pangea 0.0.42 → 0.0.45

data/lib/pangea/components/sustainable_ml_training/types.rb

@@ -0,0 +1,234 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require "dry-struct"
+require "dry-types"
+
+module Pangea
+  module Components
+    module SustainableMLTraining
+      module Types
+        include Dry.Types()
+
+        # Enums for ML training strategies
+        TrainingStrategy = Types::Coercible::String.enum(
+          'carbon_aware_scheduling',    # Schedule based on carbon intensity
+          'efficient_architecture',     # Use efficient model architectures
+          'mixed_precision',           # FP16/BF16 training
+          'gradient_checkpointing',    # Trade compute for memory
+          'federated_learning'         # Distributed edge training
+        )
+
+        ModelType = Types::Coercible::String.enum(
+          'computer_vision',
+          'natural_language',
+          'tabular_data',
+          'reinforcement_learning',
+          'generative_ai',
+          'time_series'
+        )
+
+        ComputeOptimization = Types::Coercible::String.enum(
+          'none',
+          'mixed_precision',
+          'quantization',
+          'pruning',
+          'distillation',
+          'neural_architecture_search'
+        )
+
+        InstancePriority = Types::Coercible::String.enum(
+          'gpu_efficient',    # A100, H100 (better perf/watt)
+          'cost_optimized',   # Older GPUs, spot
+          'carbon_optimized', # Graviton, renewable regions
+          'balanced'          # Mix of factors
+        )
+
+        # Input structure for sustainable ML training
+        class Input < Dry::Struct
+          attribute :name, Types::Strict::String
+          attribute :model_type, ModelType
+          
+          # Training configuration
+          attribute :training_strategy, TrainingStrategy.default('carbon_aware_scheduling')
+          attribute :dataset_size_gb, Types::Coercible::Float
+          attribute :estimated_training_hours, Types::Coercible::Float
+          attribute :checkpoint_frequency_minutes, Types::Coercible::Integer.default(30)
+          
+          # Compute optimization
+          attribute :compute_optimization, ComputeOptimization.default('mixed_precision')
+          attribute :enable_model_compression, Types::Strict::Bool.default(true)
+          attribute :target_model_size_reduction, Types::Coercible::Float.default(0.5)
+          
+          # Instance configuration
+          attribute :instance_priority, InstancePriority.default('carbon_optimized')
+          attribute :preferred_instance_types, Types::Array.of(Types::Strict::String).default([
+            'ml.p4d.24xlarge',    # 8x A100 GPUs - most efficient
+            'ml.p3.16xlarge',     # 8x V100 GPUs
+            'ml.g5.48xlarge',     # 8x A10G GPUs - good perf/cost
+            'ml.g4dn.12xlarge',   # 4x T4 GPUs - cost effective
+            'ml.trn1.32xlarge'    # 16x Trainium - AWS ML chips
+          ].freeze)
+          attribute :min_gpu_memory_gb, Types::Coercible::Integer.default(16)
+          
+          # Carbon optimization
+          attribute :carbon_intensity_threshold, Types::Coercible::Integer.default(150)
+          attribute :preferred_training_regions, Types::Array.of(Types::Strict::String).default([
+            'us-west-2',     # Oregon - renewable
+            'eu-north-1',    # Stockholm - renewable
+            'ca-central-1',  # Montreal - hydro
+            'eu-west-1'      # Ireland - carbon neutral
+          ].freeze)
+          attribute :enable_cross_region_training, Types::Strict::Bool.default(true)
+          
+          # Spot instance configuration
+          attribute :use_spot_instances, Types::Strict::Bool.default(true)
+          attribute :spot_interruption_behavior, Types::Strict::String.default('checkpoint')
+          attribute :max_spot_price_percentage, Types::Coercible::Integer.default(80)
+          
+          # Model efficiency settings
+          attribute :enable_early_stopping, Types::Strict::Bool.default(true)
+          attribute :early_stopping_patience, Types::Coercible::Integer.default(5)
+          attribute :enable_automatic_mixed_precision, Types::Strict::Bool.default(true)
+          attribute :enable_gradient_accumulation, Types::Strict::Bool.default(true)
+          
+          # Data efficiency
+          attribute :enable_data_augmentation, Types::Strict::Bool.default(true)
+          attribute :cache_dataset_in_memory, Types::Strict::Bool.default(false)
+          attribute :num_data_loader_workers, Types::Coercible::Integer.default(4)
+          
+          # Monitoring and reporting
+          attribute :track_carbon_emissions, Types::Strict::Bool.default(true)
+          attribute :track_energy_usage, Types::Strict::Bool.default(true)
+          attribute :enable_experiment_tracking, Types::Strict::Bool.default(true)
+          
+          # Storage configuration
+          attribute :s3_bucket_name, Types::Strict::String
+          attribute :use_fsx_lustre, Types::Strict::Bool.default(true)
+          attribute :enable_model_caching, Types::Strict::Bool.default(true)
+          
+          # Tags
+          attribute :tags, Types::Hash.map(Types::Coercible::String, Types::Coercible::String).default({})
+
+          def self.example
+            new(
+              name: "sustainable-bert-training",
+              model_type: "natural_language",
+              dataset_size_gb: 100.0,
+              estimated_training_hours: 24.0,
+              s3_bucket_name: "my-ml-training-bucket",
+              training_strategy: "carbon_aware_scheduling",
+              compute_optimization: "mixed_precision",
+              use_spot_instances: true,
+              tags: {
+                "Project" => "nlp-research",
+                "Sustainability" => "optimized"
+              }
+            )
+          end
+        end
+
+        # Output structure containing created resources
+        class Output < Dry::Struct
+          # SageMaker resources
+          attribute :training_job, Types::Any
+          attribute :model, Types::Any.optional
+          attribute :endpoint, Types::Any.optional
+          
+          # Compute resources  
+          attribute :spot_fleet, Types::Any.optional
+          attribute :instance_profile, Types::Any
+          
+          # Storage resources
+          attribute :s3_bucket, Types::Any
+          attribute :fsx_filesystem, Types::Any.optional
+          attribute :model_cache_bucket, Types::Any.optional
+          
+          # Lambda functions
+          attribute :carbon_scheduler_function, Types::Any
+          attribute :training_optimizer_function, Types::Any
+          attribute :efficiency_monitor_function, Types::Any
+          
+          # Monitoring resources
+          attribute :experiment_tracking, Types::Any.optional
+          attribute :carbon_dashboard, Types::Any
+          attribute :training_metrics, Types::Array.of(Types::Any)
+          attribute :efficiency_alarms, Types::Array.of(Types::Any)
+          
+          # DynamoDB tables
+          attribute :training_state_table, Types::Any
+          attribute :carbon_tracking_table, Types::Any
+          
+          # IAM roles
+          attribute :sagemaker_role, Types::Any
+          attribute :lambda_role, Types::Any
+          
+          def training_job_name
+            training_job.training_job_name
+          end
+          
+          def dashboard_url
+            "https://console.aws.amazon.com/cloudwatch/home?region=#{carbon_dashboard.region}#dashboards:name=#{carbon_dashboard.dashboard_name}"
+          end
+          
+          def model_artifacts_location
+            "s3://#{s3_bucket.bucket}/models/"
+          end
+        end
+
+        # Carbon intensity for different training approaches
+        TRAINING_CARBON_INTENSITY = {
+          'standard' => 1.0,           # Baseline
+          'mixed_precision' => 0.6,    # 40% reduction
+          'quantization' => 0.5,       # 50% reduction
+          'pruning' => 0.4,           # 60% reduction
+          'distillation' => 0.3,      # 70% reduction
+          'efficient_architecture' => 0.4  # 60% reduction
+        }.freeze
+
+        # GPU efficiency ratings (performance per watt)
+        GPU_EFFICIENCY = {
+          'A100' => 1.0,      # Baseline - most efficient
+          'H100' => 1.2,      # 20% better than A100
+          'V100' => 0.6,      # 40% less efficient
+          'T4' => 0.7,        # Good for inference
+          'A10G' => 0.8,      # Balanced
+          'Trainium' => 1.1   # AWS custom chip
+        }.freeze
+
+        # Validation methods
+        def self.validate_dataset_size(size_gb)
+          raise ArgumentError, "Dataset size must be positive" if size_gb <= 0
+          raise ArgumentError, "Dataset size exceeds 10TB limit" if size_gb > 10_000
+        end
+
+        def self.validate_training_hours(hours)
+          raise ArgumentError, "Training hours must be positive" if hours <= 0
+          raise ArgumentError, "Training exceeds 7 day limit" if hours > 168
+        end
+
+        def self.validate_carbon_threshold(threshold)
+          raise ArgumentError, "Carbon threshold must be between 0 and 1000 gCO2/kWh" unless (0..1000).include?(threshold)
+        end
+
+        def self.validate_model_compression(enable_compression, target_reduction)
+          return unless enable_compression
+          raise ArgumentError, "Target reduction must be between 0 and 1" unless (0..1).include?(target_reduction)
+        end
+      end
+    end
+  end
+end

data/lib/pangea/components/threat_intelligence_platform/types.rb

@@ -0,0 +1,203 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'dry-struct'
+require 'pangea/components/types'
+
+module Pangea
+  module Components
+    module ThreatIntelligencePlatform
+      # Threat Intelligence Platform attributes
+      class Attributes < Dry::Struct
+        transform_keys(&:to_sym)
+        schema schema.strict
+        
+        # VPC reference for deployment
+        attribute :vpc_ref, Types::VpcReference
+        
+        # Subnet references for Lambda functions
+        attribute :subnet_refs, Types::SubnetReferences
+        
+        # Threat intelligence sources
+        attribute :threat_sources, Types::Array.of(
+          Types::Hash.schema(
+            name: Types::String,
+            type: Types::String.enum('osint', 'commercial', 'government', 'custom', 'community'),
+            category: Types::String.enum('ip', 'domain', 'url', 'hash', 'email', 'cve', 'ttp', 'ioc'),
+            source_url?: Types::String.optional,
+            api_endpoint?: Types::String.optional,
+            api_key_secret_arn?: Types::String.optional,
+            format: Types::String.enum('stix', 'taxii', 'json', 'csv', 'xml', 'misp').default('json'),
+            polling_interval: Types::Integer.default(3600).constrained(gteq: 300),
+            confidence_threshold?: Types::Integer.default(70).constrained(gteq: 0, lteq: 100),
+            enabled?: Types::Bool.default(true),
+            authentication?: Types::Hash.schema(
+              type: Types::String.enum('none', 'api_key', 'oauth', 'basic'),
+              credentials_secret_arn?: Types::String.optional
+            ).optional
+          )
+        ).constrained(min_size: 1)
+        
+        # IOC (Indicator of Compromise) processing
+        attribute :ioc_processing, Types::Hash.schema(
+          enable_deduplication?: Types::Bool.default(true),
+          enable_enrichment?: Types::Bool.default(true),
+          enable_validation?: Types::Bool.default(true),
+          enable_normalization?: Types::Bool.default(true),
+          retention_days?: Types::Integer.default(90).constrained(gteq: 1, lteq: 3653),
+          archive_after_days?: Types::Integer.default(30).constrained(gteq: 1, lteq: 365),
+          max_ioc_age_days?: Types::Integer.default(180).constrained(gteq: 1, lteq: 730)
+        ).default({}.freeze)
+        
+        # Threat scoring configuration
+        attribute :threat_scoring, Types::Hash.schema(
+          scoring_model: Types::String.enum('weighted', 'ml_based', 'rule_based', 'hybrid').default('hybrid'),
+          base_scores?: Types::Hash.schema(
+            ip: Types::Integer.default(60),
+            domain: Types::Integer.default(70),
+            url: Types::Integer.default(75),
+            hash: Types::Integer.default(90),
+            email: Types::Integer.default(50)
+          ).default({}.freeze),
+          source_weights?: Types::Hash.default({}.freeze),
+          decay_enabled?: Types::Bool.default(true),
+          decay_rate?: Types::Float.default(0.95).constrained(gteq: 0.0, lteq: 1.0),
+          confidence_multiplier?: Types::Float.default(1.2).constrained(gteq: 0.5, lteq: 2.0)
+        ).default({}.freeze)
+        
+        # Enrichment sources
+        attribute :enrichment_sources, Types::Array.of(
+          Types::Hash.schema(
+            name: Types::String,
+            type: Types::String.enum('geoip', 'whois', 'dns', 'asn', 'reputation', 'sandbox', 'virustotal'),
+            api_endpoint?: Types::String.optional,
+            api_key_secret_arn?: Types::String.optional,
+            enabled?: Types::Bool.default(true),
+            cache_ttl?: Types::Integer.default(86400)
+          )
+        ).default([
+          { name: 'GeoIP', type: 'geoip', enabled: true },
+          { name: 'WHOIS', type: 'whois', enabled: true },
+          { name: 'DNS', type: 'dns', enabled: true }
+        ].freeze)
+        
+        # Threat feed integration
+        attribute :threat_feeds, Types::Array.of(
+          Types::Hash.schema(
+            name: Types::String,
+            description?: Types::String.optional,
+            feed_url?: Types::String.optional,
+            feed_type: Types::String.enum('public', 'private', 'sharing_group'),
+            tlp_level: Types::String.enum('white', 'green', 'amber', 'red').default('amber'),
+            sharing_enabled?: Types::Bool.default(false),
+            auto_publish?: Types::Bool.default(false),
+            tags?: Types::Array.of(Types::String).default([].freeze)
+          )
+        ).default([].freeze)
+        
+        # Correlation rules
+        attribute :correlation_rules, Types::Array.of(
+          Types::Hash.schema(
+            name: Types::String,
+            description: Types::String,
+            rule_type: Types::String.enum('simple', 'complex', 'ml_based', 'graph_based'),
+            conditions: Types::Array.of(Types::Hash),
+            actions: Types::Array.of(
+              Types::String.enum('alert', 'enrich', 'block', 'investigate', 'share')
+            ).default(['alert'].freeze),
+            severity: Types::String.enum('critical', 'high', 'medium', 'low').default('medium'),
+            enabled?: Types::Bool.default(true)
+          )
+        ).default([].freeze)
+        
+        # Automated response configuration
+        attribute :automated_response, Types::Hash.schema(
+          enable_auto_blocking?: Types::Bool.default(false),
+          blocking_threshold?: Types::Integer.default(90).constrained(gteq: 50, lteq: 100),
+          enable_auto_investigation?: Types::Bool.default(true),
+          investigation_threshold?: Types::Integer.default(70).constrained(gteq: 50, lteq: 100),
+          enable_auto_sharing?: Types::Bool.default(false),
+          sharing_threshold?: Types::Integer.default(80).constrained(gteq: 50, lteq: 100),
+          response_playbooks?: Types::Array.of(
+            Types::Hash.schema(
+              name: Types::String,
+              trigger_score: Types::Integer,
+              actions: Types::Array.of(Types::String)
+            )
+          ).default([].freeze)
+        ).default({}.freeze)
+        
+        # Threat hunting features
+        attribute :threat_hunting, Types::Hash.schema(
+          enable_proactive_hunting?: Types::Bool.default(true),
+          hunting_queries?: Types::Array.of(
+            Types::Hash.schema(
+              name: Types::String,
+              query: Types::String,
+              schedule: Types::String.enum('hourly', 'daily', 'weekly').default('daily'),
+              enabled?: Types::Bool.default(true)
+            )
+          ).default([].freeze),
+          enable_ml_hunting?: Types::Bool.default(true),
+          anomaly_detection_models?: Types::Array.of(Types::String).default([].freeze)
+        ).default({}.freeze)
+        
+        # API configuration for sharing
+        attribute :api_config, Types::Hash.schema(
+          enable_api?: Types::Bool.default(true),
+          rate_limiting?: Types::Hash.schema(
+            requests_per_minute: Types::Integer.default(100),
+            requests_per_hour: Types::Integer.default(1000),
+            requests_per_day: Types::Integer.default(10000)
+          ).default({}.freeze),
+          authentication_required?: Types::Bool.default(true),
+          allowed_operations?: Types::Array.of(
+            Types::String.enum('read', 'write', 'update', 'delete', 'share')
+          ).default(['read'].freeze)
+        ).default({}.freeze)
+        
+        # Reporting and analytics
+        attribute :reporting_config, Types::Hash.schema(
+          enable_daily_reports?: Types::Bool.default(true),
+          enable_weekly_reports?: Types::Bool.default(true),
+          enable_threat_landscape?: Types::Bool.default(true),
+          report_recipients?: Types::Array.of(Types::String).default([].freeze),
+          custom_reports?: Types::Array.of(
+            Types::Hash.schema(
+              name: Types::String,
+              schedule: Types::String,
+              query: Types::String,
+              format: Types::String.enum('pdf', 'html', 'json', 'csv').default('pdf')
+            )
+          ).default([].freeze)
+        ).default({}.freeze)
+        
+        # Storage configuration
+        attribute :storage_config, Types::Hash.schema(
+          primary_storage: Types::String.enum('dynamodb', 'elasticsearch', 'both').default('both'),
+          enable_compression?: Types::Bool.default(true),
+          enable_archival?: Types::Bool.default(true),
+          archive_storage: Types::String.enum('s3', 'glacier').default('s3'),
+          enable_replication?: Types::Bool.default(true),
+          replication_regions?: Types::Array.of(Types::String).default([].freeze)
+        ).default({}.freeze)
+        
+        # Tags for resource management
+        attribute :tags, Types::AwsTags.default({}.freeze)
+      end
+    end
+  end
+end

data/lib/pangea/components/types.rb

@@ -0,0 +1,198 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'dry-struct'
+require 'dry-types'
+require 'pangea/resources/types'
+
+module Pangea
+  module Components
+    # Common types for component definitions
+    module Types
+      include Dry.Types()
+      include Pangea::Resources::Types
+      
+      # Component-specific composite types
+      
+      # Multiple availability zones specification
+      AvailabilityZones = Array.of(AwsAvailabilityZone).constrained(min_size: 1, max_size: 6)
+      
+      # CIDR blocks for subnet allocation
+      SubnetCidrBlocks = Array.of(CidrBlock).constrained(min_size: 1, max_size: 10)
+      
+      # Security group rules collection
+      SecurityGroupRules = Array.of(SecurityGroupRule).default([].freeze)
+      
+      # Component naming validation (alphanumeric, underscores, hyphens)
+      ComponentName = String.constrained(
+        format: /\A[a-zA-Z][a-zA-Z0-9_-]*\z/,
+        max_size: 64
+      )
+      
+      # VPC reference validation (either ResourceReference or Terraform reference string)
+      VpcReference = String | Pangea::Resources::ResourceReference
+      
+      # Subnet references (array of ResourceReference objects or Terraform reference strings)
+      SubnetReferences = Array.of(String | Pangea::Resources::ResourceReference)
+      
+      # Security group references
+      SecurityGroupReferences = Array.of(String | Pangea::Resources::ResourceReference)
+      
+      # Route table references  
+      RouteTableReferences = Array.of(String | Pangea::Resources::ResourceReference)
+      
+      # Internet gateway reference
+      InternetGatewayReference = String | Pangea::Resources::ResourceReference
+      
+      # NAT gateway reference
+      NatGatewayReference = String | Pangea::Resources::ResourceReference
+      
+      # Component feature flags
+      ComponentFeatureFlags = Hash.schema(
+        enable_flow_logs?: Bool.default(true),
+        enable_dns_hostnames?: Bool.default(true),
+        enable_dns_support?: Bool.default(true),
+        create_nat_gateway?: Bool.default(true),
+        create_internet_gateway?: Bool.default(true),
+        enable_monitoring?: Bool.default(true)
+      ).default({}.freeze)
+      
+      # High availability configuration
+      HighAvailabilityConfig = Hash.schema(
+        multi_az: Bool.default(true),
+        min_availability_zones: Integer.default(2).constrained(gteq: 1, lteq: 6),
+        distribute_evenly: Bool.default(true)
+      ).default({}.freeze)
+      
+      # Security configuration for components
+      SecurityConfig = Hash.schema(
+        enable_flow_logs?: Bool.default(true),
+        flow_log_destination?: String.default('cloud-watch-logs').enum('cloud-watch-logs', 's3'),
+        restrict_default_sg?: Bool.default(true),
+        enable_nacl_logging?: Bool.default(false),
+        encryption_at_rest?: Bool.default(true),
+        encryption_in_transit?: Bool.default(true)
+      ).default({}.freeze)
+      
+      # Cost optimization configuration
+      CostConfig = Hash.schema(
+        use_spot_instances?: Bool.default(false),
+        enable_savings_plans?: Bool.default(false),
+        lifecycle_policies?: Bool.default(true),
+        right_sizing?: Bool.default(true)
+      ).default({}.freeze)
+      
+      # Monitoring and alerting configuration
+      MonitoringConfig = Hash.schema(
+        enable_cloudwatch?: Bool.default(true),
+        enable_detailed_monitoring?: Bool.default(false),
+        create_alarms?: Bool.default(true),
+        log_retention_days?: Integer.default(30).constrained(gteq: 1, lteq: 3653),
+        enable_xray?: Bool.default(false)
+      ).default({}.freeze)
+      
+      # Network topology patterns
+      NetworkTopology = String.enum(
+        'single-tier',     # All resources in public subnets
+        'two-tier',        # Public and private subnets
+        'three-tier',      # Public, private, and database subnets
+        'multi-tier'       # Custom multi-tier configuration
+      )
+      
+      # Component deployment patterns
+      DeploymentPattern = String.enum(
+        'development',     # Single AZ, minimal redundancy
+        'staging',         # Multi-AZ, moderate redundancy
+        'production',      # Multi-AZ, high redundancy
+        'disaster-recovery' # Cross-region, maximum redundancy
+      )
+      
+      # Load balancing configuration
+      LoadBalancingConfig = Hash.schema(
+        type: LoadBalancerType,
+        scheme: String.default('internet-facing').enum('internet-facing', 'internal'),
+        enable_deletion_protection?: Bool.default(false),
+        enable_cross_zone?: Bool.default(true),
+        idle_timeout?: Integer.default(60).constrained(gteq: 1, lteq: 4000)
+      ).default({}.freeze)
+      
+      # Auto scaling configuration
+      AutoScalingConfig = Hash.schema(
+        min_size: Integer.default(1).constrained(gteq: 0),
+        max_size: Integer.default(3).constrained(gteq: 1),
+        desired_capacity?: Integer.optional,
+        target_group_arns?: Array.of(String).default([].freeze),
+        health_check_type?: String.default('EC2').enum('EC2', 'ELB'),
+        health_check_grace_period?: Integer.default(300).constrained(gteq: 0)
+      ).default({}.freeze)
+      
+      # Database configuration
+      DatabaseConfig = Hash.schema(
+        engine: RdsEngine,
+        engine_version?: String.optional,
+        instance_class: RdsInstanceClass,
+        allocated_storage?: Integer.default(20).constrained(gteq: 20),
+        multi_az?: Bool.default(false),
+        backup_retention_period?: Integer.default(7).constrained(gteq: 0, lteq: 35),
+        enable_encryption?: Bool.default(true)
+      )
+      
+      # Port configuration for security groups
+      PortConfig = Hash.schema(
+        http: Port.default(80),
+        https: Port.default(443),
+        ssh: Port.default(22),
+        custom_ports?: Array.of(Port).default([].freeze)
+      ).default({}.freeze)
+      
+      # Custom validation for subnet CIDR distribution
+      SubnetCidrDistribution = Hash.schema(
+        public_cidrs: SubnetCidrBlocks,
+        private_cidrs?: SubnetCidrBlocks.optional,
+        database_cidrs?: SubnetCidrBlocks.optional
+      ).constructor { |value|
+        # Validate that CIDR blocks don't overlap
+        all_cidrs = []
+        all_cidrs.concat(value[:public_cidrs] || [])
+        all_cidrs.concat(value[:private_cidrs] || [])
+        all_cidrs.concat(value[:database_cidrs] || [])
+        
+        # Basic overlap detection (simplified)
+        if all_cidrs.uniq.length != all_cidrs.length
+          raise Dry::Types::ConstraintError, "Duplicate CIDR blocks found in subnet distribution"
+        end
+        
+        # Ensure public subnets exist
+        if (value[:public_cidrs] || []).empty?
+          raise Dry::Types::ConstraintError, "At least one public subnet CIDR is required"
+        end
+        
+        value
+      }
+      
+      # Tagging strategy configuration
+      TaggingConfig = Hash.schema(
+        environment?: String.optional,
+        project?: String.optional,
+        owner?: String.optional,
+        cost_center?: String.optional,
+        backup?: Bool.optional,
+        auto_scaling?: Bool.optional,
+        custom_tags?: AwsTags.default({}.freeze)
+      ).default({}.freeze)
+    end
+  end
+end