YAML surface reference

Generated from the shipped JSON Schemas — the ones the loader, the editors, and the linter share — on every refresh, so this page cannot drift from what the framework accepts. One document = one file in the app tree, and each kind has its own schema: routes under web/ and consume/, jobs under batch/, views beside the route they serve.

Route documents

Schema for TesseraQL route documents: web//.yml, queue consumers under consume/, and the mcp/ kinds, which reuse the route model.

Property	Type	Description
`version` *	const `tesseraql/v1`	The document format version. Always `tesseraql/v1`.
`id` *	string, min length 1	Unique document id, e.g. products.page; referenced by tests, coverage, governance approvals, and logs.
`kind` *	enum: `route` \| `tool` \| `resource` \| `ui` \| `prompt`	route (web/, consume/) and the mcp/ kinds tool/resource/ui/prompt, which reuse the route model.
`recipe`	enum: `query-json` \| `command-json` \| `query-html` \| `page` \| `query-export` \| `file-import` \| `file-export` \| `webhook` \| `queue-consume` \| `prompt-text`	What the route does: query-json/command-json (JSON APIs), query-html/page (HTML pages), query-export/file-import/file-export (file transfers), webhook (inbound webhooks), queue-consume (consume/** documents), and prompt-text (an mcp/ prompt document, which renders its message from a route like every other mcp kind).
`input`	map of inputField	Declared input fields - one contract for routes and jobs alike (a job’s parameters bind and validate exactly like a route’s). Documented in app-layout.md and jobs.md.
`inputPolicy`	object	Route-level input handling policy (e.g. unknown-field behavior) layered over the deny-by-default input: contract.
`security`	object	How this document authenticates and authorizes. Routes are deny-by-default: one that declares no security is unreachable. Documented in authentication.md.
`idempotency`	object	Idempotent replay for commands. A replayed key returns the stored response; a reused key with a different body is TQL-IDEM-4221 (422), and a reuse while the first request runs is TQL-IDEM-4090 (409). Documented in transactional-writes.md.
`lock`	any	Optimistic locking for this command route: the column whose value the caller must send back unchanged for the write to apply. Written as the bare column (`lock: version`) or as a block naming its type (`lock: { column: version, type: integer }`) - a form value always arrives as a string, so an untyped lock on a numeric column cannot be compared. The framework only compares it, through the lock directive the authored statement carries in its WHERE, and never advances it: the statement’s own SET list does that. A stale save is TQL-SQL-4094 (409); a request carrying neither `_lock` nor `_overwrite` is TQL-FIELD-2011 (400).
`admission`	object	Admission policy for this route: concurrency, rate limiting, and the execution lane. Documented in productivity.md (admission) and jobs.md (lanes).
`outbox`	object	Transactional outbox event recorded with the command and delivered at-least-once after commit. Documented in notifications.md and messaging.md.
`steps`	array of object	The command’s ordered statements, executed inside one transaction (command recipes). Each item carries an id: and one binding arm; each result binds under `steps.<id>`. Documented in transactional-writes.md.
`sources`	map of binding	Every named read acquisition, in authored order: each entry names its own mechanism (sql \| contract \| service \| http) and publishes rows/rowCount/first under its name, so a response, a view or a later source refers to one without knowing how it was fetched. Documented in unified-sources.md.
`validate`	map of object	Declarative validation rules keyed by rule id. A rule declares exactly one of rule: (a cross-field expression), file: (validation SQL), or use: (a shared rule declared under rules/). Honored on command-json, query-json and webhook routes, on queue consumers, and on MCP tools.
`decide`	map of object	Decision-table references keyed by alias, evaluated once per operation before the validate: rules; outputs publish as decision.. for SQL binds and directives. Documented in decision-tables.md.
`notify`	map of notification	Notifications enqueued with the command on the transactional outbox, keyed by notification id; each entry names its channel: (a workflow reminder is the separate reminders: key). Documented in notifications.md.
`errors`	object	Per-route error mapping: constraint codes and statuses onto response fields and messages. Documented in declarative-validation.md.
`import`	object	file-import parsing and column-to-bind mapping (headerRow, startRow, columns, onError: rollback\|skip). It says how to parse, never what to write: the per-row statement is the document’s one steps:/pipeline: entry. Documented in file-transfers.md.
`export`	object	query-export / file-export output: format (csv, excel, pdf), filename, columns with headers and format patterns, locale/timezone. It says how the rows are written and never what to read - the rows come from sources.main on a route, or the step’s own arm in a pipeline. Documented in file-transfers.md.
`webhook`	object	Inbound webhook verification and payload mapping for a `webhook` route. Documented in connectors.md.
`publish`	object	The domain event this command publishes on a messaging channel after commit, on the same transactional outbox as `notify:`. Documented in messaging.md.
`consume`	object	What a `consume/**` document subscribes to. Documented in messaging.md.
`response`	object	How the result becomes an HTTP response: JSON, HTML, a redirect, a stream, or a rendered file. Documented in response-shaping.md.
`pagination`	object	Declarative pagination: the framework appends the dialect clause; authored SQL carries no LIMIT/FETCH.
`datasource`	string	The named connector under tesseraql.datasources the route’s SQL runs on, defaulting to main. The name must be declared (TQL-YAML-1035); a non-main route cannot declare notify:/publish:/outbox: or sequence allocation - they ride the main connector (TQL-YAML-1036).
`cache`	object	Declarative HTTP caching for query responses (docs/response-shaping.md): Cache-Control from maxAge/visibility (private default; public lints onto auth: public only) and a content ETag answering If-None-Match with 304. Query recipes only (TQL-YAML-1025).
`emit`	any	Topic(s) broadcast to live views after this route’s write commits (docs/realtime.md): a command-json command at its commit, a file-import when its background import’s transaction commits. A name is lowercase dot/dash-separated segments; the event carries the topic name only, never data.
`invalidates`	any	Source table(s) whose code catalogs this command’s write makes stale (docs/lookups.md). Named by table, not by catalog: a maintenance screen for a shared code master writes a row whose kind is request data, so which catalog is affected is not known until the write happens. Dropped after the commit, so a rollback invalidates nothing.

inputPolicy

Route-level input handling policy (e.g. unknown-field behavior) layered over the deny-by-default input: contract.

Property	Type	Description
`unknownFields`	enum: `reject` \| `ignore`	How to treat request fields with no declared input: reject (default) or ignore.
`readOnlyFieldBehavior`	enum: `reject` \| `ignore` \| `warn`	How to treat declared but non-writable fields when present: reject (default), ignore, or warn.

security

How this document authenticates and authorizes. Routes are deny-by-default: one that declares no security is unreachable. Documented in authentication.md.

Property	Type	Description
`auth`	enum: `bearer` \| `browser` \| `api-key` \| `mtls` \| `public`	bearer \| browser \| api-key \| mtls \| public (deny-by-default: no auth means no access to protected data).
`policy`	string	A policy id under tesseraql.security.policies.
`csrf`	enum: `auto` \| `required` \| `off`	CSRF posture: auto (browser state-changing routes are protected), required, or off - one enum here and in security.defaults rules alike.

idempotency

Idempotent replay for commands. A replayed key returns the stored response; a reused key with a different body is TQL-IDEM-4221 (422), and a reuse while the first request runs is TQL-IDEM-4090 (409). Documented in transactional-writes.md.

Property	Type	Description
`required`	boolean	Whether a key is required on this command - the Idempotency-Key header, or the _idempotency hidden field a rendered form echoes.
`scope`	string	The replay scope key (default: the route id).
`ttl`	string	How long a stored response replays (duration string, default 24h).

admission

Admission policy for this route: concurrency, rate limiting, and the execution lane. Documented in productivity.md (admission) and jobs.md (lanes).

Property	Type	Description
`concurrency`	object	Bound on how many of this route’s requests run at once.
`rateLimit`	object	Token-bucket rate limit for this route.
`lane`	string	The execution lane this route runs on (tesseraql.lanes).

admission.concurrency

Bound on how many of this route’s requests run at once.

Property	Type	Description
`maxInFlight`	integer	Maximum requests of this route in flight at once; excess is rejected.

admission.rateLimit

Token-bucket rate limit for this route.

Property	Type	Description
`requestsPerSecond`	integer	Sustained requests per second allowed; excess is refused with 429.
`burst`	integer	Burst capacity (default: requestsPerSecond).
`scope`	enum: `node` \| `cluster`	node (default) limits per runtime node; cluster coordinates through the shared lease store (TQL-YAML-1023).

outbox

Transactional outbox event recorded with the command and delivered at-least-once after commit. Documented in notifications.md and messaging.md.

Property	Type	Description
`eventType`	string	The event’s type, e.g. `USER_DISABLED` — what a consumer subscribes by.
`aggregateType`	string	The kind of thing the event is about, e.g. `User`.
`aggregateId`	string	A bindable path resolving to the id of the thing the event is about, e.g. `body.name`.
`payload`	map of string	Each payload key to the bindable path supplying its value. A dotted key builds a nested object (`name.givenName`) and a `[]` key builds an array — of scalars (`members[]`), or, zipped by index, of objects (`members[].value`).
`delay`	string	Hold this entry back this long after the commit, e.g. `72h`. Exclusive with deliverAt: (TQL-BATCH-5317). Documented in notifications.md.
`deliverAt`	string	Hold this entry back until the instant this bindable path resolves to. Exclusive with delay: (TQL-BATCH-5317). Documented in notifications.md.

steps

Property	Type	Description
`sql`	object	The SQL arm: a colocated 2-way SQL file and how it is run. The keys of the mechanism nest inside the arm that owns them, so there is nowhere to write a call’s `select:` on a statement and no lint has to say it is wrong.
`contract`	object	The contract arm: a statement the identity schema owns, called by name. It reads or writes like any other statement, so it carries the same `mode`, `params` and `expect`.
`service`	object	The service arm: a runtime provider answering rows from process state. It takes only its arguments — there is no statement to run, so no mode and no row-count expectation.
`http`	object	The http arm: an outbound call whose response becomes this binding’s rows, in the vocabulary every outbound call shares. Rides the outbound gateway — allow-listed hosts, named credentials, timeouts, and a per-host circuit breaker.
`sequence`	string	Allocate the next value of a managed document-number sequence instead of running a statement; it binds as `steps.<id>.value`. It has no body beyond its name, which is why it sits beside the arms rather than being one. Documented in transactional-writes.md.
`spool`	string	A context path resolving to an earlier step’s spool reference (`steps.<id>.spool`), read as this binding’s rows. A chunk reader declares it instead of `sql:` to load what another step extracted — from another connector, or from an API — because a spool is a spool whoever filled it. Documented in jobs.md.
`when`	string	Guard expression on a step: a falsy guard skips it, recording `steps.<id>.skipped` instead of a result. A guard is about whether the step runs at all, not a question for the mechanism, so it sits beside the arm. The declared branch point for decision.* outputs (docs decision-tables).
`enrich`	map of enrichment	Keyed references folded into this binding’s rows before anything reads them (docs/lookups.md), keyed by enrichment name and applied in authored order. An enrichment nests under the source it transforms, so any arm’s rows can be enriched. Each entry names one reference — sql: (fetch by key), http: (call by key), or source: (a result already in the context, joined without a fetch, named by its context path: a route source by name, a job step as steps.<id>) — plus the on: join and one of as:/merge:. Only a binding that holds rows can carry one: a write publishes affectedRows, and a query-spool extract never held its rows.
`id` *	string	The step’s name: what later steps and the response bind against (`steps.<id>`).

steps.sql

The SQL arm: a colocated 2-way SQL file and how it is run. The keys of the mechanism nest inside the arm that owns them, so there is nowhere to write a call’s select: on a statement and no lint has to say it is wrong.

Property	Type	Description
`file`	string	A colocated 2-way SQL file, relative to the declaring document (must exist; TQL-SQL-2103). This arm’s acquisition target, the role `url` plays for `http`.
`mode`	string	How the statement runs and what it binds: `query` (rows), `query-one` (a single row), `update` (an affected-row count), `query-spool` (rows streamed to a spool a later chunk: step reads, never held), or `call` (a stored call on a command step, its OUT parameters declared under `out:`).
`params`	map of string	Each bind name to the bindable path supplying its value, such as `path.id`, `params.unit` or `principal.claim.tenant_id`.
`keys`	array of string	Columns whose database-generated values are captured after an insert; they bind as `steps.<id>.keys.<column>`.
`out`	map of string	The OUT parameters of a `mode: call` statement on a command step: each name to its JDBC type keyword (varchar, numeric, integer, bigint, boolean, date, timestamp, double). The statement binds them as `out.<name>` bind sites and the values publish as `steps.<id>.out.<name>`. Documented in transactional-writes.md.
`timeoutSeconds`	integer ≥ 0	Per-binding SQL statement timeout override; 0 disables. Default: tesseraql.sql.timeoutSeconds, else 30s.
`datasource`	string	The named connector this read runs on, overriding the document’s. Legal on a read only: a batch step owns its own transaction so an extract elsewhere splits nothing, while a write on another connector would be a second transaction nothing owns (TQL-YAML-1037).
`materialize`	object	Bounds on how much of the result is held in memory.
`expect`	object	The row count this statement must affect, and what happens when it does not — the declarative optimistic-locking check on an update or delete.

steps.sql.materialize

Bounds on how much of the result is held in memory.

Property	Type	Description
`maxRows`	integer	Largest number of rows materialized. Default: `tesseraql.resultMaterialization.maxRows`.
`onOverflow`	string	`fail` (the default) refuses a result past `maxRows`; `warn` truncates it and logs.

steps.sql.expect

The row count this statement must affect, and what happens when it does not — the declarative optimistic-locking check on an update or delete.

Property	Type	Description
`rowCount`	integer	The exact number of rows the statement must affect (rows is a list of records everywhere else).
`onMismatch`	string	`conflict` (the default) answers 409, so a stale edit is refused honestly; `error` answers 500.

steps.contract

The contract arm: a statement the identity schema owns, called by name. It reads or writes like any other statement, so it carries the same mode, params and expect.

Property	Type	Description
`name`	string	The named IAM SQL contract to execute instead of a colocated file, so an app reuses the identity schema’s statements. Documented in authentication.md.
`mode`	string	How the contract runs and what it binds, exactly as it means on the `sql` arm.
`params`	map of string	Each bind name to the bindable path supplying its value, such as `path.id`, `params.unit` or `principal.claim.tenant_id`.
`expect`	object	The row count this statement must affect, and what happens when it does not — the declarative optimistic-locking check on an update or delete.
`materialize`	object	Bounds on how much of the result is held in memory. Declared here so a contract that legitimately returns more than the app-wide budget says so on the binding, rather than an application raising the budget for every route, command and export at once.
`timeoutSeconds`	integer ≥ 0	Per-binding SQL statement timeout override; 0 disables. Default: tesseraql.sql.timeoutSeconds, else 30s.

steps.contract.expect

The row count this statement must affect, and what happens when it does not — the declarative optimistic-locking check on an update or delete.

Property	Type	Description
`rowCount`	integer	The exact number of rows the statement must affect (rows is a list of records everywhere else).
`onMismatch`	string	`conflict` (the default) answers 409, so a stale edit is refused honestly; `error` answers 500.

steps.contract.materialize

Bounds on how much of the result is held in memory. Declared here so a contract that legitimately returns more than the app-wide budget says so on the binding, rather than an application raising the budget for every route, command and export at once.

Property	Type	Description
`maxRows`	integer	Largest number of rows materialized. Default: `tesseraql.resultMaterialization.maxRows`.
`onOverflow`	string	`fail` (the default) refuses a result past `maxRows`; `warn` truncates it and logs.

steps.service

The service arm: a runtime provider answering rows from process state. It takes only its arguments — there is no statement to run, so no mode and no row-count expectation.

Property	Type	Description
`name`	string	The named runtime service provider to call instead of running SQL (docs/extending.md): non-SQL runtime state (lanes, traces, file trees, …) read as rows.
`params`	map of string	Each bind name to the bindable path supplying its value, such as `path.id`, `params.unit` or `principal.claim.tenant_id`.

steps.http

The http arm: an outbound call whose response becomes this binding’s rows, in the vocabulary every outbound call shares. Rides the outbound gateway — allow-listed hosts, named credentials, timeouts, and a per-host circuit breaker.

Property	Type	Description
`method`	string	The HTTP method. Default GET; a source is not restricted to GET, because JSON-RPC, GraphQL and `POST …/search` batch lookups are reads.
`url`	string	The absolute http/https URL. Its host must be allow-listed under tesseraql.http.outbound.allowedHosts — egress is deny by default (TQL-SEC-4070).
`headers`	map of string	Static request headers; values may carry ${…} config or secret placeholders, resolved on send.
`query`	map of string	Query-string parameters, each a bindable path resolved against the execution context.
`credential`	string	A named credential the SecretResolver supplies at call time, so a document never carries a secret.
`body`	string	A bindable path whose value is serialized as the request body.
`expectStatus`	integer	The exact status that counts as success; the default is any 2xx. A mismatch fails the call without tripping the circuit breaker — it is a deterministic rejection, not a sign the dependency is down.
`connectTimeout`	string	Connect timeout for this call (e.g. 2s), overriding tesseraql.http.outbound.connectTimeout.
`requestTimeout`	string	Request timeout for this call (e.g. 10s), overriding tesseraql.http.outbound.requestTimeout.
`retry`	object	Opt-in retry for transient faults: connect failures, timeouts and 5xx are repeated; a 4xx and an expectStatus mismatch never are. Unstated numbers come from tesseraql.http.outbound.retry. Every repeated attempt counts against the circuit breaker, the sequence ends the moment the host’s circuit opens, and it lives inside a budget of attempts x requestTimeout. Documented in connectors.md.
`select`	string	A dotted path into the response JSON naming the part that becomes rows. Default: the whole body.
`onError`	string	`fail` (default) fails the request or step; `empty` degrades to zero rows and an `error` entry, and the page still renders. The degradation is logged and metered — it is not silent.
`readOnly`	boolean	The author’s assertion that the call has no side effect, required on a command route: the write can roll back and the request cannot.
`mode`	string	How the acquired rows are delivered: `query` (default — held and published as rows) or `query-spool` (streamed to a spool a later chunk: step loads, so an API result can be written to the database without holding it). A call reads, so the SQL write modes are not modes it has.

steps.http.retry

Opt-in retry for transient faults: connect failures, timeouts and 5xx are repeated; a 4xx and an expectStatus mismatch never are. Unstated numbers come from tesseraql.http.outbound.retry. Every repeated attempt counts against the circuit breaker, the sequence ends the moment the host’s circuit opens, and it lives inside a budget of attempts x requestTimeout. Documented in connectors.md.

Property	Type	Description
`attempts`	integer ≥ 1 ≤ 10	Total attempts including the first (TQL-YAML-1058 outside 1..10).
`backoff`	string	The wait before the second attempt, e.g. 200ms.
`multiplier`	number ≥ 1	The factor the wait grows by before each further attempt.

validate

Property	Type	Description
`rule`	string	A cross-field expression that must hold.
`file`	string	Validation SQL returning one row per violation; must be a SELECT, and runs inside the command’s transaction.
`use`	string	Name of a shared rule declared under rules/. The reference supplies params: matching the rule’s binds: contract, plus its own field:/when:/code:/message:.
`params`	map of string	Binds for a SQL rule, as dotted source expressions.
`field`	string	The input the violation is reported against.
`when`	string	Guard expression; the rule is skipped when it is falsy.
`code`	string	Machine-readable violation code.
`message`	string	Message catalog key.

decide

Property	Type	Description
`use` *	string	Name of a decision declared under decisions/.
`params` *	map of string	Wiring of each decision input to a request-context expression (params.total, principal.orgUnit, “principal.role == ‘officer’”).
`effectiveAt`	string	Reference instant of a dated table-backed decision’s effective: window - audit.now unless wired to a document date (params.postingDate).

errors

Per-route error mapping: constraint codes and statuses onto response fields and messages. Documented in declarative-validation.md.

Property	Type	Description
`constraints`	map of object	Database constraint name, as declared in the schema, to the field-level error a violation of it becomes.

errors.constraints

How one constraint violation is reported.

Property	Type	Description
`field`	string	The input field the violation is reported against, so the caller sees a field error rather than a 500.
`code`	string	A stable application error code, defaulting to the violation kind (`duplicate` for a unique violation).
`message`	string	A message key resolved through the app bundles; unset, the framework’s `tql.constraint.<code>` texts apply.

import

file-import parsing and column-to-bind mapping (headerRow, startRow, columns, onError: rollback|skip). It says how to parse, never what to write: the per-row statement is the document’s one steps:/pipeline: entry. Documented in file-transfers.md.

Property	Type	Description
`format`	string	The tabular format the uploaded file is parsed as. `csv` is built in; `excel` needs the tesseraql-excel module (TQL-LD-2801 when the codec is absent).
`columns`	array of fileColumn	How the file’s columns map to the per-row statement’s bind names. Omit it to use the header labels as bind names.
`headerRow`	boolean	Whether the table starts with a header row (default `true`). With a header, simple-form columns match by label rather than by position.
`startRow`	integer ≥ 1	The 1-based row the table starts at, for files carrying title rows above the data (default 1).
`sheet`	string	For workbook formats, the sheet to read (default: the first).
`locale`	string	The locale `type:`/`format:` columns parse dates and numbers in. A literal, or a request source such as `principal.claim.locale`; unset, `tesseraql.files.locale` applies.
`onError`	string	What a failing row does: `rollback` (default) fails the whole import, `skip` records the row and commits the rest. Either way the rejected rows are reported with their row numbers.
`review`	enum: `required`	`required` splits the import in two (docs/csv-import.md): the upload parses, validates and parks the batch without writing anything, answering a report and a confirm token, and a second request commits exactly what was reviewed. Absent means the one-shot import. Only a route may declare it — a poll-driven import job has nobody to confirm (TQL-YAML-1060).

export

query-export / file-export output: format (csv, excel, pdf), filename, columns with headers and format patterns, locale/timezone. It says how the rows are written and never what to read - the rows come from sources.main on a route, or the step’s own arm in a pipeline. Documented in file-transfers.md.

Property	Type	Description
`format`	string	The format the rows are written as. `csv` is built in; `excel` and `pdf` need their modules (TQL-LD-2801 when the codec is absent).
`filename`	string	The download filename, defaulting to the document id plus the format’s extension. `{dotted.path}` interpolates a context value, and a `splitBy:` export must carry `{key}`.
`template`	string	A workbook or print template colocated with the document: an .xlsx for excel, an .html for pdf. A path that does not exist fails the build rather than quietly writing a plain grid.
`sheet`	string	For workbook formats, the sheet to write.
`startCell`	string	Placement mode: where data rows start in the template, e.g. `B5`. Refused without a template (TQL-YAML-1041), and refused on pdf (TQL-YAML-1005) — a page lays out through its template, not through cell positions.
`columns`	array of fileColumn	The columns written, in order, with their headings and format patterns. Omit it to write every column the rows carry, under its own name.
`locale`	string	The locale date and number patterns render in. A literal, or a request source such as `principal.claim.locale`, so the requesting user decides; unset, `tesseraql.files.locale` applies. A job has no request, so a step’s is a literal.
`timezone`	string	The zone date and time values render in, with the same literal / request-source / `tesseraql.files.timezone` fallback as `locale`.
`after`	object	A statement run once after the extraction, typically to mark the extracted rows. `file-export` only: on `query-export` it is a build error (TQL-CAMEL-3101), because a synchronous download has no transaction to hang it on.
`maxRows`	integer	The ceiling for a format that holds every row before it writes (pdf, and the workbook template modes), defaulting to `tesseraql.resultMaterialization.maxRows`; a negative value opts out. A streaming format is never capped.
`onOverflow`	string	`fail` (default) refuses an export past `maxRows` (TQL-LD-2850); `warn` truncates it at the cap and logs.
`groupBy`	string	A column the rows are read as ordered groups by, each exposed to the template as a `key` and its own `rows`. The rows must be ordered by it (TQL-LD-2851).
`splitBy`	string	A column that splits the export into one document per value, delivered as a single ZIP; `filename:` must carry `{key}`. The rows must be ordered by it (TQL-LD-2851).

export.after

A statement run once after the extraction, typically to mark the extracted rows. file-export only: on query-export it is a build error (TQL-CAMEL-3101), because a synchronous download has no transaction to hang it on.

Property	Type	Description
`timing`	string	`extract` (default) runs the statement in the extraction’s transaction, so rows are marked exactly when they are extracted; `download` runs it once on the first successful file fetch. A job’s export step supports `extract` only (TQL-YAML-1041).
`sql`	object	The follow-up statement, written as a source’s `sql:` arm is — `file:`, `params:`, and the rest of the arm’s keys.

webhook

Inbound webhook verification and payload mapping for a webhook route. Documented in connectors.md.

Property	Type	Description
`provider`	string	A verifier under tesseraql.connectors.webhooks (an unknown provider fails the build).

publish

The domain event this command publishes on a messaging channel after commit, on the same transactional outbox as notify:. Documented in messaging.md.

Property	Type	Description
`channel`	string	The declared messaging channel to publish on.
`topic`	string	The topic the event is published under.
`key`	string	Ordering key for the event, as a bindable path; messages sharing a key keep their relative order.
`payload`	map of string	The event body: each property name to the bindable path supplying its value.
`delay`	string	Hold this entry back this long after the commit, e.g. `72h`. Exclusive with deliverAt: (TQL-BATCH-5317). Documented in notifications.md.
`deliverAt`	string	Hold this entry back until the instant this bindable path resolves to. Exclusive with delay: (TQL-BATCH-5317). Documented in notifications.md.

consume

What a consume/** document subscribes to. Documented in messaging.md.

Property	Type	Description
`channel`	string	The declared messaging channel to consume from.
`topic`	string	The topic this consumer subscribes to.
`idempotencyKey`	string	A bindable path over the message whose value de-duplicates redeliveries, so an at-least-once channel applies each message once.

response

How the result becomes an HTTP response: JSON, HTML, a redirect, a stream, or a rendered file. Documented in response-shaping.md.

Property	Type	Description
`json`	object	The JSON response: status, body, per-field policy, and nested composition.
`html`	object	The HTML response: a template or a view, its model, the status, and headers.
`stream`	object	Stream the generated file back as the response body (`query-export`). Documented in file-transfers.md.
`redirect`	object	Answer with a redirect instead of a body — the usual close of a browser form post.
`file`	object	Render a template into a file and answer with it as a download.
`text`	object	Render a template and answer with the text itself — the message a `prompt-text` recipe returns from `prompts/get`. It is `file:` without `filename:`/`contentType:`, which a message has nowhere to put. Documented in app-mcp.md.
`onError`	object	How an error response reaches htmx, so a failed submit lands in the right place instead of replacing the page. Documented in response-shaping.md.
`session`	object	Browser-session handling for the response (docs/authentication.md).

response.json

The JSON response: status, body, per-field policy, and nested composition.

Property	Type	Description
`status`	integer ≥ 100 ≤ 599	The status answered on success (default 200; a create conventionally declares 201).
`body`	any	What the response body is: a bindable path such as `rows` or `steps.<name>`, or a literal shape composing several.
`fields`	map of fieldPolicy	Per-field visibility, masking, and classification applied to the body. Documented in data-scoping.md.
`statusWhen`	statusWhen	Conditional statuses: the first entry whose expression matches decides the status.

response.html

The HTML response: a template or a view, its model, the status, and headers.

Property	Type	Description
`status`	integer ≥ 100 ≤ 599	The status answered on success (default 200).
`template`	string	The Thymeleaf template to render, relative to the app template root (exclusive with `view:`).
`view`	string	The id of a *.view.yml document (exclusive with template:).
`shell`	enum: `auto` \| `always` \| `never`	Shell negotiation: auto (default) serves the bare #page-content region to htmx requests and the shell-wrapped page to direct navigation; always wraps unconditionally; never declares an htmx-only region endpoint.
`views`	array of string	View ids whose models a template: route binds; each renders into views[‘’] for the template to insert (illegal alongside view:).
`model`	object	Extra model entries for the template: each name to the bindable path supplying it.
`headers`	object	Response headers to set, merged over the app-wide `responseHeaders` defaults.
`headersWhen`	map of string	Conditional response headers: the first entry whose expression matches decides the headers.
`statusWhen`	statusWhen	Conditional statuses: the first entry whose expression matches decides the status.

response.stream

Stream the generated file back as the response body (query-export). Documented in file-transfers.md.

Property	Type	Description
`filename`	string	The download filename offered to the client, as a literal or a bindable path.

response.redirect

Answer with a redirect instead of a body — the usual close of a browser form post.

Property	Type	Description
`status`	integer ≥ 300 ≤ 399	The redirect status; declare `303` after a command so the browser follows with GET.
`location` *	string	Where to redirect, as a literal path or a bindable path. The sentinel `back` follows the request’s validated `_return` field - the list a page-frame row link came from - falling back to the application root.

response.file

Render a template into a file and answer with it as a download.

Property	Type	Description
`status`	integer	The status answered on success (default 200).
`template` *	string	The template rendered into the file.
`contentType`	string	The Content-Type of the produced file.
`filename`	string	The download filename offered to the client, as a literal or a bindable path.
`model`	object	Extra model entries for the template: each name to the bindable path supplying it.

response.text

Render a template and answer with the text itself — the message a prompt-text recipe returns from prompts/get. It is file: without filename:/contentType:, which a message has nowhere to put. Documented in app-mcp.md.

Property	Type	Description
`status`	integer	The status answered on success (default 200).
`template` *	string	The template rendered into the message, in Thymeleaf TEXT mode.
`model`	object	Extra model entries for the template: each name to the bindable path supplying it.

response.onError

How an error response reaches htmx, so a failed submit lands in the right place instead of replacing the page. Documented in response-shaping.md.

Property	Type	Description
`retarget`	string	The element an error response replaces, instead of the request target.
`reswap`	string	The htmx swap style an error response uses (for example `outerHTML`).

response.session

Browser-session handling for the response (docs/authentication.md).

Property	Type	Description
`rotate`	boolean	Re-issue the caller’s session cookie in place on success: a fresh id and CSRF token, the old id invalidated before the response leaves. Declare on routes that elevate the session (confirming an MFA enrollment); bearer or public callers are untouched.

pagination

Declarative pagination: the framework appends the dialect clause; authored SQL carries no LIMIT/FETCH.

Property	Type	Description
`strategy`	enum: `offset` \| `keyset` \| `snapshot`	`offset` (the default) pages by row offset; `keyset` pages by the `by:` cursor column and stays stable while rows are inserted; `snapshot` freezes a work queue’s membership at search time as row tokens the page carries - requires the view’s key:, and the authored SQL binds the page’s `keys` IN-list.
`cap`	integer ≥ 1	The snapshot membership cap (default 500): a search whose hits exceed it answers 422 rather than truncating. Only legal on strategy: snapshot.
`size`	integer ≥ 1	Page size used when the request does not ask for one.
`maxSize`	integer ≥ 1	Largest page size a request may ask for; a larger request is clamped.
`count`	boolean	Also run a count query so the response carries the total row count.
`by`	any	The keyset cursor column, or an ordered list for a composite cursor: the next cursor becomes one opaque row token, decoded back into params.after. parts for the authored tuple predicate.

cache

Declarative HTTP caching for query responses (docs/response-shaping.md): Cache-Control from maxAge/visibility (private default; public lints onto auth: public only) and a content ETag answering If-None-Match with 304. Query recipes only (TQL-YAML-1025).

Property	Type	Description
`maxAge`	string	How long a client may reuse the response (duration string such as 30s or 5m).
`visibility`	enum: `private` \| `public`	`private` (the default) lets only the client cache the response; `public` permits shared caches and lints onto `auth: public` routes only.
`etag`	boolean	Hash the rendered body and answer If-None-Match with 304 (default true).
`staleWhileRevalidate`	string	How long a stale response may still be served while it revalidates (duration string).

Job documents

Schema for TesseraQL batch job documents (batch/**/job.yml): how the job is triggered, what it runs, and the deadlines it is watched against.

Property	Type	Description
`version` *	const `tesseraql/v1`	The document format version. Always `tesseraql/v1`.
`id` *	string, min length 1	Unique document id, e.g. products.page; referenced by tests, coverage, governance approvals, and logs.
`kind` *	const `job`	Batch job documents (batch/**/job.yml).
`recipe`	enum: `batch-pipeline`	What the job does: batch-pipeline runs an ordered pipeline: of steps.
`datasource`	string	The named connector under tesseraql.datasources the route’s SQL runs on, defaulting to main. The name must be declared (TQL-YAML-1035); a non-main route cannot declare notify:/publish:/outbox: or sequence allocation - they ride the main connector (TQL-YAML-1036).
`trigger`	object	How a job starts (kind: job): a schedule, or a directory/SFTP/FTPS poll source feeding the import: pipeline. Documented in jobs.md and connectors.md.
`input`	map of inputField	Declared input fields - one contract for routes and jobs alike (a job’s parameters bind and validate exactly like a route’s). Documented in app-layout.md and jobs.md.
`pipeline`	array of object	The job’s ordered steps. A step is a binding with an id (sql: or http:) plus its output blocks (export:, push:, notify:) or a chunk:, each publishing its result to the step context. Documented in jobs.md.
`perTenant`	boolean	Run this job once per configured tenant, each on its own datasource and tenant context (kind: job). Documented in multi-tenancy.md.
`import`	object	file-import parsing and column-to-bind mapping (headerRow, startRow, columns, onError: rollback\|skip). It says how to parse, never what to write: the per-row statement is the document’s one steps:/pipeline: entry. Documented in file-transfers.md.
`overlap`	enum: `skip` \| `concurrent`	What a firing does while the previous execution still runs (kind: job): skip (default) records a SKIPPED execution naming the running one; concurrent runs anyway - declare it only for jobs that are safe to overlap. Documented in jobs.md.
`sla`	object	Deadline expectations a periodic managed check alerts on through the alerts channel (kind: job) - alert-only, nothing is killed. Documented in jobs.md.

trigger

How a job starts (kind: job): a schedule, or a directory/SFTP/FTPS poll source feeding the import: pipeline. Documented in jobs.md and connectors.md.

Property	Type	Description
`schedule`	object	Fire the job on a clock: a cron expression or a fixed delay, optionally filtered by a business-day calendar.
`poll`	object	Fire the job when files arrive: a local directory, SFTP, or FTPS source feeding the job’s import pipeline.
`after`	string	Light chaining: fire when the named job’s execution completes successfully in the same app, carrying its business date. Documented in jobs.md.

trigger.schedule

Fire the job on a clock: a cron expression or a fixed delay, optionally filtered by a business-day calendar.

Property	Type	Description
`cron`	string	A Quartz cron expression; firings are claimed cluster-wide so one node runs each.
`fixedDelay`	string	A period (duration string, e.g. 5m); mutually exclusive with cron.
`calendar`	string	A business-day calendar declared under calendars/ - the cron says when to consider a firing, the calendar says whether it counts. Documented in jobs.md.
`runOn`	enum: `business-day` \| `first-business-day-of-month` \| `last-business-day-of-month`	Which considered firings count under the calendar (default business-day); mutually exclusive with dayOfMonth.
`dayOfMonth`	integer ≥ 1 ≤ 31	The shifted nominal-day rule: fire on this day of month, or its shifted business day when it is not one - and the run’s business date is the nominal date. Rounds down to the month’s last day. Documented in jobs.md.
`shift`	enum: `next-business-day` \| `previous-business-day`	Where a non-business nominal day moves (default next-business-day); requires dayOfMonth.

trigger.poll

Fire the job when files arrive: a local directory, SFTP, or FTPS source feeding the job’s import pipeline.

Property	Type	Description
`transport`	enum: `local` \| `sftp` \| `ftps`	local (default) polls a directory under connectors.poll.allowedPaths; sftp/ftps poll a remote host in connectors.poll.allowedHosts.
`host`	string	The remote host to poll; required for `sftp` and `ftps`, and it must be listed in `connectors.poll.allowedHosts`.
`port`	integer	The remote port; defaults to the transport’s standard port.
`path`	string	The polled directory. A local path must sit under a declared allowedPaths root. A remote path with a leading slash is absolute on the server; without one it resolves against the credential’s login home.
`credential`	string	A named credential under tesseraql.connectors.poll.credentials (required for remote sources).
`include`	string	An ant-style filename filter, e.g. *.csv.
`delay`	string	Poll interval (duration string).
`move`	string	Relative directory for processed files (default .done). Plain names only - no paths or placeholders.
`moveFailed`	string	Relative directory for failed files (default .error). Plain names only.
`consumeOnce`	boolean	Consume each file once across every replica, arbitrated through a shared store. Off by default. The read lock a poll consumer carries is a write-stability check, and on sftp/ftps there is no server-side exclusion at all, so without this every replica imports every file. Turning it on also means a partner re-sending a byte-identical file is skipped while connectors.poll.consumedRetention has not lapsed.

pipeline

Property	Type	Description
`sql`	object	The SQL arm: a colocated 2-way SQL file and how it is run. The keys of the mechanism nest inside the arm that owns them, so there is nowhere to write a call’s `select:` on a statement and no lint has to say it is wrong.
`contract`	object	The contract arm: a statement the identity schema owns, called by name. It reads or writes like any other statement, so it carries the same `mode`, `params` and `expect`.
`service`	object	The service arm: a runtime provider answering rows from process state. It takes only its arguments — there is no statement to run, so no mode and no row-count expectation.
`http`	object	The http arm: an outbound call whose response becomes this binding’s rows, in the vocabulary every outbound call shares. Rides the outbound gateway — allow-listed hosts, named credentials, timeouts, and a per-host circuit breaker.
`sequence`	string	Allocate the next value of a managed document-number sequence instead of running a statement; it binds as `steps.<id>.value`. It has no body beyond its name, which is why it sits beside the arms rather than being one. Documented in transactional-writes.md.
`spool`	string	A context path resolving to an earlier step’s spool reference (`steps.<id>.spool`), read as this binding’s rows. A chunk reader declares it instead of `sql:` to load what another step extracted — from another connector, or from an API — because a spool is a spool whoever filled it. Documented in jobs.md.
`when`	string	Guard expression on a step: a falsy guard skips it, recording `steps.<id>.skipped` instead of a result. A guard is about whether the step runs at all, not a question for the mechanism, so it sits beside the arm. The declared branch point for decision.* outputs (docs decision-tables).
`enrich`	map of enrichment	Keyed references folded into this binding’s rows before anything reads them (docs/lookups.md), keyed by enrichment name and applied in authored order. An enrichment nests under the source it transforms, so any arm’s rows can be enriched. Each entry names one reference — sql: (fetch by key), http: (call by key), or source: (a result already in the context, joined without a fetch, named by its context path: a route source by name, a job step as steps.<id>) — plus the on: join and one of as:/merge:. Only a binding that holds rows can carry one: a write publishes affectedRows, and a query-spool extract never held its rows.
`id` *	string	The step’s name: what later steps bind against (`steps.<id>`) and what the execution record reports.
`notify`	notification	One notification enqueued on the transactional outbox, so it is sent if and only if the write commits. Documented in notifications.md.
`chunk`	chunk	Restartable per-row processing: a reader, a writer, and committed checkpoints, so a job that stops resumes where it left off instead of starting over. Documented in jobs.md.
`export`	object	query-export / file-export output: format (csv, excel, pdf), filename, columns with headers and format patterns, locale/timezone. It says how the rows are written and never what to read - the rows come from sources.main on a route, or the step’s own arm in a pipeline. Documented in file-transfers.md.
`push`	push	Delivery of a produced transfer to a local or remote drop — the outbound mirror of the poll trigger, under the same policy block. Documented in file-transfers.md.

pipeline.sql

Property	Type	Description
`file`	string	A colocated 2-way SQL file, relative to the declaring document (must exist; TQL-SQL-2103). This arm’s acquisition target, the role `url` plays for `http`.
`mode`	string	How the statement runs and what it binds: `query` (rows), `query-one` (a single row), `update` (an affected-row count), `query-spool` (rows streamed to a spool a later chunk: step reads, never held), or `call` (a stored call on a command step, its OUT parameters declared under `out:`).
`params`	map of string	Each bind name to the bindable path supplying its value, such as `path.id`, `params.unit` or `principal.claim.tenant_id`.
`keys`	array of string	Columns whose database-generated values are captured after an insert; they bind as `steps.<id>.keys.<column>`.
`out`	map of string	The OUT parameters of a `mode: call` statement on a command step: each name to its JDBC type keyword (varchar, numeric, integer, bigint, boolean, date, timestamp, double). The statement binds them as `out.<name>` bind sites and the values publish as `steps.<id>.out.<name>`. Documented in transactional-writes.md.
`timeoutSeconds`	integer ≥ 0	Per-binding SQL statement timeout override; 0 disables. Default: tesseraql.sql.timeoutSeconds, else 30s.
`datasource`	string	The named connector this read runs on, overriding the document’s. Legal on a read only: a batch step owns its own transaction so an extract elsewhere splits nothing, while a write on another connector would be a second transaction nothing owns (TQL-YAML-1037).
`materialize`	object	Bounds on how much of the result is held in memory.
`expect`	object	The row count this statement must affect, and what happens when it does not — the declarative optimistic-locking check on an update or delete.

pipeline.sql.materialize

Bounds on how much of the result is held in memory.

Property	Type	Description
`maxRows`	integer	Largest number of rows materialized. Default: `tesseraql.resultMaterialization.maxRows`.
`onOverflow`	string	`fail` (the default) refuses a result past `maxRows`; `warn` truncates it and logs.

pipeline.sql.expect

The row count this statement must affect, and what happens when it does not — the declarative optimistic-locking check on an update or delete.

Property	Type	Description
`rowCount`	integer	The exact number of rows the statement must affect (rows is a list of records everywhere else).
`onMismatch`	string	`conflict` (the default) answers 409, so a stale edit is refused honestly; `error` answers 500.

pipeline.contract

The contract arm: a statement the identity schema owns, called by name. It reads or writes like any other statement, so it carries the same mode, params and expect.

Property	Type	Description
`name`	string	The named IAM SQL contract to execute instead of a colocated file, so an app reuses the identity schema’s statements. Documented in authentication.md.
`mode`	string	How the contract runs and what it binds, exactly as it means on the `sql` arm.
`params`	map of string	Each bind name to the bindable path supplying its value, such as `path.id`, `params.unit` or `principal.claim.tenant_id`.
`expect`	object	The row count this statement must affect, and what happens when it does not — the declarative optimistic-locking check on an update or delete.
`materialize`	object	Bounds on how much of the result is held in memory. Declared here so a contract that legitimately returns more than the app-wide budget says so on the binding, rather than an application raising the budget for every route, command and export at once.
`timeoutSeconds`	integer ≥ 0	Per-binding SQL statement timeout override; 0 disables. Default: tesseraql.sql.timeoutSeconds, else 30s.

pipeline.contract.expect

The row count this statement must affect, and what happens when it does not — the declarative optimistic-locking check on an update or delete.

Property	Type	Description
`rowCount`	integer	The exact number of rows the statement must affect (rows is a list of records everywhere else).
`onMismatch`	string	`conflict` (the default) answers 409, so a stale edit is refused honestly; `error` answers 500.

pipeline.contract.materialize

Property	Type	Description
`maxRows`	integer	Largest number of rows materialized. Default: `tesseraql.resultMaterialization.maxRows`.
`onOverflow`	string	`fail` (the default) refuses a result past `maxRows`; `warn` truncates it and logs.

pipeline.service

The service arm: a runtime provider answering rows from process state. It takes only its arguments — there is no statement to run, so no mode and no row-count expectation.

Property	Type	Description
`name`	string	The named runtime service provider to call instead of running SQL (docs/extending.md): non-SQL runtime state (lanes, traces, file trees, …) read as rows.
`params`	map of string	Each bind name to the bindable path supplying its value, such as `path.id`, `params.unit` or `principal.claim.tenant_id`.

pipeline.http

Property	Type	Description
`method`	string	The HTTP method. Default GET; a source is not restricted to GET, because JSON-RPC, GraphQL and `POST …/search` batch lookups are reads.
`url`	string	The absolute http/https URL. Its host must be allow-listed under tesseraql.http.outbound.allowedHosts — egress is deny by default (TQL-SEC-4070).
`headers`	map of string	Static request headers; values may carry ${…} config or secret placeholders, resolved on send.
`query`	map of string	Query-string parameters, each a bindable path resolved against the execution context.
`credential`	string	A named credential the SecretResolver supplies at call time, so a document never carries a secret.
`body`	string	A bindable path whose value is serialized as the request body.
`expectStatus`	integer	The exact status that counts as success; the default is any 2xx. A mismatch fails the call without tripping the circuit breaker — it is a deterministic rejection, not a sign the dependency is down.
`connectTimeout`	string	Connect timeout for this call (e.g. 2s), overriding tesseraql.http.outbound.connectTimeout.
`requestTimeout`	string	Request timeout for this call (e.g. 10s), overriding tesseraql.http.outbound.requestTimeout.
`retry`	object	Opt-in retry for transient faults: connect failures, timeouts and 5xx are repeated; a 4xx and an expectStatus mismatch never are. Unstated numbers come from tesseraql.http.outbound.retry. Every repeated attempt counts against the circuit breaker, the sequence ends the moment the host’s circuit opens, and it lives inside a budget of attempts x requestTimeout. Documented in connectors.md.
`select`	string	A dotted path into the response JSON naming the part that becomes rows. Default: the whole body.
`onError`	string	`fail` (default) fails the request or step; `empty` degrades to zero rows and an `error` entry, and the page still renders. The degradation is logged and metered — it is not silent.
`readOnly`	boolean	The author’s assertion that the call has no side effect, required on a command route: the write can roll back and the request cannot.
`mode`	string	How the acquired rows are delivered: `query` (default — held and published as rows) or `query-spool` (streamed to a spool a later chunk: step loads, so an API result can be written to the database without holding it). A call reads, so the SQL write modes are not modes it has.

pipeline.http.retry

Property	Type	Description
`attempts`	integer ≥ 1 ≤ 10	Total attempts including the first (TQL-YAML-1058 outside 1..10).
`backoff`	string	The wait before the second attempt, e.g. 200ms.
`multiplier`	number ≥ 1	The factor the wait grows by before each further attempt.

pipeline.export

Property	Type	Description
`format`	string	The format the rows are written as. `csv` is built in; `excel` and `pdf` need their modules (TQL-LD-2801 when the codec is absent).
`filename`	string	The download filename, defaulting to the document id plus the format’s extension. `{dotted.path}` interpolates a context value, and a `splitBy:` export must carry `{key}`.
`template`	string	A workbook or print template colocated with the document: an .xlsx for excel, an .html for pdf. A path that does not exist fails the build rather than quietly writing a plain grid.
`sheet`	string	For workbook formats, the sheet to write.
`startCell`	string	Placement mode: where data rows start in the template, e.g. `B5`. Refused without a template (TQL-YAML-1041), and refused on pdf (TQL-YAML-1005) — a page lays out through its template, not through cell positions.
`columns`	array of fileColumn	The columns written, in order, with their headings and format patterns. Omit it to write every column the rows carry, under its own name.
`locale`	string	The locale date and number patterns render in. A literal, or a request source such as `principal.claim.locale`, so the requesting user decides; unset, `tesseraql.files.locale` applies. A job has no request, so a step’s is a literal.
`timezone`	string	The zone date and time values render in, with the same literal / request-source / `tesseraql.files.timezone` fallback as `locale`.
`after`	object	A statement run once after the extraction, typically to mark the extracted rows. `file-export` only: on `query-export` it is a build error (TQL-CAMEL-3101), because a synchronous download has no transaction to hang it on.
`maxRows`	integer	The ceiling for a format that holds every row before it writes (pdf, and the workbook template modes), defaulting to `tesseraql.resultMaterialization.maxRows`; a negative value opts out. A streaming format is never capped.
`onOverflow`	string	`fail` (default) refuses an export past `maxRows` (TQL-LD-2850); `warn` truncates it at the cap and logs.
`groupBy`	string	A column the rows are read as ordered groups by, each exposed to the template as a `key` and its own `rows`. The rows must be ordered by it (TQL-LD-2851).
`splitBy`	string	A column that splits the export into one document per value, delivered as a single ZIP; `filename:` must carry `{key}`. The rows must be ordered by it (TQL-LD-2851).

pipeline.export.after

Property	Type	Description
`timing`	string	`extract` (default) runs the statement in the extraction’s transaction, so rows are marked exactly when they are extracted; `download` runs it once on the first successful file fetch. A job’s export step supports `extract` only (TQL-YAML-1041).
`sql`	object	The follow-up statement, written as a source’s `sql:` arm is — `file:`, `params:`, and the rest of the arm’s keys.

import

Property	Type	Description
`format`	string	The tabular format the uploaded file is parsed as. `csv` is built in; `excel` needs the tesseraql-excel module (TQL-LD-2801 when the codec is absent).
`columns`	array of fileColumn	How the file’s columns map to the per-row statement’s bind names. Omit it to use the header labels as bind names.
`headerRow`	boolean	Whether the table starts with a header row (default `true`). With a header, simple-form columns match by label rather than by position.
`startRow`	integer ≥ 1	The 1-based row the table starts at, for files carrying title rows above the data (default 1).
`sheet`	string	For workbook formats, the sheet to read (default: the first).
`locale`	string	The locale `type:`/`format:` columns parse dates and numbers in. A literal, or a request source such as `principal.claim.locale`; unset, `tesseraql.files.locale` applies.
`onError`	string	What a failing row does: `rollback` (default) fails the whole import, `skip` records the row and commits the rest. Either way the rejected rows are reported with their row numbers.
`review`	enum: `required`	`required` splits the import in two (docs/csv-import.md): the upload parses, validates and parks the batch without writing anything, answering a report and a confirm token, and a second request commits exactly what was reviewed. Absent means the one-shot import. Only a route may declare it — a poll-driven import job has nobody to confirm (TQL-YAML-1060).

sla

Deadline expectations a periodic managed check alerts on through the alerts channel (kind: job) - alert-only, nothing is killed. Documented in jobs.md.

Property	Type	Description
`completeBy`	string	Wall-clock time (HH:mm) by which a day’s run must have completed for that business date.
`runningLongerThan`	string	A duration (e.g. 2h) beyond which a still-running execution raises the alert.

View documents

Schema for TesseraQL declarative view documents (.view.yml): what a route renders through the framework’s tql/view/ patterns instead of a hand-written template. Documented in declarative-views.md.

Property	Type	Description
`version` *	const `tesseraql/v1`	The document format version. Always `tesseraql/v1`.
`id` *	string, min length 1	Unique document id, e.g. products.page; referenced by tests, coverage, governance approvals, and logs.
`kind` *	const `view`	Declarative view documents (the *.view.yml convention).
`recipe`	enum: `list` \| `form` \| `detail` \| `dashboard` \| `import`	Which view this document is: list \| form \| detail \| dashboard \| import. A form derives its fields from the action: route’s input: block; a dashboard composes panels:; an import renders the upload form, the validation report and the confirm form of its action: file-import route.
`title`	string	The heading this view renders. A message key resolves through the app bundles; anything else renders literally.
`template`	string	The pattern override this view renders through instead of its bundled `tql/view/*` pattern (customization ladder L2). Resolved beside the view document, then under the app template root. Documented in declarative-views.md.
`action`	string	The id of the command route a form view submits to; its `input:` block is where the form’s fields come from.
`source`	string	The model key a view reads its rows from - a name in the route’s `sources:`, whatever arm it declares, defaulting to `main`.
`search`	string	The route input a list view binds its search box to; it must be declared on the route.
`fields`	array of any	The fields a form or detail view renders, in order. Documented in declarative-views.md.
`columns`	array of any	The columns a list view renders, in order. Documented in declarative-views.md.
`children`	object	Views embedded inside this one, keyed by the slot each fills. Documented in declarative-views.md.
`panels`	array of any	The panels a dashboard view composes, in order. Documented in declarative-views.md.
`slots`	map of string	Named regions this view exposes for a composing parent to fill. Documented in declarative-views.md.
`refreshOn`	string	Refetch this view’s refresh region whenever a command emits this topic (docs/realtime.md). List, detail and dashboard views only - not forms.
`workflow`	string	The workflow whose transitions region and lifecycle stepper this page renders (docs/workflow-surface.md): the server shows only the transitions legal for this user on the row’s current state. Detail views only; the id must name a declared kind: workflow document.
`key`	any	The result columns that identify one row (docs/declarative-views.md): a column name, or an ordered list for a composite key. Rows gain a stable anchor and an opaque row token; every key column must be present and non-null in each row. List views only.
`filters`	array of any	The grid page’s declared filters (docs/declarative-views.md): route inputs rendered as condition chips and a filter dialog. Each entry is an input name, or a name/label mapping. List views only.
`presets`	array of object	Named view presets (docs/declarative-views.md): contract-declared param sets the grid page renders as real links - the active one is marked, re-clicking it resets, and no storage is involved. List views only.
`actions`	array of object	Bulk actions over the grid page’s row selection (docs/declarative-views.md): declaring any renders the selection column and bar. Requires key:; list views only.

presets

Property	Type	Description
`name` *	string	The link’s label; a message key resolves through the catalog.
`params` *	map of	The query state the link applies - declared route inputs plus the framework sort/dir/size params.

actions

Property	Type	Description
`label` *	string	The button’s label; a message key resolves through the catalog.
`action` *	string	The POST route the selection submits the checked rows’ tokens to (repeated ids fields).
`confirm`	string	A confirmation prompt gating the action (the kit’s confirm dialog).

Shared definitions

enrichment

One keyed reference folded into a binding’s rows: where the keys are (on:), what answers them (sql:, http: or source: — exactly one), and how the answer lands (as: or merge:). Documented in lookups.md.

Property	Type	Description
`on`	map of string	The join: each column of the rows being enriched to the column of the reference it matches. Several pairs make a composite key, compared by the framework’s canonical normalization (INTEGER 1 matches BIGINT 1).
`sql`	object	Fetch the reference by key, written as a source’s `sql:` arm is. The statement must bind `keys` — one that never mentions it reads the whole table once per batch and still returns the right answer, which is why only the build can catch it (TQL-YAML-1048).
`http`	object	Call the reference by key, written as a source’s `http:` arm is, plus `select:` and `onError:`. How the keys reach it is `mode:`.
`source`	string	A result already in the context, joined without a fetch, named by its context path: a route source by name, a job step as `steps.<id>`. A spooled sibling is refused (TQL-CAMEL-3114) — load it into a table and enrich from there.
`mode`	string	For an `http:` reference: `perRow` (default) makes one request per distinct key, `batch` one request per `batchSize` keys. A `sql:` reference is always batched — a statement takes a key list by construction.
`as`	string	Attach the matched rows as a list under this name. Exactly one of `as:` or `merge:` (TQL-YAML-1047).
`merge`	array of string	Copy these columns of the matched row onto each row instead of attaching a list. Exactly one of `as:` or `merge:` (TQL-YAML-1047).
`batchSize`	integer ≥ 1	How many distinct keys one fetch carries.
`maxKeys`	integer ≥ 1	The ceiling on distinct keys collected for one enrichment, past which the reference is refused rather than read unboundedly.

notification

One notification enqueued on the transactional outbox, so it is sent if and only if the write commits. Documented in notifications.md.

Property	Type	Description
`channel`	string	The declared channel this notification is enqueued on, which decides the transport (mail, webhook, queue) and its configuration. It must exist (TQL-FIELD-2004).
`when`	string	A core expression over the result context; the notification is enqueued only when it holds, so a conditional send is a declaration rather than a branch.
`recipient`	string	A bindable path resolving to the address this notification goes to, overriding the channel’s configured recipients.
`attach`	string	A bindable path resolving to a transfer id — typically an export step’s `steps.<id>.transferId` — whose file rides along. Mail channels only (TQL-FIELD-2004).
`payload`	map of string	Each payload key to the bindable path supplying its value; the template or transport reads them by name.
`delay`	string	Hold this entry back this long after the commit, e.g. `72h`. Exclusive with deliverAt: (TQL-BATCH-5317). Documented in notifications.md.
`deliverAt`	string	Hold this entry back until the instant this bindable path resolves to. Exclusive with delay: (TQL-BATCH-5317). Documented in notifications.md.
`cancelKey`	string	A bindable path whose value this entry is filed under, so a later command can withdraw it while it is still undelivered. Documented in notifications.md.
`cancel`	string	A bindable path naming the cancelKey to withdraw: this block withdraws undelivered entries instead of writing one, in the withdrawing command’s own transaction. Declared instead of channel:, never beside it.

push

Delivery of a produced transfer to a local or remote drop — the outbound mirror of the poll trigger, under the same policy block. Documented in file-transfers.md.

Property	Type	Description
`transport`	string	Where the file goes: `local` writes under the work directory, `sftp`/`ftps` reach an allow-listed remote host.
`host`	string	The remote server, which must be allow-listed under `tesseraql.connectors.push.hosts`. Required on a remote transport (TQL-YAML-1042).
`port`	integer ≥ 1	The remote port, defaulting to the transport’s.
`path`	string	The destination directory. The file is staged and renamed into place, so a poller on the far side never reads a partial file.
`credential`	string	The named credential under `tesseraql.connectors.push.credentials`. Required on a remote transport (TQL-YAML-1042).
`file`	string	A bindable path resolving to the transfer id of the file to deliver, typically an earlier export step’s `steps.<id>.transferId`.
`as`	string	The name the file lands under, defaulting to the transfer’s own filename. `{dotted.path}` interpolates a context value.

chunk

Restartable per-row processing: a reader, a writer, and committed checkpoints, so a job that stops resumes where it left off instead of starting over. Documented in jobs.md.

Property	Type	Description
`reader`	binding	What the loop reads, a window at a time: its own `sql:`, or `spool:` naming an earlier step’s spool. A chunk step’s work is its reader and writer, so the step declares no arm of its own (TQL-FIELD-2004).
`writer`	binding	What runs for each row the reader produced, binding that row’s columns.
`key`	string	The reader column checkpoints track, defaulting to `id`. A restart resumes after the last committed key, which is why the reader must be ordered by it.
`commitEvery`	integer ≥ 1	How many rows one committed slice holds. A checkpoint lands with each commit, so this is also how much a restart repeats.
`onError`	string	`fail` (default) fails the step on the first writer error; `skip` records the row in `tql_job_skips` and continues, up to `skipLimit`.
`skipLimit`	integer ≥ 0	How many skipped rows the step tolerates before failing anyway, so a systematically broken load does not run to completion looking fine.
`enrich`	map of enrichment	Keyed references folded into each window before the writer sees it, so a writer may bind a column the reader’s query never selected. A reference failure fails the window, not the row.
`batch`	boolean	`true` executes the writer in JDBC batches of `commitEvery` rows — one round trip per committed slice instead of one per row. Requires the default `onError: fail`: a batch cannot attribute a member failure to one row, so a failure fails the chunk, which reruns from its last checkpoint. Documented in jobs.md.

fileColumn

One column of a file transfer, in either form: the bare name, or an object adding the file-side heading, an explicit position, and a type with its pattern. Documented in file-transfers.md.

Property	Type	Description
`name`	string	The bind name on import, the row column on export. The simple form `- name` is this key and nothing else.
`label`	string	The heading in the file — the same word a view column uses, and a message key resolves through the app bundles. Defaults to `name`.
`column`	string	An explicit position instead of matching by header: a column letter (`D`) or a 1-based number.
`type`	string	Parses the file’s text into a typed bind on import, and writes a typed cell on export. Omit it for plain text.
`format`	string	The parse/render pattern the `type:` uses, e.g. `yyyy/MM/dd` or `#,##0.00` — and, for workbooks, the matching cell format.

inputField

Property	Type	Description
`domain`	string	Name of a field domain declared under domains/; its type, bounds, pattern, format, enum, classification and mask merge in, and the keys declared here win. Operational keys (required, requiredWhen, default, writable) stay route-local.
`description`	string	What this field is, in the words a caller reads. A wire field on both MCP surfaces derived from input: an mcp/ prompt’s argument carries it in prompts/list, and an mcp/ tool’s inputSchema carries it as the JSON Schema description a model follows. Declarable on a domain, and inherited from one.
`type`	enum: `string` \| `integer` \| `number` \| `boolean` \| `date` \| `array` \| `sort`	The declared type. A supplied value is coerced to it and refused when it does not fit. `sort` is an ordered sort set (`-ship,order` - a leading `-` for descending) validated against `columns:`; the bound `params.<name>Sql` sibling carries the safe ORDER BY fragment.
`required`	boolean	Refuse the request when this field is absent.
`default`	any	The value bound when the request omits the field.
`min`	number	Smallest accepted numeric value.
`max`	number	Largest accepted numeric value.
`maxLength`	integer ≥ 0	Longest accepted string, in characters.
`minLength`	integer ≥ 0	Shortest accepted string, in characters.
`pattern`	string	Anchored regular expression (TQL-YAML-1012 when it does not compile).
`columns`	array of string	The sortable-column allowlist a `type: sort` input validates its keys against; required for that type and legal on no other.
`format`	string	string: email\|uuid\|url; date/number: a parse pattern.
`requiredWhen`	string	A core expression over params./path./body. (TQL-YAML-1014).
`enum`	array of string	The accepted values; anything else is refused.
`writable`	boolean	`false` makes the field read-only: it renders in a derived form but is never bound from the request.
`classification`	string	Data classification label carried into masking and audit. Documented in data-scoping.md.
`mask`	string	The masking rule applied when the principal may not see the value.
`widget`	enum: `text` \| `textarea` \| `number` \| `date` \| `datetime-local` \| `checkbox` \| `select` \| `hidden` \| `lookup`	Presentation hint (docs/declarative-views.md): the form widget this field renders as, declared once on a domain; a per-view fields: override wins. Never part of the HTTP contract.
`codes`	string	The code catalog this field’s values come from (docs/lookups.md): the binder accepts only that catalog’s active codes, and the violation is the enum field error. Declared on a domain, so the value set has one home instead of an enum that drifts from the master.
`lookup`	object	The master reference this field holds a key of (docs/reference-lookup.md): direct code entry resolved through a synthesized companion route, existence-checked again at submit. Declarable on a domain, like codes:.
`policy`	string	Write authorization (docs/declarative-views.md): a security policy the principal must satisfy to supply this field; a failing principal’s value follows the route’s readOnly behavior, and the derived form omits the field. Operational — never accepted inside a domain.
`items`	object	Element constraints for `type: array`: `type:`/`enum:` for scalar elements, `fields:` for object elements.

inputField.lookup

The master reference this field holds a key of (docs/reference-lookup.md): direct code entry resolved through a synthesized companion route, existence-checked again at submit. Declarable on a domain, like codes:.

Property	Type	Description
`source` *	string	URL path of the GET query route that searches the master — an ordinary route with its own security: and SQL, resolved the way a form’s action: is. Its rows must carry this field’s column (the id), code: and label:.
`code` *	string	The row column holding the code users type — the visible half of the field; the hidden id is what submits.
`label` *	string	The row column holding the display name the field’s hint shows. Presentation only, never submitted.

inputField.items

Element constraints for type: array: type:/enum: for scalar elements, fields: for object elements.

Property	Type	Description
`type`	string	The element type, for an array of scalars. Mutually exclusive with fields: (TQL-YAML-1027).
`enum`	array of string	The accepted element values; anything else is refused.
`fields`	map of inputField	The element’s own fields, for an array of objects — the header-plus-lines shape a business form submits. Elements bind, coerce and validate exactly as top-level fields do, and a violation addresses itself by index (`lines[2].qty`). One level deep: an array inside an element is refused (TQL-YAML-1027). Documented in declarative-validation.md.

fieldPolicy

Property	Type	Description
`visible`	boolean	`false` removes the field from the response entirely, for every caller.
`policy`	string	The security policy a principal must satisfy to see the value unmasked.
`mask`	string	The masking rule applied when the policy is not satisfied, such as showing only the last four characters.
`classification`	string	Data classification label carried into audit. Documented in data-scoping.md.
`unmaskWhen`	string	An expression that, when it matches, reveals the value despite the mask.

statusWhen

Property	Type	Description
`when` *	string	A whitelist-only expression over the execution context; the first matching entry wins.
`status` *	integer ≥ 100 ≤ 599	The HTTP status to answer when the expression is truthy.

binding

One acquisition or one statement. Exactly one mechanism arm names the means — sql (a colocated 2-way SQL file), contract (a named identity contract), service (a runtime provider), http (an outbound call) — or the write-side sequence, and that arm nests the keys the mechanism owns. Beside the arms sit the three questions no mechanism answers: the when: guard, the enrich: folded into the rows, and the spool: another step filled. Documented in unified-sources.md.

Property	Type	Description
`sql`	object	The SQL arm: a colocated 2-way SQL file and how it is run. The keys of the mechanism nest inside the arm that owns them, so there is nowhere to write a call’s `select:` on a statement and no lint has to say it is wrong.
`contract`	object	The contract arm: a statement the identity schema owns, called by name. It reads or writes like any other statement, so it carries the same `mode`, `params` and `expect`.
`service`	object	The service arm: a runtime provider answering rows from process state. It takes only its arguments — there is no statement to run, so no mode and no row-count expectation.
`http`	object	The http arm: an outbound call whose response becomes this binding’s rows, in the vocabulary every outbound call shares. Rides the outbound gateway — allow-listed hosts, named credentials, timeouts, and a per-host circuit breaker.
`sequence`	string	Allocate the next value of a managed document-number sequence instead of running a statement; it binds as `steps.<id>.value`. It has no body beyond its name, which is why it sits beside the arms rather than being one. Documented in transactional-writes.md.
`spool`	string	A context path resolving to an earlier step’s spool reference (`steps.<id>.spool`), read as this binding’s rows. A chunk reader declares it instead of `sql:` to load what another step extracted — from another connector, or from an API — because a spool is a spool whoever filled it. Documented in jobs.md.
`when`	string	Guard expression on a step: a falsy guard skips it, recording `steps.<id>.skipped` instead of a result. A guard is about whether the step runs at all, not a question for the mechanism, so it sits beside the arm. The declared branch point for decision.* outputs (docs decision-tables).
`enrich`	map of enrichment	Keyed references folded into this binding’s rows before anything reads them (docs/lookups.md), keyed by enrichment name and applied in authored order. An enrichment nests under the source it transforms, so any arm’s rows can be enriched. Each entry names one reference — sql: (fetch by key), http: (call by key), or source: (a result already in the context, joined without a fetch, named by its context path: a route source by name, a job step as steps.<id>) — plus the on: join and one of as:/merge:. Only a binding that holds rows can carry one: a write publishes affectedRows, and a query-spool extract never held its rows.

binding.sql

Property	Type	Description
`file`	string	A colocated 2-way SQL file, relative to the declaring document (must exist; TQL-SQL-2103). This arm’s acquisition target, the role `url` plays for `http`.
`mode`	string	How the statement runs and what it binds: `query` (rows), `query-one` (a single row), `update` (an affected-row count), `query-spool` (rows streamed to a spool a later chunk: step reads, never held), or `call` (a stored call on a command step, its OUT parameters declared under `out:`).
`params`	map of string	Each bind name to the bindable path supplying its value, such as `path.id`, `params.unit` or `principal.claim.tenant_id`.
`keys`	array of string	Columns whose database-generated values are captured after an insert; they bind as `steps.<id>.keys.<column>`.
`out`	map of string	The OUT parameters of a `mode: call` statement on a command step: each name to its JDBC type keyword (varchar, numeric, integer, bigint, boolean, date, timestamp, double). The statement binds them as `out.<name>` bind sites and the values publish as `steps.<id>.out.<name>`. Documented in transactional-writes.md.
`timeoutSeconds`	integer ≥ 0	Per-binding SQL statement timeout override; 0 disables. Default: tesseraql.sql.timeoutSeconds, else 30s.
`datasource`	string	The named connector this read runs on, overriding the document’s. Legal on a read only: a batch step owns its own transaction so an extract elsewhere splits nothing, while a write on another connector would be a second transaction nothing owns (TQL-YAML-1037).
`materialize`	object	Bounds on how much of the result is held in memory.
`expect`	object	The row count this statement must affect, and what happens when it does not — the declarative optimistic-locking check on an update or delete.

binding.sql.materialize

Bounds on how much of the result is held in memory.

Property	Type	Description
`maxRows`	integer	Largest number of rows materialized. Default: `tesseraql.resultMaterialization.maxRows`.
`onOverflow`	string	`fail` (the default) refuses a result past `maxRows`; `warn` truncates it and logs.

binding.sql.expect

The row count this statement must affect, and what happens when it does not — the declarative optimistic-locking check on an update or delete.

Property	Type	Description
`rowCount`	integer	The exact number of rows the statement must affect (rows is a list of records everywhere else).
`onMismatch`	string	`conflict` (the default) answers 409, so a stale edit is refused honestly; `error` answers 500.

binding.contract

The contract arm: a statement the identity schema owns, called by name. It reads or writes like any other statement, so it carries the same mode, params and expect.

Property	Type	Description
`name`	string	The named IAM SQL contract to execute instead of a colocated file, so an app reuses the identity schema’s statements. Documented in authentication.md.
`mode`	string	How the contract runs and what it binds, exactly as it means on the `sql` arm.
`params`	map of string	Each bind name to the bindable path supplying its value, such as `path.id`, `params.unit` or `principal.claim.tenant_id`.
`expect`	object	The row count this statement must affect, and what happens when it does not — the declarative optimistic-locking check on an update or delete.
`materialize`	object	Bounds on how much of the result is held in memory. Declared here so a contract that legitimately returns more than the app-wide budget says so on the binding, rather than an application raising the budget for every route, command and export at once.
`timeoutSeconds`	integer ≥ 0	Per-binding SQL statement timeout override; 0 disables. Default: tesseraql.sql.timeoutSeconds, else 30s.

binding.contract.expect

The row count this statement must affect, and what happens when it does not — the declarative optimistic-locking check on an update or delete.

Property	Type	Description
`rowCount`	integer	The exact number of rows the statement must affect (rows is a list of records everywhere else).
`onMismatch`	string	`conflict` (the default) answers 409, so a stale edit is refused honestly; `error` answers 500.

binding.contract.materialize

Property	Type	Description
`maxRows`	integer	Largest number of rows materialized. Default: `tesseraql.resultMaterialization.maxRows`.
`onOverflow`	string	`fail` (the default) refuses a result past `maxRows`; `warn` truncates it and logs.

binding.service

The service arm: a runtime provider answering rows from process state. It takes only its arguments — there is no statement to run, so no mode and no row-count expectation.

Property	Type	Description
`name`	string	The named runtime service provider to call instead of running SQL (docs/extending.md): non-SQL runtime state (lanes, traces, file trees, …) read as rows.
`params`	map of string	Each bind name to the bindable path supplying its value, such as `path.id`, `params.unit` or `principal.claim.tenant_id`.

binding.http

Property	Type	Description
`method`	string	The HTTP method. Default GET; a source is not restricted to GET, because JSON-RPC, GraphQL and `POST …/search` batch lookups are reads.
`url`	string	The absolute http/https URL. Its host must be allow-listed under tesseraql.http.outbound.allowedHosts — egress is deny by default (TQL-SEC-4070).
`headers`	map of string	Static request headers; values may carry ${…} config or secret placeholders, resolved on send.
`query`	map of string	Query-string parameters, each a bindable path resolved against the execution context.
`credential`	string	A named credential the SecretResolver supplies at call time, so a document never carries a secret.
`body`	string	A bindable path whose value is serialized as the request body.
`expectStatus`	integer	The exact status that counts as success; the default is any 2xx. A mismatch fails the call without tripping the circuit breaker — it is a deterministic rejection, not a sign the dependency is down.
`connectTimeout`	string	Connect timeout for this call (e.g. 2s), overriding tesseraql.http.outbound.connectTimeout.
`requestTimeout`	string	Request timeout for this call (e.g. 10s), overriding tesseraql.http.outbound.requestTimeout.
`retry`	object	Opt-in retry for transient faults: connect failures, timeouts and 5xx are repeated; a 4xx and an expectStatus mismatch never are. Unstated numbers come from tesseraql.http.outbound.retry. Every repeated attempt counts against the circuit breaker, the sequence ends the moment the host’s circuit opens, and it lives inside a budget of attempts x requestTimeout. Documented in connectors.md.
`select`	string	A dotted path into the response JSON naming the part that becomes rows. Default: the whole body.
`onError`	string	`fail` (default) fails the request or step; `empty` degrades to zero rows and an `error` entry, and the page still renders. The degradation is logged and metered — it is not silent.
`readOnly`	boolean	The author’s assertion that the call has no side effect, required on a command route: the write can roll back and the request cannot.
`mode`	string	How the acquired rows are delivered: `query` (default — held and published as rows) or `query-spool` (streamed to a spool a later chunk: step loads, so an API result can be written to the database without holding it). A call reads, so the SQL write modes are not modes it has.

binding.http.retry

Property	Type	Description
`attempts`	integer ≥ 1 ≤ 10	Total attempts including the first (TQL-YAML-1058 outside 1..10).
`backoff`	string	The wait before the second attempt, e.g. 200ms.
`multiplier`	number ≥ 1	The factor the wait grows by before each further attempt.

Property	Type	Description
`version` *	const `tesseraql/v1`	The DSL version. Always tesseraql/v1.
`domains`	map of inputField	Named field domains. A route’s input field references one with ‘domain: ’ and may override any individual key locally.
`constraints`	map of object	Database constraint names mapped once for the whole app, so a violation of a shared unique index reports the same field, code and message on every route that can raise it.

Property	Type	Description
`rule`	string	Cross-field expression. Exactly one of rule: or file:.
`file`	string	Validation SQL, resolved relative to this document. Exactly one of rule: or file:.
`binds`	map of string	The typed bind contract a reference’s params: must satisfy exactly - bind name to declared type, checked against the referencing route’s input types at load. Ambient binds (principal., audit.) are supplied by the framework and never listed here.
`code`	string	Default stable rule code, overridable at the reference.
`message`	string	Default message key, overridable at the reference.

Property	Type	Description
`inputs` *	map of object	Typed inputs by name; each row cell constrains one of these.
`outputs` *	map of object	Typed outputs by name; every row sets all of them.
`hitPolicy`	enum: `first` \| `unique`	first (default): authored order resolves. unique: more than one conditional match is an error, and overlapping rows fail the build.
`onMiss`	enum: `error` \| `default`	error (default): a lookup no row matches raises TQL-DECISION-4721. default: the trailing row without when: answers.
`source`	object	The app-owned table carrying the rows (exactly one of rows:/source:): business users maintain them at runtime, and the decision evaluates as one generated SELECT in the operation’s transaction. A NULL cell in any mapped column is the wildcard.
`default`	object	The outputs answering a miss of a table-backed decision. A YAML-backed decision declares its default as a trailing row without when: instead.
`rows`	array of object	The authored rows, resolved in order. A row is the conjunction of its when: cells (absent cell = wildcard); a trailing row without when: is the default.

Property	Type	Description
`type`	string	Inline type of the input.
`domain`	string	Field domain reference declaring the input’s type.
`match`	enum: `eq` \| `between` \| `in` \| `bool` \| `subtree`	How row cells compare against this input: eq (default, equality; empty cell = wildcard), between (inclusive range), in (membership in a small fixed set), bool, subtree (the bound org unit is in the cell’s subtree; table sources only, resolved through the managed org closure).

Property	Type	Description
`type`	string	Inline type of the output.
`domain`	string	Field domain reference declaring the output’s type.
`enum`	array of any	The output’s full value space, enabling consumption-side exhaustiveness lints.

Property	Type	Description
`table` *	string	The rule table.
`keyColumn`	string	The rule table’s key column joining set: child tables. Default id.
`match` *	map of object	Column realization per input (all but in): exactly one shape per entry.
`set`	map of object	Child-table realization of each in input: no child rows = wildcard, membership otherwise.
`priority`	string	The resolution-order column; required for hitPolicy: first.
`effective`	array of string	Optional dated-row window: the [from, to] column pair matched against the reference’s effectiveAt: (default audit.now).
`outputs` *	map of string	Output name to column.

Property	Type	Description
`eq`	string	One nullable column for an eq/bool input.
`between`	array of string	The nullable [min, max] column pair of a between input.
`subtree`	string	The nullable unit-id column of an subtree input, matched through the managed org closure.

Property	Type	Description
`table` *	string	The child table.
`key` *	string	The child column referencing the rule row’s id.
`value` *	string	The child column carrying one member per row.

Property	Type	Description
`when`	object	Cells by input name: a scalar (eq/bool), a range (‘>= 10000’, ‘5..10’, a number), or a list (in).
`outputs` *	object	The outputs this row sets — exactly the declared outputs.

YAML surface reference

Route documents

inputPolicy

security

idempotency

admission

admission.concurrency

admission.rateLimit

outbox

steps

steps.sql

steps.sql.materialize

steps.sql.expect

steps.contract

steps.contract.expect

steps.contract.materialize

steps.service

steps.http

steps.http.retry

validate

decide

errors

errors.constraints

import

export

export.after

webhook

publish

consume

response

response.json

response.html

response.stream

response.redirect

response.file

response.text

response.onError

response.session

pagination

cache

Job documents

trigger

trigger.schedule

trigger.poll

pipeline

pipeline.sql

pipeline.sql.materialize

pipeline.sql.expect

pipeline.contract

pipeline.contract.expect

pipeline.contract.materialize

pipeline.service

pipeline.http

pipeline.http.retry

pipeline.export

pipeline.export.after

import

sla

View documents

presets

actions

Other document kinds

domains

domains.constraints

rules

rules.rules

decisions

decisions.decisions

decisions.decisions.inputs

decisions.decisions.outputs

decisions.decisions.source

decisions.decisions.source.match

decisions.decisions.source.set

decisions.decisions.rows

Shared definitions

enrichment

notification

push

chunk

fileColumn