legend: ! required, ? optional, = default, T[] array, map string-keyed map, oneof(k) union by k, ~template templateable schema Module: # The root module schema. inputs: InputProperty[]! # Input configuration defining the module's form fields ui: ModuleUI? # UI configuration for links, logs, and metrics on the module dashboard readme: str? # Human-readable module documentation in Markdown. stack: ModuleStack? # Stack configuration for provisioning this module build: ModuleBuild? # Build configuration for this module deploy: ModuleDeployment? # Deployment configuration for this module schema InputProperty: # Union of all input property types. oneof: StringInputProperty | TextInputProperty | ObjectInputProperty | ObjectMapInputProperty | ObjectArrayInputProperty | ArrayInputProperty | ArrayStringInputProperty | NumberInputProperty | BooleanInputProperty | SectionInputProperty | CompoundInputProperty | RefInputProperty | GitRepoInputProperty | KeyValueInputProperty schema ModuleBuild: # Build configuration — discriminated by module build type oneof(type): disabled: DisabledModuleBuild image: ImageModuleBuild lambda: LambdaModuleBuild static: StaticModuleBuild schema ModuleDeployment: # Deployment configuration — discriminated by deployment type oneof(type): "aws:ec2": Ec2ModuleDeployment "aws:ecs": EcsModuleDeployment "aws:lambda": LambdaModuleDeployment "aws:static": AwsStaticModuleDeployment schema ModuleStack: # Root stack block in module.yaml type: enum[terraform,opentofu]! ~template # IaC stack type pipelines: StackPipelinesConfig! # Configuration for all stack pipelines ravion_state_backend_workspace: str | null? ~template # The Ravion Cloud workspace name to use for state storage. schema ModuleUI: # UI configuration for the module. links: UILink[] | null? ~template # Links to display, such as service URLs, documentation, etc. metrics: UIMetric[] | null? ~template # Metrics charts displayed on the module dashboard. logs: UILog[] | null? ~template # Log sources displayed on the module's Logs tab. Each entry is a CloudWatch log group the module emits to. schema ArrayInputProperty: # Array editor input property. id: str! {minLen:1} # Unique identifier for this input. label: str! {minLen:1} # Text shown above the form field description: str? # Help text shown below the label show_when: ShowWhen? # Only show this field when another field has a specific value immutable: bool? # Lock this field after first deploy — prevents changes to destructive settings collapsible: bool? # Render this field as collapsible (tag when collapsed, full field when expanded) Supported for all value-producing input types. type: array! # Input type for array editor fields default: any[] | null? ~template # Default array value for the field placeholder: str? # Placeholder text when the field is empty required: bool? # Whether the field must be filled in schema ArrayStringInputProperty: # Array of strings input property. id: str! {minLen:1} # Unique identifier for this input. label: str! {minLen:1} # Text shown above the form field description: str? # Help text shown below the label show_when: ShowWhen? # Only show this field when another field has a specific value immutable: bool? # Lock this field after first deploy — prevents changes to destructive settings collapsible: bool? # Render this field as collapsible (tag when collapsed, full field when expanded) Supported for all value-producing input types. type: string_array! # Input type for dynamic string arrays default: str[] | null? ~template # Default array of values placeholder: str? # Placeholder text for each input field in the array add_button_label: str? # Label for the "Add" button below the list values: StringValues? # Allowed values — static array of options or dynamic reference for a multi-select dropdown required: bool? # Whether at least one item is required patterns: ValidationPattern[]? # Regex patterns to validate each array item against schema BooleanInputProperty: # Boolean toggle/checkbox input property. id: str! {minLen:1} # Unique identifier for this input. label: str! {minLen:1} # Text shown above the form field description: str? # Help text shown below the label show_when: ShowWhen? # Only show this field when another field has a specific value immutable: bool? # Lock this field after first deploy — prevents changes to destructive settings collapsible: bool? # Render this field as collapsible (tag when collapsed, full field when expanded) Supported for all value-producing input types. type: boolean! # Input type for boolean toggle fields default: bool! ~template # Default boolean value schema CompoundInputProperty: # Compound select input property. id: str! {minLen:1} # Unique identifier for this input. label: str! {minLen:1} # Text shown above the form field description: str? # Help text shown below the label show_when: ShowWhen? # Only show this field when another field has a specific value immutable: bool? # Lock this field after first deploy — prevents changes to destructive settings collapsible: bool? # Render this field as collapsible (tag when collapsed, full field when expanded) Supported for all value-producing input types. type: compound! # Input type for compound select dropdowns fields: str[]! {minItems:1} # List of field names to expose from the selected compound value default: map | "$values:first"? ~template # Default value — a record with the field values required: bool? # Whether the field must be filled in values: CompoundValues? # Allowed values — static array of options or dynamic reference (required for compound) no_options_message: str? # Message shown when the dropdown has no available options min_current_value: bool? # Use the current deployed value as the minimum allowed value schema GitRepoInputProperty: # Git repository input property. id: str! {minLen:1} # Unique identifier for this input. label: str! {minLen:1} # Text shown above the form field description: str? # Help text shown below the label show_when: ShowWhen? # Only show this field when another field has a specific value immutable: bool? # Lock this field after first deploy — prevents changes to destructive settings collapsible: bool? # Render this field as collapsible (tag when collapsed, full field when expanded) Supported for all value-producing input types. type: gitrepo! # Input type for git repository selector default: str? # Default repository URL placeholder: str? # Placeholder text when the field is empty required: bool? # Whether the field must be filled in schema KeyValueInputProperty: # Key-value pairs input property. id: str! {minLen:1} # Unique identifier for this input. label: str! {minLen:1} # Text shown above the form field description: str? # Help text shown below the label show_when: ShowWhen? # Only show this field when another field has a specific value immutable: bool? # Lock this field after first deploy — prevents changes to destructive settings collapsible: bool? # Render this field as collapsible (tag when collapsed, full field when expanded) Supported for all value-producing input types. type: keyvalue! # Input type for key-value editor fields default: map | null? ~template # Default key-value pairs for the field required: bool? # Whether the field must have at least one key-value pair schema NumberInputProperty: # Numeric input property. id: str! {minLen:1} # Unique identifier for this input. label: str! {minLen:1} # Text shown above the form field description: str? # Help text shown below the label show_when: ShowWhen? # Only show this field when another field has a specific value immutable: bool? # Lock this field after first deploy — prevents changes to destructive settings collapsible: bool? # Render this field as collapsible (tag when collapsed, full field when expanded) Supported for all value-producing input types. type: number! # Input type for numeric fields default: int | "$values:first"? ~template # Default numeric value placeholder: str? # Placeholder text when the field is empty required: bool? # Whether the field must be filled in values: NumberValues? # Allowed values — static array of options or dynamic reference for a dropdown no_options_message: str? # Message shown when the dropdown has no available options min: int? {format:int32} # Minimum allowed value max: int? {format:int32} # Maximum allowed value min_current_value: bool? # Use the current deployed value as the minimum allowed value schema ObjectArrayInputProperty: # Structured array input property. id: str! {minLen:1} # Unique identifier for this input. label: str! {minLen:1} # Text shown above the form field description: str? # Help text shown below the label show_when: ShowWhen? # Only show this field when another field has a specific value immutable: bool? # Lock this field after first deploy — prevents changes to destructive settings collapsible: bool? # Render this field as collapsible (tag when collapsed, full field when expanded) Supported for all value-producing input types. type: object_array! # Input type for structured object arrays default: ObjectArrayDefaultItem[] | null? ~template # Default array value for the field required: bool? # Whether the field must contain at least one item item_label: str? # Label for each array item, used in add buttons and editor headers item_title: ObjectCollectionItemTitleConfig? # User-facing title template for each array item. item_description: str | null? ~template # User-facing description template shown as a secondary line for each array item. item_inputs: RefFallbackInputProperty[]! {minItems:1} # Input definitions for each object value in the array. schema ObjectInputProperty: # Object editor input property. id: str! {minLen:1} # Unique identifier for this input. label: str! {minLen:1} # Text shown above the form field description: str? # Help text shown below the label show_when: ShowWhen? # Only show this field when another field has a specific value immutable: bool? # Lock this field after first deploy — prevents changes to destructive settings collapsible: bool? # Render this field as collapsible (tag when collapsed, full field when expanded) Supported for all value-producing input types. type: object! # Input type for object editor fields default: any | null? ~template # Default object value for the field placeholder: str? # Placeholder text when the field is empty required: bool? # Whether the field must be filled in schema ObjectMapInputProperty: # Structured map input property. id: str! {minLen:1} # Unique identifier for this input. label: str! {minLen:1} # Text shown above the form field description: str? # Help text shown below the label show_when: ShowWhen? # Only show this field when another field has a specific value immutable: bool? # Lock this field after first deploy — prevents changes to destructive settings collapsible: bool? # Render this field as collapsible (tag when collapsed, full field when expanded) Supported for all value-producing input types. type: object_map! # Input type for structured object maps default: map? ~template # Default map value for the field required: bool? # Whether the field must contain at least one entry key: MapKeyConfig? # Metadata for the map entry key field. item_title: ObjectCollectionItemTitleConfig? # User-facing title template for each map item. item_label: str? # Label for each map item, used in add buttons and editor headers item_inputs: RefFallbackInputProperty[]! {minItems:1} # Input definitions for each object value in the map. schema RefInputProperty: # Module reference input property. id: str! {minLen:1} # Unique identifier for this input. label: str! {minLen:1} # Text shown above the form field description: str? # Help text shown below the label show_when: ShowWhen? # Only show this field when another field has a specific value immutable: bool? # Lock this field after first deploy — prevents changes to destructive settings collapsible: bool? # Render this field as collapsible (tag when collapsed, full field when expanded) Supported for all value-producing input types. type: str! # Reference to another module type — format is "$ref:" mapped_inputs: RefFallbackInputProperty[]? # Input definitions that copy values from the selected referenced module into this module's input values. Each mapped input is saved as a normal input on the c... required: bool? # Whether the module reference is required schema SectionInputProperty: # Visual section separator property. id: str! {minLen:1} # Unique identifier for this input. label: str! {minLen:1} # Text shown above the form field description: str? # Help text shown below the label show_when: ShowWhen? # Only show this field when another field has a specific value type: section! # Input type for visual section separators — produces no value schema StringInputProperty: # Single-line text input property. id: str! {minLen:1} # Unique identifier for this input. label: str! {minLen:1} # Text shown above the form field description: str? # Help text shown below the label show_when: ShowWhen? # Only show this field when another field has a specific value immutable: bool? # Lock this field after first deploy — prevents changes to destructive settings collapsible: bool? # Render this field as collapsible (tag when collapsed, full field when expanded) Supported for all value-producing input types. type: string! # Input type for single-line text fields default: str | "$values:first"? ~template # Default value for the field placeholder: str? # Placeholder text when the field is empty required: bool? # Whether the field must be filled in values: StringValues? # Allowed values — static array of options or dynamic reference for a dropdown no_options_message: str? # Message shown when the dropdown has no available options patterns: ValidationPattern[]? # Regex patterns to validate against min_current_value: bool? # Use the current deployed value as the minimum allowed value schema TextInputProperty: # Multi-line text area input property. id: str! {minLen:1} # Unique identifier for this input. label: str! {minLen:1} # Text shown above the form field description: str? # Help text shown below the label show_when: ShowWhen? # Only show this field when another field has a specific value immutable: bool? # Lock this field after first deploy — prevents changes to destructive settings collapsible: bool? # Render this field as collapsible (tag when collapsed, full field when expanded) Supported for all value-producing input types. type: text! # Input type for multi-line text areas default: str | null? ~template # Default value for the field placeholder: str? # Placeholder text when the field is empty required: bool? # Whether the field must be filled in patterns: ValidationPattern[]? # Regex patterns to validate against schema DisabledModuleBuild: # Disabled build configuration for a module. Additional fields are ignored. type: disabled! # Build type discriminator schema ImageModuleBuild: # Image build configuration for a module. type: image! ~template # Build type discriminator timeout: int | null? {format:int32,min:1} ~template # Maximum execution time in seconds before the build is killed. inputs: InputProperty[]! # Build-specific inputs shown when running a module build. source: Pipeline.GitSource! ~template # Git source configuration. builder: Pipeline.ImageBuildConfig! ~template # Builder configuration — dockerfile, nixpacks, or railpack settings. environment_variables: Pipeline.EnvironmentVariablesValue? ~template # Environment variables available during the build. debug: bool | null? ~template # Enable verbose build output for debugging build issues. destinations: Pipeline.EcrDestination[]! {minItems:1} ~template # ECR destinations where the built Docker image will be pushed. infrastructure: Pipeline.StepInfrastructure! ~template # Execution environment configuration used for the build. schema LambdaModuleBuild: # Lambda build configuration for a module. Produces a zip artifact uploaded to S3, sized for the Lambda Zip package type. Wraps the existing `Pipeline.BuildLam... type: lambda! ~template # Build type discriminator timeout: int | null? {format:int32,min:1} ~template # Maximum execution time in seconds before the build is killed. inputs: InputProperty[]! # Build-specific inputs shown when running a module build. source: Pipeline.GitSource! ~template # Git source configuration. builder: Pipeline.LambdaBuildConfig! ~template # Builder configuration — dockerfile or nixpacks settings for the Lambda zip build. Reuses the existing `Pipeline.LambdaBuildConfig` shape so module builds and... environment_variables: Pipeline.EnvironmentVariablesValue? ~template # Environment variables available during the build. debug: bool | null? ~template # Enable verbose build output for debugging build issues. destinations: Pipeline.S3Destination[]! {minItems:1} ~template # S3 destinations where the Lambda deployment package will be uploaded. At least one is required; the resulting key is passed to the deploy step as `deploy.inp... infrastructure: Pipeline.StepInfrastructure! ~template # Execution environment configuration used for the build. schema StaticModuleBuild: # Static build configuration for a module. type: static! ~template # Build type discriminator timeout: int | null? {format:int32,min:1} ~template # Maximum execution time in seconds before the build is killed. inputs: InputProperty[]! # Build-specific inputs shown when running a module build. source: Pipeline.GitSource! ~template # Git source configuration. builder: Pipeline.StaticBuildConfig! ~template # Builder configuration — dockerfile, nixpacks, or railpack settings. environment_variables: Pipeline.EnvironmentVariablesValue? ~template # Environment variables available during the build. debug: bool | null? ~template # Enable verbose build output for debugging build issues. destinations: Pipeline.S3Destination[]! {minItems:1} ~template # S3 destinations where the built static assets will be uploaded. infrastructure: Pipeline.StepInfrastructure! ~template # Execution environment configuration used for the build. schema AwsStaticModuleDeployment: # AWS static site deployment configuration type: "aws:static"! # Deployment type discriminator infrastructure: AwsStaticDeploymentInfrastructure! # Infrastructure resources required by the deployment timeout: int? {format:int32,min:60} # Maximum total wall-clock budget (in seconds) for a single deploy, measured from the moment the workflow starts (including time spent waiting for the deployme... inputs: InputProperty[]! # Deployment-specific inputs shown in the deploy modal. definition: AwsStaticDeploymentDefinition! ~template # Per-deploy definition. Templateable — supports both module.input and deploy.input references inside string fields. schema Ec2ModuleDeployment: # AWS EC2 deployment configuration. In-place only: instances are never replaced; the module-provided SSM document performs the whole per-instance deploy and it... type: "aws:ec2"! # Deployment type discriminator source: Pipeline.GitSource? ~template infrastructure: Ec2DeploymentInfrastructure! # Infrastructure resources required by the deployment. concurrency: EcsDeployConcurrency? # Concurrency policy — controls how simultaneous deploy requests are handled. strategy: Ec2DeploymentStrategyConfig? ~template # Rolling in-place deployment strategy. Its rollout controls map to SSM SendCommand MaxConcurrency / MaxErrors. timeout: int? {format:int32,min:60} # Maximum total wall-clock budget (in seconds) for a single deploy, measured from the moment the workflow starts (including time spent waiting for the deployme... inputs: InputProperty[]! # Deployment-specific inputs shown in the deploy modal. definition: Ec2DeploymentDefinition! ~template # Per-deploy definition. Templateable — supports both module.input and deploy.input references inside string fields. schema EcsModuleDeployment: # AWS ECS deployment configuration type: "aws:ecs"! # Deployment type discriminator infrastructure: EcsDeploymentInfrastructure! # Infrastructure resources required by the deployment strategy: EcsDeploymentStrategyConfig? ~template # Deployment strategy — rolling (default), blue_green, linear, or canary. concurrency: EcsDeployConcurrency? # Concurrency policy — controls how simultaneous deploy requests are handled. timeout: int? {format:int32,min:60} # Maximum total wall-clock budget (in seconds) for a single deploy, measured from the moment the workflow starts (including time spent waiting for the deployme... inputs: InputProperty[]! # Deployment-specific inputs shown in the deploy modal Same types as module inputs — reuses the InputProperty union task_definition: EcsTaskDefinition! ~template # AWS ECS task definition — fully typed per the RegisterTaskDefinition API Templateable — supports both module.input and deploy.input references pre_deploy: EcsRunTaskOverrides? ~template post_deploy: EcsRunTaskOverrides? ~template schema LambdaModuleDeployment: # AWS Lambda deployment configuration. v1 supports UpdateFunctionCode + PublishVersion + UpdateAlias. Pre/post deploy hooks and weighted- routing alias shifts... type: "aws:lambda"! # Deployment type discriminator infrastructure: LambdaDeploymentInfrastructure! # Infrastructure resources required by the deployment. timeout: int? {format:int32,min:60} # Maximum total wall-clock budget (in seconds) for a single deploy, measured from the moment the workflow starts (including time spent waiting for the deployme... inputs: InputProperty[]! # Deployment-specific inputs shown in the deploy modal. definition: LambdaDeploymentDefinition! ~template # Per-deploy definition. Templateable — supports both module.input and deploy.input references inside string fields. function_configuration: LambdaFunctionConfiguration? ~template # Per-deploy function-configuration overrides applied via `UpdateFunctionConfiguration` before the new code is published. schema StackPipelinesConfig: # Stack pipeline configuration defaults: StackPipelineDefaults! # Defaults applied to stack runs and merged into trigger run inputs. change: StackActionPipelineConfig! # Configuration for stack change pipeline destroy: StackActionPipelineConfig! # Configuration for stack destroy pipeline schema UILink: # A link displayed in the module UI. name: str! {minLen:1} ~template # Display name for the link href: str! ~template # URL — can use template syntax like << output.xxx >> for dynamic values schema UILog: # A log source displayed in the module UI's Logs tab. Every field is templateable so module authors can pass an entire log definition (or individual fields) fr... id: str! {minLen:1} ~template # Stable identifier for the log source, used as the React key / scope id. name: str! {minLen:1} ~template # Display name for the log source (shown as the source label). source: LogSource! ~template # Data source for the logs. Discriminated union — currently `cloudwatch`. schema UIMetric: # A metric displayed in the module UI. id: str! {minLen:1} ~template # Stable identifier for the metric, used as the React key on the dashboard and in the metric query cache key. Must be unique within a module's UI. name: str! {minLen:1} ~template # Display name for the metric type: enum[line,bar]! ~template # Chart type for the metric source: MetricSource! ~template # Data source for the metric. Discriminated union — the only `type` currently supported is `cloudwatch`. The aggregation period is chosen by the requester (fro... schema ShowWhen: # Conditional visibility mapping; array source values support contains and contains-all matching. type: map schema StringValues: # String values - either a static array of options or a dynamic reference. oneof: StringValueItem[] | str schema ValidationPattern: # A regex pattern with an error message for validation pattern: str! # JavaScript regex the input must match message: str! # Error shown to the user when validation fails schema CompoundFieldValue: # Allowed value types within a compound value item. oneof: str | num | int | bool | str[] schema CompoundValues: # Compound values - either a static array of options or a dynamic reference. oneof: CompoundValueItem[] | str schema DefaultValueRef: # Special default references derived from the field's values list. type: "$values:first" schema Pipeline.GitRepoUrl: # Full git repository URL including host. type: str schema NumberValues: # Number values - either a static array of options or a dynamic reference. oneof: NumberValueItem[] | str schema ObjectArrayDefaultItem: # Default value item for structured object arrays. type: map schema ObjectCollectionItemTitleConfig: # Configuration for the title shown for each structured collection item in the form. template: str! # Template for the item title. Supports placeholders like {key} for maps and {field_id}. fallback: str? # Fallback title template used when the primary template cannot be resolved. schema RefFallbackInputProperty: # Input properties allowed inside module reference fallback inputs. oneof(type): array: ArrayInputProperty boolean: BooleanInputProperty compound: CompoundInputProperty gitrepo: GitRepoInputProperty keyvalue: KeyValueInputProperty number: NumberInputProperty object: ObjectInputProperty object_array: ObjectArrayInputProperty object_map: ObjectMapInputProperty section: SectionInputProperty string: StringInputProperty string_array: ArrayStringInputProperty text: TextInputProperty schema MapKeyConfig: # Configuration for the string key of an object_map entry. label: str? # Text shown for the map key field. placeholder: str? # Placeholder text for a new map key. description: str? # Help text shown below the map key field. patterns: ValidationPattern[]? # Regex patterns to validate map keys against. from_fields: str | null[]? # Item input fields used to compute the map key instead of asking for one. Empty/null entries are ignored. separator: str? # String used to join computed key field values. Defaults to "-". schema RefTypeDiscriminator: # Type discriminator for module references. type: str schema Pipeline.EcrDestination: # ECR destination for image builds id: str! ~template # Unique destination identifier within the build step type: ecr! ~template # ECR destination type repository_arn: str! ~template # ECR repository ARN tags: str[] | null? ~template # Docker image tags to apply in ECR after the build finishes schema Pipeline.EnvironmentVariablesValue: # Environment variable map value. oneof: map | str schema Pipeline.GitSource: # Git source configuration for fetching code type: git! ~template # Source type identifier repo: str! ~template # Full repository URL including host branch: str! {minLen:1} ~template # Branch to check out ref: str | null? ~template # Git ref to check out — branch, commit SHA, tag, or other ref. Overrides branch HEAD if set. base_path: str | null? = . ~template # Base path within the repository to use as the working root schema Pipeline.ImageBuildConfig: # Image build configuration — discriminated by build method oneof(type): disabled: Pipeline.DisabledBuildConfig dockerfile: Pipeline.ImageDockerfileBuildConfig nixpacks: Pipeline.ImageNixpacksBuildConfig railpack: Pipeline.ImageRailpackBuildConfig schema Pipeline.StepInfrastructure: # Step infrastructure configuration execution_environment_id: str | null? ~template # ID or given ID of a pre-configured execution environment aws_account_id: str | null? ~template # AWS account reference for automatic network selection. region: str | null? ~template # AWS region for automatic network selection type: enum[ec2,ec2-spot]! ~template # Instance type — "ec2" for on-demand or "ec2-spot" for cheaper spot instances instance_size: str | str[]! ~template # Instance size — a single size like "large" or an array like ["large", "xlarge"] for spot fallback ami: str | null? ~template # AMI ID for the runner instance permissions: Pipeline.AwsPermissions? ~template # IAM permissions for the runner role — "attach" to add policies or "replace" to override step defaults storage: Pipeline.StorageConfig? ~template # Root volume storage configuration schema Pipeline.LambdaBuildConfig: # Lambda build configuration — discriminated by build method oneof(type): disabled: Pipeline.DisabledBuildConfig dockerfile: Pipeline.LambdaDockerfileBuildConfig nixpacks: Pipeline.LambdaNixpacksBuildConfig schema Pipeline.S3Destination: # S3 destination for build artifacts id: str! {minLen:1} ~template # Unique destination identifier within the build step type: s3! ~template # S3 destination type bucket: str! ~template # S3 bucket name where built assets will be uploaded directory: str | null? ~template # S3 directory override for the uploaded build output. region: str! ~template # AWS region for the destination S3 bucket schema Pipeline.StaticBuildConfig: # Static build configuration — discriminated by build method oneof(type): dockerfile: Pipeline.StaticDockerfileBuildConfig nixpacks: Pipeline.StaticNixpacksBuildConfig railpack: Pipeline.StaticRailpackBuildConfig schema AwsStaticDeploymentDefinition: # Per-deploy definition for AWS static deployments. The deploy manager promotes the resolved `s3_directory` to the `active` KVS key and (optionally) issues a b... s3_directory: str! {minLen:1} ~template # S3 directory (version prefix) to promote to active. cloudfront_invalidation_paths: str[] | null? ~template # CloudFront cache invalidation paths to issue across every distribution after the KVS write succeeds. Runs in the background — the deploy is marked complete o... keep_latest_successful_deploy_count: int | null? {format:int32,min:0} ~template # Number of latest successful deploys to keep in S3. Older S3 directories are pruned in the background after a successful deploy. Omit or set to 0 to disable p... schema AwsStaticDeploymentInfrastructure: # Infrastructure resources required for AWS static site deployment. cloudfront_keyvaluestore_arn: str! {minLen:1} ~template # CloudFront KeyValueStore ARN that holds the active version pointer. cloudfront_distribution_arns: str[]! {minItems:1} ~template # CloudFront distribution ARNs that share this origin/KVS. s3_region: str! {minLen:1} ~template # AWS region of the S3 hosting bucket. s3_bucket: str! {minLen:1} ~template # S3 bucket name that hosts the versioned build directories. schema Ec2DeploymentDefinition: # Per-deploy EC2 definition — discriminated by `runtime`. oneof(runtime): container: Ec2ContainerDeploymentDefinition manual: Ec2ManualDeploymentDefinition schema Ec2DeploymentInfrastructure: # Infrastructure resources required for an AWS EC2 deployment. Not provisioned by the deploy manager — must already exist (created by the `compute/ec2_service`... autoscaling_group_name: str! {minLen:1} ~template # Name of the Auto Scaling Group whose in-service instances the deploy targets. For container deploys the module's SSM deploy document is derived from this nam... region: str! {minLen:1} ~template # AWS region of the Auto Scaling Group and SSM document. aws_account_id: str! {minLen:1} ~template # Ravion AWS account ID (`awsact_…`, as selected from `$values:ravion/aws_accounts`) that owns the Auto Scaling Group — not the raw AWS account number. Unlike... log_group_name: str | null? ~template # CloudWatch log group receiving application stdout and stderr from the EC2 instances. The deploy manager combines this with the deployment and instance IDs to... target_group_arn: str | null? ~template # ARN of the service target group when the service is attached to a load balancer. Informational for the deploy manager (the SSM document owns drain/re-registe... schema Ec2DeploymentStrategyConfig: # Rolling in-place deployment strategy for EC2 instances. The rollout controls map 1:1 to SSM SendCommand's MaxConcurrency / MaxErrors semantics — values are a... type: rolling! ~template # Deployment strategy. EC2 deployments currently support rolling in-place updates only. concurrency_max: str | null? ~template # How many instances run the deploy document at once. SSM SendCommand MaxConcurrency semantics. errors_max: str | null? ~template # How many per-instance failures are tolerated before SSM stops sending the document to further instances. SSM SendCommand MaxErrors semantics. schema EcsDeployConcurrency: # Concurrency policy for ECS deployments targeting this module instance. queue_size: int? {format:int32,min:0} # Number of pending deploy requests that can wait in the queue. queue_overflow: enum[oldest,newest,reject]? # What to do when the queue is full and a new deploy request arrives. schema EcsDeploymentInfrastructure: # Infrastructure resources required for ECS deployment. Not provisioned by the deploy manager — must already exist. ecs_cluster_arn: str! {minLen:1} ~template # ECS cluster ARN where the service runs ecs_service_arn: str! {minLen:1} ~template # ECS service ARN of the service the deploy manager updates. The deploy strategy (rolling, blue/green, linear, canary) is executed natively by the ECS deployme... ecs_target_group_arn: str | null? ~template # ARN of the main (blue / production) target group attached to the ECS service. Forwarded as the UpdateService `loadBalancers[].targetGroupArn` when Ravion syn... ecs_alternate_target_group_arn: str | null? ~template # ARN of the alternate (green) target group ECS shifts traffic to during native traffic-shift deployments (blue_green / linear / canary). Forwarded into the Up... ecs_production_listener_rule_arn: str | null? ~template # ARN of the production listener rule (ALB) or listener (NLB) ECS rewrites to shift production traffic during native traffic-shift deployments. ecs_infrastructure_role_arn: str | null? ~template # ARN of the IAM infrastructure role ECS assumes to manage the load-balancer wiring (register/deregister targets, rewrite listener rules) during native traffic... ecs_test_listener_rule_arn: str | null? ~template # ARN of the optional test listener rule (ALB) or listener (NLB) ECS rewrites during the TEST_TRAFFIC_SHIFT lifecycle stages to route test traffic to the green... schema EcsDeploymentStrategyConfig: # Deployment strategy executed natively by the ECS deployment controller. type: enum[rolling,blue_green,linear,canary]! ~template # Deployment strategy: - rolling — in-place rolling update (default) - blue_green — full green revision, all-at-once traffic shift + bake - linear — traffic sh... bake_time_in_minutes: int | null? {format:int32,min:0,max:1440} ~template # Minutes both revisions keep running after production traffic has fully shifted, before the old revision is terminated. Rollback during the bake window is ins... canary: EcsCanaryConfig? ~template # Canary tuning — only valid when `type` is `canary`. linear: EcsLinearConfig? ~template # Linear tuning — required when `type` is `linear`. pause_stages: EcsPauseStage[] | null? ~template # Native PAUSE lifecycle hooks. Each entry pauses the deployment at the given stage until continued via the dashboard or API. Max 10. schema EcsRunTaskOverrides: # Full AWS ECS RunTask request payload — both the `TaskOverride` fields and the top-level RunTask parameters that aren't part of `TaskOverride` (launchType, ne... container_overrides: EcsContainerOverride[] | null? ~template # Per-container overrides. Each entry's `name` matches a container in the task definition. AWS RunTask supports overriding any subset of containers; the array... cpu: str | null? ~template # Task-level CPU override (string for AWS compatibility — same format as task-definition `cpu`, e.g. `"256"`, `"1024"`). memory: str | null? ~template # Task-level memory override (MiB, string format). task_role_arn: str | null? ~template # IAM task role ARN override — what the container assumes when calling AWS APIs from inside the task. execution_role_arn: str | null? ~template # IAM execution role ARN override — what ECS uses to pull the image, push logs, and read secrets at task launch. ephemeral_storage: EcsEphemeralStorage? ~template # Fargate ephemeral storage size override (20–200 GiB). launch_type: enum[FARGATE,EC2,EXTERNAL] | null? ~template # Launch type: FARGATE, EC2, or EXTERNAL. When omitted the hook inherits the parent service's launch type. Mutually exclusive with `capacity_provider_strategy`... capacity_provider_strategy: EcsCapacityProviderStrategyItem[] | null? ~template # Capacity-provider strategy — overrides `launch_type` when set. platform_version: str | null? ~template # Fargate platform version (e.g. `"1.4.0"`, `"LATEST"`). network_configuration: EcsNetworkConfiguration? ~template # VPC / subnet / security-group config. Required for `awsvpc` network-mode task definitions; inherited from the parent service when omitted. placement_constraints: EcsPlacementConstraint[] | null? ~template # Placement constraints — limits which container instances can run the task. EC2/EXTERNAL launch types only. placement_strategy: EcsPlacementStrategy[] | null? ~template # Placement strategy — how tasks get distributed across instances. propagate_tags: enum[TASK_DEFINITION,SERVICE,NONE] | null? ~template # How tags propagate from task definition / service onto the task. tags: EcsTag[] | null? ~template # Metadata tags applied to the task. enable_ecs_managed_tags: bool | null? ~template # Whether to enable AWS-managed `aws:ecs:` tags on the task. enable_execute_command: bool | null? ~template # Whether to enable ECS Exec on the task (for `aws ecs execute-command`). group: str | null? ~template # Logical group name — used for placement constraints (`memberOf(group:)`). Defaults to `family:` when AWS picks. reference_id: str | null? ~template # Caller-supplied reference id (UUID-shaped). Echoed back on the resulting Task and useful for client-side correlation. volume_configurations: EcsTaskVolumeConfiguration[] | null? ~template # Per-task volume bindings — name must match a volume in the task definition. Used for Fargate-managed ephemeral EBS volumes. timeout: int | null? {format:int32,min:1} ~template # Wall-clock timeout in seconds before the task is stopped and the deployment fails. Only meaningful when used as a pre/post deploy hook config — ignored on th... schema EcsTaskDefinition: # AWS ECS task definition — models the RegisterTaskDefinition API input. family: str! ~template # Task definition family name container_definitions: EcsContainerDefinition[]! {minItems:1} ~template # Container definitions — at least one required cpu: str | null? ~template # Task-level CPU units (required for Fargate) Valid values: "256", "512", "1024", "2048", "4096" etc. memory: str | null? ~template # Task-level memory in MiB (required for Fargate) network_mode: enum[awsvpc,bridge,host,none] | null? ~template # Network mode — "awsvpc" required for Fargate requires_compatibilities: enum[FARGATE,EC2][] | null? ~template # Launch type compatibility task_role_arn: str | null? ~template # IAM role ARN for task permissions (containers assume this role) execution_role_arn: str | null? ~template # IAM role ARN for ECS agent to pull images and write logs runtime_platform: EcsRuntimePlatform? ~template # Runtime platform (Fargate only) ephemeral_storage: EcsEphemeralStorage? ~template # Ephemeral storage (Fargate only, >20 GiB) volumes: EcsVolume[] | null? ~template # Volumes available to containers tags: EcsTag[] | null? ~template # AWS resource tags ipc_mode: enum[host,task,none] | null? ~template # IPC mode for containers (EC2 only) pid_mode: enum[host,task] | null? ~template # PID mode for containers (EC2 only) proxy_configuration: EcsProxyConfiguration? ~template # App Mesh proxy configuration inference_accelerators: EcsInferenceAccelerator[] | null? ~template # Inference accelerators (EC2 only) schema LambdaDeploymentDefinition: # Per-deploy Lambda definition — discriminated by `package_type`. oneof(package_type): image: LambdaImageDefinition zip: LambdaZipDefinition schema LambdaDeploymentInfrastructure: # Infrastructure resources required for AWS Lambda deployment. function_arn: str! {minLen:1} ~template # Full ARN of the Lambda function the deploy targets. region: str! {minLen:1} ~template # AWS region of the function. Mirrors `aws_static_module_deployment`'s `s3_region` — needed because Lambda's regional endpoint is the only thing the workflow c... alias_name: str | null? ~template # Alias the deploy flips after publishing the new function version. s3_artifact_bucket: str | null? ~template # S3 bucket the build step uploaded the zip artifact into. Optional — captured into the deploy snapshot for audit even when the deploy itself targets an Image-... schema LambdaFunctionConfiguration: # AWS Lambda function configuration — every field optional, applied as a partial update via `UpdateFunctionConfiguration`. Fields the user omits are left untou... role: str | null? ~template # IAM execution role ARN. handler: str | null? ~template # Handler entrypoint (Zip only — ignored for Image). runtime: str | null? ~template # Lambda runtime (Zip only — ignored for Image). memory_size: int | null? {format:int32,min:128,max:10240} ~template # Memory size in MiB. 128–10240. timeout: int | null? {format:int32,min:1,max:900} ~template # Wall-clock timeout in seconds. 1–900. description: str | null? ~template # Function description shown in the AWS console. architectures: enum[x86_64,arm64][] | null? ~template # CPU architectures — exactly one of `x86_64` or `arm64`. environment: LambdaEnvironment? ~template # Environment variables applied to the function. vpc_config: LambdaVpcConfig? ~template # VPC configuration. Setting empty arrays disconnects the function from the VPC. layers: str[] | null? ~template # Lambda layer ARNs (versioned, e.g. ephemeral_storage: LambdaEphemeralStorage? ~template # Ephemeral `/tmp` storage size. tracing_config: LambdaTracingConfig? ~template # X-Ray tracing mode. kms_key_arn: str | null? ~template # Customer-managed KMS key ARN for environment variable encryption. dead_letter_config: LambdaDeadLetterConfig? ~template # Dead-letter destination for async invocations. file_system_configs: LambdaFileSystemConfig[] | null? ~template # EFS file systems attached to the function. snap_start: LambdaSnapStart? ~template # SnapStart configuration. Java-only on AWS today, but the field is forwarded as-is to Lambda. logging_config: LambdaLoggingConfig? ~template # CloudWatch logging configuration. image_config: LambdaImageConfig? ~template # Image overrides — image-packaged functions only. schema StackActionPipelineConfig: # Pipeline configuration for a stack action pipeline_id: str! {minLen:1} ~template # Pipeline ID for this stack action triggers: Pipeline.PipelineTrigger[]? # Triggers that automatically start pipeline runs on webhook events. schema StackPipelineDefaults: # Default stack pipeline run configuration variant: str! {minLen:1} ~template # Default variant used for stack-triggered runs input: map? ~template # Default input values merged into each trigger run variant schema LogSource: # A CloudWatch Logs source for a module log stream. Mirrors type: cloudwatch! ~template aws_account_id: str! {minLen:1} ~template region: str! {minLen:1} ~template log_group: str! {minLen:1} ~template log_stream_prefix: str | null? ~template filter_pattern: str | null? ~template schema MetricSource: # CloudWatch-backed metric source. Module authors fill this in with literal values or templated references (e.g. `<< stack.output.* >>`). The server uses `aws_... type: cloudwatch! ~template # Source type discriminator aws_account_id: str! {minLen:1} ~template # Ravion AWS account reference used to resolve credentials for the CloudWatch call. Accepts either the Flightcontrol AWS account database ID (e.g. `awsact_123`... region: str! {minLen:1} ~template # AWS region the metric lives in. namespace: str! {minLen:1} ~template # CloudWatch namespace name: str! {minLen:1} ~template # CloudWatch metric name statistic: str! {minLen:1} ~template # CloudWatch statistic to apply dimensions: map! ~template # Dimensions used to scope the metric. Required — no longer derived from any ARN since the source no longer carries one. schema MetricType: # Allowed metric chart types. type: enum[line,bar] schema ShowWhenCondition: # A show_when condition. oneof: str | int | bool | str | int | bool[] | ShowWhenNotCondition schema DynamicValuesRef: # Dynamic values reference. type: str schema StringValueItem: # A selectable option with a string value. label: str? # Text shown in the dropdown description: str? # Extra detail shown alongside the option group_label: str? # Groups options under a shared heading in the dropdown value: str! # Actual value sent to Terraform when this option is selected show_when: ShowWhen? # Only show this option when another field has a specific value schema CompoundValueItem: # A compound value item - a record with arbitrary fields plus select metadata. label: str? # Text shown in the dropdown description: str? # Extra detail shown alongside the option group_label: str? # Groups options under a shared heading in the dropdown schema NumberValueItem: # A selectable option with a numeric value. label: str? # Text shown in the dropdown description: str? # Extra detail shown alongside the option group_label: str? # Groups options under a shared heading in the dropdown value: int! {format:int32} # Actual number sent to Terraform when this option is selected show_when: ShowWhen? # Only show this option when another field has a specific value schema Pipeline.EnvironmentVariable: # Environment variable — can be a plain string, Parameter Store reference, or Secrets Manager reference oneof: str | null | Pipeline.ParameterStoreEnvVar | Pipeline.SecretsManagerEnvVar schema Pipeline.DisabledBuildConfig: # Disabled build configuration. Valid only for module-driven builds. type: disabled! ~template # Build method — disables module build execution schema Pipeline.ImageDockerfileBuildConfig: # Dockerfile configuration for image builds type: dockerfile! ~template # Build method — use a custom Dockerfile dockerfile: str | null? = Dockerfile {minLen:1} ~template # Path to Dockerfile relative to source.base_path context: str | null? = . ~template # Docker build context path relative to source.base_path inject_env_variables_in_dockerfile: bool | null? ~template # Whether to inject environment variables as Docker build args Accepts either a boolean literal or a full template token cache_from: Pipeline.CacheFromConfig? ~template # Docker layer cache configuration schema Pipeline.ImageNixpacksBuildConfig: # Nixpacks configuration for image builds type: nixpacks! ~template # Build method — use Nixpacks auto-detection nixpacks_version: str | null? ~template # Nixpacks version to use build_path: str | null? ~template # Directory to run the Nixpacks build from, relative to the repository root config_file_path: str | null? ~template # Path to the Nixpacks configuration file relative to the repository root nix_pkgs: str[] | null? ~template # Additional Nix packages to install apt_pkgs: str[] | null? ~template # Additional apt packages to install nix_libs: str[] | null? ~template # Additional Nix libraries to install install_cmd: str | null? ~template # Custom install command build_cmd: str | null? ~template # Custom build command start_cmd: str | null? ~template # Application start command cache_from: Pipeline.CacheFromConfig? ~template # Docker layer cache configuration schema Pipeline.ImageRailpackBuildConfig: # Railpack configuration for image builds type: railpack! ~template # Build method — use Railpack auto-detection railpack_version: str | null? ~template # Railpack version to use install_cmd: str | null? ~template # Custom install command build_cmd: str | null? ~template # Custom build command start_cmd: str | null? ~template # Application start command cache_from: Pipeline.CacheFromConfig? ~template # Docker layer cache configuration schema Pipeline.AwsPermissions: # IAM policies configuration for runner roles Used by EC2-backed steps to specify additional permissions oneof: Pipeline.AwsPermissionsAttach | Pipeline.AwsPermissionsReplace schema Pipeline.InfrastructureType: # Execution environment type type: enum[ec2,ec2-spot] schema Pipeline.InstanceSize: # Instance size can be a single string or array of strings oneof: str | str[] schema Pipeline.StorageConfig: # Root volume storage configuration type: enum[gp3,gp2,io2,io1]? ~template # Volume type size: int | null? {format:int32} ~template # Volume size in GiB iops: int | null? {format:int32} ~template # Provisioned IOPS throughput: int | null? {format:int32} ~template # Provisioned throughput in MiB/s schema Pipeline.LambdaDockerfileBuildConfig: # Dockerfile configuration for Lambda builds type: dockerfile! ~template # Build method — use a custom Dockerfile dockerfile: str | null? = Dockerfile {minLen:1} ~template # Path to Dockerfile relative to source.base_path context: str | null? = . ~template # Docker build context path relative to source.base_path inject_env_variables_in_dockerfile: bool | null? ~template # Whether to inject environment variables as Docker build args Accepts either a boolean literal or a full template token output_directory: str! {minLen:1} ~template # Directory inside the built image containing the Lambda package contents max_zip_size: int | null? = 52428800 {format:int32} ~template # Maximum allowed zip size in bytes — build fails if exceeded schema Pipeline.LambdaNixpacksBuildConfig: # Nixpacks configuration for Lambda builds type: nixpacks! ~template # Build method — use Nixpacks auto-detection nixpacks_version: str | null? ~template # Nixpacks version to use build_path: str | null? ~template # Directory to run the Nixpacks build from, relative to the repository root config_file_path: str | null? ~template # Path to the Nixpacks configuration file relative to the repository root nix_pkgs: str[] | null? ~template # Additional Nix packages to install apt_pkgs: str[] | null? ~template # Additional apt packages to install nix_libs: str[] | null? ~template # Additional Nix libraries to install install_cmd: str | null? ~template # Custom install command build_cmd: str | null? ~template # Custom build command start_cmd: str | null? ~template # Application start command output_directory: str! {minLen:1} ~template # Directory inside the built image containing the Lambda package contents max_zip_size: int | null? = 52428800 {format:int32} ~template # Maximum allowed zip size in bytes — build fails if exceeded schema Pipeline.StaticDockerfileBuildConfig: # Dockerfile configuration for static builds type: dockerfile! ~template # Build method — use a custom Dockerfile dockerfile: str | null? = Dockerfile {minLen:1} ~template # Path to Dockerfile relative to source.base_path context: str | null? = . ~template # Docker build context path relative to source.base_path inject_env_variables_in_dockerfile: bool | null? ~template # Whether to inject environment variables as Docker build args Accepts either a boolean literal or a full template token output_directory: str! {minLen:1} ~template # Directory inside the built image containing the static assets to upload This path is resolved relative to source.base_path schema Pipeline.StaticNixpacksBuildConfig: # Nixpacks configuration for static builds type: nixpacks! ~template # Build method — use Nixpacks auto-detection nixpacks_version: str | null? ~template # Nixpacks version to use build_path: str | null? ~template # Directory to run the Nixpacks build from, relative to the repository root config_file_path: str | null? ~template # Path to the Nixpacks configuration file relative to the repository root nix_pkgs: str[] | null? ~template # Additional Nix packages to install apt_pkgs: str[] | null? ~template # Additional apt packages to install nix_libs: str[] | null? ~template # Additional Nix libraries to install install_cmd: str | null? ~template # Custom install command build_cmd: str | null? ~template # Custom build command output_directory: str! {minLen:1} ~template # Directory inside the built image containing the static assets to upload This path is resolved relative to source.base_path schema Pipeline.StaticRailpackBuildConfig: # Railpack configuration for static builds type: railpack! ~template # Build method — use Railpack auto-detection railpack_version: str | null? ~template # Railpack version to use install_cmd: str | null? ~template # Custom install command build_cmd: str | null? ~template # Custom build command output_directory: str! {minLen:1} ~template # Directory inside the built image containing the static assets to upload This path is resolved relative to source.base_path schema Ec2ContainerDeploymentDefinition: # Container-runtime EC2 deploy definition. The image must already exist (pushed by the upstream build step's `ecr` destination, or supplied by the user for pre... runtime: container! ~template # Definition type discriminator. image_uri: str! {minLen:1} ~template # Full image URI to deploy. Prefer a digest-qualified URI for reproducibility. Templateable — typically combines the repository URL with a deploy input or refe... schema Ec2ManualDeploymentDefinition: # Manual-runtime EC2 deploy definition. The deploy manager sends these shell commands to every in-service instance through the module-provided deploy document,... runtime: manual! ~template # Definition type discriminator. commands: str[]! {minItems:1} ~template # Shell commands run in order on each instance, as root. A non-zero exit fails the deploy on that instance. schema EcsCanaryConfig: # Canary traffic-shift tuning. Only valid when `strategy.type` is `canary`. canary_percent: num | null? {format:double,min:0.1,max:100} ~template # Percentage of production traffic to shift to the new service revision during the canary phase. Multiples of 0.1 from 0.1 to 100.0. canary_bake_time_in_minutes: int | null? {format:int32,min:0,max:1440} ~template # Minutes to wait during the canary phase before shifting the remaining production traffic to the new service revision. schema EcsLinearConfig: # Linear traffic-shift tuning. Required when `strategy.type` is `linear`. step_percentage: int! {format:int32,min:1,max:100} ~template # Percentage of production traffic shifted per step. step_bake_time_in_minutes: int! {format:int32,min:0,max:1440} ~template # Minutes to bake between each traffic-shift step. schema EcsPauseStage: # A native ECS PAUSE lifecycle hook. The deployment pauses at the given stage until a continue/rollback control is sent (dashboard or `POST /deployments/{id}/c... stage: enum[RECONCILE_SERVICE,PRE_SCALE_UP,POST_SCALE_UP,POST_TEST_TRAFFIC_SHIFT,PRE_PRODUCTION_TRAFFIC_SHIFT,POST_PRODUCTION_TRAFFIC_SHIFT]! ~template # Lifecycle stage at which the deployment pauses. timeout_in_minutes: int | null? {format:int32,min:1,max:20160} ~template # Minutes to wait for a continue before AWS applies `timeout_action`. timeout_action: enum[ROLLBACK,CONTINUE] | null? ~template # What AWS does when the pause times out. Default: ROLLBACK. schema EcsCapacityProviderStrategyItem: # Capacity-provider strategy entry. Mirrors AWS exactly. capacity_provider: str! ~template # Capacity provider name (e.g. `FARGATE`, `FARGATE_SPOT`, or a custom EC2 capacity provider). weight: int | null? {format:int32,min:0,max:1000} ~template # Relative share of tasks placed onto this provider when the strategy has multiple entries. base: int | null? {format:int32,min:0,max:100000} ~template # Minimum number of tasks placed onto this provider before weighting kicks in. At most one entry in the strategy may set `base`. schema EcsContainerOverride: # Per-container portion of `EcsRunTaskOverrides`. Mirrors the AWS ECS RunTask `ContainerOverride` struct field-for-field — every override AWS supports for a co... name: str! {minLen:1} ~template # Container name from the task definition. Required. command: str[] | null? ~template # Replacement command — replaces the container's CMD array. environment: EcsEnvironmentVariable[] | null? ~template # Environment variables merged on top of the task definition's. environment_files: EcsEnvironmentFile[] | null? ~template # Environment files (S3 references) layered on top of `environment`. cpu: int | null? {format:int32} ~template # CPU units override for this container. memory: int | null? {format:int32} ~template # Hard memory limit (MiB) override for this container. memory_reservation: int | null? {format:int32} ~template # Soft memory reservation (MiB) override for this container. resource_requirements: EcsResourceRequirement[] | null? ~template # GPU / InferenceAccelerator requirements override. schema EcsEphemeralStorage: # ECS ephemeral storage configuration size_in_gib: int! {format:int32,min:20,max:200} ~template # Storage size in GiB (21–200 for Fargate, minimum 20) schema EcsNetworkConfiguration: # AWS ECS network configuration. Only the `awsvpc` shape exists on RunTask (host / bridge networking is task-definition-driven). awsvpc_configuration: EcsAwsVpcConfiguration! ~template # VPC configuration — required when set. schema EcsPlacementConstraint: # AWS ECS placement constraint. EC2/EXTERNAL launch types only — Fargate ignores these. type: enum[distinctInstance,memberOf]! ~template # Constraint type. `distinctInstance` spreads tasks one-per-host; `memberOf` filters by a cluster query expression. expression: str | null? ~template # Cluster query expression — required when `type` is `memberOf`. schema EcsPlacementStrategy: # AWS ECS placement strategy. EC2/EXTERNAL launch types only — Fargate ignores these. type: enum[random,spread,binpack]! ~template # Strategy type. `random` ignores `field`; `spread` and `binpack` require `field`. field: str | null? ~template # Attribute the strategy operates on (e.g. `instanceId`, `attribute:ecs.availability-zone`, `cpu`, `memory`). schema EcsTag: # AWS resource tag key: str! ~template # Tag key value: str! ~template # Tag value schema EcsTaskVolumeConfiguration: # Per-task volume binding for ECS-managed volumes (today: ephemeral EBS for Fargate). The `name` must match a volume entry in the task definition's `volumes` l... name: str! ~template # Volume name — must match a `name` in the task definition. managed_ebs_volume: EcsTaskManagedEBSVolumeConfiguration? ~template # Managed-EBS volume configuration. schema EcsContainerDefinition: # ECS container definition — models a single container within a task. name: str! ~template # Container name — must be unique within the task image: str! ~template # Docker image URI cpu: int | null? {format:int32} ~template # Container-level CPU units memory: int | null? {format:int32} ~template # Hard memory limit in MiB — container is killed if it exceeds this memory_reservation: int | null? {format:int32} ~template # Soft memory limit in MiB — used for memory reservation essential: bool | null? ~template # Whether the task should stop if this container exits port_mappings: EcsPortMapping[] | null? ~template # Port mappings environment: EcsEnvironmentVariable[] | null? ~template # Environment variables secrets: EcsSecret[] | null? ~template # Secrets from Parameter Store or Secrets Manager command: str[] | null? ~template # Startup command — overrides the Docker CMD entry_point: str[] | null? ~template # Entrypoint — overrides the Docker ENTRYPOINT working_directory: str | null? ~template # Working directory inside the container health_check: EcsHealthCheck? ~template # Container health check log_configuration: EcsLogConfiguration? ~template # Log configuration linux_parameters: EcsLinuxParameters? ~template # Linux-specific parameters docker_labels: map | null? ~template # Docker labels privileged: bool | null? ~template # Run as privileged (EC2 only) user: str | null? ~template # User to run as (uid or uid:gid) stop_timeout: int | null? {format:int32} ~template # Stop timeout in seconds before SIGKILL disable_networking: bool | null? ~template # Disable networking for this container resource_requirements: EcsResourceRequirement[] | null? ~template # GPU and inference accelerator requirements mount_points: EcsMountPoint[] | null? ~template # Volume mount points volumes_from: EcsVolumeFrom[] | null? ~template # Volumes to inherit from other containers depends_on: EcsContainerDependency[] | null? ~template # Container startup dependencies repository_credentials: EcsRepositoryCredentials? ~template # Private registry credentials firelens_configuration: EcsFirelensConfiguration? ~template # Firelens log routing configuration system_controls: EcsSystemControl[] | null? ~template # System controls — kernel parameter overrides environment_files: EcsEnvironmentFile[] | null? ~template # Files containing environment variables readonly_root_filesystem: bool | null? ~template # Read-only root filesystem interactive: bool | null? ~template # Interactive mode (stdin) pseudo_terminal: bool | null? ~template # Pseudo-terminal allocation schema EcsInferenceAccelerator: # Inference accelerator for ML workloads device_name: str! ~template # Accelerator name device_type: str! ~template # Accelerator type schema EcsProxyConfiguration: # App Mesh proxy configuration type: APPMESH | null? ~template # Proxy type container_name: str! ~template # Container name for the proxy properties: EcsProxyConfigurationProperty[] | null? ~template # Proxy configuration properties schema EcsRuntimePlatform: # ECS runtime platform configuration cpu_architecture: enum[X86_64,ARM64] | null? ~template # CPU architecture — X86_64 or ARM64 operating_system_family: enum[LINUX,WINDOWS_SERVER_2019_FULL,WINDOWS_SERVER_2019_CORE,WINDOWS_SERVER_2022_FULL,WINDOWS_SERVER_2022_CORE] | null? ~template # Operating system family schema EcsVolume: # ECS volume — host path or Docker volume name: str! ~template # Volume name — referenced by container mount points host_path: str | null? ~template # Host path for bind mounts (EC2 only) efs_volume_configuration: EcsEfsVolumeConfiguration? ~template # EFS volume configuration schema LambdaImageDefinition: # Image-packaged Lambda deploy definition. The image must already exist in ECR (typically pushed by the upstream build step's `ecr` destination). package_type: image! ~template # Definition type discriminator. image_uri: str! {minLen:1} ~template # Full ECR image URI. Prefer `@sha256:` form for reproducibility — Lambda resolves a mutable tag at deploy time and silently pins it, but the dep... schema LambdaZipDefinition: # Zip-packaged Lambda deploy definition. The code object must already exist in S3 (typically uploaded by the upstream build step's `s3-zip` destination). package_type: zip! ~template # Definition type discriminator. s3_key: str! {minLen:1} ~template # S3 key the build step uploaded into. schema LambdaDeadLetterConfig: # Dead-letter destination for async invocations. target_arn: str | null? ~template # SQS queue ARN or SNS topic ARN. schema LambdaEnvironment: # Lambda function environment block. Mirrors AWS Lambda's `Environment` shape — a single `variables` map of string → string. variables: map | null? ~template # Environment variables applied to the function. Replaces the existing variable set on AWS — the API doesn't merge. schema LambdaEphemeralStorage: # Function-level ephemeral storage (`/tmp`) size in MiB. size: int! {format:int32,min:512,max:10240} ~template # Size in MiB. 512–10240. schema LambdaFileSystemConfig: # EFS file system attached to the function. arn: str! ~template # EFS access point ARN. local_mount_path: str! ~template # Mount path inside the container — must start with `/mnt/`. schema LambdaImageConfig: # Container image configuration overrides — image-packaged functions only. command: str[] | null? ~template # Override the image's CMD. entry_point: str[] | null? ~template # Override the image's ENTRYPOINT. working_directory: str | null? ~template # Override the image's WORKDIR. schema LambdaLoggingConfig: # Function logging configuration (CloudWatch destination + log levels). log_format: enum[JSON,Text] | null? ~template # Format the logs are emitted in. application_log_level: enum[TRACE,DEBUG,INFO,WARN,ERROR,FATAL] | null? ~template # Application log level — only valid when `log_format` is JSON. system_log_level: enum[DEBUG,INFO,WARN] | null? ~template # System log level — only valid when `log_format` is JSON. log_group: str | null? ~template # Destination CloudWatch log group. schema LambdaSnapStart: # SnapStart configuration. apply_on: enum[None,PublishedVersions]! ~template # When to take the snapshot. `None` disables SnapStart; `PublishedVersions` snapshots each `PublishVersion` call. schema LambdaTracingConfig: # AWS X-Ray tracing configuration. mode: enum[Active,PassThrough]! ~template # Active samples + traces requests; PassThrough only propagates an upstream sampling decision. schema LambdaVpcConfig: # VPC configuration for a Lambda function. subnet_ids: str[] | null? ~template # Subnet IDs the function's ENIs are placed into. security_group_ids: str[] | null? ~template # Security group IDs attached to the function's ENIs. ipv6_allowed_for_dual_stack: bool | null? ~template # Whether the function gets dual-stack IPv6 networking. schema Pipeline.PipelineTrigger: # Pipeline trigger definition. oneof(type): webhook: Pipeline.GenericPipelineTrigger "webhook:github": Pipeline.GithubPipelineTrigger "webhook:gitlab": Pipeline.GitlabPipelineTrigger schema CloudWatchLogSource: # A CloudWatch Logs source for a module log stream. Mirrors type: cloudwatch! ~template aws_account_id: str! {minLen:1} ~template region: str! {minLen:1} ~template log_group: str! {minLen:1} ~template log_stream_prefix: str | null? ~template filter_pattern: str | null? ~template schema CloudWatchMetricSource: # CloudWatch-backed metric source. Module authors fill this in with literal values or templated references (e.g. `<< stack.output.* >>`). The server uses `aws_... type: cloudwatch! ~template # Source type discriminator aws_account_id: str! {minLen:1} ~template # Ravion AWS account reference used to resolve credentials for the CloudWatch call. Accepts either the Flightcontrol AWS account database ID (e.g. `awsact_123`... region: str! {minLen:1} ~template # AWS region the metric lives in. namespace: str! {minLen:1} ~template # CloudWatch namespace name: str! {minLen:1} ~template # CloudWatch metric name statistic: str! {minLen:1} ~template # CloudWatch statistic to apply dimensions: map! ~template # Dimensions used to scope the metric. Required — no longer derived from any ARN since the source no longer carries one. schema ShowWhenComparableValue: # Value or values to compare against in a show_when condition; arrays mean membership for scalar sources and contains-all for array sources. oneof: str | int | bool | str | int | bool[] schema ShowWhenNotCondition: # Negated show_when condition. not: str | int | bool | str | int | bool[]! # Show the property only when the source value does not match this condition. schema Pipeline.ParameterStoreEnvVar: # Environment variable from AWS Parameter Store from_parameter_store: Pipeline.ParameterStoreReferenceValue! ~template # Parameter Store reference schema Pipeline.SecretsManagerEnvVar: # Environment variable from AWS Secrets Manager from_secrets_manager: Pipeline.SecretsManagerReferenceValue! ~template # Secrets Manager reference schema Pipeline.CacheFromConfig: # Configuration for Docker layer cache source from ECR digest: str | null? ~template # Specific image digest to use for cache tag: str | null? ~template # Specific image tag to use for cache schema Pipeline.AwsPermissionsAttach: # IAM policies to attach alongside step default policies attach: str[]! ~template # AWS managed policy ARNs to attach alongside step default policies schema Pipeline.AwsPermissionsReplace: # IAM policies to replace step default policies entirely replace: str[]! ~template # AWS managed policy ARNs to use instead of step default policies schema Pipeline.EbsVolumeType: # EBS volume type for the runner root volume type: enum[gp3,gp2,io2,io1] schema EcsEnvironmentFile: # Environment file from S3 value: str! ~template # S3 ARN of the environment file type: s3! ~template # File type schema EcsEnvironmentVariable: # Environment variable as name-value pair name: str! ~template # Variable name value: str! ~template # Variable value schema EcsResourceRequirement: # GPU or other resource requirement type: enum[GPU,InferenceAccelerator]! ~template # Resource type — currently only GPU value: str! ~template # Number of resources schema EcsAwsVpcConfiguration: # AWS VPC configuration for `awsvpc`-mode tasks. subnets: str[]! {minItems:1} ~template # Subnet IDs the task ENI is placed into. security_groups: str[] | null? ~template # Security groups attached to the task ENI. assign_public_ip: enum[ENABLED,DISABLED] | null? ~template # Whether the task ENI gets a public IP. Required for Fargate tasks pulling images from non-VPC-routable registries (e.g. schema EcsTaskManagedEBSVolumeConfiguration: # AWS-managed Fargate ephemeral EBS volume configuration. role_arn: str! ~template # IAM role ARN AWS uses to provision the EBS volume on the customer's behalf. Required. volume_type: str | null? ~template # EBS volume type (`gp3`, `gp2`, `io2`, `io1`, `sc1`, `st1`, `standard`). size_in_gib: int | null? {format:int32} ~template # Volume size (GiB). Range depends on `volume_type`. snapshot_id: str | null? ~template # Snapshot id to restore from. iops: int | null? {format:int32} ~template # Provisioned IOPS — required for `io1`/`io2`, optional for `gp3`. throughput: int | null? {format:int32} ~template # Provisioned throughput (MiB/s) — `gp3` only. filesystem_type: str | null? ~template # Filesystem type to format the volume with (`ext3`, `ext4`, `xfs`, `ntfs`). Defaults per OS family. kms_key_id: str | null? ~template # KMS key id (alias or ARN) for at-rest encryption. encrypted: bool | null? ~template # Whether the volume is encrypted at rest. tag_specifications: EcsEBSTagSpecification[] | null? ~template # Tag specifications applied to the EBS volume. termination_policy: EcsTaskManagedEBSVolumeTerminationPolicy? ~template # Termination policy — controls whether the volume is deleted when the task stops. volume_initialization_rate: int | null? {format:int32} ~template # Initialization rate (MiB/s) for snapshot-restored volumes — controls how fast blocks are pre-warmed. schema EcsContainerDependency: # Container dependency — controls startup order container_name: str! ~template # Name of the dependency container condition: enum[START,COMPLETE,SUCCESS,HEALTHY]! ~template # Condition to wait for schema EcsFirelensConfiguration: # Firelens log routing configuration type: enum[fluentbit,fluentd]! ~template # Router type options: map | null? ~template # Router options schema EcsHealthCheck: # Container health check configuration command: str[]! ~template # Command to run — prefix with CMD or CMD-SHELL interval: int | null? {format:int32} ~template # Interval between checks in seconds timeout: int | null? {format:int32} ~template # Timeout for each check in seconds retries: int | null? {format:int32} ~template # Number of retries before marking unhealthy start_period: int | null? {format:int32} ~template # Grace period before health checks start in seconds schema EcsLinuxParameters: # Linux-specific container settings init_process_enabled: bool | null? ~template # Run an init process inside the container capabilities: EcsLinuxCapabilities? ~template # Linux capabilities to add or drop shared_memory_size: int | null? {format:int32} ~template # Shared memory size in MiB tmpfs: EcsTmpfs[] | null? ~template # Tmpfs mounts schema EcsLogConfiguration: # Log configuration for a container log_driver: enum[awslogs,awsfirelens,json-file,syslog,fluentd,splunk]! ~template # Log driver — awslogs for CloudWatch, awsfirelens for Firelens options: map | null? ~template # Driver-specific options secret_options: EcsSecret[] | null? ~template # Secret log options (ARN references) schema EcsMountPoint: # Container mount point referencing a volume source_volume: str! ~template # Name of the volume (must match a volume in the task definition) container_path: str! ~template # Path inside the container to mount read_only: bool | null? ~template # Whether the mount is read-only schema EcsPortMapping: # Port mapping for a container container_port: int! {format:int32} ~template # Port on the container host_port: int | null? {format:int32} ~template # Port on the host (EC2) or omit for awsvpc protocol: enum[tcp,udp] | null? ~template # Transport protocol app_protocol: enum[http,http2,grpc] | null? ~template # Application protocol for service connect schema EcsRepositoryCredentials: # Private registry credentials credentials_parameter: str! ~template # ARN of the Secrets Manager secret containing registry credentials schema EcsSecret: # Secret injected from Parameter Store or Secrets Manager name: str! ~template # Environment variable name in the container value_from: str! ~template # Full ARN of the secret in Parameter Store or Secrets Manager schema EcsSystemControl: # System control — kernel parameter override namespace: str! ~template # Namespace (e.g., net.core.somaxconn) value: str! ~template # Value to set schema EcsVolumeFrom: # Volume-from reference — mount volumes from another container source_container: str! ~template # Source container name read_only: bool | null? ~template # Whether the mount is read-only schema EcsProxyConfigurationProperty: # Proxy configuration key-value property name: str! ~template # Property name value: str! ~template # Property value schema EcsEfsVolumeConfiguration: # EFS volume configuration for ECS tasks file_system_id: str! ~template # EFS file system ID root_directory: str | null? ~template # Root directory on the EFS file system transit_encryption: enum[ENABLED,DISABLED] | null? ~template # Whether to enable IAM authorization transit_encryption_port: int | null? {format:int32} ~template # Port for transit encryption (default 2049) authorization_config: EcsEfsAuthorizationConfig? ~template # EFS access point ID schema Pipeline.GenericPipelineTrigger: # Pipeline trigger for generic webhooks. id: str! # Unique identifier for this trigger repo: str! ~template # Git repository in owner/repo or host/owner/repo format filter: Pipeline.TriggerFilter? # Filters to narrow which events trigger the pipeline run: map! # Maps variant IDs to run configuration — keys must match declared variant IDs. type: webhook! # Webhook type for generic webhook triggers. schema Pipeline.GithubPipelineTrigger: # Pipeline trigger for GitHub webhooks. id: str! # Unique identifier for this trigger repo: str! ~template # Git repository in owner/repo or host/owner/repo format filter: Pipeline.TriggerFilter? # Filters to narrow which events trigger the pipeline run: map! # Maps variant IDs to run configuration — keys must match declared variant IDs. type: "webhook:github"! # Webhook type — determines which events are supported. event: enum[push,pull_request,pull_request_review,pull_request_review_comment,pull_request_review_thread,release,deployment]! # Webhook event type to listen for. schema Pipeline.GitlabPipelineTrigger: # Pipeline trigger for GitLab webhooks. id: str! # Unique identifier for this trigger repo: str! ~template # Git repository in owner/repo or host/owner/repo format filter: Pipeline.TriggerFilter? # Filters to narrow which events trigger the pipeline run: map! # Maps variant IDs to run configuration — keys must match declared variant IDs. type: "webhook:gitlab"! # Webhook type — determines which events are supported. event: enum[push,merge_request,tag_push]! # Webhook event type to listen for. schema ShowWhenValue: # Value that can be used in a show_when condition. oneof: str | int | bool schema Pipeline.ParameterStoreReferenceValue: # Parameter Store reference — shorthand string or object with optional version metadata oneof: str | Pipeline.ParameterStoreReference schema Pipeline.SecretsManagerReferenceValue: # Secrets Manager reference — shorthand string or object with optional JSON key/version metadata oneof: str | Pipeline.SecretsManagerReference schema EcsEBSTagSpecification: # Tag specification for an ECS-managed EBS volume. resource_type: volume! ~template # Resource type the tags apply to. Currently only `volume` is supported. propagate_tags: enum[TASK_DEFINITION,SERVICE,NONE] | null? ~template # Where the tags come from — explicit list, propagated from the task definition, or none. tags: EcsTag[] | null? ~template # Explicit tags. schema EcsTaskManagedEBSVolumeTerminationPolicy: # Termination policy for an ECS-managed EBS volume. delete_on_termination: bool! ~template # Whether to delete the volume when the task stops. schema EcsLinuxCapabilities: # Linux kernel capabilities add: str[] | null? ~template # Capabilities to add drop: str[] | null? ~template # Capabilities to drop schema EcsTmpfs: # Tmpfs mount configuration container_path: str! ~template # Mount path in the container size: int! {format:int32} ~template # Maximum size in MiB mount_options: str[] | null? ~template # Mount options schema EcsEfsAuthorizationConfig: # EFS authorization config access_point_id: str | null? ~template # EFS access point ID iam: enum[ENABLED,DISABLED] | null? ~template # Whether to use the task execution role for EFS schema Pipeline.TriggerFilter: # Trigger filter configuration branch: str | null? ~template # Only trigger when this branch is pushed tag: str | null? ~template # Only trigger when a tag matching this pattern is pushed action: str | str[]? ~template # Only trigger for specific webhook actions. paths: str[] | null? ~template # Only trigger when files in these paths are changed payload: Pipeline.PayloadCondition[]? # Filter by webhook payload fields using dot-notation paths. schema Pipeline.TriggerRepo: # Git repository identifier used by webhook triggers. type: str schema Pipeline.TriggerRunVariantConfig: # Per-variant run configuration for a trigger. description: str | null? ~template # Description for the pipeline run created by this trigger variant input: map? ~template # Input overrides for this variant run schema Pipeline.GithubWebhookEvent: # GitHub webhook events that can trigger a pipeline type: enum[push,pull_request,pull_request_review,pull_request_review_comment,pull_request_review_thread,release,deployment] schema Pipeline.GitlabWebhookEvent: # GitLab webhook events that can trigger a pipeline type: enum[push,merge_request,tag_push] schema Pipeline.ParameterStoreReference: # Parameter Store reference with optional version metadata key: str! ~template # Parameter Store parameter name or path version: str | null? ~template # Parameter version number schema Pipeline.SecretsManagerReference: # Secrets Manager reference with optional JSON key and version metadata key: str! ~template # Secret name or ARN in Secrets Manager json_key: str | null? ~template # JSON key to extract from a JSON-structured secret version: str | null? ~template # Secret version ID or stage schema Pipeline.PayloadCondition: # Condition to check against a webhook payload field. path: str! # Dot-notation path to the payload field equals: str | null? ~template # Exact string match contains: str | null? ~template # Substring match matches: str | null? ~template # Glob pattern match one_of: str[] | null? ~template # Value must be one of these strings not: Pipeline.PayloadConditionMatcher? # Negated payload field matcher. The condition fails when this matcher is true. schema Pipeline.PayloadConditionMatcher: # Payload field matcher used by positive conditions and negated conditions. equals: str | null? ~template # Exact string match contains: str | null? ~template # Substring match matches: str | null? ~template # Glob pattern match one_of: str[] | null? ~template # Value must be one of these strings Syntax: `<< expression >>` for dynamic values Modes: - Block: `<< module.input.timeout >>` — preserves type (number, boolean, etc.) - Interpolation: `"prefix-<< module.input.env >>"` — always string (only for string fields) Operators: +, -, *, /, %, >, <, >=, <=, ==, !=, &&, ||, ! Ternary: `<< condition ? trueVal : falseVal >>` Default/fallback: `<< module.input.x || "fallback" >>` skips nil and empty string Access: `array[0]`, `map["key"]`, `map.key`, hyphenated selectors like `module.input.image-tag` Helpers: len(), upper(), lower(), string(), int(), float(), get(), map() - `get(object, "a.b", default?)`: safe nested lookup; returns nil or optional default when missing - `map(arrayOrObject, expr)`: transforms array items or object values; use `#` for the current item. Object values are processed in sorted key order. Collections: array concatenation with `+`, object literals, array literals Truthy: nil, false, empty string, and zero are falsey; arrays/objects are truthy even when empty Nil: use `nil` or `null` YAML quoting: Quote ternary expressions to avoid YAML parsing `:` as mapping separator: ```yaml field: "<< module.input.flag ? value1 : value2 >>" ``` Namespaces by location: - stack/ui/deploy/build template fields: module.input.*, stack.id, stack.output.*, defaults.* - deploy fields also allow: deploy.input.* - build fields also allow: build.input.*, pipeline.input.*, pipeline.run.*, pipeline.variant.*, steps.{id}.{input,output}.*, step.input.* - inputs[].default: module.input.*, module.given_id, organization.id, project.{id,given_id}, environment.{id,given_id}, defaults.* - $ref mapped input defaults also allow: ref.{id,given_id}, ref.input.*, ref.stack.{id,output.*} - trigger run templates preserve: trigger.payload.{branch,commit,ref,repository,event,tag} Module input visibility: - A value-producing input whose `show_when` conditions do not match resolves to `nil`, even when it defines a `default`; hidden defaults are not applied. - Treat every `show_when`-controlled input as nullable in downstream stack, build, deploy, and UI templates. - `nil` is falsey, boolean operators and ternaries short-circuit, `len(nil)` returns `0`, and `map(nil, expression)` returns `[]`. - Guard arithmetic, type conversions, string concatenation, and array concatenation when an operand may be nil. Use an explicit `!= nil` check, a type-correct fallback, or a short-circuited branch controlled by the same condition as `show_when`. - When preserving an omitted downstream value, use that system's exact default as the fallback. Hidden-input conversion example: ```yaml cloudwatch_alarm_storage_threshold: '<< module.input.cloudwatch_alarm_storage_threshold_gib != nil ? int(module.input.cloudwatch_alarm_storage_threshold_gib * 1073741824) : 5368709120 >>' ``` Module-only resolver features: - Object spreads: `...defaults`, `...defaults.name`, `...overrides`, `...overrides.name`; spread values must resolve to objects. Defaults apply first, explicit keys next, overrides last. - Array spreads: `...<< expr >>` as a complete array item; spread value must resolve to an array. - `$values:...` strings are dynamic value refs and are preserved instead of template-resolved. Examples: ```yaml terraform_variables: ...defaults.base: << defaults.aws-config >> region: << module.input.region >> ...overrides.user: << module.input.extra_variables || {} >> regions: - us-east-1 - ...<< module.input.additional_regions >> records: << map(module.input.dns-records, {"name": get(#, "name"), "ttl": get(#, "ttl", 300)}) >> ```