Build production-grade backends
in minutes, not weeks.

workflow CheckoutSaga {
  input: CheckoutRequest
  output: CheckoutResult
  timeout_seconds: 300
  max_retries: 2
 
  step reserve_inventory -> ReservationSummary
  retry {
    max_retries: 3
    delay_seconds: 10
  } {
    return Inventory.reserve(input.sku, input.quantity)
  }
 
  compensate reserve_inventory {
    Inventory.release(reserve_inventory.reservation_id)
  }
 
  step charge_card -> ChargeSummary {
    if input.simulate_failure {
      fail("checkout_failed", "card authorization declined")
    }
    return Payments.charge(input.payment_method, input.amount_cents)
  }
 
  compensate charge_card {
    Payments.refund(charge_card.charge_id)
  }
 
  step fulfill -> CheckoutResult after charge_card {
    return Fulfillment.ship(
      reservation: reserve_inventory.reservation_id,
      charge: charge_card.charge_id
    )
  }
 
  return fulfill
}

fn search_help_docs(term: String) -> String[] {
  return [term, "billing", "password reset"]
}
 
action get_support_profile() -> MeResponse {
  let actor = auth.current_user()
  return { id: actor.id, email: actor.email, name: actor.name }
}
 
llm client SupportAgent {
  provider:    env("LLM_PROVIDER", "openai")
  wire_format: env("LLM_WIRE_FORMAT", "openai")
  model:       env("LLM_MODEL", "gpt-4.1-mini")
  api_key:     env("LLM_API_KEY", "replace-me")
  max_turns:   env_int("LLM_MAX_TURNS", 8)
  temperature: 0.2
  system_prompt: "You are a concise support assistant."
 
  tool search_help_docs(term: String) -> String[] = search_help_docs
  tool get_support_profile() -> MeResponse        = get_support_profile
}
 
route POST "/support/draft" protect Auth -> SupportTicketDraft {
  input: SupportReplyRequest
  handler {
    return SupportAgent.respond_as(SupportTicketDraft, {
      user_prompt: input.message
      conversation_id: input.conversation_id
    })
  }
}

model Doc {
  id: UUID
  title: String
  body: String
  embedding: Vector(1536) @index(hnsw, metric: cosine)
  created_at: Time
  updated_at: Time
}
 
crud Doc at "/docs" {
  list: public
  get:  public
  searchable { title  body }
}
 
native fn embed_text(value: String) -> Vector(1536) = "embed_text"
 
route POST "/docs/search" public -> DocHybridMatch[] {
  input: SimilarDocRequest
  handler {
    return Doc.hybrid_search(
      query: input.query,
      embedding: embed_text(input.query),
      limit: 20
    )
  }
}

service App {
  openapi  { title: "App API"  version: "0.9.0" }
  server   { host: env("HOST", "0.0.0.0")  port: env_int("PORT", 3000) }
 
  telemetry {
    provider:     opentelemetry
    endpoint:     env("OTEL_EXPORTER_OTLP_ENDPOINT", "")
    service_name: "app-api"
    protocol:     otlp_http
    sampling:     parentbased_ratio(0.1)
  }
}
 
route GET "/checkout" protect Auth -> CheckoutResult {
  handler {
    let actor = auth.current_user()
 
    trace.annotate({ actor_id: actor.id, tenant_id: actor.tenant_id })
    metrics.counter("checkout.requests").increment({ tenant_id: actor.tenant_id })
 
    return Checkout.place(input)
  }
}

rag SupportAnswerer {
  retriever:             Doc.similar_with_scores
  embed_with:            embed_text
  llm:                   SupportAgent
  context_window_tokens: 4000
  rerank:                score_threshold(0.7)
  top_k:                 8
}
 
route POST "/support/answer" public -> String {
  input: SimilarDocRequest
  handler {
    let response = SupportAnswerer.respond(input.query)
    return response.text
  }
}

llm client SupportAgent {
  provider:       "openai"
  wire_format:    "openai"
  model:          env("LLM_MODEL", "gpt-4.1-mini")
  api_key:        env("LLM_API_KEY", "")
  max_tokens:     600
  max_turns:      8
  temperature:    0.2
 
  budget_per_tenant_per_day_usd: 5.0
  over_budget_behavior:          downgrade("SupportAgentFallback")
 
  tool search_help_docs(term: String) -> String[] = search_help_docs
}
 
llm client SupportAgentFallback {
  provider:    "openai"
  wire_format: "openai"
  model:       "gpt-4.1-mini"
  api_key:     env("OPENAI_API_KEY", "")
  max_tokens:  600
  max_turns:   4
  temperature: 0.2
}
 
llm client routed RoutedSupportAgent {
  primary:             SupportAgent
  fallback:            SupportAgentFallback
  route_by:            cost_vs_latency(target_per_request_usd: 0.05)
  on_primary_outage:   fallback
  on_rate_limit:       fallback
  on_budget_pressure:  fallback
}

api_explorer HospitalApi {
  upstream: service
  mount_target: full_panel
 
  collection AdmissionFlow {
    step admit {
      call:   action admit_patient
      params: { input: { mrn: "TEST001", age: 65 } }
      capture {
        admission_id: response.id
        admitted_at:  response.admitted_at
      }
    }
 
    step record_vitals {
      call:   route POST "/vitals/{admission_id}"
      params: { admission_id: admission_id }
      input:  { admission_id: admission_id, bp: "130/85", hr: 72 }
      assert: status == 200 && response.recorded_at > admitted_at
    }
  }
 
  safety {
    redact_pii:          auto
    audit_every_request: true
    max_environment:     dev_or_staging
  }
}

type CertificateContext {
  recipient_name:  String
  completion_date: String
  instructor_name: String
}
 
route POST "/certificates/{recipient_name}" public -> String {
  handler {
    let ctx = CertificateContext {
      recipient_name:  params.recipient_name
      completion_date: "April 23, 2026"
      instructor_name: "Niko Ma"
    }
 
    let pdf = pdf.render_svg_template(
      load_template("ryt200.svg"),
      ctx,
      "/tmp/certs/" + ctx.recipient_name + ".pdf",
      font_paths:   ["/fonts/PlayfairDisplay.ttf"],
      resource_dir: "/tmp/cert-assets",
      title:        "RYT-200 Certificate"
    )
 
    let stored = blob.put(pdf.path, "certs/" + ctx.recipient_name + ".pdf", pdf.content_type)
    return blob.signed_url(stored.key, expires_seconds: 300, download_name: pdf.filename)
  }
}

# production native Rust binary — Tokio + Axum + sqlx
$ carrier build --target rust --release
$ ./.carrier/build/clinic-app
 
# Spring Boot service — Java 21, JDBC + HikariCP
$ carrier build --target java --release
$ java -jar .carrier/generated-java/target/clinic-app.jar
 
# dev iteration target — Fastify + pg, ~200ms restart
$ carrier build --target node
$ node .carrier/generated-node/main.mjs
 
# the migration SQL is byte-identical across all three targets
# develop with node, ship to Rust or Spring Boot from the same source

# rsync project up, run carrier on the build server, fetch artifacts
$ carrier build --target rust --release --compile-remote=true
 
# upload + remote build streams progress live; nothing is silent
# the remote command always runs with --compile-remote=false (no recursion)
 
# default rsync excludes: target/, .carrier/, node_modules/, .git/,
# .env, .env.*, secrets/, credentials/, service-account*.json
# Carrier never ships your .env files

service App {
  openapi { title: "Tank-Hardened API"  version: "1.0.0" }
 
  runtime {
    request_depth_limit:    32
    action_depth_limit:     16
    workflow_depth_limit:   16
    expression_depth_limit: 64
    json_body_depth_limit:  16
    schema_expansion_depth: 16
    body_size_limit:        2_megabytes
    artifact_size_limit:    50_megabytes
    request_timeout_ms:     5_000
 
    panic_policy: catch
    evidence:     emit_when_explicitly_enabled
    ops_routes:   local_only
  }
}

# 1. local sizing advisor
$ carrier tune --profile production
# writes .carrier/tune.json + .carrier/tune.runtime.carrier (copy-ready)
 
# 2. budgets + verification + invariant proofs + tests
$ carrier check --verify --profile production --fail-on-unknown
 
# 3. attack harness — health/auth/depth/oversize/concurrency probes
$ carrier harden --chaos --run --sandbox-db
# spawns the binary on loopback, mints tenant A/B JWTs,
# probes isolation, drops the owned database after probes
 
# 4. live evidence + Flight Recorder
$ curl -s http://127.0.0.1:4000/ops/flight?request_id=... | jq

verification {
  solver:             z3
  mode:               bounded
  max_records:        1
  max_workflow_depth: 10
  timeout:            30_seconds
}
 
invariant InventoryNeverNegative {
  subject:     InventoryItem
  must_always: quantity_on_hand >= 0
}
 
invariant LabResultRequiresReviewer {
  subject:    LabResult
  transition: status -> "reviewed"
  requires:   reviewed_by != ""
}
 
invariant NoProviderOverlap {
  subject:    Appointment
  must_never:
    exists other Appointment where
      other.provider_id == provider_id &&
      overlaps(other.start_slot, other.end_slot, start_slot, end_slot)
}
 
assume StripeDoesNotOverRefund {
  external:   stripe.refund
  guarantees: refund.amount <= charge.remaining_refundable_amount
}

sla SepsisBundle {
  workflow:    AdmitSuspectedSepsis
  starts_when: step_started("RecordVitals")
  ends_when:   step_completed("CompleteBundle")
  attainment:  95%
  deadline:    4_hours
  warning_at:  80%
  breach_at:   100%
  scope:       tenant
  measure_by:  calendar_month
  escalation:  notify(role: "charge_nurse") on breach_imminent
  compliance_evidence: attach_to_audit
  report:      include_in("ClinicalQualityDashboard")
  exclude_when: field("comfort_care_only") == true
}

auth jwt AdminAuth {
  issuer:   env("JWT_ISSUER", "carrier")
  audience: env("JWT_AUDIENCE", "carrier-users")
  secret:   env("JWT_SECRET", "local-dev-secret")
  jwks_url: env("JWT_JWKS_URL", "")
 
  roles_claim: "roles"
  roles {
    super_admin includes [admin]
    admin       includes [editor, viewer]
    editor      includes [viewer]
  }
}
 
route POST "/orgs/{id}/archive"
  protect AdminAuth all_roles [admin, compliance_officer]
  -> Org
{
  params { id: UUID }
  handler { return Org.archive(params.id) }
}

# manifest-driven React Native SDK — no recompile needed
$ carrier check
$ carrier sdk react-native --output mobile/carrier-sdk
 
# generated package exposes:
#   createCarrierSdk(...)         low-level fetch client
#   createTokenSession(...)       JWT/session hook
#   CarrierMutationQueue          persisted offline queue (idempotency keys)
#   useCarrierQuery(...)          React hooks layered on top
#   useCarrierMutation(...)
#   useCarrierSubscription(...)   typed realtime helpers
 
# offline queue guarantees:
#   queued writes survive restart (with a storage adapter)
#   deterministic replay ordering
#   stable Idempotency-Key per write
#   bounded retry backoff
#   conflicts + poison items stay visible to the app