal method lookup and dispatches straight to
+        # the synthesizer's `method_missing`. Without this, attribute names that
+        # collide with Kernel/Object methods (e.g. GitHub's `fork`, `raise`,
+        # `send`, `class`) would invoke the Ruby builtin instead of the
+        # abstract-synthesizer's block-recording DSL.
+        send(block_type, tf_type, name) do
+          # input[attr] resolves refs over validated attrs transparently
+          map.each { |attr| send(:method_missing, attr, input[attr]) }
+          map_present.each { |attr| val = input[attr]; send(:method_missing, attr, val) if val }
+          map_bool.each { |attr| val = input[attr]; send(:method_missing, attr, val) unless val.nil? }
+          if tags
+            tag_val = input[tags]
+            send(:method_missing, tags, tag_val) if tag_val&.respond_to?(:any?) && tag_val.any?
+          end
+          if labels
+            label_val = input[labels]
+            send(:method_missing, labels, label_val) if label_val&.respond_to?(:any?) && label_val.any?
+          end
+          instance_exec(self, input, &custom_block) if custom_block
+
+          meta_args.each do |meta_key, meta_val|
+            if meta_val.is_a?(Hash)
+              send(:method_missing, meta_key) do
+                meta_val.each { |k, v| send(:method_missing, k, v) }
+              end
+            else
+              send(:method_missing, meta_key, meta_val)
+            end
+          end
+        end
+      end
+
+      def _build_reference(type_str, name, input, outputs)
+        output_hash = outputs.each_with_object({}) do |(friendly, tf_attr), h|
+          h[friendly] = "${#{type_str}.#{name}.#{tf_attr}}"
+        end
+        ResourceReference.new(
+          type: type_str,
+          name: name,
+          resource_attributes: input.to_h,
+          outputs: output_hash
+        )
       end
     end
   end

data/lib/pangea/resources/resource_input.rb

@@ -0,0 +1,149 @@
+# frozen_string_literal: true
+
+module Pangea
+  module Resources
+    # Partitions resource attributes into validated literals and opaque references.
+    #
+    # Types stay pure — they model the domain (CIDRs, ports, arrays).
+    # ResourceInput handles the serialization concern: some values are known
+    # at synthesis time (literals), some are opaque (Terraform ${...} refs).
+    #
+    # Equivalent to Rust's serde boundary: the type is strict, the
+    # serialization layer handles the wire format.
+    #
+    # Equivalent to substrate's convergence typestate: data is tagged with
+    # its partition at the boundary, inner types are uncontaminated.
+    #
+    # Usage (internal to ResourceBuilder — not called directly):
+    #   input = ResourceInput.partition(VpcAttributes, { cidr: "10.0.0.0/16", id: "${aws_vpc.x.id}" })
+    #   input[:cidr]  # => "10.0.0.0/16" (validated by Dry::Struct)
+    #   input[:id]    # => "${aws_vpc.x.id}" (opaque, passed through)
+    #   input.to_h    # => { cidr: "10.0.0.0/16", id: "${aws_vpc.x.id}" }
+    #
+    class ResourceInput
+      # Terraform interpolation reference — opaque string resolved at plan time.
+      # Strict: must match ${...} syntax exactly. Random strings rejected.
+      REF_PATTERN = /\A\$\{.+\}\z/.freeze
+
+      attr_reader :validated, :refs
+
+      # Partition a raw attribute hash into validated literals and opaque refs.
+      #
+      # Literals are validated strictly by Dry::Struct. Refs are frozen and
+      # passed through. Required attributes that carry refs are excluded from
+      # validation (they can't be validated at synthesis time — Terraform
+      # resolves them at plan time).
+      #
+      # We use Dry::Struct.load instead of .new for the literals hash because
+      # .load bypasses the missing-key check — ref-carrying required fields
+      # are intentionally absent from the literals hash.
+      #
+      # @param attributes_class [Class] Dry::Struct subclass for type validation
+      # @param raw_hash [Hash] User-provided attributes (may contain ${...} refs)
+      # @return [ResourceInput]
+      def self.partition(attributes_class, raw_hash)
+        literals = {}
+        refs = {}
+
+        raw_hash.each do |k, v|
+          sym = k.to_sym
+          if v.is_a?(String) && v.match?(REF_PATTERN)
+            refs[sym] = v
+          else
+            literals[sym] = v
+          end
+        end
+
+        # Validate that every required attribute is accounted for
+        # (present in either literals or refs, not missing from both).
+        # Keys with a `.default(...)` type are NOT user-required — Dry::Struct
+        # fills them in on `.load` when omitted. `Schema::Key#required?`
+        # reports `true` for every attribute regardless of default, so we
+        # additionally filter by `k.type.default?`.
+        required_keys = attributes_class.schema
+          .select { |k| k.required? && !k.type.default? }
+          .map(&:name)
+          .to_set
+
+        provided_keys = literals.keys.to_set | refs.keys.to_set
+        missing = required_keys - provided_keys
+        unless missing.empty?
+          raise ArgumentError,
+            "#{attributes_class}: missing required attributes #{missing.to_a.inspect}. " \
+            "Provide literal values or Terraform references for all required fields."
+        end
+
+        # Validate each literal value against its declared type.
+        # We can't use .new (raises on missing required keys that are refs)
+        # and can't use .load (skips ALL validation).
+        # Instead: validate each field individually, then load the validated hash.
+        schema_keys = attributes_class.schema.each_with_object({}) do |k, h|
+          h[k.name] = k.type
+        end
+
+        literals.each do |key, value|
+          type = schema_keys[key]
+          next unless type # unknown keys already caught by ResourceBuilder
+
+          begin
+            type.call(value)
+          rescue Dry::Types::ConstraintError, Dry::Types::CoercionError => e
+            raise e.class, "#{attributes_class}: attribute :#{key} — #{e.message}"
+          end
+        end
+
+        # .load bypasses missing-key enforcement (refs are intentionally absent)
+        # but we've validated every literal value above.
+        validated = attributes_class.load(literals)
+        new(validated, refs.freeze)
+      end
+
+      # @param validated [Dry::Struct] Type-validated literal attributes
+      # @param refs [Hash{Symbol => String}] Opaque Terraform references
+      def initialize(validated, refs)
+        @validated = validated
+        @refs = refs
+        freeze
+      end
+
+      # Access an attribute value. Refs take priority over validated literals.
+      # This is the serialization merge: opaque values override typed values.
+      #
+      # @param key [Symbol, String] Attribute name
+      # @return [Object] The ref string if present, otherwise the validated value
+      def [](key)
+        k = key.to_sym
+        refs.fetch(k) { validated[k] }
+      end
+
+      # Merge validated attrs and refs into a single hash for Terraform JSON.
+      # Refs override validated values (they are the source of truth at plan time).
+      #
+      # @return [Hash]
+      def to_h
+        validated.to_h.merge(refs)
+      end
+
+      # Template-author DSL: `input.priority` resolves like `input[:priority]`.
+      # Refs win over validated literals (same as `[]`). Unknown attribute
+      # names fall through to `super` → NoMethodError with full message.
+      def method_missing(name, *args)
+        if args.empty? && attribute?(name)
+          self[name]
+        else
+          super
+        end
+      end
+
+      def respond_to_missing?(name, include_private = false)
+        attribute?(name) || super
+      end
+
+      private
+
+      def attribute?(name)
+        refs.key?(name) || validated.respond_to?(name)
+      end
+    end
+  end
+end

data/lib/pangea/resources/types/coercions.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require_relative 'core'
+
+module Pangea
+  module Resources
+    module Types
+      # Port as String — accepts Integer, coerces to String.
+      # Use for AWS health_check.port, listener.port etc. where the API
+      # expects a string but callers naturally pass integers.
+      PortString = Coercible::String
+
+      # Port as Integer — accepts String, coerces to Integer.
+      # Constrained to valid port range 0-65535.
+      PortInt = Coercible::Integer.constrained(gteq: 0, lteq: 65535)
+
+      # Boolean — accepts String 'true'/'false', Integer 0/1, coerces to Bool.
+      # Handles common type mismatches from YAML configs, CLI args, and API
+      # responses where booleans arrive as strings or integers.
+      CoercibleBool = Bool.constructor do |v|
+        case v
+        when ::String then %w[true 1 yes].include?(v.downcase)
+        when ::Integer then v != 0
+        else !!v
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/types/core.rb

@@ -79,6 +79,29 @@ module Pangea
       # Unix User/Group IDs
       UnixUserId = Integer.constrained(gteq: 0, lteq: 4294967295)
       UnixGroupId = Integer.constrained(gteq: 0, lteq: 4294967295)
+
+      # ── Terraform Reference Types (Algebraic Sum Types) ────────────
+
+      # Terraform interpolation reference — opaque string resolved at plan time.
+      # Strict constraint: must match ${...} syntax exactly. Random strings rejected.
+      # Equivalent to Rust: struct TerraformRef(String);
+      Ref = String.constrained(format: /\A\$\{.+\}\z/)
+
+      # Sum type builder: literal T | Terraform reference.
+      # Produces a discriminated union that accepts EITHER a validated literal
+      # value OR a Terraform interpolation reference. Nothing else.
+      #
+      # Equivalent to Rust: enum TfValue<T> { Literal(T), Ref(String) }
+      #
+      # Usage:
+      #   T::RefOr(T::CidrBlock)           → CidrBlock | Ref
+      #   T::RefOr(T::Array.of(T::String)) → Array<String> | Ref
+      #   T::RefOr(T::Port)                → Port | Ref
+      #   T::RefOr(T::Bool)                → Bool | Ref
+      #
+      def self.RefOr(type)
+        type | Ref
+      end
     end
   end
 end

data/lib/pangea/resources/types/index.rb

@@ -16,5 +16,8 @@
 # Core types (must be loaded first)
 require_relative 'core'
 
+# Coercion types — pragmatic type coercions for common mismatches
+require_relative 'coercions'
+
 # Provider types are loaded by their respective gems:
 # pangea-aws, pangea-cloudflare, pangea-hcloud

data/lib/pangea/resources/validators/common.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Pangea
+  module Resources
+    module Validators
+      module Common
+        def check_mutually_exclusive(attrs, *field_names)
+          present = field_names.select { |f| !attrs.public_send(f).nil? }
+          if present.length > 1
+            raise Dry::Struct::Error, "Cannot specify both '#{present.join("' and '")}'"
+          end
+        end
+
+        def check_required_one_of(attrs, *field_names)
+          present = field_names.select { |f| !attrs.public_send(f).nil? }
+          if present.empty?
+            raise Dry::Struct::Error, "Must specify one of: #{field_names.join(', ')}"
+          end
+        end
+
+        def skip_validation_for_refs?(attrs, *field_names)
+          field_names.any? { |f| Pangea::Resources::BaseAttributes.terraform_reference?(attrs.public_send(f).to_s) }
+        end
+      end
+    end
+  end
+end