Thirty-three declarations. A compiled, AI-friendly surface for fast, secure APIs.

service App {
  openapi { title: "Hello Carrier API" version: "0.1.0" }
  server  { host: env("HOST", "0.0.0.0") port: env_int("PORT", 3000) }
}
 
auth jwt Auth {
  issuer:   env("JWT_ISSUER", "carrier")
  audience: env("JWT_AUDIENCE", "carrier-users")
  secret:   env("JWT_SECRET", "local-dev-secret")
}
 
type RegisterRequest {
  email: String     @email
  name: String      @length(min: 2, max: 100)
  password: String  @length(min: 8)
}
 
type AuthTokens { access_token: String  refresh_token: String }
 
route POST "/auth/register" public -> AuthTokens {
  input: RegisterRequest
  handler {
    let user = auth.register(
      email: input.email, name: input.name, password: input.password
    )
    return auth.issue_tokens(user.id)
  }
}
 
route GET "/me" protect Auth -> MeResponse {
  handler { return auth.current_user() }
}

auth jwt AdminAuth {
  issuer:   env("JWT_ISSUER", "carrier")
  audience: env("JWT_AUDIENCE", "carrier-users")
  secret:   env("JWT_SECRET", "local-dev-secret")
  jwks_url: env("JWT_JWKS_URL", "")
 
  roles_claim: "roles"
  roles {
    super_admin includes [admin]
    admin       includes [editor, viewer]
    editor      includes [viewer]
  }
}
 
route POST "/orgs/{id}/archive"
  protect AdminAuth all_roles [admin, compliance_officer]
  -> Org
{
  params { id: UUID }
  handler { return Org.archive(params.id) }
}

service App {
  openapi { title: "Tank-Hardened API"  version: "1.0.0" }
 
  runtime {
    request_depth_limit:    32
    action_depth_limit:     16
    workflow_depth_limit:   16
    expression_depth_limit: 64
    json_body_depth_limit:  16
    schema_expansion_depth: 16
    body_size_limit:        2_megabytes
    artifact_size_limit:    50_megabytes
    request_timeout_ms:     5_000
 
    panic_policy: catch
    evidence:     emit_when_explicitly_enabled
    ops_routes:   local_only
  }
}

crud Doctor at "/doctors" {
  create: protect AdminAuth roles [admin]
  list:   public
  get:    public
  update: protect AdminAuth roles [admin]
  delete: soft using deleted_at protect AdminAuth roles [admin]
  restore: true protect AdminAuth roles [admin]
 
  list_defaults {
    page_size: 20
    sort: "rating"
    direction: desc
    scope: active          // active · all · deleted
  }
 
  filters {
    specialty: exact
    city:      exact
    language:  contains
    rating:    min
  }
 
  searchable { full_name  specialty  city  bio }
}

route GET "/doctors/{id}" public -> Doctor {
  params { id: UUID }
  handler { return Doctor.get(id: params.id) }
}
 
route POST "/admin/doctors/{id}/lock"
  protect AdminAuth roles [admin] idempotent -> Doctor
{
  params { id: UUID }
  handler { return audit_locked_doctor(params.id) }
}

/// Transaction-safe admin action with row locking
action audit_locked_doctor(id: UUID) -> Doctor {
  let actor = auth.current_user()
 
  transaction {
    let locked = Doctor.get_for_update(id: id, scope: "all")
    logs.info("doctor lock audit", {
      action_name: "audit_locked_doctor"
      doctor_id: locked.id
      actor_email: actor.email
    })
  }
 
  return Doctor.get(id: id, scope: "all")
}
 
/// Idempotent admin route; retries return the stored response
route POST "/admin/doctors/{id}/lock"
  protect AdminAuth roles [admin] idempotent -> Doctor
{
  params { id: UUID }
  handler { return audit_locked_doctor(params.id) }
}

policy AppointmentSlot {
  tenant_field: org_id
  read:  roles [viewer, scheduler]
  write: roles [scheduler]
  deleted: roles [scheduler]
}
 
model AppointmentSlot {
  id: UUID
  org_id: String  @index
  clinician_name: String  @length(min: 3, max: 120)
  starts_at: Time
  status: SlotStatus = open
  version: Int  @version
  deleted_at: Time?
  created_at: Time
  updated_at: Time
}

event SlotReminderQueued {
  slot_id: UUID
  trigger: String
}
 
job send_slot_reminder(payload: Json) -> Void {
  logs.info("slot reminder job", { job_name: "send_slot_reminder", payload: payload })
  audit.record("send_slot_reminder", "AppointmentSlot", "scheduled", payload)
}
 
schedule "*/15 * * * *" run send_slot_reminder
 
route POST "/slots/{id}/notify"
  protect StaffAuth roles [scheduler] idempotent -> Json
{
  params { id: UUID }
  handler {
    let job_id = jobs.enqueue("send_slot_reminder", { slot_id: params.id }, delay_seconds: 5)
    emit SlotReminderQueued { slot_id: params.id, trigger: "manual" }
    return { job_id: job_id }
  }
}

workflow CheckoutSaga {
  input: CheckoutRequest
  output: CheckoutResult
  timeout_seconds: 300
  max_retries: 2
 
  step reserve_inventory -> ReservationSummary
  retry {
    max_retries: 3
    delay_seconds: 10
  } {
    return Inventory.reserve(input.sku, input.quantity)
  }
 
  compensate reserve_inventory {
    Inventory.release(reserve_inventory.reservation_id)
  }
 
  step charge_card -> ChargeSummary {
    if input.simulate_failure {
      fail("checkout_failed", "card authorization declined")
    }
    return Payments.charge(input.payment_method, input.amount_cents)
  }
 
  compensate charge_card {
    Payments.refund(charge_card.charge_id)
  }
 
  step fulfill -> CheckoutResult after charge_card {
    return Fulfillment.ship(
      reservation: reserve_inventory.reservation_id,
      charge: charge_card.charge_id
    )
  }
 
  return fulfill
}

sla SepsisBundle {
  workflow:    AdmitSuspectedSepsis
  starts_when: step_started("RecordVitals")
  ends_when:   step_completed("CompleteBundle")
  attainment:  95%
  deadline:    4_hours
  warning_at:  80%
  breach_at:   100%
  scope:       tenant
  measure_by:  calendar_month
  escalation:  notify(role: "charge_nurse") on breach_imminent
  compliance_evidence: attach_to_audit
  report:      include_in("ClinicalQualityDashboard")
  exclude_when: field("comfort_care_only") == true
}

verification {
  solver:             z3
  mode:               bounded
  max_records:        1
  max_workflow_depth: 10
  timeout:            30_seconds
}
 
invariant InventoryNeverNegative {
  subject:     InventoryItem
  must_always: quantity_on_hand >= 0
}
 
invariant LabResultRequiresReviewer {
  subject:    LabResult
  transition: status -> "reviewed"
  requires:   reviewed_by != ""
}
 
invariant NoProviderOverlap {
  subject:    Appointment
  must_never:
    exists other Appointment where
      other.provider_id == provider_id &&
      overlaps(other.start_slot, other.end_slot, start_slot, end_slot)
}
 
assume StripeDoesNotOverRefund {
  external:   stripe.refund
  guarantees: refund.amount <= charge.remaining_refundable_amount
}

llm client SupportAgent {
  provider:       "openai"
  wire_format:    "openai"
  model:          env("LLM_MODEL", "gpt-4.1-mini")
  api_key:        env("LLM_API_KEY", "")
  max_tokens:     600
  max_turns:      8
  temperature:    0.2
 
  budget_per_tenant_per_day_usd: 5.0
  over_budget_behavior:          downgrade("SupportAgentFallback")
 
  tool search_help_docs(term: String) -> String[] = search_help_docs
}
 
llm client SupportAgentFallback {
  provider:    "openai"
  wire_format: "openai"
  model:       "gpt-4.1-mini"
  api_key:     env("OPENAI_API_KEY", "")
  max_tokens:  600
  max_turns:   4
  temperature: 0.2
}
 
llm client routed RoutedSupportAgent {
  primary:             SupportAgent
  fallback:            SupportAgentFallback
  route_by:            cost_vs_latency(target_per_request_usd: 0.05)
  on_primary_outage:   fallback
  on_rate_limit:       fallback
  on_budget_pressure:  fallback
}

rag SupportAnswerer {
  retriever:             Doc.similar_with_scores
  embed_with:            embed_text
  llm:                   SupportAgent
  context_window_tokens: 4000
  rerank:                score_threshold(0.7)
  top_k:                 8
}
 
route POST "/support/answer" public -> String {
  input: SimilarDocRequest
  handler {
    let response = SupportAnswerer.respond(input.query)
    return response.text
  }
}

ui AdminConsole {
  framework: yew
  theme:     carrier.default
 
  expose route "/docs"        as list_detail_edit
  expose agent SupportAgent   as thread_participant {
    identity:         from_chat_session
    thread:           injected
    response_channel: thread_reply
  }
 
  safety {
    redact_pii:   auto
    require_auth: auto
    tenant_scope: auto
  }
}

model Doc {
  id: UUID
  title: String
  body: String
  embedding: Vector(1536) @index(hnsw, metric: cosine)
  created_at: Time
  updated_at: Time
}
 
crud Doc at "/docs" {
  list: public
  get:  public
  searchable { title  body }
}
 
native fn embed_text(value: String) -> Vector(1536) = "embed_text"
 
route POST "/docs/search" public -> DocHybridMatch[] {
  input: SimilarDocRequest
  handler {
    return Doc.hybrid_search(
      query: input.query,
      embedding: embed_text(input.query),
      limit: 20
    )
  }
}

type OrderPlacedPayload {
  order_id: String
  source: String
}
 
job enrich_order_event(payload: OrderPlacedPayload) -> Void {
  logs.info("order received", { order_id: payload.order_id })
}
 
queue OrderEventDeadLetters {
  backend: redis
  subject: "orders.v1.dead"
  publish OrderPlacedDead: OrderPlacedPayload
}
 
queue OrderEvents {
  backend: redis
  subject: "orders.v1"
  publish OrderPlaced: OrderPlacedPayload
 
  consume OrderPlaced by enrich_order_event {
    concurrency: 2
    ack: on_success
    retry: backoff(delay_seconds: 15, max_attempts: 4)
    dead_letter: OrderEventDeadLetters
  }
}

model Organization {
  org_id: String
  name: String
  suspended_at: Time?
  deleted_at: Time?
}
 
tenant Organization {
  id_field: org_id
  export_format: ndjson
 
  on_create {
    audit.record("tenant.bootstrap", "Organization", tenant.org_id)
  }
 
  on_suspend {
    logs.info("tenant suspended", { org_id: tenant.org_id })
  }
 
  on_delete {
    purge_policy: retain 30 days
    logs.warn("tenant scheduled for purge", { org_id: tenant.org_id })
  }
}

flag support_agent_v2 {
  default: false
  rules {
    tenant in ["org_alpha", "org_beta"]: true
    percentage(20) grouped_by tenant_id: true
  }
}
 
route GET "/flags/support-agent-v2" protect Auth -> Json {
  handler {
    return { enabled: flags.enabled("support_agent_v2") }
  }
}

event DoctorRealtimeEvent {
  action: String
  doctor_id: UUID
}
 
stream DoctorEvents
  at "/streams/doctors"
  protect AdminAuth roles [admin]
  -> DoctorRealtimeEvent
{
  tenant_field:    tenant_id
  workspace_field: workspace_id
  group_field:     doctor_id
}
 
watch Doctor {
  on create  emit DoctorRealtimeEvent { action: "created",  doctor_id: value.id }
  on update  emit DoctorRealtimeEvent { action: "updated",  doctor_id: value.id }
  on delete  emit DoctorRealtimeEvent { action: "archived", doctor_id: old.id   }
  on restore emit DoctorRealtimeEvent { action: "restored", doctor_id: value.id }
}

service App {
  openapi  { title: "App API"  version: "0.9.0" }
  server   { host: env("HOST", "0.0.0.0")  port: env_int("PORT", 3000) }
 
  telemetry {
    provider:     opentelemetry
    endpoint:     env("OTEL_EXPORTER_OTLP_ENDPOINT", "")
    service_name: "app-api"
    protocol:     otlp_http
    sampling:     parentbased_ratio(0.1)
  }
}
 
route GET "/checkout" protect Auth -> CheckoutResult {
  handler {
    let actor = auth.current_user()
 
    trace.annotate({ actor_id: actor.id, tenant_id: actor.tenant_id })
    metrics.counter("checkout.requests").increment({ tenant_id: actor.tenant_id })
 
    return Checkout.place(input)
  }
}

test "me endpoint uses authenticated scenario user" {
  auth {
    id: 7
    email: "viewer@example.com"
    name: "Viewer"
    roles: ["user"]
  }
 
  given {
    let health = http.request(method: "GET", path: "/health")
  }
 
  when {
    let me = http.request_as("MeResponse", method: "GET", path: "/me")
  }
 
  then health.status == 200 && me.email == "viewer@example.com"
}

type SummaryFixture {
  prompt:   String
  expected: String
}
 
eval "summaries stay factual" {
  dataset: "./evals/summary_fixtures.jsonl"
  forall sample: SummaryFixture
 
  when {
    let actual = SupportAgent.respond_as(String, {
      user_prompt: sample.prompt
    })
  }
 
  grade   actual == sample.expected
  require pass_rate >= 0.9
}

type CertificateContext {
  recipient_name:  String
  completion_date: String
  instructor_name: String
}
 
route POST "/certificates/{recipient_name}" public -> String {
  handler {
    let ctx = CertificateContext {
      recipient_name:  params.recipient_name
      completion_date: "April 23, 2026"
      instructor_name: "Niko Ma"
    }
 
    let pdf = pdf.render_svg_template(
      load_template("ryt200.svg"),
      ctx,
      "/tmp/certs/" + ctx.recipient_name + ".pdf",
      font_paths:   ["/fonts/PlayfairDisplay.ttf"],
      resource_dir: "/tmp/cert-assets",
      title:        "RYT-200 Certificate"
    )
 
    let stored = blob.put(pdf.path, "certs/" + ctx.recipient_name + ".pdf", pdf.content_type)
    return blob.signed_url(stored.key, expires_seconds: 300, download_name: pdf.filename)
  }
}

client WeatherApi {
  base_url: env("WEATHER_API_URL", "https://api.example.com")
  header "x-api-key": env("WEATHER_API_KEY", "")
  timeout_ms: 3000
}
 
type WeatherResponse {
  city: String
  temperature_c: Float
  condition: String
}
 
route GET "/weather/{city}" public -> WeatherResponse {
  handler {
    return WeatherApi.get("/forecast", query: { city: params.city })
  }
}

/// Admin reporting endpoint using raw SQL mapped into a typed result list
route GET "/reports/doctors/by-city" protect AdminAuth roles [admin]
  -> DoctorCityReportRow[]
{
  handler {
    return sql.list_as(
      "DoctorCityReportRow",
      "select city, count(*)::bigint as total
         from doctors
         where deleted_at is null
         group by city
         order by total desc, city asc"
    )
  }
}