velocity-python 0.1.133__tar.gz → 0.2.0__tar.gz

{velocity_python-0.1.133/src/velocity_python.egg-info → velocity_python-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: velocity-python
-Version: 0.1.133
+Version: 0.2.0
 Summary: A rapid application development library for interfacing with data storage
 Author-email: Velocity Team <info@codeclubs.org>
 License-Expression: MIT
@@ -52,11 +52,10 @@ Requires-Dist: python-tds>=1.15.0; extra == "sqlserver"
 Provides-Extra: postgres
 Requires-Dist: psycopg[binary]>=3.2.0; extra == "postgres"
 Provides-Extra: payment
-Requires-Dist: stripe>=12.0.0; extra == "payment"
-Requires-Dist: braintree>=4.30.0; extra == "payment"
-Requires-Dist: xmltodict>=0.13.0; extra == "payment"
+Requires-Dist: stripe<17,>=15.0.0; extra == "payment"
+Requires-Dist: braintree<5,>=4.30.0; extra == "payment"
+Requires-Dist: xmltodict<2,>=0.13.0; extra == "payment"
 Provides-Extra: plaid
-Requires-Dist: velocity-python[payment]; extra == "plaid"
 Requires-Dist: ecdsa>=0.19.0; extra == "plaid"
 Provides-Extra: all
 Requires-Dist: velocity-python[aws,excel,http,payment,pdf,plaid,postgres,templates]; extra == "all"
@@ -76,9 +75,9 @@ Requires-Dist: pytest-asyncio>=1.0.0; extra == "test"
 Requires-Dist: psycopg[binary]>=3.2.0; extra == "test"
 Requires-Dist: boto3>=1.35.0; extra == "test"
 Requires-Dist: requests>=2.32.0; extra == "test"
-Requires-Dist: stripe>=12.0.0; extra == "test"
-Requires-Dist: braintree>=4.30.0; extra == "test"
-Requires-Dist: xmltodict>=0.13.0; extra == "test"
+Requires-Dist: stripe<17,>=15.0.0; extra == "test"
+Requires-Dist: braintree<5,>=4.30.0; extra == "test"
+Requires-Dist: xmltodict<2,>=0.13.0; extra == "test"
 Requires-Dist: authorizenet>=1.1.3; extra == "test"
 Requires-Dist: ecdsa>=0.19.0; extra == "test"
 Requires-Dist: openpyxl>=3.1.0; extra == "test"
@@ -247,6 +246,8 @@ def import_customers(tx, records):
 ## Documentation
 
 Full documentation is included in the `docs/` directory of the source distribution.
+What changed in each release, and what callers must do before upgrading, is in
+[`CHANGELOG.md`](CHANGELOG.md) (Breaking / Deploy ordering / Added / Fixed per version).
 
 | Guide | File | Description |
 |-------|------|-------------|
@@ -265,6 +266,8 @@ Full documentation is included in the `docs/` directory of the source distributi
 | Utilities | `docs/utilities.md` | Excel/PDF export, data conversion, formatting, timers, email parsing and SMTP sending |
 | Testing Guide | `docs/TESTING.md` | Running tests, markers, coverage |
 | Security | `docs/SECURITY.md` | Pre-commit hooks, credential scanning |
+| Changelog | `CHANGELOG.md` | Per-release breaking changes, deploy ordering, additions and fixes |
+| Improvement Backlog | `docs/IMPROVEMENT_BACKLOG.md` | Proposed and deferred library improvements |
 
 ---
 

{velocity_python-0.1.133 → velocity_python-0.2.0}/README.md

@@ -153,6 +153,8 @@ def import_customers(tx, records):
 ## Documentation
 
 Full documentation is included in the `docs/` directory of the source distribution.
+What changed in each release, and what callers must do before upgrading, is in
+[`CHANGELOG.md`](CHANGELOG.md) (Breaking / Deploy ordering / Added / Fixed per version).
 
 | Guide | File | Description |
 |-------|------|-------------|
@@ -171,6 +173,8 @@ Full documentation is included in the `docs/` directory of the source distributi
 | Utilities | `docs/utilities.md` | Excel/PDF export, data conversion, formatting, timers, email parsing and SMTP sending |
 | Testing Guide | `docs/TESTING.md` | Running tests, markers, coverage |
 | Security | `docs/SECURITY.md` | Pre-commit hooks, credential scanning |
+| Changelog | `CHANGELOG.md` | Per-release breaking changes, deploy ordering, additions and fixes |
+| Improvement Backlog | `docs/IMPROVEMENT_BACKLOG.md` | Proposed and deferred library improvements |
 
 ---
 

{velocity_python-0.1.133 → velocity_python-0.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "velocity-python"
-version = "0.1.133"
+version = "0.2.0"
 authors = [
   { name="Velocity Team", email="info@codeclubs.org" },
 ]
@@ -83,18 +83,22 @@ sqlserver = [
 postgres = [
   "psycopg[binary]>=3.2.0",
 ]
+# Tested bounds: the unit suite passes on stripe 15.0.x and 16.0.0 and on
+# braintree 4.42 and 4.47. Raise an upper bound only after `make test-unit`
+# passes on the new major (stripe objects stopped being dicts in 13; each
+# stripe major also moves the default API version, so callers should pin
+# stripe.api_version). Apps pin exact versions inside these bounds (see
+# docs/payment.md "Installation").
 payment = [
-  "stripe>=12.0.0",
-  "braintree>=4.30.0",
-  "xmltodict>=0.13.0",
+  "stripe>=15.0.0,<17",
+  "braintree>=4.30.0,<5",
+  "xmltodict>=0.13.0,<2",
 ]
 # Plaid webhook ES256 verification (velocity.payment.plaid_webhook). ecdsa is
 # pure Python, so it fits a Lambda layer where `cryptography` does not.
-# Includes [payment] because importing velocity.payment.plaid_webhook runs
-# velocity/payment/__init__.py, which imports stripe and braintree eagerly;
-# drop it once those package-level imports are lazy or guarded.
+# velocity/payment/__init__.py imports the processor adapters lazily, so
+# importing plaid_webhook needs no stripe/braintree (tests/test_payment_lazy_imports.py).
 plaid = [
-  "velocity-python[payment]",
   "ecdsa>=0.19.0",
 ]
 all = [
@@ -120,9 +124,9 @@ test = [
   "psycopg[binary]>=3.2.0",
   "boto3>=1.35.0",
   "requests>=2.32.0",
-  "stripe>=12.0.0",
-  "braintree>=4.30.0",
-  "xmltodict>=0.13.0",
+  "stripe>=15.0.0,<17",
+  "braintree>=4.30.0,<5",
+  "xmltodict>=0.13.0,<2",
   "authorizenet>=1.1.3",
   "ecdsa>=0.19.0",
   "openpyxl>=3.1.0",

{velocity_python-0.1.133 → velocity_python-0.2.0}/src/velocity/__init__.py

@@ -1,4 +1,4 @@
-__version__ = version = "0.1.133"
+__version__ = version = "0.2.0"
 
 import importlib as _importlib
 

velocity_python-0.2.0/src/velocity/aws/blobs.py

@@ -0,0 +1,256 @@
+"""Content-addressed S3 blob store.
+
+For offloading large row payloads (raw emails, documents, exports) out of
+Postgres while the row keeps only the content hash. Keys are derived from
+the sha256 of the content, so storage is idempotent and deduplicating by
+construction: the same bytes always land on the same key, and a re-upload
+of an existing object is skipped.
+
+    store = BlobStore("my-bucket", prefix="demo/gmail-raw", suffix=".eml")
+    sha, key = store.put_bytes(raw)      # no-op if already stored
+    raw = store.get_bytes(sha)           # or get_bytes(key)
+    url = store.presigned_get(sha)       # hand-off to a browser
+
+A site's per-stage store (keys under ``{stage}/{family}``, the bucket named by
+a config key) comes from :meth:`BlobStore.for_stage`; browser uploads go
+straight to S3 through :meth:`BlobStore.presigned_put`:
+
+    store = BlobStore.for_stage("BlobBucket", "forms/assets")
+    upload = store.presigned_put(key, content_type="image/png")
+    # -> {"url": ..., "key": key, "bucket": ...}; the browser PUTs the body
+"""
+
+from __future__ import annotations
+
+import hashlib
+import os
+import re
+import unicodedata
+from typing import Optional, Tuple
+from urllib.parse import quote
+
+#: The stage segment used when neither the caller nor the environment names one.
+UNKNOWN_STAGE = "unknown"
+
+_UNSAFE_HEADER_CHARS = re.compile(r'["\\\x00-\x1f\x7f]')
+
+
+class BlobStoreNotConfigured(LookupError):
+    """No bucket is configured for a :meth:`BlobStore.for_stage` store.
+
+    ``bucket_key`` is the config key that was looked up; the message names it
+    and is safe to show an operator.
+    """
+
+    def __init__(self, bucket_key: str):
+        self.bucket_key = bucket_key
+        super().__init__(f"no {bucket_key} is configured for this environment")
+
+
+def resolve_bucket(bucket_key: str, bucket: Optional[str] = None) -> Optional[str]:
+    """``bucket`` when given, else the ``bucket_key`` config value
+    (:func:`velocity.aws.ssm_config.getenv`), else None. Whitespace is stripped."""
+    value = str(bucket or "").strip()
+    if value:
+        return value
+    from velocity.aws import ssm_config
+
+    return str(ssm_config.getenv(bucket_key) or "").strip() or None
+
+
+def resolve_stage(stage: Optional[str] = None, default: str = UNKNOWN_STAGE) -> str:
+    """``stage`` when given, else :func:`velocity.aws.ssm_config.get_stage`
+    (``AppStage``, then its compatibility aliases), else ``default``."""
+    value = str(stage or "").strip()
+    if value:
+        return value
+    from velocity.aws import ssm_config
+
+    return str(ssm_config.get_stage() or "").strip() or default
+
+
+def stage_prefix(family: str, stage: Optional[str] = None) -> str:
+    """``{stage}/{family}``: the per-environment key prefix of a store family."""
+    family = str(family or "").strip("/")
+    if not family:
+        raise ValueError("stage_prefix requires a family")
+    return f"{resolve_stage(stage)}/{family}"
+
+
+def attachment_disposition(filename: str) -> str:
+    """A ``Content-Disposition: attachment`` value naming ``filename``.
+
+    S3 refuses a response header it cannot represent in ISO-8859-1, and a
+    quote would end the value early, so ``filename=`` carries an ASCII
+    rendering (accents folded, quotes / backslashes / control characters
+    replaced, ``download`` when nothing ASCII is left of the stem); a name that is not plain ASCII also gets the RFC 5987
+    ``filename*=UTF-8''...`` form, which browsers prefer.
+    """
+
+    def fold(text):
+        folded = unicodedata.normalize("NFKD", text).encode("ascii", "ignore")
+        return _UNSAFE_HEADER_CHARS.sub("_", folded.decode("ascii"))
+
+    name = str(filename or "").strip()
+    stem, extension = os.path.splitext(name)
+    stem = fold(stem).strip()
+    ascii_name = (stem if stem.strip(" ._") else "download") + fold(extension)
+    value = f'attachment; filename="{ascii_name}"'
+    if name and ascii_name != name:
+        value += f"; filename*=UTF-8''{quote(name, safe='')}"
+    return value
+
+
+class BlobStore:
+    def __init__(
+        self,
+        bucket: str,
+        prefix: str = "",
+        suffix: str = "",
+        region: Optional[str] = None,
+        client=None,
+    ):
+        if not bucket:
+            raise ValueError("BlobStore requires a bucket name")
+        self.bucket = bucket
+        self.prefix = prefix.strip("/")
+        self.suffix = suffix
+        self.region = region
+        self._client = client
+
+    @classmethod
+    def for_stage(
+        cls,
+        bucket_key: str,
+        family: str,
+        *,
+        suffix: str = "",
+        bucket: Optional[str] = None,
+        stage: Optional[str] = None,
+        region: Optional[str] = None,
+        client=None,
+    ) -> "BlobStore":
+        """The store for one key family of this environment.
+
+        The bucket is ``bucket`` or the ``bucket_key`` config value
+        (:func:`resolve_bucket`); keys live under ``{stage}/{family}``, the
+        stage being ``stage`` or :func:`velocity.aws.ssm_config.get_stage`
+        (:func:`resolve_stage`). Raises :class:`BlobStoreNotConfigured` when no
+        bucket resolves. Explicit ``bucket`` / ``stage`` serve local tools,
+        where nothing sets the Lambda environment.
+        """
+        name = resolve_bucket(bucket_key, bucket)
+        if name is None:
+            raise BlobStoreNotConfigured(bucket_key)
+        return cls(
+            name,
+            prefix=stage_prefix(family, stage),
+            suffix=suffix,
+            region=region,
+            client=client,
+        )
+
+    @property
+    def client(self):
+        if self._client is None:
+            import boto3
+
+            kwargs = {"region_name": self.region} if self.region else {}
+            self._client = boto3.client("s3", **kwargs)
+        return self._client
+
+    def key_for(self, sha256_hex: str) -> str:
+        name = f"{sha256_hex}{self.suffix}"
+        return f"{self.prefix}/{name}" if self.prefix else name
+
+    def _resolve_key(self, sha_or_key: str) -> str:
+        # A bare 64-hex-char sha resolves through key_for; anything else is
+        # treated as a full key (lets callers store either form).
+        value = str(sha_or_key)
+        if len(value) == 64 and all(c in "0123456789abcdef" for c in value.lower()):
+            return self.key_for(value.lower())
+        return value
+
+    def exists(self, sha_or_key: str) -> bool:
+        try:
+            self.client.head_object(
+                Bucket=self.bucket, Key=self._resolve_key(sha_or_key)
+            )
+            return True
+        except Exception:
+            return False
+
+    def put_bytes(
+        self, data: bytes, content_type: Optional[str] = None
+    ) -> Tuple[str, str]:
+        """Store ``data`` (idempotent); returns (sha256_hex, key)."""
+        payload = bytes(data or b"")
+        sha = hashlib.sha256(payload).hexdigest()
+        key = self.key_for(sha)
+        if not self.exists(key):
+            params = {"Bucket": self.bucket, "Key": key, "Body": payload}
+            if content_type:
+                params["ContentType"] = content_type
+            self.client.put_object(**params)
+        return sha, key
+
+    def get_bytes(self, sha_or_key: str) -> bytes:
+        response = self.client.get_object(
+            Bucket=self.bucket, Key=self._resolve_key(sha_or_key)
+        )
+        return response["Body"].read()
+
+    def presigned_get(
+        self,
+        sha_or_key: str,
+        expires_seconds: int = 900,
+        *,
+        filename: Optional[str] = None,
+        content_type: Optional[str] = None,
+    ) -> str:
+        """A presigned GET URL. ``filename`` makes the browser save the object
+        under that name (:func:`attachment_disposition`) rather than its hash
+        key; ``content_type`` overrides the served ``Content-Type``."""
+        params = {"Bucket": self.bucket, "Key": self._resolve_key(sha_or_key)}
+        if filename:
+            params["ResponseContentDisposition"] = attachment_disposition(filename)
+        if content_type:
+            params["ResponseContentType"] = content_type
+        return self.client.generate_presigned_url(
+            "get_object", Params=params, ExpiresIn=int(expires_seconds)
+        )
+
+    def presigned_put(
+        self,
+        sha_or_key: str,
+        *,
+        content_type: Optional[str] = None,
+        expires_seconds: int = 900,
+        content_length: Optional[int] = None,
+    ) -> dict:
+        """A presigned PUT for a direct browser-to-S3 upload.
+
+        Returns ``{"url", "key", "bucket"}``; the client sends
+        ``fetch(url, {method: "PUT", body})``. ``content_type``, when given, is
+        signed, so the PUT must send that exact ``Content-Type`` (S3 answers
+        403 otherwise). ``content_length`` signs ``Content-Length`` too, so a
+        SigV4 URL accepts only a body of exactly that many bytes — the way to
+        make a size limit the caller validated binding (a presigned PUT cannot
+        carry a range; that needs a presigned POST policy).
+
+        Mint the key server-side (``key_for(sha)``, or a key derived from a
+        record id) and never sign a key the client names.
+        """
+        key = self._resolve_key(sha_or_key)
+        params = {"Bucket": self.bucket, "Key": key}
+        if content_type:
+            params["ContentType"] = content_type
+        if content_length is not None:
+            length = int(content_length)
+            if length < 0:
+                raise ValueError("content_length must not be negative")
+            params["ContentLength"] = length
+        url = self.client.generate_presigned_url(
+            "put_object", Params=params, ExpiresIn=int(expires_seconds)
+        )
+        return {"url": url, "key": key, "bucket": self.bucket}

{velocity_python-0.1.133 → velocity_python-0.2.0}/src/velocity/aws/capabilities/__init__.py

@@ -28,7 +28,13 @@ from .dispatch import (  # noqa: F401
     CapabilityDispatcher,
     run_capability,
 )
-from .provisioning import provision, trigger_key  # noqa: F401
+from .provisioning import (  # noqa: F401
+    as_bool,
+    provision,
+    row_enabled,
+    trigger_key,
+    upgrade_column_types,
+)
 
 # built-ins (importing registers them)
 from . import retention  # noqa: E402,F401
@@ -44,6 +50,7 @@ __all__ = [
     "CapabilityDispatcher",
     "POLICY_KINDS",
     "REGISTRY",
+    "as_bool",
     "capability",
     "catalog",
     "describe",
@@ -52,9 +59,11 @@ __all__ = [
     "policy_field",
     "provision",
     "resolve_config",
+    "row_enabled",
     "run_capability",
     "summarize_policy",
     "trigger_key",
+    "upgrade_column_types",
     "validate_policy",
     "NIGHTLY",
     "HOURLY",

{velocity_python-0.1.133 → velocity_python-0.2.0}/src/velocity/aws/capabilities/provisioning.py

@@ -44,13 +44,21 @@ PROGRAM_SOURCE = (
 )
 
 
+CAPABILITIES_NAME_INDEX = f"idx__{SITE_TABLE}__name"
+
 # The table velocity owns for this module; ensured by provision() and by
 # velocity.aws.schema.ensure_infrastructure() (the pre-lock schema step).
 SCHEMA = {
     SITE_TABLE: {
-        "columns": {"name": "TEXT", "enabled": "BOOLEAN", "config": "TEXT"},
+        # Declared SQL types. Sites provisioned before velocity honoured them
+        # hold TEXT here; upgrade_column_types() casts those in place.
+        "columns": {"name": "TEXT", "enabled": "BOOLEAN", "config": "JSONB"},
         # provision() merges on name: ON CONFLICT needs this unique index.
-        "unique_indexes": [{"columns": ["name"], "name": "sys_capabilities_name_uidx"}],
+        # Named as velocity's merge self-heal names it (idx__<table>__<cols>),
+        # which is also the name app schema lanes declare with
+        # CREATE UNIQUE INDEX IF NOT EXISTS, so an environment provisioned
+        # first and one synced first end up with one identical index.
+        "unique_indexes": [{"columns": ["name"], "name": CAPABILITIES_NAME_INDEX}],
     },
 }
 
@@ -79,6 +87,105 @@ def row_enabled(row) -> bool:
     return as_bool((row or {}).get("enabled"), default=True)
 
 
+def _enabled_using(column: str) -> str:
+    """``USING`` expression casting a TEXT ``enabled`` exactly as
+    :func:`as_bool` reads it: NULL stays NULL (on), the false spellings are
+    FALSE, anything else TRUE — never a cast error on an odd value."""
+    falses = ", ".join(f"'{text}'" for text in sorted(_FALSE_TEXT))
+    return (
+        f"CASE WHEN {column} IS NULL THEN NULL "
+        f"WHEN lower(btrim({column})) IN ({falses}) THEN FALSE ELSE TRUE END"
+    )
+
+
+def _config_using(column: str) -> str:
+    """``USING`` expression for a TEXT ``config``: blank becomes NULL (read as
+    ``{}``), everything else is cast as JSON — pre-checked by
+    :func:`_invalid_configs`, so the cast cannot fail half-way."""
+    return f"NULLIF(btrim({column}), '')::jsonb"
+
+
+# column -> (information_schema data_type wanted, declared DDL, USING builder)
+COLUMN_UPGRADES = {
+    "enabled": ("boolean", "BOOLEAN", _enabled_using),
+    "config": ("jsonb", "JSONB", _config_using),
+}
+
+
+def _invalid_configs(table) -> list:
+    """Names of rows whose TEXT ``config`` is not blank and not a JSON
+    object — the rows that would fail the JSONB cast or fail
+    :func:`velocity.aws.capabilities.base.load_config` afterwards."""
+    bad = []
+    for row in table.select(columns=["name", "config"]):
+        raw = row.get("config")
+        if raw is None or not str(raw).strip():
+            continue
+        try:
+            value = json.loads(raw)
+        except ValueError:
+            value = None
+        if not isinstance(value, dict):
+            bad.append(row.get("name"))
+    return bad
+
+
+def upgrade_column_types(tx, *, dry_run: bool = False) -> list:
+    """Cast a TEXT ``sys_capabilities.enabled`` / ``config`` to the declared
+    BOOLEAN / JSONB, in place. Idempotent: an absent table, a column already
+    typed, or a non-PostgreSQL server is a no-op (``[]``).
+
+    For an app's migration lane: provisioning and ``ensure_infrastructure``
+    never rewrite an existing column's type, so a site whose table was created
+    while velocity read declared types as sample values keeps TEXT until this
+    runs. Returns ``[{"column", "from", "to", "sql"}, ...]`` for each column
+    changed (or, with ``dry_run=True``, that would change — nothing runs).
+
+    Raises ``ValueError`` before any DDL when a column has a type other than
+    TEXT or the declared one, or when a ``config`` value is not a JSON object
+    (named, so an operator can fix those rows first).
+    """
+    table = tx.table(SITE_TABLE)
+    if not str(getattr(table.sql, "server", "")).lower().startswith("postgre"):
+        return []
+    if not table.exists():
+        return []
+    types = {str(k).lower(): str(v).lower() for k, v in table.column_types().items()}
+
+    pending = {}
+    for column, (wanted, ddl, using) in COLUMN_UPGRADES.items():
+        current = types.get(column)
+        if current is None or current == wanted:
+            continue
+        if current != "text":
+            raise ValueError(
+                f"{SITE_TABLE}.{column} is {current!r}; expected text or "
+                f"{wanted} — inspect it by hand"
+            )
+        pending[column] = (current, wanted, ddl, using)
+    if not pending:
+        return []
+
+    if "config" in pending:
+        bad = _invalid_configs(table)
+        if bad:
+            raise ValueError(
+                f"{SITE_TABLE}.config is not a JSON object for: "
+                f"{', '.join(map(str, bad))} — fix those rows, then rerun"
+            )
+
+    changes = []
+    columns = {}
+    for column, (current, wanted, ddl, using) in pending.items():
+        spec = {"type": ddl, "using": using(table.sql.quote_identifier(column))}
+        sql, _vals = table.alter({column: spec}, sql_only=True, declared=True)
+        changes.append({"column": column, "from": current, "to": wanted, "sql": sql})
+        columns[column] = spec
+    if not dry_run:
+        table.migrate_schema(columns=columns)
+    return changes
+
+
 def trigger_key(cap_name: str, action: str) -> str:
     return f"cap:{cap_name}:{action}"
 

{velocity_python-0.1.133 → velocity_python-0.2.0}/src/velocity/aws/deploy/__init__.py

@@ -25,6 +25,15 @@ Frontend build check (``python build.py validate-frontend``):
     from velocity.aws.deploy import validate_yarn_frontend
     validate_yarn_frontend(PROJECT_ROOT, extra_amplify_yml_steps=(...))
 
+IAM statement builders (pure; resources may be CloudFormation intrinsics),
+for templates that should grant exactly what velocity's deploys grant:
+
+    from velocity.aws.deploy import (
+        ssm_parameter_arns, ssm_read_statement, queue_consumer_statement,
+        queue_producer_statement, failure_topic_publish_statement,
+        dlq_redrive_policy,
+    )
+
 See docs/deploy.md in the velocity-python repo for deployment, and the
 "CI regression gate" section of docs/aws-handlers.md for ci_gate.
 """
@@ -40,13 +49,24 @@ from velocity.aws.deploy.frontend_checks import (
 from velocity.aws.deploy.policies import (
     AWS_LAMBDA_VPC_ACCESS_ARN,
     IAM_MANAGED_POLICY_MAX_CHARS,
+    QUEUE_CONSUME_ACTIONS,
+    SEND_QUEUE_ACTIONS,
+    SSM_READ_ACTIONS,
     ManagedPolicySizeError,
     app_policy_name,
     app_runtime_statements,
     baseline_lambda_policy_document,
+    dlq_redrive_policy,
     ensure_app_policy,
+    failure_topic_publish_statement,
+    queue_consumer_statement,
+    queue_producer_statement,
+    queue_worker_statement,
     reconcile_role_policies,
     retire_policy,
+    ssm_decrypt_statement,
+    ssm_parameter_arns,
+    ssm_read_statement,
     sync_managed_policy_document,
 )
 from velocity.aws.deploy.operations import (
@@ -93,10 +113,14 @@ __all__ = [
     "ManagedPolicySizeError",
     "MasqueradeReconcile",
     "PlainTarget",
+    "QUEUE_CONSUME_ACTIONS",
+    "SEND_QUEUE_ACTIONS",
+    "SSM_READ_ACTIONS",
     "app_policy_name",
     "app_runtime_statements",
     "apply_reserved_concurrency",
     "baseline_lambda_policy_document",
+    "dlq_redrive_policy",
     "ensure_alarm_topic",
     "ensure_api_cors_header",
     "ensure_app_policy",
@@ -105,11 +129,15 @@ __all__ = [
     "ensure_identity_pool_developer_provider",
     "ensure_queue_alarms",
     "ensure_queue_event_source_mapping",
+    "failure_topic_publish_statement",
     "get_amplify_app_id_and_branch",
     "initialize_build_environment",
     "list_functions_by_tag",
     "queue_alarm_definitions",
+    "queue_consumer_statement",
+    "queue_producer_statement",
     "queue_visibility_timeout",
+    "queue_worker_statement",
     "reconcile_role_policies",
     "resolve_deploy_config_value",
     "resolve_latest_layer_arns",
@@ -121,6 +149,9 @@ __all__ = [
     "run_post_deploy_reconcilers",
     "set_cloudwatch_logging",
     "setup_sqs_queue_and_permissions",
+    "ssm_decrypt_statement",
+    "ssm_parameter_arns",
+    "ssm_read_statement",
     "sync_managed_policy_document",
     "update_lambda_function_config",
     "update_lambda_layers_to_latest",