devlift-cli 0.1.0__py3-none-any.whl

devlift_cli/commands/manual.py

@@ -0,0 +1,82 @@
+"""devlift manual [topic] (also `devlift man`) — the bundled manual, paged on a
+terminal, or one section of it printed straight through."""
+
+from __future__ import annotations
+
+import os
+import re
+import sys
+from importlib import resources
+
+import typer
+from rich.markdown import Markdown
+
+from devlift_cli.context import Invocation
+from devlift_cli.errors import InputError
+from devlift_cli.render import output
+
+
+def manual_text() -> str:
+    return resources.files("devlift_cli").joinpath("MANUAL.md").read_text(encoding="utf-8")
+
+
+def _sections(text: str) -> list[tuple[str, str]]:
+    """(heading, body) for every `##`/`###` heading, in order."""
+    parts = re.split(r"^(#{2,3} .+)$", text, flags=re.MULTILINE)
+    out = []
+    for i in range(1, len(parts), 2):
+        heading = parts[i].lstrip("#").strip()
+        out.append((heading, parts[i] + parts[i + 1]))
+    return out
+
+
+def section_command(topic: str):
+    """A `manual` subcommand for one command group: `devlift sqs manual`.
+
+    The same section `devlift manual sqs` prints, reachable from inside the
+    group so it can be read without leaving what you were typing.
+    """
+    def command(
+        ctx: typer.Context,
+        raw: bool = typer.Option(False, "--raw", help="Plain Markdown instead of terminal formatting."),
+    ):
+        inv: Invocation = ctx.obj
+        text = "\n".join(body for h, body in _sections(manual_text()) if topic.lower() in h.lower())
+        if raw or inv.output != "table":
+            print(text)
+            return
+        output.console.print(Markdown(text))
+
+    command.__doc__ = f"Show the manual section for {topic}."
+    return command
+
+
+def manual(
+    ctx: typer.Context,
+    topic: str | None = typer.Argument(None, help="A section: s3, sqs, dynamodb, services, exit codes, scripting, …"),
+    raw: bool = typer.Option(False, "--raw", help="Plain Markdown instead of terminal formatting."),
+    no_pager: bool = typer.Option(False, "--no-pager", help="Print the whole manual straight through instead of paging it."),
+):
+    """Show the full user manual (also `devlift man`), or one section of it (`devlift manual s3`)."""
+    inv: Invocation = ctx.obj
+    text = manual_text()
+    if topic:
+        needle = topic.strip().lower()
+        matches = [(h, body) for h, body in _sections(text) if needle in h.lower()]
+        if not matches:
+            names = ", ".join(h for h, _ in _sections(text))
+            raise InputError(f"No manual section matches '{topic}'.", hint=f"Sections: {names}")
+        text = "\n".join(body for _, body in matches)
+    if raw or inv.output != "table":
+        print(text)
+        return
+    # The whole manual is a few screens long. On a terminal, page it the way
+    # `man` does — scroll, search with /, q to leave — instead of dumping it
+    # past the top of the window. A single section, a pipe, --raw or
+    # --no-pager print straight through.
+    if topic or no_pager or not sys.stdout.isatty() or not inv.interactive:
+        output.console.print(Markdown(text))
+        return
+    os.environ.setdefault("LESS", "-R")  # keep the formatting when less is the pager
+    with output.console.pager(styles=True):
+        output.console.print(Markdown(text))

devlift_cli/commands/repositories.py

@@ -0,0 +1,49 @@
+"""devlift repositories … — the repositories and branches `eks create` picks from."""
+
+from __future__ import annotations
+
+import typer
+
+from devlift_cli.commands.manual import section_command
+from devlift_cli.api import catalog
+from devlift_cli.context import Invocation
+from devlift_cli.render.output import rows_table
+
+repositories_app = typer.Typer(help="Git repositories the DevLift GitHub App can see.", no_args_is_help=True)
+
+
+@repositories_app.command("list")
+def repositories_list(
+    ctx: typer.Context,
+    search: str | None = typer.Option(None, "--search", help="Only repositories whose name contains this text."),
+):
+    """List repositories (the values --repository accepts)."""
+    inv: Invocation = ctx.obj
+    repos = catalog.list_repositories(inv.api)
+    if search:
+        s = search.lower()
+        repos = [r for r in repos if s in str(r.get("full_name", "")).lower()]
+    inv.emit(repos, lambda d: rows_table(
+        ["Repository", "Default branch", "Private", "Updated"],
+        [(r.get("full_name"), r.get("default_branch"), "yes" if r.get("private") else "no", (r.get("updated_at") or "")[:10]) for r in d],
+    ))
+
+
+@repositories_app.command("branches")
+def repositories_branches(
+    ctx: typer.Context,
+    repository: str = typer.Argument(..., help="Repository as owner/name."),
+):
+    """List a repository's branches (the values --branch accepts)."""
+    inv: Invocation = ctx.obj
+    if "/" not in repository:
+        raise typer.BadParameter("Give the repository as owner/name, e.g. example-org/orders.")
+    branches = catalog.list_branches(inv.api, repository)
+    inv.emit(branches, lambda d: rows_table(
+        ["Branch", "Protected"],
+        [(b.get("name"), "yes" if b.get("protected") else "no") for b in d],
+        title=repository,
+    ))
+
+
+repositories_app.command("manual")(section_command("repositories"))

devlift_cli/commands/request.py

@@ -0,0 +1,89 @@
+"""devlift request … — the author's side of the review lane."""
+
+from __future__ import annotations
+
+import typer
+
+from devlift_cli.commands.manual import section_command
+from devlift_cli.api import approvals as approvals_api
+from devlift_cli.context import Invocation
+from devlift_cli.ops.approvals import find_requests, kind_of, print_request, resolve_target, run_verb
+from devlift_cli.render.output import kv_table, rows_table
+from devlift_cli.resolve.names import Resolver
+
+request_app = typer.Typer(help="Your change requests: list, show, submit, withdraw, discard.", no_args_is_help=True)
+
+_REF = typer.Argument(..., help="Queue code (queue-…) or service name.")
+_ENV = typer.Option(None, "--env", help="Environment, when the service is configured in several.")
+_REGION = typer.Option(None, "--region", help="Region, when the service runs in several.")
+_COMMENT = typer.Option("", "--comment", help="Optional note recorded on the request.")
+
+
+def _list_table(rows: list[dict]):
+    return rows_table(
+        ["Request", "Kind", "Service", "Status", "Requested by", "Requested at", "You may"],
+        [(r.get("code"), kind_of(r), r.get("display_name"), r.get("status"),
+          (r.get("requested_by_name") or r.get("requested_by") or "") + ("  (you)" if (r.get("you") or {}).get("mine") else ""),
+          (r.get("requested_at") or "")[:16].replace("T", " "),
+          ", ".join(k[4:] for k in ("can_approve", "can_deploy") if (r.get("you") or {}).get(k)) or "–") for r in rows],
+    )
+
+
+@request_app.command("list")
+def request_list(
+    ctx: typer.Context,
+    status: str | None = typer.Option(None, "--status", help="draft | submit | approved | rejected"),
+    service: str | None = typer.Option(None, "--service", help="Only requests on this service."),
+    env: str | None = _ENV,
+    region: str | None = _REGION,
+    mine: bool = typer.Option(False, "--mine", help="Only requests you raised."),
+):
+    """List change requests you raised or can act on."""
+    inv: Invocation = ctx.obj
+    resource_code = resolve_target(inv, Resolver(inv.api, inv.profile.name), service, env, region).config_code if service else None
+    rows = approvals_api.list_requests(inv.api, status=status, resource_code=resource_code)
+    if mine:
+        rows = [r for r in rows if (r.get("you") or {}).get("mine")]
+    inv.emit(rows, _list_table)
+
+
+@request_app.command("show")
+def request_show(ctx: typer.Context, ref: str = _REF, env: str | None = _ENV, region: str | None = _REGION):
+    """Show a request: who, status, and the frozen diff a reviewer sees."""
+    inv: Invocation = ctx.obj
+    target, rows = find_requests(inv, Resolver(inv.api, inv.profile.name), ref, env=env, region=region, statuses=None, mine_only=False)
+    full = [approvals_api.get_request(inv.api, r["code"]) for r in rows]
+    if not full:
+        from devlift_cli.errors import EXIT_NOT_FOUND, CliError
+        raise CliError(f"No request on {target.service_name}.", EXIT_NOT_FOUND)
+
+    def table(d):
+        for r in d:
+            print_request(r)
+        return kv_table([])
+    inv.emit(full, table)
+
+
+@request_app.command("history")
+def request_history(ctx: typer.Context, service: str = typer.Argument(..., help="Service name."), env: str | None = _ENV, region: str | None = _REGION):
+    """Every request ever raised against a service configuration."""
+    inv: Invocation = ctx.obj
+    target = resolve_target(inv, Resolver(inv.api, inv.profile.name), service, env, region)
+    inv.emit(approvals_api.history(inv.api, target.config_code), _list_table)
+
+
+def _verb_command(verb: str, doc: str):
+    def command(ctx: typer.Context, ref: str = _REF, env: str | None = _ENV, region: str | None = _REGION, comment: str = _COMMENT):
+        inv: Invocation = ctx.obj
+        result = run_verb(inv, Resolver(inv.api, inv.profile.name), verb, ref, env=env, region=region, comment=comment)
+        inv.emit(result.to_dict(), lambda d: rows_table(["Request", "Kind", "Status"], [(r["code"], r["kind"], r["status"]) for r in d["requests"]], title=f"{d['service']}: {verb}"))
+    command.__doc__ = doc
+    return command
+
+
+request_app.command("submit")(_verb_command("submit", "Send your draft for review (settings and routes together). The diff is frozen now."))
+request_app.command("withdraw")(_verb_command("withdraw", "Pull your submitted request back out of review; it becomes a draft again."))
+request_app.command("discard")(_verb_command("discard", "Throw your draft away."))
+
+
+request_app.command("manual")(section_command("request, approval"))

devlift_cli/commands/s3.py

@@ -0,0 +1,198 @@
+"""devlift s3 …"""
+
+from __future__ import annotations
+
+import re
+
+import typer
+
+from devlift_cli.commands.manual import section_command
+from devlift_cli.context import Invocation
+from devlift_cli.errors import InputError
+from devlift_cli.api.infra_list import display_name
+from devlift_cli.ops.resources import ResourceKind, create_resource, describe_resource, list_resources, update_resource
+from devlift_cli.render.output import kv_table, rows_table
+from devlift_cli.resolve import allowlist
+from devlift_cli.resolve.names import Resolver
+
+s3_app = typer.Typer(help="S3 buckets.", no_args_is_help=True)
+
+_BUCKET_RE = re.compile(r"^[a-z0-9.-]+$")
+_ACCOUNT_RE = re.compile(r"^\d{12}$")
+
+
+def validate_bucket_name(raw: str) -> str | None:
+    name = raw.strip()
+    if not name:
+        return "required."
+    if not 3 <= len(name) <= 63:
+        return f"must be 3-63 characters (currently {len(name)})."
+    if not _BUCKET_RE.match(name):
+        return "use only lowercase letters, numbers, dots (.) and hyphens (-)."
+    if not name[0].isalnum() or not name[-1].isalnum():
+        return "must start and end with a letter or number."
+    return None
+
+
+S3 = ResourceKind(
+    noun="bucket",
+    infra_type="s3_infrastructuretype_ref",
+    case_ref_code="create_bucket",
+    service=allowlist.SERVICE_S3,
+    validate_name=validate_bucket_name,
+    labels={"versioning": "Versioning", "enable_s3_replication": "Replication", "cross_account_account_id": "Replication account"},
+)
+
+
+@s3_app.command("list")
+def s3_list(
+    ctx: typer.Context,
+    app: str | None = typer.Option(None, "--app", "--product", help="Only this application."),
+    env: str | None = typer.Option(None, "--env", help="Only this environment."),
+    region: str | None = typer.Option(None, "--region", help="Only this region."),
+):
+    """List S3 buckets registered in DevLift."""
+    inv: Invocation = ctx.obj
+    res = Resolver(inv.api, inv.profile.name)
+    rows = list_resources(inv, res, S3, app=app, env=env, region=region)
+    inv.emit(rows, lambda d: rows_table(
+        ["Bucket", "Environment", "Region", "Versioning", "Replication", "Status", "Code"],
+        [(display_name(r), r.get("environment"), r.get("geo_loc_mst_code"), (r.get("locator") or {}).get("versioning"), (r.get("locator") or {}).get("enable_s3_replication"), r.get("status"), r.get("code")) for r in d],
+    ))
+
+
+@s3_app.command("describe")
+def s3_describe(
+    ctx: typer.Context,
+    name: str = typer.Argument(..., help="Bucket name or resource code."),
+    env: str | None = typer.Option(None, "--env", help="Disambiguate when the name exists in several environments."),
+):
+    """Show one bucket: placement, settings, live status."""
+    inv: Invocation = ctx.obj
+    res = Resolver(inv.api, inv.profile.name)
+    detail = describe_resource(inv, res, S3, name, env=env)
+    loc = detail.get("locator") or {}
+    inv.emit(detail, lambda d: kv_table([
+        ("Bucket", display_name(d)),
+        ("Full name", loc.get("bucket_name")),
+        ("ARN", loc.get("bucket_arn")),
+        ("Code", d.get("code")),
+        ("Environment", d.get("environment")),
+        ("Region", f"{loc.get('region') or ''} ({d.get('geo_loc_mst_code')})"),
+        ("Account", loc.get("accountId")),
+        ("Versioning", loc.get("versioning")),
+        ("Replication", loc.get("enable_s3_replication")),
+        ("Status", d.get("infra_status")),
+    ], title=display_name(d)))
+
+
+@s3_app.command("create")
+def s3_create(
+    ctx: typer.Context,
+    name: str | None = typer.Option(None, "--name", help="Bucket name (3-63 chars, lowercase)."),
+    app: str | None = typer.Option(None, "--app", "--product", help="Application name or code."),
+    env: str | None = typer.Option(None, "--env", help="dev | stage | qa | prod"),
+    region: str | None = typer.Option(None, "--region", help="Region name or code (see `devlift regions list`)."),
+    versioning: bool | None = typer.Option(None, "--versioning/--no-versioning", help="Object versioning."),
+    replication: bool | None = typer.Option(None, "--replication/--no-replication", help="Cross-account replication."),
+    cross_account_id: str | None = typer.Option(None, "--cross-account-id", help="12-digit AWS account ID (with --replication)."),
+    do_wait: bool = typer.Option(False, "--wait", help="Follow the deployment until it finishes."),
+):
+    """Create an S3 bucket. Any flag you omit is asked for on a terminal.
+
+    Example: devlift s3 create --name my-logs --app core --env stage --region mumbai --versioning --no-replication -y
+    """
+    inv: Invocation = ctx.obj
+    res = Resolver(inv.api, inv.profile.name)
+
+    if name is None:
+        name = inv.ask("Bucket name", flag="--name")
+    if versioning is None:
+        versioning = inv.ask_bool("Enable versioning?", default=False, flag="--versioning/--no-versioning")
+    if replication is None:
+        replication = inv.ask_bool("Enable cross-account replication?", default=False, flag="--replication/--no-replication")
+    if replication:
+        if cross_account_id is None:
+            cross_account_id = inv.ask("Replication target AWS account ID (12 digits)", flag="--cross-account-id")
+        if not _ACCOUNT_RE.match(cross_account_id.strip()):
+            raise InputError("--cross-account-id must be a 12-digit AWS account ID.")
+    elif cross_account_id:
+        raise InputError("--cross-account-id only applies with --replication.")
+
+    attributes = {
+        "versioning": "true" if versioning else "false",
+        "enable_s3_replication": "true" if replication else "false",
+        "cross_account_account_id": cross_account_id.strip() if replication and cross_account_id else None,
+    }
+    result = create_resource(inv, res, S3, name=name, app=app, env=env, region=region, attributes=attributes, do_wait=do_wait)
+    data = {"bucket": name, **result.to_dict()}
+    inv.emit(data, lambda d: kv_table([
+        ("Bucket", d["bucket"]),
+        ("Resource code", d["resource_code"]),
+        ("Queue item", d["queue_code"]),
+        ("Status", d.get("status")),
+        ("Workflow", d.get("workflow_id")),
+        ("Pull request", d.get("pr_url")),
+    ]))
+
+
+@s3_app.command("update")
+def s3_update(
+    ctx: typer.Context,
+    name: str = typer.Argument(..., help="Bucket name or resource code."),
+    env: str | None = typer.Option(None, "--env", help="Narrows the lookup when the name exists in several environments."),
+    app: str | None = typer.Option(None, "--app", "--product", help="The bucket's application. Only needed on backends that do not report it."),
+    versioning: bool | None = typer.Option(None, "--versioning/--no-versioning", help="Object versioning."),
+    replication: bool | None = typer.Option(None, "--replication/--no-replication", help="Cross-account replication."),
+    cross_account_id: str | None = typer.Option(None, "--cross-account-id", help="12-digit AWS account ID (with --replication)."),
+    do_wait: bool = typer.Option(False, "--wait", help="Follow the deployment until it finishes."),
+):
+    """Change a bucket's settings and deploy the change.
+
+    Only the flags you pass change. The name, application, environment and
+    region cannot be changed — a bucket somewhere else is a new bucket.
+
+    Example: devlift s3 update my-logs --env stage --versioning -y
+    """
+    inv: Invocation = ctx.obj
+    res = Resolver(inv.api, inv.profile.name)
+
+    changes: dict = {}
+    if versioning is not None:
+        changes["versioning"] = "true" if versioning else "false"
+    if replication is not None:
+        changes["enable_s3_replication"] = "true" if replication else "false"
+        if not replication:
+            changes["cross_account_account_id"] = ""
+    if cross_account_id is not None:
+        if replication is False:
+            raise InputError("--cross-account-id only applies with --replication.")
+        if not _ACCOUNT_RE.match(cross_account_id.strip()):
+            raise InputError("--cross-account-id must be a 12-digit AWS account ID.")
+        changes["cross_account_account_id"] = cross_account_id.strip()
+    if not changes:
+        raise InputError(
+            "Nothing to change.",
+            hint="Pass --versioning/--no-versioning, --replication/--no-replication or --cross-account-id.",
+        )
+
+    def check(config: dict) -> str | None:
+        wants_replication = str(config.get("enable_s3_replication", "")).lower() == "true"
+        if wants_replication and not config.get("cross_account_account_id"):
+            return "Replication needs a target account: pass --cross-account-id with --replication."
+        return None
+
+    outcome = update_resource(inv, res, S3, name=name, env=env, app=app, changes=changes, check=check, do_wait=do_wait)
+    data = {"bucket": outcome.name, **outcome.to_dict()}
+    inv.emit(data, lambda d: kv_table([
+        ("Bucket", d["bucket"]),
+        ("Resource code", d["resource_code"]),
+        ("Changed", "yes" if d["changed"] else "no"),
+        ("Queue item", d.get("queue_code")),
+        ("Status", d.get("status")),
+        ("Workflow", d.get("workflow_id")),
+        ("Pull request", d.get("pr_url")),
+    ]))
+
+
+s3_app.command("manual")(section_command("s3"))

devlift_cli/commands/sqs.py

@@ -0,0 +1,229 @@
+"""devlift sqs …"""
+
+from __future__ import annotations
+
+import re
+
+import typer
+
+from devlift_cli.commands.manual import section_command
+from devlift_cli.api.infra_list import display_name
+from devlift_cli.context import Invocation
+from devlift_cli.errors import InputError
+from devlift_cli.ops.resources import ResourceKind, create_resource, describe_resource, list_resources, update_resource
+from devlift_cli.render.output import kv_table, rows_table
+from devlift_cli.resolve import allowlist
+from devlift_cli.resolve.names import Resolver
+
+sqs_app = typer.Typer(help="SQS queues.", no_args_is_help=True)
+
+_QUEUE_RE = re.compile(r"^[a-zA-Z0-9_-]+$")
+_ACCOUNT_RE = re.compile(r"^\d{12}$")
+
+# Same bounds the dashboard enforces (lib/validation/infraFieldRules.ts).
+_NUMBER_RULES = {
+    "max_receive_count": ("--max-receive-count", 1, 1000),
+    "visibility_timeout_seconds": ("--visibility-timeout", 0, 43200),
+    "message_retention_seconds": ("--retention", 60, 1209600),
+    "dlq_message_retention_seconds": ("--dlq-retention", 60, 1209600),
+}
+
+
+def validate_queue_name(raw: str) -> str | None:
+    name = raw.strip()
+    if not name:
+        return "required."
+    if len(name) > 80:
+        return f"must be 80 characters or fewer (currently {len(name)})."
+    if name.lower().endswith(".fifo"):
+        return "drop the '.fifo' suffix; it is added automatically for FIFO queues."
+    if not _QUEUE_RE.match(name):
+        return "use only letters, numbers, hyphens (-) and underscores (_)."
+    return None
+
+
+SQS = ResourceKind(
+    noun="queue",
+    infra_type="sqs_infrastructuretype_ref",
+    case_ref_code="create_queue",
+    service=allowlist.SERVICE_SQS,
+    validate_name=validate_queue_name,
+    labels={
+        "fifo_queue": "FIFO",
+        "create_dlq": "Dead-letter queue",
+        "cross_account_ids": "Cross-account access",
+        "max_receive_count": "Max receive count",
+        "visibility_timeout_seconds": "Visibility timeout (s)",
+        "message_retention_seconds": "Retention (s)",
+        "dlq_message_retention_seconds": "DLQ retention (s)",
+    },
+)
+
+
+def _bounded(key: str, value: int | None) -> int | None:
+    if value is None:
+        return None
+    flag, lo, hi = _NUMBER_RULES[key]
+    if not lo <= value <= hi:
+        raise InputError(f"{flag} must be between {lo} and {hi}.")
+    return value
+
+
+@sqs_app.command("list")
+def sqs_list(
+    ctx: typer.Context,
+    app: str | None = typer.Option(None, "--app", "--product", help="Only this application."),
+    env: str | None = typer.Option(None, "--env", help="Only this environment."),
+    region: str | None = typer.Option(None, "--region", help="Only this region."),
+):
+    """List SQS queues registered in DevLift."""
+    inv: Invocation = ctx.obj
+    rows = list_resources(inv, Resolver(inv.api, inv.profile.name), SQS, app=app, env=env, region=region)
+    inv.emit(rows, lambda d: rows_table(
+        ["Queue", "Environment", "Region", "FIFO", "DLQ", "Status", "Code"],
+        [(display_name(r), r.get("environment"), r.get("geo_loc_mst_code"), (r.get("locator") or {}).get("fifo_queue"), (r.get("locator") or {}).get("create_dlq"), r.get("status"), r.get("code")) for r in d],
+    ))
+
+
+@sqs_app.command("describe")
+def sqs_describe(ctx: typer.Context, name: str = typer.Argument(..., help="Queue name or resource code."), env: str | None = typer.Option(None, "--env")):
+    """Show one queue."""
+    inv: Invocation = ctx.obj
+    detail = describe_resource(inv, Resolver(inv.api, inv.profile.name), SQS, name, env=env)
+    loc = detail.get("locator") or {}
+    inv.emit(detail, lambda d: kv_table([
+        ("Queue", display_name(d)),
+        ("Full name", loc.get("queue_name") or loc.get("name")),
+        ("URL", loc.get("queue_url")),
+        ("ARN", loc.get("queue_arn")),
+        ("Code", d.get("code")),
+        ("Environment", d.get("environment")),
+        ("Region", f"{loc.get('region') or ''} ({d.get('geo_loc_mst_code')})"),
+        ("FIFO", loc.get("fifo_queue")),
+        ("Dead-letter queue", loc.get("create_dlq")),
+        ("Visibility timeout", loc.get("visibility_timeout_seconds")),
+        ("Retention", loc.get("message_retention_seconds")),
+        ("Status", d.get("infra_status")),
+    ], title=display_name(d)))
+
+
+@sqs_app.command("create")
+def sqs_create(
+    ctx: typer.Context,
+    name: str | None = typer.Option(None, "--name", help="Queue name (no .fifo suffix)."),
+    app: str | None = typer.Option(None, "--app", "--product", help="Application name or code."),
+    env: str | None = typer.Option(None, "--env", help="dev | stage | qa | prod"),
+    region: str | None = typer.Option(None, "--region", help="Region name or code."),
+    fifo: bool | None = typer.Option(None, "--fifo/--no-fifo", help="FIFO queue."),
+    dlq: bool | None = typer.Option(None, "--dlq/--no-dlq", help="Create a dead-letter queue."),
+    cross_account_ids: list[str] = typer.Option([], "--cross-account-id", help="12-digit AWS account allowed to use the queue (repeatable)."),
+    max_receive_count: int | None = typer.Option(None, "--max-receive-count", help="Receives before a message goes to the DLQ (1-1000)."),
+    visibility_timeout: int | None = typer.Option(None, "--visibility-timeout", help="Seconds (0-43200)."),
+    retention: int | None = typer.Option(None, "--retention", help="Message retention in seconds (60-1209600)."),
+    dlq_retention: int | None = typer.Option(None, "--dlq-retention", help="DLQ retention in seconds (60-1209600)."),
+    do_wait: bool = typer.Option(False, "--wait", help="Follow the deployment until it finishes."),
+):
+    """Create an SQS queue. Any flag you omit is asked for on a terminal.
+
+    Example: devlift sqs create --name orders --app core --env stage --region mumbai --no-fifo --dlq -y
+    """
+    inv: Invocation = ctx.obj
+    res = Resolver(inv.api, inv.profile.name)
+    if name is None:
+        name = inv.ask("Queue name", flag="--name")
+    if fifo is None:
+        fifo = inv.ask_bool("FIFO queue?", default=False, flag="--fifo/--no-fifo")
+    if dlq is None:
+        dlq = inv.ask_bool("Create a dead-letter queue?", default=False, flag="--dlq/--no-dlq")
+    for acct in cross_account_ids:
+        if not _ACCOUNT_RE.match(acct.strip()):
+            raise InputError(f"--cross-account-id '{acct}' must be a 12-digit AWS account ID.")
+    attributes = {
+        "fifo_queue": "true" if fifo else "false",
+        "create_dlq": "true" if dlq else "false",
+        "cross_account_ids": [a.strip() for a in cross_account_ids] or None,
+        "max_receive_count": _bounded("max_receive_count", max_receive_count),
+        "visibility_timeout_seconds": _bounded("visibility_timeout_seconds", visibility_timeout),
+        "message_retention_seconds": _bounded("message_retention_seconds", retention),
+        "dlq_message_retention_seconds": _bounded("dlq_message_retention_seconds", dlq_retention),
+    }
+    result = create_resource(inv, res, SQS, name=name, app=app, env=env, region=region, attributes=attributes, do_wait=do_wait)
+    data = {"queue": name, **result.to_dict()}
+    inv.emit(data, lambda d: kv_table([
+        ("Queue", d["queue"]),
+        ("Resource code", d["resource_code"]),
+        ("Queue item", d["queue_code"]),
+        ("Status", d.get("status")),
+        ("Workflow", d.get("workflow_id")),
+        ("Pull request", d.get("pr_url")),
+    ]))
+
+
+@sqs_app.command("update")
+def sqs_update(
+    ctx: typer.Context,
+    name: str = typer.Argument(..., help="Queue name or resource code."),
+    env: str | None = typer.Option(None, "--env", help="Narrows the lookup when the name exists in several environments."),
+    app: str | None = typer.Option(None, "--app", "--product", help="The queue's application. Only needed on backends that do not report it."),
+    dlq: bool | None = typer.Option(None, "--dlq/--no-dlq", help="Dead-letter queue."),
+    cross_account_ids: list[str] = typer.Option([], "--cross-account-id", help="12-digit AWS account allowed to use the queue (repeatable; replaces the whole list)."),
+    clear_cross_accounts: bool = typer.Option(False, "--clear-cross-accounts", help="Remove every cross-account grant."),
+    max_receive_count: int | None = typer.Option(None, "--max-receive-count", help="Receives before a message goes to the DLQ (1-1000)."),
+    visibility_timeout: int | None = typer.Option(None, "--visibility-timeout", help="Seconds (0-43200)."),
+    retention: int | None = typer.Option(None, "--retention", help="Message retention in seconds (60-1209600)."),
+    dlq_retention: int | None = typer.Option(None, "--dlq-retention", help="DLQ retention in seconds (60-1209600)."),
+    do_wait: bool = typer.Option(False, "--wait", help="Follow the deployment until it finishes."),
+):
+    """Change a queue's settings and deploy the change.
+
+    Only the flags you pass change. The name, FIFO flag, application,
+    environment and region cannot be changed — FIFO is part of the queue's
+    real name, so a different one is a new queue.
+
+    Example: devlift sqs update orders --env stage --dlq --max-receive-count 5 -y
+    """
+    inv: Invocation = ctx.obj
+    res = Resolver(inv.api, inv.profile.name)
+
+    changes: dict = {}
+    if dlq is not None:
+        changes["create_dlq"] = "true" if dlq else "false"
+    if cross_account_ids and clear_cross_accounts:
+        raise InputError("--cross-account-id and --clear-cross-accounts cannot be combined.")
+    if cross_account_ids:
+        for acct in cross_account_ids:
+            if not _ACCOUNT_RE.match(acct.strip()):
+                raise InputError(f"--cross-account-id '{acct}' must be a 12-digit AWS account ID.")
+        changes["cross_account_ids"] = [a.strip() for a in cross_account_ids]
+    if clear_cross_accounts:
+        changes["cross_account_ids"] = []
+    for key, value in (
+        ("max_receive_count", max_receive_count),
+        ("visibility_timeout_seconds", visibility_timeout),
+        ("message_retention_seconds", retention),
+        ("dlq_message_retention_seconds", dlq_retention),
+    ):
+        bounded = _bounded(key, value)
+        if bounded is not None:
+            changes[key] = bounded
+    if not changes:
+        raise InputError(
+            "Nothing to change.",
+            hint="Pass --dlq/--no-dlq, --cross-account-id, --clear-cross-accounts, --max-receive-count, "
+                 "--visibility-timeout, --retention or --dlq-retention.",
+        )
+
+    outcome = update_resource(inv, res, SQS, name=name, env=env, app=app, changes=changes, do_wait=do_wait)
+    data = {"queue": outcome.name, **outcome.to_dict()}
+    inv.emit(data, lambda d: kv_table([
+        ("Queue", d["queue"]),
+        ("Resource code", d["resource_code"]),
+        ("Changed", "yes" if d["changed"] else "no"),
+        ("Queue item", d.get("queue_code")),
+        ("Status", d.get("status")),
+        ("Workflow", d.get("workflow_id")),
+        ("Pull request", d.get("pr_url")),
+    ]))
+
+
+sqs_app.command("manual")(section_command("sqs"))