pangea 0.0.45 → 0.0.46

data/lib/pangea/resources/aws_sns_topic/types.rb

@@ -1,193 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-require 'dry-struct'
-require 'pangea/resources/types'
-
-module Pangea
-  module Resources
-    module AWS
-      module Types
-        # Type-safe attributes for AWS SNS Topic resources
-        class SNSTopicAttributes < Dry::Struct
-        transform_keys(&:to_sym)
-
-        # Topic name (optional - AWS will generate if not provided)
-        attribute :name, Pangea::Resources::Types::String.optional
-
-        # Display name for the topic
-        attribute :display_name, Pangea::Resources::Types::String.optional
-
-        # KMS encryption key
-        attribute :kms_master_key_id, Pangea::Resources::Types::String.optional
-
-        # FIFO topic (requires .fifo suffix in name)
-        attribute :fifo_topic, Pangea::Resources::Types::Bool.default(false)
-
-        # Content-based deduplication for FIFO topics
-        attribute :content_based_deduplication, Pangea::Resources::Types::Bool.default(false)
-
-        # Delivery policy (JSON string)
-        attribute :delivery_policy, Pangea::Resources::Types::String.optional
-
-        # SNS topic policy (JSON string)
-        attribute :policy, Pangea::Resources::Types::String.optional
-
-        # Message delivery status attributes
-        attribute :application_success_feedback_role_arn, Pangea::Resources::Types::String.optional.default(nil)
-        attribute :application_success_feedback_sample_rate, Pangea::Resources::Types::Integer.constrained(gteq: 0, lteq: 100).optional.default(nil)
-        attribute :application_failure_feedback_role_arn, Pangea::Resources::Types::String.optional.default(nil)
-
-        attribute :http_success_feedback_role_arn, Pangea::Resources::Types::String.optional.default(nil)
-        attribute :http_success_feedback_sample_rate, Pangea::Resources::Types::Integer.constrained(gteq: 0, lteq: 100).optional.default(nil)
-        attribute :http_failure_feedback_role_arn, Pangea::Resources::Types::String.optional.default(nil)
-
-        attribute :lambda_success_feedback_role_arn, Pangea::Resources::Types::String.optional.default(nil)
-        attribute :lambda_success_feedback_sample_rate, Pangea::Resources::Types::Integer.constrained(gteq: 0, lteq: 100).optional.default(nil)
-        attribute :lambda_failure_feedback_role_arn, Pangea::Resources::Types::String.optional.default(nil)
-
-        attribute :sqs_success_feedback_role_arn, Pangea::Resources::Types::String.optional.default(nil)
-        attribute :sqs_success_feedback_sample_rate, Pangea::Resources::Types::Integer.constrained(gteq: 0, lteq: 100).optional.default(nil)
-        attribute :sqs_failure_feedback_role_arn, Pangea::Resources::Types::String.optional.default(nil)
-
-        attribute :firehose_success_feedback_role_arn, Pangea::Resources::Types::String.optional.default(nil)
-        attribute :firehose_success_feedback_sample_rate, Pangea::Resources::Types::Integer.constrained(gteq: 0, lteq: 100).optional.default(nil)
-        attribute :firehose_failure_feedback_role_arn, Pangea::Resources::Types::String.optional.default(nil)
-
-        # Message data protection policy (JSON string)
-        attribute :message_data_protection_policy, Pangea::Resources::Types::String.optional
-
-        # Tracing configuration
-        attribute :tracing_config, Pangea::Resources::Types::String.constrained(included_in: ['Active', 'PassThrough']).optional
-
-        # Tags
-        attribute :tags, Pangea::Resources::Types::AwsTags.default({})
-
-        # Custom validation
-        def self.new(attributes = {})
-          attrs = super(attributes)
-
-          # Validate FIFO topic naming convention
-          if attrs.fifo_topic && attrs.name && !attrs.name.end_with?('.fifo')
-            raise Dry::Struct::Error, "FIFO topic names must end with '.fifo' suffix"
-          end
-
-          # Validate non-FIFO topic naming convention
-          if !attrs.fifo_topic && attrs.name && attrs.name.end_with?('.fifo')
-            raise Dry::Struct::Error, "Standard topic names cannot end with '.fifo' suffix"
-          end
-
-          # Validate FIFO-only attributes
-          if !attrs.fifo_topic && attrs.content_based_deduplication
-            raise Dry::Struct::Error, "content_based_deduplication is only valid for FIFO topics"
-          end
-
-          # Validate delivery policy is valid JSON if provided
-          if attrs.delivery_policy
-            begin
-              JSON.parse(attrs.delivery_policy)
-            rescue JSON::ParserError => e
-              raise Dry::Struct::Error, "delivery_policy must be valid JSON: #{e.message}"
-            end
-          end
-
-          # Validate policy is valid JSON if provided
-          if attrs.policy
-            begin
-              JSON.parse(attrs.policy)
-            rescue JSON::ParserError => e
-              raise Dry::Struct::Error, "policy must be valid JSON: #{e.message}"
-            end
-          end
-
-          # Validate message data protection policy is valid JSON if provided
-          if attrs.message_data_protection_policy
-            begin
-              JSON.parse(attrs.message_data_protection_policy)
-            rescue JSON::ParserError => e
-              raise Dry::Struct::Error, "message_data_protection_policy must be valid JSON: #{e.message}"
-            end
-          end
-
-          # Validate feedback sample rates are provided with role ARNs
-          %w[application http lambda sqs firehose].each do |protocol|
-            sample_rate_attr = "#{protocol}_success_feedback_sample_rate"
-            role_arn_attr = "#{protocol}_success_feedback_role_arn"
-            
-            if attrs.send(sample_rate_attr) && !attrs.send(role_arn_attr)
-              raise Dry::Struct::Error, "#{sample_rate_attr} requires #{role_arn_attr} to be set"
-            end
-          end
-
-          attrs
-        end
-
-        # Helper methods
-        def is_fifo?
-          fifo_topic
-        end
-
-        def is_encrypted?
-          kms_master_key_id.present?
-        end
-
-        def has_delivery_policy?
-          delivery_policy.present?
-        end
-
-        def has_access_policy?
-          policy.present?
-        end
-
-        def has_data_protection?
-          message_data_protection_policy.present?
-        end
-
-        def has_feedback_enabled?
-          application_success_feedback_role_arn.present? ||
-          application_failure_feedback_role_arn.present? ||
-          http_success_feedback_role_arn.present? ||
-          http_failure_feedback_role_arn.present? ||
-          lambda_success_feedback_role_arn.present? ||
-          lambda_failure_feedback_role_arn.present? ||
-          sqs_success_feedback_role_arn.present? ||
-          sqs_failure_feedback_role_arn.present? ||
-          firehose_success_feedback_role_arn.present? ||
-          firehose_failure_feedback_role_arn.present?
-        end
-
-        def feedback_protocols
-          protocols = []
-          protocols << 'application' if application_success_feedback_role_arn || application_failure_feedback_role_arn
-          protocols << 'http' if http_success_feedback_role_arn || http_failure_feedback_role_arn
-          protocols << 'lambda' if lambda_success_feedback_role_arn || lambda_failure_feedback_role_arn
-          protocols << 'sqs' if sqs_success_feedback_role_arn || sqs_failure_feedback_role_arn
-          protocols << 'firehose' if firehose_success_feedback_role_arn || firehose_failure_feedback_role_arn
-          protocols
-        end
-
-        def topic_type
-          fifo_topic ? 'FIFO' : 'Standard'
-        end
-
-        def tracing_enabled?
-          tracing_config == 'Active'
-        end
-      end
-    end
-  end
-end
-end

data/lib/pangea/resources/aws_sqs_queue/CLAUDE.md

@@ -1,190 +0,0 @@
-# AWS SQS Queue Implementation
-
-## Overview
-
-The `aws_sqs_queue` resource provides a type-safe implementation for AWS Simple Queue Service (SQS) queues, supporting both Standard and FIFO queue types with comprehensive configuration options for message processing, encryption, and fault tolerance.
-
-## Implementation Details
-
-### Type System (types.rb)
-
-The `SQSQueueAttributes` class uses dry-struct for runtime validation with the following key validations:
-
-1. **Queue Naming Validation**:
-   - FIFO queues must end with `.fifo` suffix
-   - Standard queues cannot end with `.fifo` suffix
-   - Enforced through custom validation in `self.new`
-
-2. **Constraint Validations**:
-   - `visibility_timeout_seconds`: 0-43200 (12 hours)
-   - `message_retention_seconds`: 60-1209600 (14 days)
-   - `max_message_size`: 1024-262144 bytes (256KB)
-   - `delay_seconds`: 0-900 (15 minutes)
-   - `receive_wait_time_seconds`: 0-20 (long polling)
-   - `kms_data_key_reuse_period_seconds`: 60-86400 (1 day)
-
-3. **FIFO-Specific Validations**:
-   - `content_based_deduplication` only valid for FIFO queues
-   - `deduplication_scope` only valid for FIFO queues
-   - `fifo_throughput_limit` only valid for FIFO queues
-
-4. **Policy Validations**:
-   - `redrive_allow_policy` requires `sourceQueueArns` when `redrivePermission` is "byQueue"
-   - Cannot enable both KMS and SQS-managed encryption simultaneously
-
-### Resource Function (resource.rb)
-
-The `aws_sqs_queue` function:
-
-1. **Validates Input**: Uses `SQSQueueAttributes` for type safety
-2. **Generates Terraform**: Creates `aws_sqs_queue` resource block
-3. **Handles JSON Policies**: Converts Ruby hashes to JSON for policies
-4. **Returns Reference**: Provides typed reference with outputs
-
-Key implementation details:
-- Conditionally adds FIFO-specific attributes only for FIFO queues
-- Serializes `redrive_policy` and `redrive_allow_policy` to JSON
-- Handles mutually exclusive encryption options
-- Provides computed properties for queue analysis
-
-### Helper Methods
-
-The type class provides several helper methods:
-- `is_fifo?` - Check if FIFO queue
-- `is_encrypted?` - Check if any encryption is enabled
-- `has_dlq?` - Check if dead letter queue is configured
-- `long_polling_enabled?` - Check if long polling is active
-- `is_delay_queue?` - Check if delay is configured
-- `allows_all_sources?` - Check DLQ source permissions
-- `queue_type` - Return "Standard" or "FIFO"
-- `encryption_type` - Return "KMS", "SQS-SSE", or "None"
-
-## Design Decisions
-
-### 1. Queue Name Validation
-We enforce the `.fifo` suffix convention at the type level rather than auto-appending it. This makes the queue type explicit and prevents confusion.
-
-### 2. JSON Policy Handling
-Policies are serialized to JSON within the resource function rather than expecting pre-serialized strings. This allows for better validation and type safety.
-
-### 3. Encryption Options
-KMS and SQS-managed encryption are mutually exclusive by AWS design. We validate this at the type level to catch configuration errors early.
-
-### 4. Default Values
-Conservative defaults are chosen:
-- 30 seconds visibility timeout (enough for simple tasks)
-- 4 days message retention (balanced between storage and recovery)
-- Long polling disabled by default (opt-in for optimization)
-
-### 5. Computed Properties
-Rich computed properties enable infrastructure analysis and conditional logic in templates without manual computation.
-
-## Testing Considerations
-
-When testing SQS queue configurations:
-
-1. **Queue Type Tests**:
-   ```ruby
-   # Standard queue
-   expect { aws_sqs_queue(:test, { name: "test.fifo", fifo_queue: false }) }
-     .to raise_error(Dry::Struct::Error)
-   
-   # FIFO queue
-   expect { aws_sqs_queue(:test, { name: "test", fifo_queue: true }) }
-     .to raise_error(Dry::Struct::Error)
-   ```
-
-2. **Encryption Tests**:
-   ```ruby
-   # Mutual exclusion
-   expect { 
-     aws_sqs_queue(:test, { 
-       name: "test",
-       kms_master_key_id: "key",
-       sqs_managed_sse_enabled: true 
-     }) 
-   }.to raise_error(Dry::Struct::Error)
-   ```
-
-3. **DLQ Configuration Tests**:
-   ```ruby
-   # Valid DLQ setup
-   dlq = aws_sqs_queue(:dlq, { name: "dlq" })
-   main = aws_sqs_queue(:main, {
-     name: "main",
-     redrive_policy: {
-       deadLetterTargetArn: dlq.arn,
-       maxReceiveCount: 3
-     }
-   })
-   ```
-
-## Integration Patterns
-
-### With Lambda Functions
-```ruby
-queue = aws_sqs_queue(:events, { name: "events" })
-
-aws_lambda_event_source_mapping(:queue_processor, {
-  event_source_arn: queue.arn,
-  function_name: lambda_function.name
-})
-```
-
-### With SNS Topics
-```ruby
-topic = aws_sns_topic(:alerts, { name: "alerts" })
-queue = aws_sqs_queue(:alert_queue, { name: "alert-queue" })
-
-aws_sns_subscription(:queue_sub, {
-  topic_arn: topic.arn,
-  protocol: "sqs",
-  endpoint: queue.arn
-})
-```
-
-### With IAM Policies
-```ruby
-queue = aws_sqs_queue(:app_queue, { name: "app-queue" })
-
-policy_document = {
-  Version: "2012-10-17",
-  Statement: [{
-    Effect: "Allow",
-    Action: ["sqs:SendMessage", "sqs:ReceiveMessage"],
-    Resource: queue.arn
-  }]
-}
-```
-
-## Performance Considerations
-
-1. **Long Polling**: Enable `receive_wait_time_seconds` to reduce API calls and costs
-2. **Batch Operations**: Design consumers to use batch receive/delete operations
-3. **Message Size**: Keep messages small; use S3 for large payloads
-4. **FIFO Throughput**: Use `perQueue` limit for higher throughput when ordering isn't critical per message group
-
-## Security Best Practices
-
-1. **Always Enable Encryption**: Use KMS for sensitive data, SQS-SSE for general use
-2. **Implement DLQ**: Prevent message loss and enable debugging
-3. **Use Least Privilege**: Queue policies should grant minimal required permissions
-4. **Separate DLQ Access**: Use `redrive_allow_policy` to restrict DLQ access
-5. **Tag Resources**: Enable cost tracking and compliance scanning
-
-## Monitoring Integration
-
-The resource outputs enable CloudWatch alarm creation:
-```ruby
-queue = aws_sqs_queue(:critical, { name: "critical-queue" })
-
-aws_cloudwatch_metric_alarm(:queue_depth, {
-  alarm_name: "#{queue.name}-depth",
-  metric_name: "ApproximateNumberOfMessagesVisible",
-  namespace: "AWS/SQS",
-  dimensions: {
-    QueueName: queue.name
-  },
-  threshold: 1000
-})
-```

data/lib/pangea/resources/aws_sqs_queue/resource.rb

@@ -1,114 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-require 'pangea/resources/base'
-require 'pangea/resources/reference'
-require 'pangea/resources/aws_sqs_queue/types'
-require 'pangea/resource_registry'
-require 'json'
-
-module Pangea
-  module Resources
-    module AWS
-      # Create an AWS SQS Queue with type-safe attributes
-      #
-      # @param name [Symbol] The resource name
-      # @param attributes [Hash] SQS queue attributes
-      # @return [ResourceReference] Reference object with outputs and computed properties
-      def aws_sqs_queue(name, attributes = {})
-        # Validate attributes using dry-struct
-        queue_attrs = AWS::Types::Types::SQSQueueAttributes.new(attributes)
-        
-        # Generate terraform resource block via terraform-synthesizer
-        resource(:aws_sqs_queue, name) do
-          # Set queue name
-          name queue_attrs.name
-          
-          # Set queue type
-          fifo_queue queue_attrs.fifo_queue
-          
-          # FIFO-specific settings
-          if queue_attrs.fifo_queue
-            content_based_deduplication queue_attrs.content_based_deduplication
-            deduplication_scope queue_attrs.deduplication_scope
-            fifo_throughput_limit queue_attrs.fifo_throughput_limit
-          end
-          
-          # Queue configuration
-          visibility_timeout_seconds queue_attrs.visibility_timeout_seconds
-          message_retention_seconds queue_attrs.message_retention_seconds
-          max_message_size queue_attrs.max_message_size
-          delay_seconds queue_attrs.delay_seconds
-          receive_wait_time_seconds queue_attrs.receive_wait_time_seconds
-          
-          # Dead letter queue configuration
-          if queue_attrs.redrive_policy && queue_attrs.redrive_policy[:deadLetterTargetArn]
-            redrive_policy JSON.generate(queue_attrs.redrive_policy)
-          end
-          
-          # Redrive allow policy (for DLQ source queues)
-          if queue_attrs.redrive_allow_policy && queue_attrs.redrive_allow_policy.any?
-            redrive_allow_policy JSON.generate(queue_attrs.redrive_allow_policy)
-          end
-          
-          # Encryption configuration
-          if queue_attrs.kms_master_key_id
-            kms_master_key_id queue_attrs.kms_master_key_id
-            kms_data_key_reuse_period_seconds queue_attrs.kms_data_key_reuse_period_seconds
-          elsif queue_attrs.sqs_managed_sse_enabled
-            sqs_managed_sse_enabled queue_attrs.sqs_managed_sse_enabled
-          end
-          
-          # Apply queue policy if provided
-          policy queue_attrs.policy if queue_attrs.policy
-          
-          # Apply tags
-          if queue_attrs.tags.any?
-            tags queue_attrs.tags
-          end
-        end
-        
-        # Return resource reference with available outputs
-        ref = ResourceReference.new(
-          type: 'aws_sqs_queue',
-          name: name,
-          resource_attributes: queue_attrs.to_h,
-          outputs: {
-            id: "${aws_sqs_queue.#{name}.id}",
-            arn: "${aws_sqs_queue.#{name}.arn}",
-            url: "${aws_sqs_queue.#{name}.url}",
-            name: "${aws_sqs_queue.#{name}.name}"
-          }
-        )
-        
-        # Add computed properties via method delegation
-        ref.define_singleton_method(:queue_type) { queue_attrs.queue_type }
-        ref.define_singleton_method(:is_fifo?) { queue_attrs.is_fifo? }
-        ref.define_singleton_method(:is_encrypted?) { queue_attrs.is_encrypted? }
-        ref.define_singleton_method(:encryption_type) { queue_attrs.encryption_type }
-        ref.define_singleton_method(:has_dlq?) { queue_attrs.has_dlq? }
-        ref.define_singleton_method(:long_polling_enabled?) { queue_attrs.long_polling_enabled? }
-        ref.define_singleton_method(:is_delay_queue?) { queue_attrs.is_delay_queue? }
-        ref.define_singleton_method(:allows_all_sources?) { queue_attrs.allows_all_sources? }
-        
-        ref
-      end
-    end
-  end
-end
-
-# Auto-register this module when it's loaded
-Pangea::ResourceRegistry.register(:aws, Pangea::Resources::AWS)

data/lib/pangea/resources/aws_sqs_queue/types.rb

@@ -1,169 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-require 'dry-struct'
-require 'pangea/resources/types'
-
-module Pangea
-  module Resources
-    module AWS
-      module Types
-        # Type-safe attributes for AWS SQS Queue resources
-        class SQSQueueAttributes < Dry::Struct
-        transform_keys(&:to_sym)
-
-        # Queue name (required - must end with .fifo for FIFO queues)
-        attribute :name, Pangea::Resources::Types::String
-
-        # Queue type (Standard or FIFO)
-        attribute :fifo_queue, Pangea::Resources::Types::Bool.default(false)
-
-        # Content-based deduplication (FIFO queues only)
-        attribute :content_based_deduplication, Pangea::Resources::Types::Bool.default(false)
-
-        # Visibility timeout in seconds (0-43200, 12 hours max)
-        attribute :visibility_timeout_seconds, Pangea::Resources::Types::Integer.constrained(gteq: 0, lteq: 43200).default(30)
-
-        # Message retention period in seconds (60s-1209600s / 14 days)
-        attribute :message_retention_seconds, Pangea::Resources::Types::Integer.constrained(gteq: 60, lteq: 1209600).default(345600) # 4 days
-
-        # Maximum message size in bytes (1024-262144 / 256KB)
-        attribute :max_message_size, Pangea::Resources::Types::Integer.constrained(gteq: 1024, lteq: 262144).default(262144)
-
-        # Delay queue - message delivery delay in seconds (0-900)
-        attribute :delay_seconds, Pangea::Resources::Types::Integer.constrained(gteq: 0, lteq: 900).default(0)
-
-        # Receive message wait time in seconds (0-20) for long polling
-        attribute :receive_wait_time_seconds, Pangea::Resources::Types::Integer.constrained(gteq: 0, lteq: 20).default(0)
-
-        # Dead letter queue configuration
-        attribute :redrive_policy, Pangea::Resources::Types::Hash.schema(
-          deadLetterTargetArn: Pangea::Resources::Types::String,
-          maxReceiveCount: Pangea::Resources::Types::Integer.constrained(gteq: 1, lteq: 1000).default(3)
-        ).optional.default(nil)
-
-        # Allow messages from source queues (for dead letter queue)
-        attribute :redrive_allow_policy, Pangea::Resources::Types::Hash.schema(
-          redrivePermission: Pangea::Resources::Types::String.default('allowAll').constrained(included_in: ['allowAll', 'denyAll', 'byQueue']),
-          sourceQueueArns?: Pangea::Resources::Types::Array.of(Pangea::Resources::Types::String).optional
-        ).optional.default(nil)
-
-        # KMS encryption configuration
-        attribute :kms_master_key_id, Pangea::Resources::Types::String.optional.default(nil)
-
-        # KMS data key reuse period in seconds (60-86400)
-        attribute :kms_data_key_reuse_period_seconds, Pangea::Resources::Types::Integer.constrained(gteq: 60, lteq: 86400).default(300)
-
-        # Server-side encryption using SQS service key
-        attribute :sqs_managed_sse_enabled, Pangea::Resources::Types::Bool.default(false)
-
-        # Deduplication scope (FIFO only) - messageGroup or queue
-        attribute :deduplication_scope, Pangea::Resources::Types::String.default('queue').constrained(included_in: ['messageGroup', 'queue'])
-
-        # FIFO throughput limit (FIFO only) - perMessageGroupId or perQueue
-        attribute :fifo_throughput_limit, Pangea::Resources::Types::String.default('perQueue').constrained(included_in: ['perMessageGroupId', 'perQueue'])
-
-        # Queue policy (as JSON string)
-        attribute? :policy, Pangea::Resources::Types::String.optional
-
-        # Tags
-        attribute :tags, Pangea::Resources::Types::AwsTags.default({})
-
-        # Custom validation
-        def self.new(attributes = {})
-          attrs = super(attributes)
-
-          # Validate FIFO queue naming convention
-          if attrs.fifo_queue && !attrs.name.end_with?('.fifo')
-            raise Dry::Struct::Error, "FIFO queue names must end with '.fifo' suffix"
-          end
-
-          # Validate non-FIFO queue naming convention
-          if !attrs.fifo_queue && attrs.name.end_with?('.fifo')
-            raise Dry::Struct::Error, "Standard queue names cannot end with '.fifo' suffix"
-          end
-
-          # Validate FIFO-only attributes
-          if !attrs.fifo_queue
-            if attrs.content_based_deduplication
-              raise Dry::Struct::Error, "content_based_deduplication is only valid for FIFO queues"
-            end
-            if attrs.deduplication_scope != 'queue'
-              raise Dry::Struct::Error, "deduplication_scope is only valid for FIFO queues"
-            end
-            if attrs.fifo_throughput_limit != 'perQueue'
-              raise Dry::Struct::Error, "fifo_throughput_limit is only valid for FIFO queues"
-            end
-          end
-
-          # Validate redrive allow policy
-          if attrs.redrive_allow_policy && 
-             attrs.redrive_allow_policy[:redrivePermission] == 'byQueue' && 
-             (attrs.redrive_allow_policy[:sourceQueueArns].nil? || attrs.redrive_allow_policy[:sourceQueueArns].empty?)
-            raise Dry::Struct::Error, "sourceQueueArns must be specified when redrivePermission is 'byQueue'"
-          end
-
-          # Validate encryption settings (can't have both KMS and SQS managed)
-          if attrs.kms_master_key_id && attrs.sqs_managed_sse_enabled
-            raise Dry::Struct::Error, "Cannot enable both KMS encryption and SQS managed server-side encryption"
-          end
-
-          attrs
-        end
-
-        # Helper methods
-        def is_fifo?
-          fifo_queue
-        end
-
-        def is_encrypted?
-          kms_master_key_id.present? || sqs_managed_sse_enabled
-        end
-
-        def has_dlq?
-          redrive_policy && redrive_policy[:deadLetterTargetArn].present?
-        end
-
-        def long_polling_enabled?
-          receive_wait_time_seconds > 0
-        end
-
-        def is_delay_queue?
-          delay_seconds > 0
-        end
-
-        def allows_all_sources?
-          redrive_allow_policy.nil? || redrive_allow_policy[:redrivePermission] == 'allowAll'
-        end
-
-        def queue_type
-          fifo_queue ? 'FIFO' : 'Standard'
-        end
-
-        def encryption_type
-          if kms_master_key_id
-            'KMS'
-          elsif sqs_managed_sse_enabled
-            'SQS-SSE'
-          else
-            'None'
-          end
-        end
-        end
-      end
-    end
-  end
-end