slate

slate:zstd

2026-09-06T00:36:22.158815252Z

`slate:zstd`

Zstandard — the encoding for a hot path, and for a protocol whose two ends are both yours.

import { zstd, unzstd } from slate:zstd

val page = toBytes(repeat("<p>hello</p>", 40))
val small = zstd(page, 3)                   // the level: 1 fast, 3 the default, 19 for storage
val back = unzstd(small, 1 << 20)           // the limit is not optional

print(len(small) < len(page))
print(back.ok, fromBytes(back.value).value == fromBytes(page).value)
print(unzstd(toBytes("not zstd"), 1 << 20).ok)

true
true true
false

Why it is here beside brotli and gzip

It fills the gap between them. slate:brotli at quality 5 is the slow end of what a request handler can afford; deflate is the fast end and compresses worse than either. zstd at level 3 is several times faster than deflate and compresses better than it, and at 19 it is in brotli’s range — so it is the first encoding worth reaching for on a response being built now, and the obvious one for a build cache, a log, or a wire format where both ends are yours.

The names are the format’s own verbs

zstd and unzstd, not compress and decompress. Those two are slate:brotli‘s, and every built-in module’s names are declared into one scope — so two modules cannot own a word. slate:gzip settled this first with gzip, gunzip, deflate and inflate, and these are what the command line calls them.

The two channels

zstd faults — it cannot fail on input the program already holds. unzstd answers a result, because what is being decompressed came from somewhere else: a request body that is not a zstd frame is an ordinary thing to be sent and a 400 to answer, not a defect in the program reading it.

The three failures are three sentences, since they mean three different things to whoever sent the bytes: expands past the N bytes it was allowed, ends in the middle, is not a zstd frame.

The limit is required

A zstd frame is entitled to say nothing about how large it becomes, and where its header does carry a size that number is the frame’s claim rather than a fact. So there is no form of unzstd that omits the limit.

The level is written at every call

There is no default, for slate:brotli‘s reason: it is the one number a caller has to think about, and no single value is right often enough to be the quiet one. The scale runs from libzstd’s own minimum to 22 and is not linear — negative levels are a regime of their own that skips most of the match search, 1 to 3 are for anything on a hot path, 9 is a good compress-once setting, and 19 to 22 want real memory at the writing end.

A frame carries a checksum, which is what tells a damaged stream from one that was never zstd.

Both hosts have it, and a browser does not

node has carried Zstandard in zlib since 22.15, so this module is native under slate js as well as here — and the compressed bytes are not compared between the two, node linking its own copy of libzstd and the interpreter linking the machine’s. Two encoders at one level may frame the same input differently and both be right; what is checked is the round trip and what each makes of the other’s frames.

One difference is documented rather than papered over. node’s decompressor answers nothing about a frame that ends in the middle — an empty buffer and no error, where libzstd’s one-shot call says srcSize_wrong — so the JavaScript back end reads the frame header and measures what came back against what it claimed. A frame that declared no size is the one case it cannot check, and there the two back ends read a truncation differently: this one answers what it managed and the interpreter refuses. Every frame zstd writes declares its size, so this is about frames from somewhere else.

No browser has zstd — CompressionStream takes gzip, deflate and deflate-raw, and no engine has proposed a fourth — so both names refuse there naming zstd, exactly as slate:brotli does.

slate:http writes Content-Encoding: zstd for a client that asks for it, in preference to brotli, with nothing asked of the handler; that page says what the rules are.

slate:ws

2026-09-06T00:36:22.158815252Z

`slate:ws`

WebSockets, written in slate over the slate:http upgrade seam.

import { serve } from slate:http
import { accept } from slate:ws

serve(port, handler, (req, socket, head) ->
    val ws = accept(req, socket, head).value

    ws.onMessage((m) -> ws.send("echo:" + m)))


`open(url)`	a promise of a result holding the connection — the client
`accept(req, socket, head)`	a result holding the connection — the server
`accepting(req)`	whether this request is a WebSocket handshake
`framed(payload, opcode)`	a frame a server writes, for a program doing its own writing
`maskedFrame(payload, opcode)`	the same frame a client writes, which is masked
`unframed(bytes)`	the other direction

`open(url)` — the client

import { open } from slate:ws

async main()
    val made = await open("wss://example.com/socket")

    if !made.ok then return print(made.error)

    val c = made.value

    c.onMessage((m) -> print("said", m))
    c.onClose((code, why) -> print("gone", code))
    c.send("hello")

main()

A promise of a result and not a promise that fails, which is connect‘s shape in slate:net: a server that is not there is a condition a client was always going to deal with. ws:// and wss:// are the only two schemes, and a url that is not one is refused in the same sentence wherever the program runs.

The connection is the same object accept answers — onMessage, onBinary, onClose, send, sendBytes, ping, close — so a program that speaks WebSocket does not know which end it is.

A client masks every frame it sends and a server masks none, which is RFC 6455’s rule and not an implementation detail: masking exists so that a hostile page cannot steer an intermediary into reading payload bytes as a request of its own, and only the browser’s direction has that problem. Each end fails the connection when the other gets it wrong.

Under slate js the client is the HOST’s. A browser has no socket at all, so the framing here has nothing to write onto and the work goes to the WebSocket object the page already has; the JavaScript page says what that changes. The one visible difference is ping, which refuses there: a browser writes the protocol’s control frames itself and gives a page no way to.

The upgrade seam

serve takes a third function, and so does serveStream. A request that says Connection: upgrade reaches it with (req, conn, leftover).

The leftover bytes matter. A client may put its first frame in the same packet as the handshake, and those bytes are already off the socket — so they are handed to accept, which seeds the connection’s buffer with them.

A server with no upgrade function answers 501 rather than going quiet. The client asked for a protocol this program does not speak, which it can act on; a socket nothing will ever answer is not.

What is in the module

The framing, the masking, the fragment reassembly and base64 are all slate. &, |, ^, << and >> are slate’s own on 64-bit integers, and toBytes/fromBytes are the byte surface.

SHA-1 is the one thing reached for, from slate:crypto. This is not a use of SHA-1 that its weakness touches: nothing is signed, and the protocol wants a value only the other end could have computed.

Values

2026-09-06T00:36:22.158815252Z

Values

slate is dynamically typed. Every value is one of a fixed set of kinds, and a program can ask which.

The kinds

kind	written	notes
`null`	`null`	the only absence there is
`boolean`	`true`, `false`
`integer`	`42`, `0xff`	64 bits, signed, wraps
`real`	`3.14`, `2e10`	a double
`string`	`"text"`	a sequence of characters, never of bytes
`array`	`[1, 2]`	reference type, compares by contents
`object`	`{ a: 1 }`	reference type, compares by contents
`function`	`x -> x`, a definition
promise	answered by an `async` call	see Asynchrony

Eight more scalar kinds come with slate:time — instant, duration, date, time, dateTime, zone, zoned, period — and a compiled pattern comes with slate:regex. Each has a type word that tests for it in pattern position.

number is not a kind. It is the union of integer and real, and exists because the two are separate values: a guard about arithmetic would otherwise have to be written twice.

Truth

Only false and null are false. Zero, the empty string and the empty array are all true.

print(if 0 then "true" else "false")
print(if "" then "true" else "false")
print(if [] then "true" else "false")

true
true
true

Equality

== compares by value, all the way down. Two arrays holding the same elements are equal; two objects holding the same fields are equal.

print([1, 2] == [1, 2], { a: 1 } == { a: 1 })

true true

An integer and a real compare across the kinds, so 1 == 1.0 is true — but 1 is integer and 1.0 is integer still differ, the two being distinct values that happen to compare equal.

A function is equal to itself. f == f is true, and two separately written lambdas with the same body are not equal.

A class may take == over for its own instances by writing equals, and must write hash beside it if those instances are to be used as table keys. <, <=, > and >= are one hook, compare — see Objects.

Numbers

An integer is 64 bits and wraps; it does not promote to a real and does not become a big integer.

print(9223372036854775807 + 1)
print(1 << 40)

-9223372036854775808
1099511627776

/ between two integers divides towards zero and answers an integer; % takes the sign of the left operand. Where either operand is a real the answer is a real.

print(7 / 2, 7.0 / 2, -7 / 2)

3 3.5 -3

A real that is whole prints as an integer does. string(1.0) is "1". Only %, indexing, or a kind test can tell the two apart, so a function that must answer an integer is worth annotating.

Strings

A slate string is a sequence of characters, so every position, length and slice is counted the way a person counts:

print(len("日本語"))
print("日本語"[0..<1])
print("héllo"[1])
print(indexOf("héllo", "llo"))      // by character; it is 3 by byte

3
日
é
2

There is no character type: a single character is a string of one. That is what lets indexing, chars and split all hand back the same kind of thing.

toBytes(s) answers an array of numbers and fromBytes(bs) answers a result; those two are the only place a slate program sees UTF-8, and len(toBytes(s)) is the byte count.

Case and whitespace are the whole database and not the ASCII range. upper and lower answer what any other language with a case table answers, which is not always one character out for one character in, and trim takes off Unicode’s White_Space — so a no-break space pasted out of a form comes off and a zero-width no-break space, which is not a space at all, stays.

print(upper("Straße"), len(lower("İ")))
print(lower("ΟΔΟΣ"), lower("ΟΔΟΣΑ"))
print("[" + trim(" \u{a0}x\u{a0} ") + "]")

STRASSE 2
οδος οδοσα
[x]

The second line is Unicode’s own rule that a sigma ending a word is written ς, which is context rather than a table; the first is ß uppercasing to two letters and İ lowercasing to two.

normalize(s, form) puts text into one of "NFC", "NFD", "NFKC" and "NFKD", which is what two strings have to go through before == between them means what a reader thinks it means — the same word typed on two machines is routinely two different sequences of characters. casefold(s) is what two strings differing only in case both come to, and is not lower: ß folds to ss, so casefold("STRASSE") == casefold("Straße") where lowering leaves them different.

Conversion

The type words are the conversions. string, number, integer, real and boolean each test in pattern position and convert in expression position; the two never overlap.

print(string(123) + "!")
print(number("42"), number("nonsense"))
print(integer(2.9), real(3), real(3) is real)

123!
42 null
2 3 true

number answers null where the text is not a number, which is how a program checks input without raising. integer and real move between the two numeric kinds; the four roundings — floor, ceil, round, trunc — leave an integer alone.

min and max take as many arguments as they are given and answer an integer when every one of them was.

Reference and copy

Arrays and objects are reference types: two names may hold the same array, and a write through one is visible through the other. Everything else is a scalar.

a with { f: v } answers a copy of a with f changed, which is how a record is updated without mutating it. concat(xs, ys) is the array counterpart.

Absence

There is no undefined. null is the only absence, it is an ordinary value, and slate refuses to store anything else in its place. That single rule explains a run of behaviour that otherwise looks unrelated:

pop, shift and at fault where there is nothing there, rather than answering nothing.
find and indexOf answer null — a search that found nothing is an answer, where reaching past the end is a mistake.
A parameter nobody gave is not bound at all, so there is no sentinel to test for and f(1, null) is not the same as f(1).
An object field a value need not have is a question about its shape (pinned?), not a value that might be absent.

slate:url

2026-09-06T00:36:22.158815252Z

`slate:url`

Percent-encoding and the name=value grammar — the piece under everything that reads a URL.

import { percentDecode, encodeComponent, parseQuery, parsePairs } from slate:url

val q = parseQuery("name=Ada+Lovelace&year=1843&tag=caf%C3%A9")

print(q.name, q.year, q.tag)
print(encodeComponent("a b/c?d=e&f"))
print(percentDecode("caf%C3%A9", false))

val cookies = parsePairs("session=abc; theme=dark", ";", false)

print(cookies.session, cookies.theme)

Ada Lovelace 1843 café
a%20b%2Fc%3Fd%3De%26f
café
abc dark

It exists so that a page can import it

These four were slate:http‘s, and that module exported them saying in as many words that a framework over it needs the same decoder its router uses. That was true and it was not enough: the JavaScript back end emits the whole of an imported module, so a browser page importing slate:http to reach two functions grew by 239 KB — 340,761 bytes to 579,710 — because slate:http is a server, an HTTP/2 speaker and a file server. A page that only wants to read its own query string was paying for all of it.

So this is the lowest module slate has after slate:llhttp, and it is here for that module’s reason: what a program actually wanted was underneath something much larger.

slate:http still exports all four and always will. It imports them from here and forwards them, so nothing written against that module changed.

It asks nothing of the host — no socket, no clock, no document — so it works under the interpreter, under node and in a browser with no branch anywhere.

Decoding is over bytes, not characters

%C3%A9 is two bytes that are one character, so a decoder working a character at a time cannot put them back together: this one collects the bytes and decodes the lot at the end.

It answers its input unchanged where those bytes turn out not to be text. A URL is something somebody else wrote, and a fault here would let any link stop a program. For the same reason, a % not followed by two hex digits is a % — which is what every browser does with one.

plusIsSpace is the one difference between a query or a form and everything else percent-encoded. A cookie’s + is a +, and so is a path segment’s.

Encoding is the unreserved set and nothing more

encodeComponent leaves A-Z, a-z, 0-9, -, ., _ and ~ alone and encodes everything else, which is RFC 3986’s unreserved set. Encoding more than is needed is always safe and encoding less never is, so the rule is the narrow one.

A repeated name is the last one

import { parseQuery } from slate:url

val q = parseQuery("a=1&a=2&debug")

print(q.a)
print(has(q, "debug"), q.debug, "|")

2
true  |

That is a decision rather than an oversight. The alternative every framework reaches for is an array where a name repeats — which makes the type of q.name depend on what somebody put in a link, so a program that read it as a string works until the day a name arrives twice. A value whose shape varies is the thing this language argues against everywhere.

A program that genuinely expects a name more than once reads the raw text by hand; a server has it on req.search.

A name with no = is present and empty, which is what a bare ?debug means to everybody who writes one.

`parsePairs` is the grammar the three of them share

A query string, a form body and a Cookie header are one grammar with two knobs: the separator, and whether + means a space.

import { parsePairs } from slate:url

print(parsePairs("a=1&b=two+words", "&", true).b)
print(parsePairs("a=1; b=two+words", ";", false).b)

two words
two+words

It is exported because the three callers inside slate:http do not exhaust it: a dozen headers are name=value lists, and a program reading one of them would otherwise write this again — which is the very thing moving the module was meant to stop.

A value wrapped in quotes is unwrapped, a cookie’s being so by the specification.

`base64urlEncode` and `base64urlDecode`

Bytes as text that survives a URL: RFC 4648 §5’s alphabet, which is base64 with - for + and _ for /, and no padding at all.

import { base64urlEncode, base64urlDecode } from slate:url

print(base64urlEncode("foobar"))
print(base64urlEncode([251, 255]))

val r = base64urlDecode("Zm9vYmFy")

print(r.ok, fromBytes(r.value).value)

val bad = base64urlDecode("ab*d")

print(bad.ok, bad.error)

Zm9vYmFy
-_8
true foobar
false `*` is not a base64url character

Encode takes a string or an array of bytes, and a string is its UTF-8 bytes — the same reading encodeComponent gives one, and the only reading there is: what an encoding of bytes does with text is encode the text’s bytes.

Decode answers a result, and its value is BYTES. Text encoded this way arrives from outside — a cookie, a token, a signature somebody sent — so being malformed is a condition the caller was always going to deal with rather than a fault, which is the rule for anything read from outside. And what was encoded is as likely to be a digest as a sentence, so answering text would be guessing; fromBytes is the one call to text and answers a result of its own, so the two compose:

val r = base64urlDecode(piece)

if r.ok then fromBytes(r.value) else r

Three things are refused, each with its own sentence:

a character that is not in the alphabet, = included — the padded spelling is base64 and this is not it, and accepting both would make two encodings of one value valid, which is the shape of hole a token format compared as text is walked through;
a length one past a multiple of four, which carries no whole byte in its last character, so such a piece is truncated rather than merely odd;
bits past the last whole byte that are not zero, or two spellings decode to the same bytes.

slate:jwt is written on these, a token being three base64url pieces; it carried a private copy until the pair moved here, which is why they are in this module and not in that one.

Types

2026-09-06T00:36:22.158815252Z

Types

slate is dynamically typed with a gradual checker: nothing has to be annotated, and what is annotated is checked twice — once by a pass before the program runs, and once by the machine when the value actually arrives.

The rule the checker obeys

The pass may only report what the machine would also refuse. A program that runs is never refused before it runs. Everything below follows from that one constraint: where the pass cannot be certain, it says nothing rather than guessing, and the machine still checks.

What that costs against TypeScript is worth saying plainly: TS catches a mistake on a path you never ran, and this only fires where the pass can prove the value is wrong or where that path executes.

Three deliberate exceptions, each an annotation the machine cannot check for you. An annotated var is held to its declared type at every assignment; every argument must fit the type a type parameter was solved to; and an object literal written where a shape is expected may carry only the fields that shape names. Each is a promise the program made in writing, and being held to it is what writing one is for.

`type`

A type is a shape with a name:

type Point = { x: number, y: number }
type Circle = { centre: Point, radius: number }

describe(v) = v match
    Circle -> s"a circle of radius ${v.radius}"
    Point  -> s"the point ${v.x}, ${v.y}"
    _      -> "no idea"

print({ x: 3, y: 4 } is Point)
print(describe({ centre: { x: 0, y: 0 }, radius: 2 }))
print(describe({ x: 3, y: 4 }))
print(describe("nothing"))

true
a circle of radius 2
the point 3, 4
no idea

It is TypeScript’s type — the same declaration, the same structural reading, asking for at least those fields. What differs is that slate’s is not erased: one declaration serves both the pattern and the check at a boundary, where a TypeScript app that reads an API response writes the shape twice, once as a type and once as a schema for the run.

Nothing of a type’s structure exists at run time. A name in pattern position is replaced by the pattern the type declared, while the program is compiled, so p is Point costs no instruction.

A type may not bind a name. type Tagged = { x: n } is refused: a name written inside a type would be introduced wherever the type is used. It is the rule an alternative of a | already followed.

export type is how an interface leaves the file it was written in, and both halves cross — the shape the compiler resolves and the value the name binds.

The type expressions

written	means
`any`	anything, and what an unannotated thing is
`number` `integer` `real` `string` `boolean` `array` `object` `function` `null`	a kind
`{ a: T, b?: U }`	an object with at least those fields — except a literal written at the spot, which may carry no others
`[T, U]`	an array whose first elements fit
`array of T`	an array every element of which fits `T`
`object of T`	an object every value of which fits `T`
`T \\| U`	either
`T & U`	both
`(T)`	the same `T`, bracketed to group it
`A -> B`	a function of one parameter
`(A, B) -> C`, `() -> C`	a function of none or several
a `type`, `class` or `data` name	what that declared
`Name[A, B]`	a generic type, given what it is generic over

`array of T`

An array pattern tests the elements it writes and lets the rest through — ["a", 2] is [string, ...] is true — so a list of unknown length needs this:

type Tags   = array of string
type Counts = object of integer
type Grid   = array of array of integer

print(["a", "b"] is Tags, [1] is Tags, [] is Tags)
print({ a: 1 } is Counts, { a: "x" } is Counts)
print([[1, 2], [3]] is Grid)

true false true
true false
true

An empty container fits, every element of nothing fitting anything. A floor is said with an intersection: [any, ...] & array of string. The element pattern may not bind, running once per element.

A for over one types its variable, so for u in users where users: array of User makes u a User.

`?` and `|`

A field the value need not have is marked ?. Present it must fit; absent the shape still holds — which a nullable union cannot say, tag: string | null still requiring the key to be there.

type Note = { title: string, pinned?: boolean }

print({ title: "a" } is Note)               // absent, and the shape still holds
print({ title: "a", pinned: true } is Note)
print({ title: "a", pinned: 1 } is Note)    // present, and does not fit

true
true
false

= is for a pattern that binds and ? is for one that tests, and each is refused where the other belongs.

A union may have null as an alternative, which is how a parameter says it will take nothing:

type Point = { x: number, y: number }
type MaybePoint = Point | null
type Shape = { side: number } | { radius: number }

print(null is MaybePoint, { x: 1, y: 2 } is MaybePoint, 3 is MaybePoint)
print({ side: 1 } is Shape, { radius: 1 } is Shape, { area: 1 } is Shape)

true true false
true true false

`&`

& is |‘s dual and binds tighter, matching only where every part does. A value picks up fields on its way down through a stack of functions, and this is how the one at the bottom says what it receives:

type Authed = { user: { id: integer } }
type Bodied = { body: string }

handle(req: Authed & Bodied) = req.user.id

print(handle({ user: { id: 7 }, body: "hi" }))

A part may bind, where an alternative may not: every part runs, so { a } & { b } binding both is sound.

A function type

integer -> integer is the type of n -> n + 1, and it is spelled the way the lambda is. One parameter needs no brackets; none or several are a bracketed list:

apply(f: integer -> integer) -> integer = f(1)
twice(f: (integer, integer) -> integer) = f(2, 3)
later(f: () -> string) = f()

print(apply(n -> n + 1), twice((a, b) -> a * b), later(() -> "hi"))

2 6 hi

The arrow is the loosest thing in a type and groups to the right. string | null -> integer is a function taking either — which is what a parameter usually means — and a union holding a function says so with brackets:

type Handler = string | null -> integer
type MaybeFn = (integer -> integer) | null

run(f: MaybeFn) = if f is null then 0 else f(2)

print(run(null), run(n -> n * 10))

0 20

Writing one down is what types the lambda handed to it, which is where most of what it buys shows up: the parameters flow inwards and what the body does with them is checked.

apply(f: integer -> integer) = f(1)

print(apply(n -> n + "x"))

`+` does not apply to an integer and a string

What is checked is the arity and the parameters, and deliberately not the result. A function’s own -> string is checked against what that function answers and never against what somebody who was handed it expected, so a mismatch there is a complaint no run could make. Where the result matters — f(cb) = cb(1) + 1 — it is read off the annotation and the arithmetic is checked on its own.

At run time a function type asks what it can ask: is this callable, and would it take a call of this size. What a function will do with what it is given is not a question about the value in front of you, which is why the parameters are the checker’s business and the count is both.

Annotating

Per parameter, and per result:

double(x: number) -> number = x * 2

print(double(21))

A result that does not fit what was promised is a fault where the answer was written:

name(p: { id: number }) -> string = p.id

print(name({ id: 7 }))

this answers string, and gave back 7

A parameter’s complaint lands where the value was handed over:

type Point = { x: number, y: number }

d(b: Point) = b.x

print(d({ x: 0 }))

`d` takes { x: number, y: number } here, and this is { x: integer }

A lambda’s parameters may be annotated and its result may not. The arrow already separates the parameters from the body, so there is nowhere for a result to be written; it is read off the body.

val g = (n: integer) -> n + 1

print(g(2))

A binding

val x: T = e and var n: T = e, checked where the value arrives and again by the pass that runs before the program does:

val name: string = "ada"
val tags: array of string = ["reading", "writing"]
var count: integer = 0

count += 1

print(name, tags, count)

ada ["reading", "writing"] 1

An annotated var is TypeScript’s let: the declared type is what the name holds for its whole life, so every assignment is checked against it rather than against what happens to be there.

var n: integer = 0

n = "later"

`n` was declared integer, and this is string

An unannotated var is left as it always was — the union of its initialiser and every value ever assigned to it — so a program that deliberately reuses a name for another kind is untouched.

An object literal written where a shape is expected

A shape asks for at least its fields — except of a literal written at the spot, which may carry only the fields it names. An object that arrives through a name is one other places hold, so the fields this parameter does not want are somebody else’s business. A literal written here has no other reader, so a field the shape does not name is not a spare: it is a mistake, and the mistake it nearly always is is a misspelling.

type Style = { color: string, weight: integer }

use(s: Style) = s.color

print(use({ colour: "red", weight: 400 }))

`colour` is not a field of { color: string, weight: integer }, and an object literal written here may carry only the fields it names -- did you mean `color`?

It is TypeScript’s excess-property check, drawn in the same place and for the same reason, and it applies to a literal at an annotated parameter — including one typed by a solved type parameter — and to the value of a binding that declared a type.

Only a literal standing at the spot. A value reaching the same parameter through a name is structural as it always was; a literal built by a spread is a merge rather than a literal; and a literal nested inside one is the outer field’s business rather than the annotation’s.

type Spot = { x: number, y: number }

area(p: Spot) = p.x * p.y

val big = { x: 2, y: 3, z: 4 }
val some = { x: 2, z: 9 }

print(area(big), area({ ...some, y: 3 }))

6 6

A rest parameter

...rest: array of T describes the array, because the array is what the name holds: a call gathers what is left over into one, and it is checked once, where the gathering happened.

total(...ns: array of number) = reduce(ns, (a, b) -> a + b, 0)

print(total(1, 2, 3))

What the checker knows before the program runs

A call answers in terms of what it was given

filter, sorted, reversed, slice and pop all give back what they were handed, so the element type survives them and a mistake is caught where it is written — in either spelling, a method being checked as the free function it is:

f(xs: array of string) = len(xs)

h(ns: array of integer) = f(ns.filter(n -> n > 1))

`f` takes array of string here, and this is array of integer

f(filter(ns, n -> n > 1)) draws the same complaint, a method being checked as the free function it is.

map(ns, n -> string(n)) is an array of string, the lambda’s result being read off its body.

A callback knows what it is handed

map, filter, forEach and the rest call their function with one element; sorted calls its comparator with two; reduce calls its function with a running value and an element. The checker says so, so a lambda written at the call gets its parameters typed from the array beside it — and what it does with them is checked:

h(ns: array of integer) = map(ns, n -> n * 2)   // an array of integer, not of any

print(h([1, 2, 3]))

[2, 4, 6]

What the callback does with what it was handed is checked:

g(ss: array of string) = map(ss, s -> s * 2)

`*` does not apply to string and integer

and so is its arity — in one direction. A callback may declare FEWER parameters than the builtin hands it, a native passing as many as the callback declares; see Callbacks. Declaring more is refused, there being nothing to fill them with:

q(ns: array of integer) = map(ns, (a, b) -> a)

`map` takes (integer) -> any here, and this is (integer, any) -> integer

It is the CALLER that makes the relaxation sound, so it stops at a builtin. A parameter the program annotated is compared strictly in both directions: a call the program wrote passes what the program wrote, and nothing adapts.

None of that is a type variable. A builtin’s signature names an argument by position, and the type at that position is filled in at the call — no binding, no scope, nothing to write anywhere. What a program writes for itself is the next section.

Type parameters

first[T](xs: array of T) -> T is how a function you write says the same thing a builtin says: the answer is whatever the call was given.

first[T](xs: array of T) -> T = xs[0]

print(first(["ada", "grace"]), first([1, 2]))

ada 1

The parameters are solved from the arguments left to right, so a callback written at the call is typed from the arguments before it — and what it does with them is checked:

map2[A, B](xs: array of A, f: A -> B) -> array of B = map(xs, f)

print(map2(["a", "b"], s -> upper(s)))

["A", "B"]

They are declared in one place and nowhere else — [T] after the name of a definition or a type — and there are no bounds, no variance and no defaults. A generic type is used by giving it what it is generic over, and the shape that comes out is the shape both declarations describe:

type Pair[A, B] = { first: A, second: B }

show(p: Pair[string, integer]) = s"${p.first} is ${p.second}"

print(show({ first: "ada", second: 36 }))
print({ first: "ada", second: "x" } is Pair[string, integer])

ada is 36
false

A generic type used without its arguments is refused rather than quietly erased, because a check that passes for the wrong reason is worse than no check:

type Pair[A, B] = { first: A, second: B }

show(p: Pair) = p.first

`Pair` is generic over 2 types, so it needs them here

Every argument must fit the type the parameter was solved to

A type parameter is solved from the arguments, and every one of them has to be contained in the answer. The candidates are gathered across the whole call and the one that every other candidate fits is chosen; where there is no such candidate the call is refused, naming the parameter, what it was taken to be, and the argument that disagrees:

pair[T](a: T, b: T) -> array of T = [a, b]

print(pair(1, "x"))

`T` is integer from an argument before this one, and this is string

A union is still an answer where the PROGRAM declared one, because then it is a candidate like any other and the value beside it fits:

pair[T](a: T, b: T) -> array of T = [a, b]

val mixed: integer | string = 1

print(pair(mixed, "x"))

[1, "x"]

fits is the same relation used everywhere else on this page, so an integer does not fit a real. pair(1, 2.5) is refused for that reason, and number is the type that takes both — which is what to annotate with where a call means to mix them:

pair[T](a: T, b: T) -> array of T = [a, b]

print(pair(1, 2.5))

`T` is integer from an argument before this one, and this is real

What a type parameter still does not do

It is erased, so nothing at run time knows it was there. The machine sees values, not the calls that were made — which is exactly why the check above happens while compiling or not at all.

So x is T cannot be asked, and it is refused where it is written rather than answering something. There are no type arguments at a call either — first[string](xs) is an index followed by a call, and no grammar can have both — so they are solved from the arguments or not given.

Inside the definition a T is a value nothing is known about, which is what makes upper(xs[0]) in a generic function perfectly legal: T may be a string, and refusing a program that runs is the one thing the checker may not do.

It reads the rest of the block before it says what a name holds

A var is the union of its initialiser and every value ever assigned to it, so a counter stays an integer through += 1 and n++ and a wrong call is refused before the program runs. A var the program reassigns to another kind is said nothing about. An ANNOTATED var is what it was declared and every assignment is checked against that, which is the one place the pass refuses something the machine would have run: the annotation is a promise the program made, and being held to it is what writing one is for.
An array literal says what it was built out of, so map([1, 2], n -> n * 2) types its callback and first([1, 2]) answers an integer. Elements that disagree make a union and one that is not known gives the whole thing up. A NAME does not keep it: an array is mutable and outlives the line that built it, so the element type is dropped where a literal is bound to a name — the rule an object’s shape already follows. An annotation is not dropped, being a promise the machine checks.
A local object’s fields are known for as long as nothing can have made them stale: its name never mentioned except to read a field off it, so nothing else holds the object and no field of it is ever written. o with { … } is a mention.
An annotated parameter’s shape is not carried past the call. The object came from somewhere else, the caller may hold another name for it, and the annotation is checked on the way in and says nothing about after.

Where it steps aside

A call that spreads — f(...xs) — is not checked for arity, the count being a run-time fact.
A receiver whose type is any is never asked what methods it has.
An object’s field names are the program’s, so an object is never asked whether it has one.
A method name is refused before it runs where the receiver’s kind is certain — "abc".push(1), date(…).hour() — because that asks the machine’s own question: the dispatch table is one table.

A type is a value under its own name

Which is what makes the declaration the validator — nothing written twice, and no schema library to keep in step with it:

type Note = { title: string, pinned?: boolean }

print(Note.test({ title: "a" }))
print(Note.mismatch({ }))
print(Note.name())

true
[{path: "title", wanted: "string", got: "nothing"}]
Note

mismatch collects every reason rather than stopping at the first, because a person filling in a form wants to be told about all of it at once, and path says where in the value each one is.

Those three are the whole surface: a shape’s fields cannot be read back out, so nothing can grow to depend on the structure of a type. is is deliberately not extended to take one — a bare name in pattern position binds, so v is s would match everything — and shape is a type word, so s is shape asks whether s is one of these.

This covers all three declarations that name a type, so a class name and a data name answer the same three about themselves — the shape being the very pattern is tests, interned where the declaration stands:

class Point
    var x
    var y

data Failure
    NotFound(what)
    Empty

print(Point.name(), Point.test(Point(1, 2)), Point.test({ x: 1, y: 2 }))
print(Failure.test(Empty), Failure.mismatch(3))
print(NotFound.test(NotFound("a")), NotFound.test(Empty))

Point true false
true [{path: "", wanted: "Failure", got: "integer"}]
true false

A class and a variant ask a nominal question — was this value made from that declaration — so test is is and a mismatch against one names the type and stops. There is nothing more useful to say about a value that was made from something else.

A static the class itself declares wins over all three, the shape answering only where the object’s own fields and its whole proto chain have said nothing. So test and name are still words a class may use for its own purposes.

shape as a type word takes all three, so f(s: shape) is how a function says it wants one — and Point is shape is true where Point(1, 2) is shape is not, a value being what the type describes rather than the type.

Interfaces

An interface, in the sense of a set of operations, needs nothing further — functions are values, so type Drawable = { draw: function } is one. A class promises one with is in its header, which is TypeScript’s implements and is checked where the class is written.

slate:time

2026-09-06T00:36:22.158815252Z

`slate:time`

Eight types, because one type is where a date library’s bugs come from. A Date that is an instant answering calendar questions by silently reading the host’s zone is the conflation every famous defect follows from, so slate splits it:

type	what it is
`instant`	a point on the timeline, with no calendar
`duration`	an exact length — micros to weeks
`date`	a calendar date, with no time of day
`time`	a time of day, with no date
`dateTime`	a wall reading, with no zone
`zone`	a zone
`zoned`	a wall reading in a zone
`period`	months and days

Each has a type word that tests for it, so date, time and zone in pattern position test rather than bind. Ordinary val date = … is unaffected.

Making one

import { now, monotonic, date, time, dateTime, zone, localZone, utc } from slate:time

now()                       // an instant
monotonic()                 // a DURATION -- it names no point in time
date(2026, 9, 2)
time(14, 30, 0)
dateTime(2026, 9, 2, 14, 30, 0)
zone("America/Toronto")
localZone()
utc                         // a VALUE, not a call -- the one zone that cannot fail to be found

instant, epochSeconds, epochMillis and epochMicros cross to and from a count.

The clock reads whole milliseconds and an instant holds microseconds. now() is a millisecond reading on every back end — JavaScript’s has nothing finer, and a timestamp that printed six fractional digits in one program and three in another would be a difference nobody asked for. An instant a program builds is exact: epochMicros(1000000001) keeps its last digit, and monotonic(), which is what an elapsed time is measured with, is finer than a millisecond wherever the host clock is.

Durations are micros millis seconds minutes hours days weeks; periods are months years.

seconds(90)                 // a duration
months(3)                   // a period
2.hours()                   // the same length, as a method

Duration against period

This is the distinction that earns the type count. A duration is exact timeline and may be added to anything; a period is months and days and may be added only to a calendar reading.

import { date, days, months, weeks } from slate:time

val d = date(2026, 3, 7)

print(d + days(1))
print(d + months(1))
print(months(1).days(), weeks(2).days())

2026-03-08
2026-04-07
0 14

zoned + days(1) keeps the wall clock across a daylight-saving change and zoned + hours(24) does not — both right, and the program says which. instant + days(1) is refused, an instant having no calendar.

Both are right, and the program says which.

Months and days never convert. months(1).days() is 0; weeks(2).days() is 14. A month is 28 to 31 days, so any other answer is wrong somewhere. There is deliberately no days on a duration.

Reading one

One word per unit, and the receiver decides the question. Plural is a length, singular is a part.

import { date, hours, seconds, year, month, day, weekday, daysInMonth, isLeapYear } from slate:time

val d = date(2026, 9, 2)

print(year(d), month(d), day(d))
print(d.year(), weekday(d), daysInMonth(d), isLeapYear(d))
print(2.hours(), seconds(90))
print(hours(3).minutes())       // how many whole minutes it is

2026 9 2
2026 Wednesday 30 false
2h 1m 30s
180

year month day hour minute second weekday monthName dayOfYear daysInMonth isLeapYear.

`at`

at is the one word for reading one thing in terms of another:

instant.at(zone)
zoned.at(zone)
date.at(time)
dateTime.at(zone)           // a RESULT

A wall reading that a zone skips or repeats is handed back, not guessed at. dateTime.at(zone) answers an error naming the gap or the ambiguity, and .at(zone, "earlier" | "later" | "after") makes the choice explicitly. Every mainstream library picks one silently.

offset, isDST and abbrev ask a zone about a moment. startOf truncates and onOrAfter moves to the next weekday.

The two channels

import { parseDate } from slate:time

print(parseDate("2026-09-02"))
print(parseDate("2026-02-30"))      // text from outside is a RESULT

{ok: true, value: 2026-09-02}
{ok: false, error: "cannot read \"2026-02-30\" as a date: day is out of range"}

Three numbers the program wrote are a fault, the other half of the same rule:

import { date } from slate:time

print(date(2026, 2, 30))

there is no such date

parseDate, parseTime, parseDateTime and parseTimestamp. There is no Invalid Date and nothing spreads NaN.

Comparison

== on a zoned reading needs the same instant and the same zone, where < compares only the instant. 09:00 in Toronto and 09:00 in Tokyo are different readings and neither is before the other. Java draws the line in the same place.

`format`

moment-flavoured, with |bars| around literal text and WWWW where moment writes dddd:

import { dateTime, utc } from slate:time

val t = dateTime(2026, 9, 2, 14, 30, 0).at(utc).value

print(t.format("YYYY-MM-DDThh:mm:ssZ"))
print(t.format("|on| WWWW, MMMM D, YYYY"))

2026-09-02T14:30:00Z
on Wednesday, September 2, 2026

An element the value does not have is refused, never zero-filled:

import { date } from slate:time

print(date(2026, 9, 2).format("hh:mm"))

hh

An element the value does not have is refused, never zero-filled. date.format("hh:mm") says a date has no time of day — a date rendered as 00:00 is a midnight the program never meant, and that is exactly the value that then gets stored and reported on. format is in the instant’s table for the same reason, so the refusal can say “read it in a zone first”.

f caps at six digits, a reading being microseconds. a/A are am/AM. The zone elements are lower-case z, so Z stays a literal.

Timers

sleep and setTimeout take a duration as well as a number, so await sleep(2.seconds()) reads as what it is.

monotonic() answers a duration, not an instant: it names no point in time, and elapsed measurement is the one thing it is for.

Tests

2026-09-06T00:36:22.158815252Z

Tests

@test marks a function of no arguments, and slate test is the only thing that calls one.

val floor = 2

export clamp(x) = if x < floor then floor else x

@test
clamp_lifts_a_small_number_to_the_floor() =
    assertEq(clamp(-3), floor)

@test
async a_missing_file_answers_rather_than_raising() =
    val r = await readFile("nothing-here.txt")

    assert(!r.ok, "a file that is not there answers a result")

$ slate test .
  ok    examples/testing.sl :: clamp_lifts_a_small_number_to_the_floor   0ms
  FAIL  examples/testing.sl :: widen_clamps_every_element   0ms
        error: got [2, 5], wanted [2, 5, 2]
          --> examples/testing.sl:41:5
           |
        41 |     assertEq(widen([1, 5, -2]), [2, 5, 2])
           |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

5 passed, 1 failed

slate test takes a file or a directory, and walks a directory for every .sl file under it. slate test --js runs the same suite in JavaScript.

The assertions


`assert(condition)`
`assert(condition, message)`
`assertEq(got, wanted)`	renders both sides, quoting a string so `"6"` and `6` do not look alike
`assertFaults(fn)`	calling `fn` is supposed to raise
`assertFaults(fn, message)`	and the fault has to say that
`skip(reason)`	this test is not going to run here, and why

A failed assertion raises, and the runner catches it exactly as a catch would. A test that faults without asserting anything fails the same way, and whatever it printed is shown above the failure.

A call that is supposed to fail

assertFaults is the one assertion that cannot be written as a condition, because a fault leaves the test rather than answering false. Without it the shape is a try whose body ends in a complaint — and a try that forgets that last line is a test which passes whatever the call does.

val pump = { handle: null }

pull(p) = if p.handle == null then throw "the pump has no handle" else "water"

@test
pulling_a_handleless_pump_says_so() =
    assertFaults(() -> pull(pump), "no handle")

The function takes no arguments, so what you write at the call is a lambda around the thing you expect to go wrong. With a second argument the fault’s own text has to contain it; with one, any fault will do. What fails, and what it says:

expected a fault, got a value: 42 — the call answered instead of raising;
the fault said "…", wanted it to contain "…" — it raised, about something else.

An async function’s fault arrives a turn later, so assertFaults answers a promise where it was given one — await it, and the test is async like any other that waits for something.

@test
async a_file_that_is_not_there_is_a_fault_in_the_strict_reader() =
    await assertFaults(readStrictly)

A skip travels straight through it. A skip is the test’s whole verdict rather than the fault the call was asked for, so assertFaults never swallows one.

Leaving a test out

skip(reason) says a test is not going to run here, which is what a suite needs where one host has something another has not — a socket under slate js, a database nobody started, a platform the code is not written for yet.

@test
a_server_answers_what_it_is_asked() =
    if !canListen() then skip("this host has no listener")

    assertEq(ask("/"), "hello")

  ok    tests/api.sl :: a_route_is_matched_before_it_is_called   0ms
  skip  tests/api.sl :: a_server_answers_what_it_is_asked   this host has no listener

7 passed, 1 skipped

It raises, so nothing after it runs — which is why there is no return on the line below it, and why forgetting one cannot leave the test running on the host it was written to be left out of.

A catch does not get it. A skip is the test’s whole verdict, exactly as exit is a script’s, so a library the test called cannot swallow it.

A reason is required, and it is shown where the timing is on a pass. A test left out with nothing said is one nobody ever puts back — and a run that skipped anything says so on its last line, so a suite that quietly stopped running half of itself cannot report a page of greens.

Setting up, and tidying away

Four annotations say what runs around a test, and every one of them marks a function of no arguments exactly as @test does:


`@setup`	before each test in the file
`@teardown`	after each test, however it went
`@setupAll`	once, before the first test
`@teardownAll`	once, after the last

What they share, they share through the file’s own vars, there being nothing else to pass: a hook takes no arguments and hands nothing back.

import { lmdbOpen, lmdbClose } from slate:lmdb

var store = null
var wrote = 0

@setupAll
open_the_store() =
    store = lmdbOpen("/tmp/counting", { mapSize: 1048576 })

@setup
start_from_nothing() =
    wrote = 0

@teardownAll
shut_the_store() =
    lmdbClose(store)

@test
a_write_is_counted() =
    wrote = wrote + 1

    assertEq(wrote, 1)

One of each to a file, and a second is refused where it is written, naming both:

error: a file has one `@setup` at most, and `first` is already it -- `second` would be the second

That is the whole of the arrangement — there is no nesting, no group, and no way for one test to opt out of the file’s setup. A test that wants something different is a test that belongs in a file of its own, which costs nothing and reads better than a flag would.

A hook may be async, and is waited for the way an async test is.

When one of them goes wrong

A fault in @setup fails the test it was preparing, and the failure names the setup:

  FAIL  tests/store.sl :: a_write_is_counted   0ms
        `open_the_store` failed before this test ran
        error: the store would not open

A fault in @setupAll does that to every test in the file, and a skip in either leaves the test out with the reason given — which is how a whole file says this host is not for me once instead of in every test.

A @teardown runs however the test went — passed, failed or left out — because what it gives back is exactly what a setup that stopped halfway had already taken. Its own fault is a failure of its own, counted on the last line under the teardown’s name rather than folded into the test or quietly dropped: a passing test with a broken teardown is not a passing file.

A @setup, the test it prepares and its @teardown run on one event loop, and each of the three is waited for only as far as its own answer. So a socket the setup opened is still open while the test runs, and a timer the test armed is still armed while the teardown runs — which is what makes clearTimeout in a teardown mean anything. The loop is let settle after the teardown, and it waits only for what the three of them left behind: whatever the file’s @setupAll opened is the file’s, and settles after its @teardownAll.

Running only some of them

--only <substring> runs the tests whose name contains it, and nothing else:

$ slate test tests --only clamp
  ok    examples/testing.sl :: clamp_lifts_a_small_number_to_the_floor   0ms

1 passed

The last line still counts what ran. A filter that matches nothing is a failure, not an empty success — the usual cause is a misspelling, and a test step that is green having run nothing is the worst outcome available to it:

$ slate test tests --only clmap

0 passed
slate: no test name contains "clmap"

A file with nothing chosen is not prepared: its @setupAll does not run, so a filter costs nothing in a suite whose files each open a database.

Where tests live

Beside the code or in a file of their own, and the difference is what they can reach. A slate module is a file, so a test beside the code sees what that file kept private, and a test file that imports the module sees exactly what a reader of it sees. Both are ordinary @test functions; nothing distinguishes the two arrangements but where you put them.

Only the file being tested contributes its tests. A test file that imports the module it tests does not run that module’s tests a second time, so walking a directory runs each file’s tests exactly once.

Two rules worth knowing

An async test is waited for. Calling one hands back a promise that has not settled, so a runner that read the answer straight away would call every asynchronous test a pass whatever it did.

Running a file plainly calls none of its tests, so @test costs a program that is not being tested one closure and nothing else.

Statements

2026-09-06T00:36:22.158815252Z

Statements

Declarations

val name = "slate"
var n = 0

val cannot be assigned to again; var can. A val bound to an array or an object still allows that container to be changed — the binding is what is fixed, not the value.

Either may say what it holds, and an annotated var is TypeScript’s let: the declared type is what the name holds for its whole life, so every assignment is checked against it.

val name: string = "slate"
var n: integer = 0

n += 1

print(name, n)

slate 1

A definition is a statement too, and so are type, class and data, each of which belongs to the top level of a file.

What is in scope where

A definition is HOISTED to the top of the block it is written in, which is JavaScript’s rule, so a name may be used above the line that defines it:

val sink = written

written(r) = "wrote " + string(r)

print(sink(1))

wrote 1

A val or var initialiser stays sequential — it may read what is above it and not what is below — and that is the half that matters: nothing about hoisting makes a program’s data flow depend on where a function happens to sit.

val a = b
val b = 1

print(a)

`b` is not defined

The definitions run where they are hoisted, so a statement standing between two of them is not reordered around anything: only the binding moves, and what it binds is a function that has not been called yet.

A definition may not take a name its own block has already declared, whether by another definition or by a val or a var. The hoisting is the reason: the two would not run in the order they are written, so what the second one means depends on a rule the reader cannot see.

f() = 1

print(f())

f() = 2

`f` is declared twice in this block

A nested block is its own, so shadowing an outer name is untouched — and a val written below a definition is not a collision but the ordinary way to name a generator and then run it:

counting()
    yield 1
    yield 2

val counting = counting()

print(counting.next().value, counting.next().value)

1 2

Assignment

Assignment is a statement, never an expression, so = cannot appear inside an expression and there is nothing for it to be confused with.

var n = 0
var xs = [1, 2]
var o = { f: 0 }
var a = 1
var b = 2

n = 3
xs[0] = 9
o.f = 9
a, b = b, a                 // several places at once

print(n, xs, o, a, b)

3 [9, 2] {f: 9} 2 1

Assignment binds nothing. g = 1 where g was never declared is refused before the program runs, naming the nearest name it does know; val and var are the only things that introduce a name.

The compound forms are += -= *= /= %= and the bitwise &= |= ^= <<= >>=. A compound form evaluates its place once, so xs[next()] += 1 calls next a single time.

++ and -- step a name, a field or an element, prefix or postfix.

`if`

grade(mark)
    if mark >= 90
        "A"
    elif mark >= 80
        "B"
    else
        "C"

print(grade(95), grade(85), grade(20))

A B C

The inline form takes then, and its body is a statement, not an expression — which is the rule that makes the short forms worth having:

first_big(xs)
    for x in xs
        if x <= 2 then continue
        if x > 2 then return x

    null

print(first_big([1, 2, 7, 9]), first_big([1, 2]))

7 null

An if is an expression when every branch answers one: val g = if c then 1 else 2.

Loops

Three of them, and every one is an expression:

var c = 3

while c > 0
    c -= 1

for x in [1, 2]
    print(x)

var n = 0

loop
    n += 1

    if n == 2 then break

print(c, n)

1
2
0 2

do introduces a one-line body — while c do …, for x in xs do …, loop do ….

for await x in source is the fourth, and it walks something that answers next() a value at a time — see Asynchrony.

A for head may take its element apart with a pattern:

for [k, v] in entries({ a: 1, b: 2 })
    print(k, v)

a 1
b 2

What a loop answers

break is what gives a loop a value. A loop that finishes on its own answers null, or whatever its else clause left:

find_first(xs, wanted)
    for i in 0..<len(xs) do
        if xs[i] == wanted then break i
    else
        -1
end find_first

print(find_first([4, 5, 6], 5), find_first([4, 5, 6], 9))

1 -1

The else clause runs when the loop ended without a break, and its value is the loop’s.

Labels

A label says which loop a break leaves, which is the only way out of a nested one:

val found = 'search for a in [1, 2, 3]
    for b in [4, 5]
        if a * b == 8 then break 'search [a, b]

print(found)

[2, 4]

continue starts the next turn, and takes a label the same way.

Blocks

A block’s value is its trailing expression. return is for leaving a function early and nothing else, so a function whose last statement is its answer does not write one.

counter()
    var count = 0

    bump()
        count = count + 1
        count

    bump

val c = counter()

print(c(), c(), c())

1 2 3

`throw`

throw v is a statement, like return and break — nothing after it runs, and the value is not optional. See Faults.

Closing words

end if, end while, end for, end loop, and end <name> for a definition, a class or a data type. All are optional and all are for a block long enough to want one.

slate:sqlite

2026-09-06T00:36:22.158815252Z

`slate:sqlite`

SQLite — the database that needs no server, and the one a program can have without asking anybody to install anything.

import { sqlite } from slate:sqlite

val db = sqlite(":memory:")

db.exec("create table notes (id integer primary key, title text, weight real)")
db.run("insert into notes (title, weight) values (?, ?)", "a note", 1.5)

val put = db.run("insert into notes (title) values (?)", "another")

print(put.changes, put.lastInsertRowid)

for row in db.query("select id, title from notes order by id")
    print(row.id, row.title)

db.close()

1 2
1 a note
2 another

sqlite(path) answers the database and everything else is a method on it, which is slate:redis‘s shape and is the same one pg has — so the two databases a program might reach for do not have to be learned twice.


`db.exec(sql)`	run every statement in the text, for its effect
`db.query(sql, ...params)`	the rows, each an object keyed by column name
`db.run(sql, ...params)`	`{ changes, lastInsertRowid }`
`db.transaction(work)`	everything `work` did, or nothing of it
`db.compiledWith(option)`	whether this SQLite was built with a named option
`db.close()`	the statements go, and then the connection

The path is SQLite’s own, and is not always a file

:memory: is a private database living as long as the connection, which is what a test wants, and "" is a temporary one on disk that is deleted when the connection goes. Anything else is a path.

val db = sqlite("notes.db", { busyTimeout: 5000 })

db.exec("create table if not exists notes (title text)")
db.run("insert into notes (title) values (?)", "kept")

db.close()

{ readOnly: true } opens a database that is already there and fails where there is none, rather than making an empty one. { busyTimeout: ms } is how long to wait for a lock before giving up, and is worth setting on anything more than one process writes to. Those are the two options there is, and an option spelled any other way is refused by name rather than ignored.

`exec` runs several statements and `query` runs one

That is SQLite’s own behaviour rather than this module’s. sqlite3_prepare compiles the first statement in a piece of text and hands back a pointer to what is left — so a schema of six create tables run through query would create one table and say nothing about the other five. exec walks that pointer, which is why it is the call a schema goes through.

The parameters are the arguments after the SQL

db.query(sql, ...params), and a list a program worked out is spread: db.query(sql, ...values).

A parameter is never interpolated into the SQL. SQLite compiles the statement before it is given a single value, so nothing a parameter holds can become part of the query — ? is the whole of the defence against injection, and there is no escaping function here because there is nothing to escape.

A ? nobody bound is refused rather than quietly bound to SQL NULL, which is what SQLite would do: where id = ? called with no parameter would otherwise run, match nothing, and say nothing.

What crosses, in each direction

SQLite	slate
`INTEGER`	an integer, read as 64 bits
`REAL`	a real
`TEXT`	text
`BLOB`	an array of bytes
`NULL`	`null`

The type belongs to the value and not to the column. SQLite is dynamically typed: a column declared integer holds whatever was put in it, and two rows of one column may differ — so what a cell comes back as is decided per row, by what is actually stored there.

Going out: text as itself, an integer and a real as themselves, null as SQL NULL, true and false as 1 and 0 (SQLite has no boolean storage class), and an array as a blob. That last one is simpler here than in PostgreSQL, which has both int[] and bytea and needs to be told which.

A transaction commits on a return and rolls back on a fault

import { sqlite } from slate:sqlite

val db = sqlite(":memory:")

db.exec("create table notes (title text)")

move()
    db.run("insert into notes (title) values ('a')")

    throw "something went wrong"

print(db.transaction(move) catch e -> e.message)
print(db.query("select count(*) as n from notes")[0].n)

something went wrong
0

The rollback path is the one a program forgets, and that is the whole argument for the method: a failure between begin and commit that simply returns leaves the transaction open, holding its locks, until the connection closes. Here the fault is caught, the transaction is undone, and the fault carries on with its own words.

SQLite has no nested transactions, so a transaction inside a transaction is refused by the database rather than counted.

Statements are prepared once and kept

query and run take the SQL rather than a statement object, and the connection keeps what it compiled — so parsing and planning happen once per piece of SQL for the life of the connection and a program gets that without holding anything. The cache is bounded, the oldest statement going when the room runs out, so a program that builds its SQL as text in a loop does not accumulate one per string.

Full-text search, where the machine’s SQLite has it

What SQLite can do is a property of the machine, it being the library the machine supplies rather than one slate carries. db.compiledWith("ENABLE_FTS5") is how a program asks — the SQLITE_ prefix is optional — and the alternative is finding out at the create virtual table, which fails with no such module: fts5.

import { sqlite } from slate:sqlite

val db = sqlite(":memory:")

db.exec("create virtual table search using fts5(body)")
db.run("insert into search (body) values (?)", "the quick brown fox")
db.run("insert into search (body) values (?)", "a lazy dog sleeping")

val hits = db.query("select body, bm25(search) as score from search where search match ? order by score", "fox")

print(len(hits), hits[0].body)
print(hits[0].score is real, hits[0].score < 0)

1 the quick brown fox
true true

bm25 is negative, FTS5 ordering a better match first by making its score smaller.

Faults, not results

Everything here faults with a sentence, which is the one place slate’s rule reads the other way round. The rule is that text from outside the program is an answer and a value the program built itself is a fault — and a local database is on the second side of that line nearly everywhere it can fail: the SQL is in the program, the number of parameters is a property of that SQL, and a call on a closed database is a mistake in the order the program did things. pg answers a result instead, and the difference is the machine: a server that is down, a password that is wrong and a role that does not exist are all conditions a program was always going to handle.

A program that wants an answer rather than a fault writes catch:

val rows = db.query(sql) catch e -> []

Both hosts have it

node has carried node:sqlite since 22.5, so this module is whole under slate js as well as here — the same object with the same methods, over node’s own copy of SQLite rather than the machine’s. tests/js/p28.sl is what says the two agree: the storage classes, the transaction, the full-text search and every sentence either back end says about SQL it will not take.

node writes one line to stderr the first time a program here opens a database — ExperimentalWarning: SQLite is an experimental feature — which is node’s and not slate’s, and node --no-warnings silences it. It is written at the first call rather than when the program starts, so a program that never opens a database never draws it.

A browser has no SQLite and node:sqlite is not coming to one — what a page has instead is IndexedDB and the long-deprecated Web SQL, neither of which is this — so the module refuses there naming node’s module, exactly as slate:brotli does.

Two builds of SQLite are two builds, so a version number, a bm25 score and anything else the library is free to change between releases are properties of the machine rather than claims about slate.

The one such difference worth knowing about is "double quotes". SQL says a double-quoted word is an identifier, and SQLite has a long-standing misfeature where one that matches no column is taken as a string literal instead — on by default in the build macOS ships and off in node’s, which sets SQLITE_DQS=0. So select "hello" answers the text hello under the interpreter and no such column: "hello" under slate js. Write a string literal in single quotes, which is what SQL says and what both builds agree about.

slate:regex

2026-09-06T00:36:22.158815252Z

`slate:regex`

PCRE2 patterns. One export, because a pattern is one object and everything a program does with it is a method on that object.

import { regex } from slate:regex

val re = regex("(\\d+)-(\\d+)")
val text = "a 10-20 b 30-40"

print(re.test(text))
print(re.find(text).groups)
print(re.find(text).start, re.find(text).end)
print(re.replace(text, "$2-$1"))
print(re.replaceFirst(text, "x"))
print(re.pattern())

true
["10-20", "10", "20"]
2 7
a 20-10 b 40-30
a x b 30-40
(\d+)-(\d+)

Asking for a g flag is refused by name, since a flag silently ignored would make replace look like it had worked for the wrong reason:

import { regex } from slate:regex

print(regex("a", "g"))

The flags are i, m, s and x.

A match is an ordinary object

text, start, end, groups and named.

groups has the whole match at 0, and null for a group that took no part.
named is always present and empty where the pattern names nothing. A field that appears only sometimes is one a program must test for before reading.
Every offset is in characters, as everywhere else in slate — PCRE2 answers in bytes and the whole slot array is converted in one pass.

Three of JavaScript’s decisions are reversed

slate	JavaScript, and what it costs
a pattern carries no position	a `/g` pattern holds a mutable `lastIndex`, so `re.test(s)` twice on one string is `true` then `false` — visible only on the second call
`replace` replaces every match, `replaceFirst` stops	a bare `replace` changes the first only unless `/g` is set, which is why `replaceAll` had to be added two decades later
a match that would backtrack forever is a fault	no limit at all, so a crafted subject stops a server answering

There is no g flag, and asking for one is refused by name with the sentence saying what to do instead — a flag silently ignored would make replace look like it had worked for the wrong reason.

Two dialect points

$ is the very end rather than also the position before a final newline, and \d is [0-9] rather than every decimal digit in Unicode. Both are settled here so that a pattern means one thing wherever it runs — each is a place PCRE2 and JavaScript would otherwise disagree silently, compiling either way and merely matching something else. A program wanting Unicode digits writes \p{Nd}, which works regardless.

Under slate js a pattern is translated into RegExp, and the same rule decides everything there: \s, . and ^/$ under m all mean something else to a browser and are written out so that they do not. A handful of PCRE2 constructs a browser has nothing to mean — a possessive quantifier, an atomic group, recursion, \K — are refused where the pattern is written, naming the construct. The JavaScript page has the measurements and the three differences that are left standing, of which the backtracking budget above is one: RegExp has no such limit in any browser.

Equality

An identical pattern compiles once, so regex("a") == regex("a") is true where two arrays written the same way are equal by contents but two compiled patterns would not otherwise have been. That falls out of interning rather than being a decision about equality.

There is no way to release a pattern, and none is needed: a slot names the same pattern for as long as the program runs, so a loop writing regex("\\d+") costs one entry and not one per turn.

slate:redis

2026-09-06T00:36:22.158815252Z

`slate:redis`

A Redis client on the event loop.

import { redis } from slate:redis

val r = (await redis("127.0.0.1", 6379)).value

await r.command("SET", "greeting", "hello")
print((await r.command("GET", "greeting")).value)

r.onPush(m -> print("pushed:", m))

r.close()

One export, because a connection is one object and everything else is a method on it. That is slate:regex‘s shape. redis is also what connect had to become, slate:net exporting that name and a program with a Redis client in it having sockets in it.

The transport is slate’s

Only the reply parser is bound. The reader is fed bytes and answers replies and never opens, reads or writes a socket — so the transport stays on the same loop that is answering HTTP, and a Redis client in a server cannot stop the server. Binding a blocking redisCommand would have made that impossible rather than merely difficult.

There is no `get` and no `set`

Redis has some 240 commands and grows more each release, so a client that named them would be a list to keep current and a wall between a program and anything new.

command gathers its words — r.command(...parts) for a computed one — and every argument crosses as a counted string, so a value holding CRLF or what looks like a whole second command is still one argument and there is nothing to escape.

The rules

A command answers a result and a closed client throws. -ERR is the server refusing and a connection that has gone is an outside condition; calling command after close is the program’s own mistake.
Every waiting promise is settled when the connection goes, with a result rather than a failure — a program awaiting an answer it will never get would otherwise wait for the rest of the run, which in a server is a request that never finishes.
A push is never matched against a waiting command. A pub/sub message arrives between replies to your own commands, so a client that assumed every reply was its own would hand a subscriber’s message back as the answer to a GET — silently, both being good replies. r.onPush(f) is where they go.
Pipelining is what happens when you do not await. RESP has no request ids because answers come back in the order the commands were written, so issuing several and awaiting them afterwards costs one round trip.
A protocol failure ends the connection rather than being stepped over. The two ends disagree about where a reply begins, so nothing after it can be trusted.

slate:process

2026-09-06T00:36:22.158815252Z

`slate:process`

Another program, this program’s own environment, and being asked to stop.

import { env, args } from slate:process

print(args, env("PATH") is string, env("NO_SUCH_VARIABLE_HERE"))

[] true null

`stderr`

print is the answer a program produces and stderr is what it says about producing it, which is the division every shell already makes: slate app.sl > answers.txt keeps the answers in the file and lets the complaints through to the terminal.

import { stderr } from slate:process

stderr("could not reach the database, retrying\n")

It takes as many values as print does and separates them the same way, and answers nothing.
The newline is yours, as node’s process.stderr.write leaves it: a program writing a JSON object per line and one drawing a progress bar want different answers, and only one of them can be the default.
It writes straight to the descriptor and does not wait. A complaint is the one thing a program may need to have said before the next line runs — a crash after an await would lose it — so this is synchronous, exactly as print is.

`args` and `exit`

#!/usr/bin/env slate

import { args, exit } from slate:process

if args.len() == 0
    print("usage: greet <name>...")
    exit(2)

for name in args
    print("Hello, " + name + "!")

args is a value, not a call, and it holds only what came after the program’s name — so args[0] is the first thing a person typed. That is where slate parts from C, node and Python, all three of which hand a program its whole command line and begin by skipping past themselves.
exit(status) stops the program and tells the shell what it came to. Everything printed before it is still printed, a try between it and the top cannot swallow it, and a status outside 0–255 is refused rather than truncated — a shell keeps the low eight bits, so an unexamined exit(256) is a program that says it failed and is recorded as having succeeded.
slate reads no argument of its own after the program’s name, so a script’s own options are safe to invent.
Without an exit, a program that ran answers 0 and one that faulted answers 1. slate itself answers 2 when it could not work out what it was being asked to do.

`env`

env(name) answers string | null. ?? "" is what a program writes.

`run`

val r = await run(cmd, args, options)       // { status, signal, out, err } or an error

Options are { cwd, env, timeout }.

A child that ran and failed is a success with a non-zero status; an error means there was no child. That is what lets a caller tell “the program said no” from “there is no such program”.
A signal is null, never 0, since 0 is a status a program can exit with.
Settling waits for three things: the child exiting and both pipes reaching end of file. A child can exit with output still in the pipe, so settling on the exit alone hands back a truncated answer that looks whole.
The child’s stdin is closed, not inherited. An inherited descriptor has the child competing with slate for the terminal, and a child waiting on input nobody will type is a hang with nothing on screen.
env replaces the child’s environment. A program that wants to add a variable reads it with env(name) and passes it through; one that wants an empty environment has no other way to say so.
A timeout sends SIGKILL, a timeout being the caller saying they will not wait any longer and a signal the child may ignore leaving the promise pending exactly as it was.
Output that is not text fails the call rather than being replaced or mangled.

Signals

A program that leaves a socket open never exits, so a server ends only from the inside — and every way a deployment has of asking one to stop is a signal:

import { onSignal } from slate:process
import { serve, close } from slate:http

val server = serve(8080, req -> "hello")

onSignal("SIGTERM", () ->
    print("shutting down")
    close(server))

SIGTERM is what a container stopping and a systemd unit restarting both send; SIGINT is Ctrl-C.

The handler is an ordinary function at an ordinary time. It runs between one turn of the loop and the next, so nothing about it is restricted the way a C signal handler is: it may print, allocate, close a socket, start a timer, and take as long as the shutdown needs.
It is handed nothing, and the registration is what names the signal. slate checks the count of a call’s arguments, so a name passed to every handler would be a parameter almost none of them would read; a program that wants one function for two signals registers it twice.
A watcher does not keep the program alive. A script that installs a handler and does nothing else still ends. What keeps a server running is the server.
onSignal answers an id and offSignal(id) stops that handler. Stopping one twice is not an error.
SIGKILL and SIGSTOP are refused by name — the kernel acts on those itself and nothing a program says will run first.

Patterns

2026-09-06T00:36:22.158815252Z

Patterns

One grammar, used in four places: a match arm, an is test, a binding (val { a } = o), and a parameter that takes its argument apart.

`match`

match is postfix — a transformation of the thing to its left. A guard runs after the pattern has bound:

classify(v) = v match
    { kind: "point", at: [0, 0] } -> "origin"
    { kind: "point", at: [x, y] } if x == y -> "diagonal"
    [first, ...rest] -> "a list starting " + string(first)
    "sat" | "sun" -> "a weekend"
    n @ number if n < 0 -> "a negative number"
    _ -> "something else"

print(classify({ kind: "point", at: [0, 0] }))
print(classify({ kind: "point", at: [2, 2] }))
print(classify([9, 1]))
print(classify("sun"))
print(classify(-4))
print(classify(true))

origin
diagonal
a list starting 9
a weekend
a negative number
something else

Arms are tried in order. A subject matching no arm is a fault, as Scala’s MatchError is.

An arm’s body may be an expression or an indented block, and the inline then forms work inside one.

What binds and what tests

A bare name in a pattern tests for a kind where it names one, and binds otherwise. The kind words are:

null  boolean  integer  real  number  string  array  object  function

plus promise, generator, regex, shape, and the eight temporal words — instant, duration, date, time, dateTime, zone, zoned, period. That is the whole list: twenty-one words. Every type, class and data variant declared in the file adds its own name to it.

None of them is a keyword. val int = 3 and val date = readIt() are ordinary bindings; the words are read this way in pattern position and nowhere else. What it costs is real: a match arm may no longer bind a name spelled date or time.

number is the one word that is not a kind, being the union of integer and real.

_ matches anything and binds nothing.

`@`

n @ pat tests and names at once:

tell(v) = v match
    n @ number if n < 0 -> s"the negative number ${n}"
    p @ { x: 0, y } -> s"${p} is on the y axis at ${y}"
    _ -> "something else"

print(tell(-4))
print(tell({ x: 0, y: 3 }))

the negative number -4
{x: 0, y: 3} is on the y axis at 3

A broad guard is why this matters. n if n < 0 binds anything, so the guard evaluates [3, 4] < 0 and faults; n @ number if n < 0 cannot reach the guard with the wrong kind.

`|` and `&`

| is alternation. No alternative may bind a name, since it would be bound down one path and not the other:

print("sun" match
    "sat" | "sun" -> "a weekend"
    _ -> "a working day")

a weekend

An alternative that binds is refused where it is written:

print(1 match
    a | b -> 1
    _ -> 2)

an alternative of a pattern may not bind a name

& is its dual, binds tighter, and may bind — every part of an intersection runs, so both names are bound down the one path that matched:

both(v) = v match
    { a } & { b } -> s"$a $b"
    _ -> "no"

print(both({ a: 1, b: 2 }), both({ a: 1 }))

1 2 no

Object patterns

An object pattern matches an object with at least those fields, because a record grows fields over its life.

type Note = { title: string, pinned?: boolean }

print({ title: "a" } is Note)
print({ title: "a", pinned: true } is Note)
print({ title: "a", pinned: 1 } is Note)        // present, and does not fit

true
true
false

{ name: n } binds n, { name } is shorthand for { name: name }, and { pinned? } is a field the subject need not have.

A field a proto supplies counts, a pattern asking whether the value has the field — which is the question . answers.

= is for a pattern that binds and ? is for one that tests, and each is refused where the other belongs.

Array patterns

An array pattern tests the elements it writes and lets the rest through:

print(["a", 2] is [string, ...])

val [first, ...rest] = [1, 2, 3]

print(first, rest)

true
1 [2, 3]

Bindings

A val or a var may take its value apart:

val { title } = { title: "t", extra: 1 }
val [first, second] = [10, 20]

print(title, first, second)

t 10 20

`is`

is puts a pattern where a condition is wanted:

type Point = { x: number, y: number }

val v = 3

print(v is number, v is not string, v is 1 | 3 | 5)
print({ x: 1, y: 2 } is Point)

true true true
true

Exhaustiveness

Exhaustiveness is checked exactly where the value’s shape was written down, and nowhere else. slate is dynamically typed, so for an unannotated subject the set of values a name may hold is not known and nothing useful can be said.

What data adds is a closed list of variants, so a match over a subject annotated with one is checked against it and every variant left out is named:

data Shape
    Circle(r)
    Rect(w, h)
    Empty

sides(s: Shape) = s match
    Circle(_) -> 0
    Rect(_, _) -> 4
    Empty -> 0

print(sides(Circle(1)), sides(Rect(1, 2)), sides(Empty))

0 4 0

A variant left out is named where the match is written:

data Shape
    Circle(r)
    Rect(w, h)
    Empty

sides(s: Shape) = s match
    Circle(_) -> 0

this match does not cover

A _ arm is how a program says it has finished listing.

Class and variant patterns

A class name or a data variant written with fields after it tests and takes apart in one breath — by position, or by name:

class Square
    var side

class Circle
    var radius

class Rect
    var w
    var h

tell(v) = v match
    Square(n) -> s"a square of side ${n}"
    Circle { radius: r } -> s"a circle of ${r}"
    Rect { w, h } -> s"${w} by ${h}"
    _ -> "something else"

print(tell(Square(3)))
print(tell(Circle(7)))
print(tell(Rect(2, 5)))
print(tell(42))

a square of side 3
a circle of 7
2 by 5
something else

The positional order is the constructor’s, and holds by construction: the field list a pattern is checked against is the parameter list of the new the class was given.

Naming the class is also what lets a misspelled field be caught. A bare { raduis: r } is a legal pattern that never matches — any object may lack any field — so the arm is silently dead. Written after a class name there is a declaration to check it against, and it is refused where it stands.

Both forms nest, both take an @ binding, and the test is the proto walk — so a pattern written for a base class takes an object of a class descended from it apart.

Types in patterns

A type name in pattern position is replaced by the pattern the type declared, while the program is compiled:

type Point = { x: number, y: number }

print({ x: 3, y: 4 } is Point)
print({ x: 3 } is Point)

true
false

Nothing of a type’s structure exists at run time, so a type costs no instruction. A type may not bind a name — type Tagged = { x: n } is refused — for the reason | may not.

Packages

2026-09-06T00:36:22.158815252Z

Packages

A package is named by an unquoted specifier:

import { mount } from lath              // the package's own `main`
import { domHost } from lath/dom        // one of its other modules

$ slate add github.com/slate-language/lath

The manifest

A project or a package is a directory holding a package.sl, which is a slate object literal:

{
    name: "lath",
    version: "0.2.0",

    // What a bare `import ... from lath` reaches.
    main: "lath.slx",

    // The other modules a consumer may name, `lath/<key>`.
    modules: {
        dom: "dom.slx",
    },

    dependencies: {
        pg: { git: "github.com/slate-language/pg", version: "0.2.0" },
    },

    // What this package's own tests and examples need. A consumer never resolves these.
    devDependencies: {
        logger: { git: "github.com/slate-language/logger", version: "0.1.0" },
    },
}

The keys are name, version, main, modules, dependencies and devDependencies, and nothing else — an unknown one is named. name and version are required; a dependency takes git and version, both required. Comments are //, as everywhere else, which is most of why the format is slate’s rather than JSON’s.

devDependencies differs from dependencies in who resolves it and in nothing else. It is fetched, hashed and pinned in slate.sum exactly as any other dependency when it is your project being built — and a package you depend on has its own second section skipped, however deep it sits. So a package’s suite may reach for whatever it likes without every consumer paying for it.

A package is in one section or the other, and both slate add and the manifest reader refuse a name in both: two packages cannot share an import name, and one package cannot be in two places. A file written by hand that names one twice is a file saying two contradictory things, and it is answered with a caret rather than resolved twice.

slate deps marks the ones a consumer would not get:

  parsing 0.4.0 (github.com/sysl-lang/parsing)
  logger 0.1.0 (github.com/slate-language/logger) -- dev

slate add --dev github.com/slate-language/logger

The format is slate’s own syntax because slate’s value model already is the config model — null, booleans, two kinds of number, strings, arrays and records, and nothing else. What decided it is not the grammar: a manifest gets a span and a report, so a file that is wrong is answered with the same source-quoting, caret-drawing diagnostic a program that is wrong gets.

The file is parsed and never run, and that is the whole design. A resolver working out what to fetch is reading a file that arrived with the thing it is deciding whether to fetch; a manifest that ran would make that a code-execution step. So the reader is a restriction pass over an ordinary slate expression:

A lambda, a call, a name and an operator are each refused by what they are — “the name b“, “a call”, “a + between two things” — rather than as “not a literal”, which is true of all of them and names none.
- in front of a numeric literal is allowed, the lexer having no signed literal.
A key is a name or a string, so the manifest syntax is a superset of JSON’s.
A repeated key is refused rather than resolved. First-wins and last-wins both silently discard something a person wrote.
The walk carries on after a refusal, so a manifest with three mistakes reports three.

What a package exposes

Its main, and whatever its own manifest lists under modules — which is what the slash names.

It is a list rather than a search. Resolving lath/dom by trying dom.slx and then dom.sl would make every private helper in every package importable by accident, and would turn a renamed file into a broken consumer with no way for the author to have said otherwise.

A package’s entry file is its own manifest’s main. That is optional for a project, which may simply be run by naming a file, and required for anything imported — there being nothing else that says which of a package’s files is the package.

Where things are

The project is found by walking up from the entry file, so a program works wherever it sits and wherever it is run from. A file under no project is not an error: a single file that imports nothing is a perfectly good slate program.

The cache is $HOME/.slate/pkg, overridable by SLATE_CACHE.

`slate.sum`

slate.sum records what was fetched. The hash is over the extracted tree, not over the download, so it is a statement about the code a build actually compiled rather than about one particular archive of it.

It records the WHOLE graph and not the packages the project happens to name. A package reached through another one is compiled exactly as one the manifest wrote, so it is pinned exactly as one. That takes saying because a package’s own dependencies are written in its own manifest, which arrives with the package: slate add and slate fetch resolve, fetch, and then resolve again — until a round arrives with nothing new — because the first pass over an empty cache can only see what the project itself declared.

Objects

2026-09-06T00:36:22.158815252Z

Objects

An object is a collection of fields.

print({ name: "ada", born: 1815 })
print({ "two words": 1 })
print({})

{name: "ada", born: 1815}
{"two words": 1}
{}

Every field is written key: value. There is no { name } shorthand in a literal — that spelling belongs to an object pattern, where it means bind the field name to the name name, and a literal reading it the other way round would make one notation mean two things.

A key in a literal is a name or a string, and nothing else — a number there is a parse error. A key written through an index may be any value, and stays that value:

var q = {}

q[42] = "answer"

print(q, q[42])

{42: "answer"} answer

That is why toJSON refuses a non-string key rather than rendering it: { 1: "a" } and { "1": "a" } are two objects and would be one document.

Objects are reference types and compare by their contents.

keys(o), values(o), entries(o) and has(o, k) are how a program walks one; entries is what makes a destructuring for head worth having:

val o = { a: 1, b: 2 }

print(keys(o), values(o), has(o, "a"))

for [k, v] in entries(o)
    print(k, v)

["a", "b"] [1, 2] true
a 1
b 2

o with { f: v } answers a copy with f changed. There is no spread in a literal — with is it.

`proto`

proto is an ordinary field, and a lookup that misses carries on into it:

val Shape = {
    describe: self -> s"${self.kind} with area ${self.area()}",
    kind: "shape"
}

val Square = { proto: Shape, kind: "square", area: self -> self.side * self.side }

square(side) = { side: side, proto: Square }

print(square(4).describe())

square with area 16

No syntax and no new kind of value. A proto may have a proto, so chains and overriding come free; describe lives on Shape and calls area, which only the concrete shapes have, so the call goes back down to whichever object it started from. That is dispatch, and it needed no keyword.

It is also what makes objects affordable. Three methods written as captured closures cost three closures per instance; on a proto they cost three once.

An object pattern counts a field a proto supplies, a pattern asking whether the value has the field — which is the question . answers. (JavaScript splits the same seam and puts in on this side of it.)

The receiver rule

A method reached through a proto is handed the object it was found on. One describe serves every shape, so it cannot have captured a particular one — it has to be told, and self is an ordinary first parameter.

A method stored on the object itself has already captured what it needs and is given nothing extra:

counter()
    var n = 0
    var c = {}

    c.bump = () ->
        n += 1
        n

    c

val c = counter()

print(c.bump(), c.bump())

1 2

That is not two rules but one: captured methods take no receiver, shared ones must.

Only o.m(...) passes a receiver. o.m on its own hands back the bare function, so taking a method off an object and calling it later is allowed and gives you what you took.

Operator hooks

An object may answer for an operator. The word is the method’s name, and a class body writes one with the definition syntax it already has:

class Money
    var cents

    plus(self, o)    = Money(self.cents + o.cents)
    times(self, n)   = Money(self.cents * n)
    negated(self)    = Money(-self.cents)
    compare(self, o) = self.cents - o.cents      // `<`, `<=`, `>` and `>=` read its sign

    toString(self)   = "$" + string(self.cents / 100)

val a = Money(150)
val b = Money(50)

print(a + b, a * 2, -a)
print(a < b, a > b)

$2 $3 $-1
false true

hook	operator
`plus`	`+`
`minus`	`-`
`times`	`*`
`dividedBy`	`/`
`remainder`	`%`
`negated`	prefix `-`
`compare`	`<`, `<=`, `>`, `>=`
`equals`	`==`, `!=`
`hash`	a table key

Ordering is one hook and not four, so a type cannot order inconsistently with itself. == keeps equals, because a type whose ordering is coarser than its equality is an ordinary thing to want.

The left operand decides and the right is never asked — equals‘s rule already — so there is no reflected form and 2 * money is a fault.

A hook is the last thing tried, so none can shadow what an operator means.

A type that writes equals should write hash beside it, or two equal values will not find each other in a table.

`toString` and `toJSON`

A class may say how it prints and how it encodes, which is what a value object needs to stop leaking the fields it is made of:

class Money
    var cents

    toString(self) = "$" + string(self.cents / 100)
    toJSON(self)   = string(self.cents / 100)

print(Money(150))
print(toJSON({ paid: Money(150) }))

$1
{"paid":"1"}

Both replace everything below them at every depth, so a value inside an array or a response body renders the way its class says rather than only when printed on its own.

Without toJSON, a class instance and a data variant encode as their own fields — Circle(3) is {"r":3} — and never as the chain they hang from.

Identity

The proto is the identity, and class is what lets is ask about it. Written by hand, p.proto == Point is the closest an object literal gets — and it is not quite instanceof: == on objects is deep, so it answers true for anything holding the same fields, and it looks exactly one link up the chain.

slate:nghttp2

2026-09-06T00:36:22.158815252Z

`slate:nghttp2`

HTTP/2: the framing layer, and HPACK on its own.

import { h2Client, h2Server, h2Receive, h2Send, h2Next, h2Request, h2Respond, h2Close } from slate:nghttp2

DRAIN h2Next AFTER h2Send, NOT ONLY AFTER h2Receive. A session queues an event when it writes as much as when it reads: the last frame of a request going out is what ends that stream, so streamClose is waiting in the session the moment the write is made. A loop shaped as receive, drain, write — which is the shape a socket callback naturally takes — leaves that event sitting until the peer happens to send something else. Where the peer has nothing more to say, nothing ever arrives to shake it out and the program waits forever.

It is the client still uploading when its answer comes back that meets this, because that is the one whose stream ends on a write rather than on a read. Alternate until neither side has anything: drain, write, drain again, and stop when a drain yields no event and a write yields no bytes.

Nothing here touches a socket. Bytes that arrived go in at h2Receive, bytes to write come out of h2Send, and what happened in between is read off with h2Next. HTTP/2 is a transformation, so how bytes reach the wire stays your program’s business — which is why the whole protocol can be driven between two sessions in memory, with no port and nothing that can hang:

import { h2Client, h2Server, h2Receive, h2Send, h2Next, h2Request, h2Respond, h2Close } from slate:nghttp2

val c = h2Client()
val s = h2Server()

// Whatever one end wants to write, handed to the other.
pump(from, to)
    val bytes = h2Send(from)

    if len(bytes) > 0 then h2Receive(to, bytes)

// Everything the peer did since last time.
seen(who)
    var out = []

    loop
        val e = h2Next(who)

        if e == null then break

        push(out, e)

    out

val stream = h2Request(c, { ":method": "GET", ":scheme": "https", ":authority": "example.test", ":path": "/things" })

pump(c, s)

for e in seen(s)
    if e.kind == "headers" then print("asked for", e.headers[3])

h2Respond(s, stream, { ":status": "200", "content-type": "text/plain" }, "hello from h2")

pump(s, c)

for e in seen(c)
    if e.kind == "data" then print(fromBytes(e.bytes).value)

h2Close(c)
h2Close(s)

asked for [":path", "/things"]
hello from h2


`h2Client(options?)` / `h2Server(options?)`	a session
`h2Receive(session, bytes)`	`null`, or `{ error }` where the peer spoke nonsense
`h2Send(session)`	the bytes to write, as an array
`h2Next(session)`	the next event, or `null`
`h2Request(session, headers, body?)`	a client’s; answers the stream number
`h2Respond(session, stream, headers, body?)`	a server’s
`h2RequestStream(session, headers)` / `h2RespondStream(session, stream, headers)`	the same two with the body written afterwards
`h2Push(session, stream, piece)`	more of a body that is still open; `{ error }` where the peer gave up
`h2Finish(session, stream, trailers?)`	the body is complete and the stream ends
`h2Settings(session, { … })`
`h2Goaway(session, lastStream, code?)` / `h2Reset(session, stream, code)`	giving up
`h2WindowUpdate(session, stream, by)` / `h2Consume(session, stream, bytes)`	flow control
`h2Ping(session)`
`h2Wants(session)`	`{ read, write }`
`h2Close(session)`
`hpackDeflater(maxTable?)` / `hpackInflater()`	HPACK on its own
`hpackDeflate(encoder, headers)` / `hpackInflate(decoder, bytes)`
`hpackClose(x)`

Which version a connection is

HTTP/2 over TLS is chosen by ALPN and by nothing else — no upgrade handshake, no version header. That half is slate:net‘s: a listener offers a list, a client offers one, and alpnProtocol(conn) says what the two settled on. A server taking both versions on one port asks it and hands the connection to whichever it is:

val server = listen({ port: 8443, cert: pem, key: keyPem, alpn: ["h2", "http/1.1"] }, conn ->
    if alpnProtocol(conn) == "h2"
        speakHttp2(conn)
    else
        speakHttp1(conn))

h2c — HTTP/2 with no TLS at all — needs nothing extra, a session neither knowing nor caring where its bytes come from. What is not here is the HTTP/1.1 Upgrade: dance that converts an existing connection; prior-knowledge h2c, which is what one speaks to a service one controls, is the ordinary case and works today.

Events

h2Next answers one at a time, in the order they happened, and null when there are no more. Every event has a kind, and the rest of its fields depend on it:

`kind`
`headers`	`stream`, `headers`, and `of` — `"request"`, `"response"` or `"trailer"`
`data`	`stream`, `bytes` — one event per DATA frame, not one per stream
`streamEnd`	`stream` — the peer will send no more, and may still be reading
`streamClose`	`stream`, `code` — finished at both ends
`settings`	the peer’s settings arrived and are in force
`goaway`	`lastStream`, `code`
`rstStream`	`stream`, `code`
`windowUpdate`	`stream`, `increment` — `stream` is 0 for the connection
`ping`	`ack`

Events rather than callbacks, and that is the design decision this module turns on: nghttp2 calls back from inside receive, which is a place your code has no business running — it cannot submit frames there without reentering the library, and a closure it registered would have to be kept alive by the session. What you write instead is a loop.

Headers

Write them as an object, or as pairs where order and duplicates matter. An object is what a program writes nine times in ten; two set-cookie headers are legal and an object has one key.

h2Respond(s, stream, { ":status": "200", "content-type": "application/json" }, body)

h2Respond(s, stream, [[":status", "200"], ["set-cookie", "a=1"], ["set-cookie", "b=2"]])

They always arrive as pairs. Two headers of one name are legal, and an object would silently keep one of them — which is the shape of defect that makes request smuggling possible. A program that wants an object folds the list itself, knowing what it discarded.

A third element marks a field never-indexed, which is a wire decision rather than a comment: an attacker who can insert requests on a connection learns a secret header’s value one character at a time by watching whether his guess compressed, and keeping it out of the dynamic table is the defence. authorization and cookie are the fields that want it.

h2Request(c, [[":method", "GET"], [":scheme", "https"], [":path", "/"],
    ["authorization", "Bearer …", true]])

A header value is text and a number is refused rather than converted, because a value is a string on the wire — and converting silently would make true a header value too:

import { h2Client, h2Request } from slate:nghttp2

h2Request(h2Client(), { ":path": 12 })

a header value is text

What a session refuses, and how

Bytes the peer got wrong are an ANSWER, because a peer that speaks nonsense is the ordinary thing a server deals with and a fault would take the server down with the connection:

import { h2Server, h2Receive } from slate:nghttp2

val s = h2Server()

print(h2Receive(s, toBytes("GET / HTTP/1.1\r\n\r\n")).error != "")

true

A handle you have closed is a defect in the program, exactly as a closed socket is, so that one faults — and says what was closed rather than naming an integer.

A body written a piece at a time

h2Request and h2Respond take the bytes they are to send, which is right for a body a program already has. A body produced as it goes — an event stream, a proxied response, a file read in pieces — is the other pair, and the difference on the wire is when the head goes out: a response whose source never ends still has to say 200 before its first byte of body exists.

h2RespondStream(s, stream, { ":status": "200", "content-type": "text/event-stream" })

// … whenever there is something to say:
h2Push(s, stream, "data: hello\n\n")

// … and at the end, which for an event stream may be never:
h2Finish(s, stream)

h2Push answers { error } where the stream has no open body, which is the ordinary way a program learns the peer gave up: a reset or a close drops the body, so the next push says so rather than writing into nothing. Trailers may be named at h2Finish and nowhere else — what was unknown until the body ended is exactly what a trailer is for.

h2RequestStream is the same on the client side, and it is what an upload of unknown length is.

Flow control, and back-pressure

A session extends its own windows as bytes arrive, which is right for a program that deals with a body as fast as it reads one. A program that queues bodies, writes them to disk or hands them to something slower wants the credit returned when the work is done — and that is what h2Consume is for. It needs a session made for it, since a session that extends its own windows has nothing to report:

val s = h2Server({ autoWindowUpdate: false })

// … a body arrives, is written away, and only then:
h2Consume(s, stream, len(bytes))

HPACK on its own

The header-compression tier needs no session, and it is worth having by itself: it is the security-relevant half of HTTP/2, identical whoever drives the frames, and a decoder that trusts its input is a decompression bomb waiting for somebody to send it one.

import { hpackDeflater, hpackInflater, hpackDeflate, hpackInflate, hpackClose } from slate:nghttp2

val enc = hpackDeflater()
val dec = hpackInflater()

val block = hpackDeflate(enc, { ":status": "200", "content-type": "text/plain" })

print(hpackInflate(dec, block))

// The dynamic table is what makes the second block of the same headers a fraction of the first.
val again = hpackDeflate(enc, { ":status": "200", "content-type": "text/plain" })

print(len(again) < len(block))

hpackClose(enc)
hpackClose(dec)

[[":status", "200"], ["content-type", "text/plain"]]
true

A deflater and an inflater are each a conversation, not a function. The dynamic table is built from every block that has gone through, so blocks must be given to one inflater in the order they arrived — that is HPACK’s design, and it is what makes the second request on a connection cost five bytes where the first cost thirty-eight. A block that will not decode is an answer, { error }, for the reason a session’s refusal is.

Where this sits

The module is named for the library and its names for the protocol, which is slate:llhttp‘s arrangement exactly — that one is llhttp and exports httpParser and httpFeed. What the two have in common is the tier, a door onto somebody else’s state machine, and naming them the same way is what says so. It also leaves HTTP/2’s own short name free for whatever a program eventually wants to import, which is the reason the HTTP server is slate:http and not slate:llhttp.

slate:nghttp2 is slate:llhttp‘s sibling, and it is public for the same reason: slate:http is the server a program wants, and these are the layers under whatever speaks HTTP next. A server that takes both versions on one port, a client that keeps its connections, a proxy, a gRPC endpoint — every one of those is an ordinary package rather than a change to slate.

The protocol itself is sh.sysl.nghttp2, the library curl, Apache and Envoy use. slate adds no HTTP/2 of its own: what is here converts values at the boundary and nothing else, which is the same arrangement slate:redis and slate:llhttp have with their own bindings.

slate:net

2026-09-06T00:36:22.158815252Z

`slate:net`

TCP, and TLS at both ends.

import { listen, connect, onData, onError, send, close, localPort, startTls } from slate:net

val server = listen(0, conn ->
    onData(conn, chunk ->
        if chunk == null
            close(conn)
        else
            send(conn, "echo: " + chunk)))

async main()
    val client = (await connect("127.0.0.1", localPort(server))).value

    onData(client, chunk ->
        if chunk != null
            print(chunk)
            close(client)
            close(server))

    await send(client, "hello")

main()


`listen(port, fn)` or `listen({ port, cert, key, alpn }, fn)`	a server
`connect(host, port)`	a promise of a result
`onData(sock, fn)`	each chunk as text, and `null` at the end
`onBytes(sock, fn)`	the same reader for something that is not text
`onError(sock, fn)`	a sentence, instead of that `null`
`send(sock, v)`	a promise of a result; an array is sent as bytes
`close(sock)`
`localPort(server)`
`remoteAddress(conn)`	the IP at the other end, or `null` where there is no other end
`startTls(sock, options)`	a promise that settles when the handshake finishes
`alpnProtocol(conn)`	which application protocol was agreed, or `null`

Under slate js this is node’s own TCP, and everything above is the same. TLS is the exception: startTls, and a listen given a cert and a key, both refuse there naming TLS. A browser has no sockets at all and says so.

Promises and callbacks

connect and send answer promises of a result; listen, onData and onBytes take callbacks. That split is not a matter of taste: a connect and a send are each one attempt with one outcome, which is what a promise is, and a listener does not have one connection any more than a connection has one chunk.

A refused connection is the ordinary thing a client handles, so it comes back as { ok: false, error: … } rather than stopping the program.

onData hands over null once the peer has finished sending — the end of a stream is a value here rather than a failure, because a peer closing its half is how a request ordinarily ends. Calling either reader a second time replaces the function rather than adding one, which is what makes a protocol that changes what it expects halfway through writable at all.

A socket that fails ends its stream — it does not stop the program. A connection reset is something any peer can produce, so it arrives as the same null a peer that finished sends: if chunk == null then close(c) is right either way. onError is how a program tells the two apart, and one that never registers a handler never hears about it. It is a registration of its own rather than a third argument to onData because onData replaces its callback.

Ports and names

A port of 0 asks the kernel to pick one and localPort says which.

remoteAddress says who connected, as the text a person would read it as — "127.0.0.1", "::1". A listener has no other end and answers null, which is an answer rather than a failure: asking a socket who is at the far end of it is asking about a thing that may not be there.

An IPv4 client of a dual-stack server is written the way it dialled. listen binds :: so that a client asking for localhost reaches the server, and the kernel then reports every IPv4 peer in the mapped form ::ffff:127.0.0.1. The prefix is taken off here, or an allow-list written against 127.0.0.1 would match nothing on a machine with IPv6.

connect takes a name or an address, resolving through libuv’s resolver on its thread pool. A name that does not resolve settles the promise the way a refused connection does, rather than raising.

Lifetime

A socket keeps the program alive, exactly as a timer does, so close is not optional; a program that leaves one open never exits. Closing twice is fine, which is what lets a server close its connections while a read callback closes its own.

A closed socket is not whatever opens next. The value a program holds carries the generation that claimed its slot, so a socket held across a close never comes to mean its successor.

TLS

A listener told a certificate hands out connections whose bytes are already decrypted, so slate:http — and any other protocol written over these sockets — is an HTTPS server without learning that TLS exists:

val server = listen({ port: 8443, cert: pem, key: keyPem }, conn -> …)

TLS is a transport and not an HTTP concern, which is why it goes under listen rather than beside serve. node splits it the other way, with an https module beside http; node’s https is literally http over a tls.Server, and putting the seam one layer down is that arrangement with the duplication left out. alpn beside them offers a protocol list.

The other end is startTls, which upgrades a socket that is already open:

async main()
    val db = (await connect("db.example.com", 5432)).value

    onBytes(db, read)

    val up = await startTls(db, { host: "db.example.com", trust: authority })

    if !up.ok then print(up.error)

ALPN, which is how HTTP/2 is chosen

A client offers a list of protocol names and the server picks one, and for HTTP/2 that is the whole of the negotiation — there is no upgrade handshake and no version header. Both ends say what they will take, and both read the answer off the connection:

val server = listen({ port: 8443, cert: pem, key: keyPem, alpn: ["h2", "http/1.1"] }, conn ->
    if alpnProtocol(conn) == "h2" then speakHttp2(conn) else speakHttp1(conn))

val up = await startTls(sock, { host: "example.com", alpn: ["h2", "http/1.1"] })

print(alpnProtocol(sock))

The server’s own order decides, because it is the end that knows which protocol it serves well. alpnProtocol answers null for three ordinary cases and no failure: a plain socket, a peer that offered nothing, and a handshake that has not finished — a server reads it inside its connection callback, by which time the handshake is long done.

slate:nghttp2 is what frames the bytes once h2 is what was agreed.

An upgrade rather than a flag on connect, because that is what protocols actually do. TLS from byte zero is one case and not the general one: PostgreSQL sends eight bytes in the clear and reads one back before any handshake, SMTP has STARTTLS, IMAP and FTP have their own, and a WebSocket over TLS is HTTPS first. It is also the weaker primitive — TLS from the start is connect and then this — so one builtin covers both where a flag would have covered neither.

A server upgrades its end the same way, with the certificate and key listen would have taken:

startTls(conn, { cert: pem, key: keyPem })

There is no third argument saying which end this is: a client has a name to check and a server has a certificate to present, and neither object could be mistaken for the other.

Everything after the handshake is unchanged: send takes plaintext, the reader is handed plaintext, and a program that writes before awaiting has its bytes queued rather than lost.

The name is checked against the certificate and there is no way to say otherwise. It goes out as SNI, without which a shared host does not know which certificate to send, and it is what the certificate’s names are verified against. An address works too and is checked against the certificate’s addresses rather than its names — which is why connect resolving matters here rather than being a convenience: verify against the name the program was looking for, not the address the resolver happened to answer with.

trust is added to the machine’s own store rather than put in place of it, so naming a private authority does not stop verifying everything else the program talks to.

Modules

2026-09-06T00:36:22.158815252Z

Modules

A file is a module. What another file can see is what it writes export in front of:

export val greeting = "hello"

export double(x) = x * 2

secret() = "no other file can reach this"

print(greeting, double(21), secret())

hello 42 no other file can reach this

and a file takes what it needs by name, or takes the whole module under one:

import { double, greeting as hi } from "./util.sl"
import * as util from "./util.sl"

print(hi, double(21), util.shout("go"))

export goes in front of a val, a var, a definition, a type, a class or a data. A type, class or data crosses as both halves at once — the value the name binds and the declaration the compiler resolves.

The three kinds of specifier

import { helper } from "./util.sl"      // a quoted path  -- a file
import { mount } from lath              // a bare word    -- a package
import { domHost } from lath/dom        // ... and one of that package's other modules
import { date, now } from slate:time    // slate:name     -- one of slate's own

A path is relative to the file the import is written in, so a directory of files that import each other works wherever the program is run from.

A bare util.sl is refused rather than guessed at: an unquoted specifier is how a package is named, and a language that resolved it as a file could not tell the two apart. The two are different syntax rather than two readings of one string, which is further from node’s rule than a ./ prefix would have been and is the point — nothing already written changes meaning, and no reader has to work out whether a leading ./ was optional.

See Packages for what a bare name resolves to, and the library for the slate: modules.

Importing a file that is not slate

A quoted path naming anything but .sl or .slx is an asset, and one name takes the whole of it as a string:

import styles from "./button.css"
import template from "./welcome.html"

print(len(styles))

The file is read while the program is compiled and travels inside it, so nothing has to sit beside the binary at run time and nothing is read twice — six files importing one stylesheet is one string. It is the same on both back ends: under slate js the text is written into the emitted program, byte for byte.

The extension decides, never what the writer meant. "./util.sl" is a module and "./button.css" is an asset, and each is refused in the other’s form:

import { helper } from "./styles.css"

is not slate source, so there are no names in it to take

and a bare name asked of slate source says the same thing the other way round — slate has no default export, and a file that does have names in it is imported by naming them.

A package’s assets are the package’s own. A .css shipped beside a .slx is imported by that file, relatively, and handed on as an ordinary exported value — so nothing about the package system had to learn what an asset is.

Two things are refused, both before the program runs. A file that is not there is named beside the file that asked for it. And a file that is not UTF-8 text is refused rather than mangled: slate has one text type, so there is no value a PNG could arrive as, and a program that wants bytes wants readBytes — which reads them while the program runs, where their size is not the program’s size.

Imports are resolved before anything runs

The machine never sees an import. That is not a preference: slate’s file surface is promise-shaped, so an import resolved at run time would need either a blocking read carved out as a special case or an import that answers a promise — and the second forces top-level await, which slate refuses, on every program that imports anything at all.

What it costs is that a path cannot be computed, which is the same bargain sysl takes and is what makes the set of files a program is made of knowable by reading it.

A module is an object

So there is no new kind of value and nothing new for the collector to trace — util.double is the field selection a program writes for itself.

It follows that a module’s exports are a snapshot taken when its file finishes: an export var the module changes afterwards is not seen changing from outside, which is where this parts company with TypeScript’s live bindings.

What is refused, and when

A circle of imports, with the chain named. node allows one and initialises half a module, which is a famous source of confusion; refusing can be relaxed later, and half-built modules cannot be un-shipped.
Asking for a name a file does not export — before the program runs, and the message says what the file does export. Left to run time it would arrive as an absent field, and the message would be about a name bound to nothing: true, and about the wrong thing.
A name nothing has bound, likewise before it runs.

Every complaint is drawn against the file it is about. A fault carries the file its span belongs to rather than looking one up when it is reported, because a signal outlives the statement that raised it.

slate:lmdb

2026-09-06T00:36:22.158815252Z

`slate:lmdb`

An ordered key-value store in a memory-mapped file — the one place a slate server can keep something across a restart without a second process being up.

import { lmdbOpen, lmdbWrite, lmdbRead, lmdbDb, lmdbPut, lmdbGet, lmdbCommit, lmdbAbort } from slate:lmdb

// The directory has to exist; LMDB writes `data.mdb` and `lock.mdb` into it.
val store = lmdbOpen("/var/db/sessions", { mapSize: 1 << 30, maxDbs: 4 })

val w = lmdbWrite(store)
val sessions = lmdbDb(w, "sessions")

lmdbPut(w, sessions, "s:abc", toJSON({ user: "ed", at: 1 }))
lmdbCommit(w)

val r = lmdbRead(store)

print(parseJSON(fromBytes(lmdbGet(r, lmdbDb(r, "sessions"), "s:abc")).value).value.user)
print(lmdbGet(r, lmdbDb(r, "sessions"), "s:nothing"))     // null — a key that is not there

lmdbAbort(r)

The blocks on this page are quoted rather than run, which is what every page here does for a module that needs somewhere on disk of its own: a program that made a store would be picking a path, and the one it picked would be the suite’s business rather than the reader’s. dev/slatelang/slate/tests_lmdb.sysl runs all of this against a real store in a directory of its own.

Why it is here

Every server slate is aimed at wants the same three things and had nowhere to put them: a session store, a rate-limit bucket per client, and a replay ring for the events a reconnecting browser missed. Each is small, is read far more often than it is written, and is worthless if it evaporates when the process restarts — and until this module the answers were a file rewritten by hand or slate:redis, which is a second process to run and a network hop for a lookup that should cost a page fault.

A read takes no lock and blocks nothing. Readers never block writers, writers never block readers, and there is exactly one writer at a time across the whole store and across every process using it. That last part is the trade — this is not the store for a write-heavy queue — and it is exactly right for the three uses above, where a write is a session being created and a read is every request after it.

A handle is an integer

An environment, a transaction, a database and a cursor are each a number into a table inside slate, which is what every handle in slate is — a socket, a timer, a compiled pattern, an HTTP/2 session. So == compares what slate says it compares, print has something to say, and a number from one table handed to a call that wants another is refused rather than misread.

The nineteen names


`lmdbOpen(path, options)` `lmdbClose(env)` `lmdbInfo(env)`	the store
`lmdbRead(env)` `lmdbWrite(env)` `lmdbCommit(txn)` `lmdbAbort(txn)`	a transaction
`lmdbDb(txn, name)` `lmdbClear(txn, db)` `lmdbStat(txn, db)`	a database inside it
`lmdbGet` `lmdbHas` `lmdbPut` `lmdbDelete`	one key
`lmdbCursor(txn, db)` `lmdbFirst` `lmdbNext` `lmdbSeek(cur, key)` `lmdbCursorClose`	a range

A key or a value may be text or bytes, and what comes back is always bytes. Text crosses as its UTF-8, which is what toBytes would have made of it and what would have gone onto a wire either way; LMDB records nothing about which of the two it was given, so fromBytes is how a program that wrote text reads it back.

A named database is itself a key in the unnamed one, which is where LMDB keeps the name-to-handle mapping — so the unnamed database of a store with three named ones has three keys in it before a program writes anything. Keep ordinary keys somewhere else, or behind a prefix.

lmdbDb(txn, null) is the store’s unnamed database, which is always there. A named one needs maxDbs to have been large enough at lmdbOpen, and — the first time — a write transaction, since making it writes. Whether it is created is decided by which transaction asked rather than by an option: a reader cannot write, so a reader asking for a database that does not exist wanted lmdbWrite.

What is an answer and what is a failure

A key that is not there is null, and lmdbDelete on one is false. A store is asked about keys it does not have as a matter of course — that is what a session lookup on a first request is — so the ordinary case must not be the exceptional one.

Everything else faults with a sentence. A store is opened once at start-up and every call after it is a program touching its own data, so there is no result to thread through every call site; a catch is there for the two that a running server really can hit, which are a full map and a disk that will not take a write.

`mapSize` is a hard ceiling and never a hint

LMDB reserves that much address space when the store is opened and never grows it. A write past it fails and the store has to be reopened larger — there is no growing it in place, and no amount of free disk changes that.

It costs nothing until it is used, the map being sparse, so naming a figure far larger than the data is the normal thing to do: a gigabyte for a session store is not a gigabyte of anything. lmdbInfo answers { mapSize, used, maxReaders, readers, lastTransaction }, and used against mapSize is the only meaningful fraction — the number of keys says nothing about how much room is left.

The default is 10 MB, which is deliberately small enough to be wrong for anything real. maxDbs defaults to 16, which is not LMDB’s own default of none: a program that asked for a database by name would otherwise be refused on its very first call.

Two readers at once, which is what most bindings get wrong

LMDB’s default gives each thread ONE reader slot, and a second read transaction on a thread that already holds one is refused with MDB_BAD_RSLOT — whose own message, “Invalid reuse of reader locktable slot”, reads as a damaged lock file rather than the design decision it is.

slate opens every store with MDB_NOTLS, which moves the slot onto the transaction. Two request handlers each holding a reader is the ordinary case here, so there is no option for this and a program cannot turn the refusal back on.

A transaction that is merely dropped aborts

That is the safe way round: a handler that throws halfway through a sequence of writes leaves the store as it was, and one that meant to keep the work has already said so with lmdbCommit. The end of a program does the same to everything still open.

lmdbClose ends every transaction still open on the store, cursors first, in the order LMDB requires — a server shutting down must not be stopped by a handler that was mid-write.

A cursor dies with its transaction. LMDB frees the transaction structure when one ends and a cursor holds a pointer into it, so a cursor used afterwards would be reading pages LMDB has reclaimed; slate refuses instead. lmdbCursorClose is for a long-lived reader making many walks, where the cursors would otherwise pile up until it committed.

A range is a cursor and byte order

Keys come out in byte order, so a prefix is a contiguous run: lmdbSeek(cur, "u:") moves to that key or the first one after it, and lmdbNext walks from there. That is the whole of a prefix scan, and it works whether or not u: is itself a key.

val cur = lmdbCursor(r, db)
var at = lmdbSeek(cur, "u:")

while at != null && startsWith(fromBytes(at.key).value, "u:")
    print(fromBytes(at.key).value)
    at = lmdbNext(cur)

lmdbFirst starts at the beginning, and the end of a walk is null.

What is not here

A session store, a token bucket, a replay ring. Each is a key layout and an expiry rule — a policy — and policy belongs in a package rather than in the compiler. What is here is the store they are all written over, which is slate:llhttp‘s arrangement exactly: the state machine is slate’s and what is built on it is not.

Duplicate-key databases, custom orderings and nested transactions, all of which LMDB has. None has been needed yet, and a comparator that disagrees between two openings of one database corrupts it silently — a sharp enough edge to want a design rather than a wrapper.

The interpreter only

No JavaScript host has LMDB and every name here refuses under slate js. A browser has no memory-mapped file at all — IndexedDB and the Origin Private File System are what a page stores things in, and neither is an ordered B+tree walked with a cursor — and node has no LMDB in its standard library either: every binding on npm is a native addon, so a compiled program would depend on something the tool cannot see and did not install.

So this is a refusal naming LMDB rather than a not in the JavaScript back end yet stub, which is slate:brotli‘s case and gets its treatment. docs/reference/javascript.md lists it with the rest.

The library

Not vendored — LMDB is the library the machine has: brew install lmdb on macOS, liblmdb-dev on Debian and Ubuntu, lmdb on Arch. pkg-config finds it on all three.

slate:llhttp

2026-09-06T00:36:22.158815252Z

`slate:llhttp`

The HTTP parser itself — the state machine under slate:http.

import { httpParser, httpFeed, httpTake } from slate:llhttp

httpParser httpStream httpFeed httpTake httpTakePart httpFinish httpClose httpUpgraded

This is the lowest module slate has, and it is public on purpose. slate:http is the server a program wants; this is for the programs that want something else — a proxy, a client that keeps its connections, a test double that has to answer exactly the bytes it was asked about, or a protocol that begins as HTTP and then stops being it. Every one of those is an ordinary package, where otherwise it would have been a change to slate.

Node hid the same seam and its own client had to route around it: undici carries llhttp compiled to wasm because internalBinding('http_parser') is not reachable. Two parsers in one process is the cost of that policy.

The names keep their http prefix rather than being shortened to fit the module. They are the seam slate:http is written against and they are spelled this way inside it, so a reader moving between the module’s source and a package that uses the same calls sees one vocabulary.

Under slate js the grammar is written out rather than bound, node’s own parser being unreachable from a program — which is the seam node hid and the reason undici carries llhttp compiled to wasm. The two readings answer the same things about the same bytes, which is what tests/js/p26.sl is for; a browser has no sockets to read from and every name refuses there.

Lexical structure

2026-09-06T00:36:22.158815252Z

Lexical structure

What the compiler reads before it reads anything else: files, whitespace, names and literals.

Files

A slate program is a .sl file. A file that writes elements is conventionally .slx, after .tsx — but the extension says nothing to the compiler, which parses both the same way, and elements are read in every file. It is a name for a reader and an editor.

A file with a #! line on its first byte is a command. slate skips that line and everything after the program’s name on the command line belongs to the program:

#!/usr/bin/env slate

import { args, exit } from slate:process

if args.len() == 0
    print("usage: greet <name>...")

for name in args
    print("Hello, " + name + "!")

usage: greet <name>...

#! is read at the very first byte and nowhere else. # is not a comment in slate.

Comments

// to the end of the line. There is no block comment.

Indentation is structure

slate is off-side ruled, as Python and sysl are. A block is opened by indenting under the line that introduces it and closed by returning to the outer column.

A newline inside brackets means nothing, which is what lets an argument list or an array literal be split across lines. Two tokens suspend that rule, and only where they end a line: -> and match. Either one at the end of a line opens a block even inside brackets, which is what lets a callback with a real body be written where it is passed:

forEach([1, 2, 3], x ->
    val doubled = x * 2
    print(x, doubled))

1 2
2 4
3 6

An arrow written mid-line would hand the block to whatever line came next, so it does not open one.

A block lambda has to be the last argument, because its block runs to the end of its last line and a , arriving there has nothing to mean.

A trailing operator does not continue a line. a + followed by b on the next line is two statements, not a sum. Where an expression has to span lines, brackets are what say so — inside them the off-side rule is suspended and the continuation is unambiguous:

isShort(n) = len(n) < 4
isKnown(n) = n == "ada"

val name = "ada"
val ok = (
    isShort(name) ||
    isKnown(name))

print(ok)

true

`end`, and the closing words

A block that has grown long enough to want a closing marker takes one: end if, end while, end for, end loop, end <name> for a definition or a class. end is a soft word — a program may still call something end — and so are class, data and type.

Names

An identifier is a letter or _ followed by letters, digits and _. Names are case-sensitive.

The type words are not keywords. null, boolean, integer, real, number, string, array, object, function, date, time, zone and the rest of the twenty-one listed in Patterns are ordinary names in expression position — val int = 3 and val date = readIt() both work — and are read as type tests only in pattern position.

There are no abbreviations. It is boolean and function, never bool and fn; a short form is refused with the long one named.

A keyword may name a FIELD, as it may in JavaScript — after a ., in an object literal, in a with, and as a pattern’s key. A word the grammar happens to use is not a word a program controls: somebody else’s JSON has an if in it.

val o = { with: 1, if: 2, match: 3 }

print(o.with, o.if, (o with { if: 9 }).if)

val { if: n } = o

print(n)

1 2 9
2

A keyword still may not name a BINDING, so the { name } shorthand has nothing to introduce where the key is one, and says so:

val { with } = { with: 1 }

is a word the grammar has taken

Literals

val text = "it"

print(null, true, false)
print(42, -7, 1_000_000)
print(0xff, 0b1011, 0o17)
print(3.14, 2e10, 1e-3)
print("text", s"interpolated ${text}")
print([1, 2, 3], [0; 5])
print({ a: 1, b: 2 })
print(0..<3, 1..10)

null true false
42 -7 1000000
255 11 15
3.14 2e+10 0.001
text interpolated it
[1, 2, 3] [0, 0, 0, 0, 0]
{a: 1, b: 2}
0..<3 1..10

An integer may be written in hexadecimal, binary or octal, and _ may be written between digits of any of them.

Integers and reals are separate values, not one numeric type. An integer is 64 bits, wraps, and divides towards zero.

Every comma list takes a trailing comma: an array, an object, an argument list, a parameter list.

[v; n] is an array of n copies of v.

Strings

A string literal is double-quoted with the usual escapes (\n, \t, \\, \", \u{...}). There is no single-quoted form and no character type — a single character is a string of one.

An s-string interpolates:

val w = 3
val h = 4
val point = { x: 7 }

print(s"${w} by ${h}")
print(s"$w by $h")           // the same thing
print(s"$point.x")           // interpolates `point`, then `.x` is text
print(s"${point.x}")         // says the other thing
print(s"costs 5$")           // a `$` that begins no name is just itself
print(s"$$")                 // a literal `$`

3 by 4
3 by 4
{x: 7}.x
7
costs 5$
$

A hole that is a single name needs no braces. The short form is identifier-only and stops at the end of the name, which is why $point.x and ${point.x} differ.

There is no raw string. A backslash in a string is an escape wherever it appears, so a regular expression written as a literal doubles its backslashes: regex("\\d+").

What a program never writes

There is no undefined, no NaN that spreads, and no Invalid Date. Each of those is a value that travels through a program silently changing what everything downstream computes, and slate has none of them: the equivalent situation is either a null the program can test or a fault it can catch.

slate:jwt

2026-09-06T00:36:22.158815252Z

`slate:jwt`

JSON Web Tokens, written in slate.

import { sign, verify, decode } from slate:jwt

val token = sign({ sub: "alice", exp: when + 3600 }, secret, "HS256")
val r = verify(token, secret, "HS256")


`sign(claims, key, alg)`
`verify(token, key, alg)`	a result
`decode(token)`	the claims, unverified

The algorithm is an argument because the `alg` header is not to be trusted

That is the whole security of the thing. A verifier that read the algorithm out of the token it is checking accepts whatever an attacker wrote there — alg: none was accepted by most libraries for years, and the RS256-public-key-used-as-an-HMAC-secret confusion turns a published key into a signing key.

The caller says what it expects, the header is compared against it before a signature is checked at all, and a token that disagrees is refused there.

HS256/384/512, RS, PS and ES.

Three arguments and no options object

All three are decisions the caller has to make, and an option is for what has a sensible answer when nobody says. Extra header fields — kid, above all — go in the claims under header, and are taken out rather than signed: a claim called header would be a surprising thing to find in a payload you signed.

The two channels

A malformed token, a bad signature and an expired claim are all answers, because a program handling requests wants to say 401 and carry on. A key that is not a key faults, being the program’s own mistake.

An HMAC tag is compared in constant time, and that is not superstition: a comparison that stops at the first differing byte tells an attacker how much of a forged tag was right. The asymmetric algorithms need no such care, verifying a signature not being a comparison.

JavaScript

2026-09-06T00:36:22.158815252Z

JavaScript

$ slate js hello.sl -o hello.js

slate js reads the same tree the interpreter walks and writes one self-contained JavaScript file — the runtime, any framework, and the program. There is no bundler, no node_modules, and nothing to install beside it. The output runs under node, under quickjs, and in a browser.

slate test --js . compiles a whole directory into one program and runs it under node, reporting in the same words slate test does. A test is written about the language rather than about an implementation of it, so the same file is the check that the two back ends have not drifted apart — which is worth more than it sounds, since a test driving the interpreter says nothing whatever about slate js.

The value model

An integer is a BigInt and a real is a number, and every operator goes through the runtime. This is the decision everything else follows from, and it is not caution: slate’s integer is 64 bits, wraps, divides towards zero and shifts to 63 places, and a double does none of those — nor could it be told from a real afterwards, so 2.5 is integer would answer whatever the value happened to look like.

The operators follow because the two languages disagree too often for the exceptions to be worth tracking:

	slate	JavaScript
`7 / 2`	`3`	`3.5`
`0` in a condition	true	false
`[1] == [1]`	true	false
`1 << 40`	2^40	256

One thing print says differently, and it is not closable cheaply. A promise prints as <promise pending>, <promise 5> or <promise failed: …> in the interpreter and as <promise> here: a JavaScript promise does not expose its state synchronously, and wrapping every promise in the runtime so that print could read one would cost every await in every program to improve a debugging accident. Printing a promise is not something a program’s output should depend on either way.

What is not there yet

slate:process‘s run, slate:redis, slate:nghttp2, and TLS. Each is a name that says “not in the JavaScript back end yet” when a program reaches it, rather than a name that is not there — so a program is told which half of the world it is in. No global is on that list any more; fetch was the last and has its own section below.

slate:net and slate:llhttp came OFF that list in 0.0.31, and they are what everything above a socket stands on — see the section below. What is still owed of the transport is TLS: startTls refuses naming it, and listen given a cert and a key refuses in the same words, so an HTTPS server is the interpreter’s for now.

slate:zstd is WHOLE here on node and absent in a browser, which is the same rule read twice. node has carried Zstandard in zlib since 22.15, so zstd and unzstd are the host’s own there; no browser has a CompressionStream("zstd") and none is coming, so both refuse in a page naming zstd. The frames are not compared between the back ends and cannot be — node links its own copy of libzstd and the interpreter links the machine’s, so two encoders at one level may frame the same input differently and both be right. tests/js/p27.sl compares the round trip and every refusal instead.

slate:image is NOT on that list either, and its two hosts refuse for two different reasons. node has no image support in its standard library at all — every reader anybody uses is an npm dependency — so “not yet” would be a promise nothing can keep without one. A browser does decode, through createImageBitmap and OffscreenCanvas, and is refused anyway: the whole of that surface answers promises where readImage and its four siblings answer on the spot, so a browser half would make the two back ends disagree about what an image is. That is crypto.subtle‘s rule again — a host that has a thing only in a different shape does not have it — and it means slate:image is a server’s module.

slate:crypto‘s ARGON2 IS node’s OWN AND A BROWSER HAS NONE, which is slate:zstd‘s rule read once more. node carries Argon2id in its core crypto — crypto.argon2 — so argon2 and argon2Verify are the host’s there, and the records are compared between the back ends rather than merely round-tripped: node and monocypher derive the same bytes for the same parameters, so tests/js/p30.sl verifies a record the interpreter made against a fixed salt and the interpreter verifies one node made. A digest that agreed with itself and with nothing else would still be caught.

The web platform has no Argon2 at all, and crypto.subtle is not a near miss. Its deriveBits speaks PBKDF2 and HKDF, both fast by construction and neither memory-hard — so building the page half on one of those would be a password hash weaker than the same program gets on a server, under the same name, silently. Both refuse in a page, naming Argon2 and saying what a browser has instead.

argon2NeedsRehash works everywhere, including in a page. It derives nothing — it reads the parameters out of the record and compares them — so it is a string parse, and a page that stores records it cannot make can still say which of them are due to be re-made.

slate:sqlite is WHOLE here on node and absent in a browser, which is slate:zstd‘s answer read again. node has carried node:sqlite since 22.5, so the module’s floor is DatabaseSync there and the machine’s libsqlite3 here, with one piece of slate source above both — the same object with the same five methods either way. A page has no SQLite of any kind (IndexedDB is not this, and Web SQL is long deprecated), so every name refuses there naming node’s module.

The one thing the JavaScript floor has to compute that the interpreter is told is how many parameters a statement takes: node exposes no sqlite3_bind_parameter_count, and without it the two would disagree about the commonest mistake there is — node binds SQL NULL for a ? nobody gave, so where id = ? called with nothing runs, matches nothing and says nothing. js_rt_sqlite.sysl reads the count off the SQL, which is what lets both back ends refuse it with one sentence. tests/js/p28.sl compares the storage classes, the transaction, the full-text search and every refusal.

slate:brotli is NOT on that list, and the difference matters. No JavaScript host has a brotli encoder and none is coming, so “not yet” would be a promise nobody can keep. compress and decompress say that they are brotli, that a JavaScript host has none, and that slate:gzip is the compression a browser does have. That is abbrev‘s case below, drawn the same way.

slate:lmdb is not on that list either, and all nineteen of its names refuse. A browser has no memory-mapped file at all — IndexedDB and the Origin Private File System are what a page stores things in, and neither is an ordered B+tree walked with a cursor — and node has no LMDB in its standard library: every binding on npm is a native addon, so a program compiled by slate js would depend on something the tool cannot see and did not install. Each refusal names the call, says it is LMDB, and says the module runs in the interpreter only.

`slate:gzip` is whole here, and the container is read by slate rather than by the host

This is the module the parity rule was written for. A browser has CompressionStream and DecompressionStream, which speak gzip, zlib and raw deflate — so gzip and zlib are compression a slate program can count on anywhere, where brotli is not.

import { gzip, gunzip } from slate:gzip

async main()
    val small = await gzip(repeat("<p>hello</p>", 40))
    val back = await gunzip(small, 1 << 20)

    print(back.ok, fromBytes(back.value).value == repeat("<p>hello</p>", 40))

main()

true true

All four names answer promises on BOTH hosts, and that is the whole shape decision. A CompressionStream is a TransformStream; there is no synchronous door to it, and slate’s rule is that a host with a thing only in a different SHAPE does not have it. Nothing held the signature yet — the module is new — so it was written promise-shaped everywhere rather than synchronous in one place and refusing in the other. The interpreter compresses with miniz and answers a promise it has already settled.

The gzip header and trailer are parsed by slate on both back ends, and only the deflate body goes to the host’s stream. That is what makes the refusals the same sentence wherever a program runs: the magic bytes, the compression method, a header that ends early, the limit, the stated length and the CRC-32 are all slate’s own checks, and the CRC is computed here rather than taken from anybody.

One sentence is not shared, and it is the body itself. miniz says whether a stream that would not inflate was truncated or corrupt; a host’s decompressor throws one TypeError for both, and for a wrong checksum too. So where the interpreter says this compressed stream ends in the middle or this is not a compressed stream at all, a JavaScript host says this compressed stream could not be read — a plain statement rather than a guess dressed as a finding. zlib’s own two-byte header is checked here as well, so the common case — something that is not a zlib stream at all — does read the same on both.

`slate:crypto` is whole here, and WebCrypto is not how

The five digests, hmac, pbkdf2, randomBytes and timingSafeEqual all work, and answer what the interpreter answers:

import { md5, sha1, sha256, sha512, hmac, pbkdf2, randomBytes, timingSafeEqual } from slate:crypto

val digits = "0123456789abcdef"

hex(bs) = join(map(bs, b -> digits[b / 16] + digits[b % 16]), "")

print(hex(sha256("abc")))
print(hex(md5("abc")), hex(sha1("abc")))
print(hex(hmac("SHA-256", "key", "message")))
print(hex(pbkdf2("SHA-1", "password", "salt", 4096, 20)))
print(len(randomBytes(32)), timingSafeEqual("abc", "abc"), timingSafeEqual("abc", "abd"))

ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
900150983cd24fb0d6963f7d28e17f72 a9993e364706816aba3e25717850c26c9cd0d89d
6e9ef29b75fffc5b7abae527d58fdadb2fe42e7219011976917343065f58ed4a
4b007901b765489abead49d926f721d065a429c1
32 true false

crypto.subtle IS NOT USED, AND THAT IS THE DECISION EVERYTHING HERE FOLLOWS FROM. The web platform’s only digest is asynchronous and always has been — there is no synchronous hash in a browser at all — so a sha256 built on it would answer a promise here and a byte array under the interpreter. Two back ends disagreeing about the shape of an answer is worse than either being slow, and it would have taken a breaking change to the interpreter to fix, over a call that costs microseconds. So the digests are written out in JavaScript and stay synchronous. md5 would have had to be anyway — WebCrypto has never carried it — so four asynchronous digests and one synchronous was never on offer.

What that costs, measured on node: PBKDF2-HMAC-SHA256 at 100,000 iterations is 176 ms here against 7 ms for a native library, and SHA-256 runs at about 280 MiB/s against 3 GiB/s. Roughly 25× either way. It matters for exactly one call — a key derivation, which is the one thing here designed to be slow — so an iteration count is worth choosing with a browser in mind: 600,000, which is OWASP’s current recommendation for SHA-256, is about a second of a page’s main thread.

randomBytes is the one name that reaches for the host, and the host has it. crypto.getRandomValues is synchronous everywhere, which is what lets the whole module stay synchronous — the half of slate:crypto that cannot be written out at any price is the half a browser does supply.

The asymmetric half of JWS is the one thing that refuses. slate:jwt‘s HS256, HS384 and HS512 are HMAC under a JOSE name and work here in full; RS*, PS* and ES* are RSA and ECDSA, whose only implementation in a browser is crypto.subtle‘s and answers a promise where jwsSign answers bytes. That refusal names the algorithm and the reason, so a reader knows the fix is a choice rather than a wait.

`slate:time` is whole, except for two things a JavaScript host does not have

An instant, a duration, the clock that reads one and the arithmetic over both work exactly as they do under the interpreter:

import { epochMillis, epochSeconds, seconds, minutes, hours, now } from slate:time

val t = epochMillis(1756900000000)

print(t)
print(t + minutes(90), (t + hours(2)) - t)
print(hours(1) + minutes(30), minutes(hours(1) + minutes(30)))
print(epochSeconds(t), now() is instant)

2025-09-03T11:46:40Z
2025-09-03T13:16:40Z 2h
1h 30m 90
1756900000 true

And so does the calendar. date, time, dateTime, zone, zoned and period are built over Intl — the value model, the arithmetic, startOf, onOrAfter, format and the four parsers — and answer what the interpreter answers:

import { date, dateTime, zone, epochSeconds, days, hours, months, parseDate } from slate:time

val toronto = zone("America/Toronto").value
val t = epochSeconds(1719792000).at(toronto)

// The Saturday evening before the clocks go forward, which is where a day and twenty-four hours
// stop being the same length.
val night = dateTime(2024, 3, 9, 20, 0).at(toronto).value

print(t)
print(t.year(), t.monthName(), t.weekday(), t.hour())
print(t.format("WWWW, MMMM D, Y |at| h12:mm a"))
print(date(2024, 1, 31) + months(1), night + days(1), night + hours(24))
print(dateTime(2024, 3, 10, 2, 30).at(toronto).error)
print(parseDate("2024-02-30").error)

2024-06-30T20:00:00-04:00[America/Toronto]
2024 June Sunday 20
Sunday, June 30, 2024 at 8:00 pm
2024-02-29 2024-03-10T20:00:00-04:00[America/Toronto] 2024-03-10T21:00:00-04:00[America/Toronto]
2024-03-10T02:30:00 never happens in America/Toronto -- the clocks go from -05:00 to -04:00 -- say `.at(zone, "after")` to take the reading past the gap
cannot read "2024-02-30" as a date: day is out of range

The worry that kept the calendar out was that a zone read from Intl and a zone read from the IANA database are two answers to one question, and a program saying what time a meeting is in Toronto may not get a different answer for having been compiled rather than interpreted. That was a worry rather than a measurement, and it has been measured: every zone this machine has, 598 of them, at six instants. The two agree on all 2985 readings from 2000 through 2025.

Two names still refuse, and neither is owed work — they are things the host does not have.

abbrev, because Intl has no IANA abbreviation at all. What its timeZoneName options carry is CLDR’s English display data, which agrees with tzdata for American zones by coincidence and nowhere else. Measured on one instant:

zone	IANA	`short`	`long`
`America/Toronto`	`EDT`	`EDT`	Eastern Daylight Time
`Europe/London`	`BST`	`GMT+1`	British Summer Time
`Asia/Kolkata`	`IST`	`GMT+5:30`	India Standard Time
`Africa/Cairo`	`EEST`	`GMT+3`	Eastern European Summer Time

67 of 84 readings disagree, and shortGeneric is worse — “United Kingdom Time”. zzz in a format pattern is the same name under another spelling and refuses with the same sentence.

isDST, because Intl exposes no daylight-saving flag, and the offset-comparison rule every JavaScript date library uses instead is unsound in both directions. Over 3582 readings it is wrong at 31 of them:

it misses a zone that is permanently on daylight time. Africa/Casablanca and Africa/El_Aaiun are +01 all year with tzdata’s flag set, and every Argentine zone was in 2000. No comparison of offsets can see a flag that never changes.
it invents one for a zone that moved its standard offset mid-year. Asia/Almaty and Asia/Qostanay went +06 to +05 in March 2024, so January’s offset exceeds May’s and the rule reads January as daylight time.

The second half is what settles it: the failure is an ordinary permanent offset change rather than an exotic zone, so there is no version of the rule that under-reports safely.

The alternative to both — a table of zone rules carried in slate’s own JavaScript runtime — was considered and refused. It would answer them, which is what makes it a decision rather than an oversight. It is refused because it is a second copy of tzdata: an authority the runtime would hold against the one the interpreter reads from the system database, kept in step by hand, in a place nobody looks until a zone changes and only one of the two back ends notices. The measurement above is exactly the drift that copy would reintroduce.

One thing the measurement DID find, and it is nobody’s defect. The two back ends read two copies of tzdata — the interpreter reads the host’s /usr/share/zoneinfo and a JavaScript engine reads the release bundled into its ICU — and those are not always the same release. On this machine they were 2026c and 2025c, and the seven readings out of 3582 where the offsets disagreed were all at 2038-01-01, in zones whose future rules changed in the release between. Each back end reads the database its host has, which is what both are supposed to do; a program that pins a projected offset decades out is pinning the skew rather than the calendar.

An instant is a whole number of milliseconds from the clock on both back ends, Date.now() having nothing finer — the interpreter drops its microseconds to match. An instant a program builds keeps every digit: epochMicros(1000000001) is exact wherever it runs.

slate:dom is the other way round: it works only here. Under the interpreter every one of its names faults with a sentence naming the command rather than the code, because the same program is correct in a browser and it is the command that is wrong.

`slate:regex` is whole here, and a pattern is TRANSLATED rather than handed over

RegExp is not PCRE2. slate’s patterns are Perl’s — that is the whole reason regex.sysl is on sh.sysl.pcre2 rather than on POSIX — and a browser has one regular expression engine. So every pattern is read through a translator on its way in, and what a construct gets depends on how the two engines differ over it: an exact equivalent is translated, something RegExp does not have is refused naming the construct, and something both engines accept while meaning different things is translated too, because that is the one kind a program could get wrong with nothing refusing it.

import { regex } from slate:regex

print(regex("(?<y>\\d{4})-(\\d{2})").find("on 2026-08").named.y)
print(regex("[[:alpha:]]+").find("42abc!").text)
print(regex("\\p{Greek}+").find("ab\u{3b1}\u{3b2}!").text)
print(regex("\\s").test("\u{a0}"), regex("a.b").test("a\rb"))
print(regex("(\\w+)@(\\w+)").replace("a@b and c@d", "$2 at $1"))
print(len(regex("$").findAll("abc")), regex("a*").split("bb").join("|"))

2026
abc
αβ
false true
b at a and d at c
1 |b|b|

Three constructs mean different things in the two engines, and every one is a silent wrong answer rather than an error. They were measured through this project’s own PCRE2 and through node:

\s. PCRE2 here is not in UCP mode, so \s is the six ASCII spaces; RegExp reads it as every Unicode space, twenty-five of them. A record split on \s would cut on a no-break space in a browser and not in the interpreter. \s, \S, \h, \H, \v, \V and every POSIX class are written out as their ranges.
.. PCRE2’s excludes the newline. RegExp‘s also excludes the carriage return and the two Unicode line separators, so it becomes [^\n].
^ and $ under m, for the same reason and in the same three characters. They become lookarounds, and RegExp‘s own m is never set.

What is refused, and why none of it is work owed. A browser’s regular expressions have no possessive quantifier a*+, no atomic group (?>…), no branch reset (?|…), no recursion (?R), no conditional (?(1)…), no \K, \G, \C or \X, and no modifier that runs to the end of a pattern ((?i) — the scoped (?i:…) does work). Each is refused where the pattern is written, in a sentence naming the construct.

A lookbehind is the one place RegExp is the LOOSER engine, and it is refused here so that the two agree: PCRE2 will not compile a lookbehind whose length is unlimited — (?<=ab*)c is “length of lookbehind assertion is not limited” — and RegExp takes anything. A bounded one compiles on both, (?<=ab?)c and (?<=a{2,3})c included. The other place RegExp used to be looser closed itself: a range with a class at one end, [\d-x], is refused by the u flag exactly as PCRE2 refuses it.

u is always set, and that is what makes an offset a character. Without it RegExp counts a subject in UTF-16 code units, so ^.$ says an emoji is two and every offset after one is too big; PCRE2 is in UTF mode and counts characters. The offsets a match reports are converted back in one walk of the subject, which is what regex.sysl does for the other back end.

Three differences are left standing and are named here rather than closed.

A backreference to a group that took no part in the match fails under PCRE2 and matches the empty string under RegExp — (?:(?<n>a)|b)\k<n> is false against "b" in the interpreter and true here. It is a property of the run rather than of the pattern text, so nothing could be scanned for; refusing every pattern with a backreference in it would refuse most real ones.
Under i, a JavaScript host counts U+017F and U+212A as word characters, its u mode folding them into s and k where PCRE2’s \w stays ASCII. That is exactly two code points and only under i. Closing it would mean rewriting every character class through the v flag’s set subtraction, which is a much newer thing to require of a browser than the difference is worth.
There is no backtracking budget here. PCRE2 gives up on a pattern that would backtrack forever and raises a fault naming it; RegExp has no such limit in any browser, so (a+)+$ against a subject that does not match stops answering rather than complaining. That is a thing a JavaScript host does not have.

`slate:net` is node’s own TCP, and the request parser is written out

This is the floor everything else stands on, and it was missing. slate:http is written in slate over listen, onBytes, send and close, so a server could not be started under slate js at all — and a framework checking its router by rendering a page through a real request had two tests skipping on every run for want of a listener.

A socket is a slot and a generation, exactly as it is in the interpreter, so nothing of node’s crosses into a slate value: == compares what slate says it compares, print answers <socket 3>, and a socket held across a close never comes to mean whatever opens next.

A BROWSER HAS NO SOCKETS AND NEVER WILL, so this is node’s half of the JavaScript world. Nothing in a page may listen and nothing in one may open a TCP connection; the refusal there names the host rather than promising anything, which is slate:brotli‘s case and not run‘s.

The reader is installed at the first onData or onBytes and never at accept. A node socket is paused until something listens for data, and slate’s rule is that a connection handed to a program is the program’s to read when it is ready — installing earlier would drain the first packets of every connection into a callback nobody had registered, which is a request lost with nothing to say so.

alpnProtocol is here and answers null for a plain socket, which is what the interpreter answers and is what slate:http reads at the first byte of every connection to tell HTTP/2 from HTTP/1.1. A name that refused would make every serve fault over a question whose answer is no.

slate:llhttp is a PARSER here rather than a binding, and it is the one place the two back ends do not share an implementation of something they both have. The interpreter’s is llhttp, a C state machine generated from a grammar; node’s own is behind internalBinding('http_parser') — the seam node hid, and the reason undici carries llhttp compiled to wasm. So the HTTP/1.1 request grammar is written out, and tests/js/p26.sl is what says the two readings agree: the request line, the headers, Content-Length and chunked framing, pipelining, a head split across two arrivals, an upgrade and where the HTTP stopped, and the three refusals — 400 for bytes that were not HTTP (including two Content-Length headers, and one beside a Transfer-Encoding), 431 for a head over the limit and 413 for a body over it.

A message’s own error text is the host’s, which is the one thing that cannot be made to match: a refused connection carries node’s ECONNREFUSED: … where the interpreter carries libuv’s. The code is the same word on both, that being the operating system’s.

`slate:ws` is a CLIENT here, and the server half is what a browser cannot have

A browser has no socket, so nothing that listens can exist there: accept and the upgrade seam it sits on refuse under slate js, because listen does. What a page can have is a client, and it has one already — the WebSocket object — so that is what open(url) becomes here.

It is the same Connection either way and the module chooses which implementation answers. Everything about the protocol that needs no socket is slate’s on both hosts: the framing, the masking, the fragment reassembly, the accept value and the reading of a url. What differs is only who owns the bytes.

ping refuses here, and it is the shape case rather than a missing feature. The protocol has a ping and the browser’s object does not expose one: a page cannot write a control frame at all, the browser answering the server’s pings on the page’s behalf. So ping says that, and a program needing a round trip sends an ordinary message.

A Blob is never handed to a program. A browser’s message event carries binary as a Blob by default and a Blob is read asynchronously, which would make onBinary answer at some later turn here and at once in the interpreter; the connection sets binaryType to arraybuffer on the way in.

hostHas(name) is how the module asks, and it is not a name a program can write. It is declared into the scope a built-in module’s source compiles in — the same place sha1 and jwsSign live — and answers whether the host provides a thing ITSELF, which is a different question from whether slate has one. The interpreter answers no to all of them: it speaks WebSocket over its own socket, compresses with miniz and fetches over OpenSSL, and in each case there is nobody else’s implementation to use.

compression is two globals and one question. A host with a CompressionStream and no DecompressionStream does not compress, so hostHas("compression") wants both.

`fetch` is the host’s own, and two things about it are the host’s too

A browser has fetch, so this was work owed rather than something the host lacks. What had to be written is the shaping: the host answers a Response and slate answers { ok, value } with a status, a headers object of lower-cased names, and a body. A server that cannot be reached is { ok: false, error }, never a rejection — which is fetch‘s rule in slate whichever host answers.

The URL is read here and not left to the host. gopher://x/ is a mistake neither host has anything to do with, so both back ends answer “gopher://x/ is not an http or https URL” rather than slate’s sentence in one place and the browser’s in the other. That is slate:ws‘s rule for open, drawn the same way.

trust refuses, and it is the shape case rather than a missing feature. It names a certificate to trust as well as the machine’s own, and no JavaScript host lets a program add a trust anchor for one request. A refusal is the only safe answer: a program that believes it pinned a certificate and did not is worse off than one told it cannot.

The redirect rule is the host’s here. The interpreter follows at most five and refuses one that leaves https for http. A browser follows redirects itself, and redirect: "manual" does not hand a page the location back — a cross-origin redirect comes back opaque, with no status and no headers to read — so a page cannot implement that rule at all, and doing it on node alone would make the two JavaScript hosts disagree with each other. This is ping‘s case in slate:ws: the host does the thing and gives the program no way in.

A body that is not UTF-8 is "" on both, which took a decision here: a host’s text() replaces every bad byte with U+FFFD, so the response would come back as replacement characters here and as "" there. The bytes are decoded strictly instead and the failure is caught.

A response header that repeats is joined with ", " on both, and the interpreter changed to match. It used to keep the last, which silently threw one away — an object has one value per name and HTTP does not. A Headers object is what a JavaScript host hands over, already combined and with no way to ask for the lines back, so combining is the only reading both can give; RFC 9110 allows it in as many words.

Set-Cookie is excluded from that by the same section, and is a list of the lines on both. A cookie carries commas of its own, so a joined value cannot be taken apart again; Headers has getSetCookie() for exactly this reason and that is what is read here. In a browser it is absent however many arrived — Set-Cookie is a forbidden response-header name and a page never reads one, though the browser still applies the cookie. That is ping‘s case again: the host does the thing and gives the program no way in.

Which response headers are readable at all in a browser is CORS’s decision and not slate’s.

`slate:dom` has three more doors, and they are the rule read from the other side

location(), the history calls and localStorage are things a browser has and nothing else does. So the interpreter and node both refuse them — naming which of the three, because they are three different mistakes — where everything else in this file is a name a browser has that slate had not yet reached.

No history state object, and that is a measurement rather than a simplification: pushState structured-clones what it is given, and structuredClone strips the prototype, so a slate object put in comes back a plain object carrying a fields map that nothing in the language could read. The url is the whole of the state.

A push does not raise onNavigate — a browser raises popstate for a movement the user made and never for one the program made itself.

A browser’s print is the print dialog, and the runtime used to reach for globalThis.print as its writer, so a page’s every print("hi") asked which printer to use and wrote nothing. quickjs is why that global is looked at at all — it is quickjs’s writer and has no relation to the window method of the same name — and a document is what tells the two apart. check/ in slate’s own repo drives all of this against jsdom.

And four that READ the page, for a program adopting markup it did not write

children(node), tagName(node), nodeText(node) and attribute(node, name) are the read side, and they refuse under the interpreter exactly as the write side does and for the same reason. They exist because hydration cannot be written without them: a framework adopting a server’s markup has to walk what is there and ask what it found, and until 0.0.28 slate:dom could build a page and could not read one.

A handle for an element the program never created is not new — byId and query have minted one since the module shipped — so what these add is the walk rather than a kind of value. parent, the siblings and an innerHTML reader are deliberately absent: a page is walked downwards from something the program already holds, and the rest is a general traversal API.

Case, whitespace and the normal forms are one operation, and that took proving

Nothing in this section is a difference, which is worth saying in a chapter that is otherwise a list of them. upper, lower and normalize are the host’s own here — toUpperCase, toLowerCase and String.prototype.normalize — and the interpreter’s side was written to reach the same answers rather than defensible ones: every code point there is was run through both back ends and compared. So upper("ß") is SS on each, İ lowercases to two characters on each, and a sigma ending a word is ς on each.

That is not what a per-character walk over a case table gives. A hundred and two characters uppercase to more than one, so the interpreter carries a table for those; İ and the final sigma are the two cases going the other way, and the second is context rather than a table.

trim calls neither host’s own, and it is the one of the four that could have. ECMAScript’s whitespace is not the database’s White_Space: it takes U+FEFF off, which the database does not call a space at all, and leaves U+0085 on, which it does. Both back ends spell the twenty-five characters out instead.

casefold is written out here, no JavaScript host having case folding at all. It is NFC(fold(NFD(s))) — the standard’s own caseless match — and what stands between it and toLowerCase is a table of two hundred and nine code points: the ones that fold to more than one character, the ones that fold across an alphabet rather than down it (µ to a Greek mu, ſ to s, a combining iota to a letter), and Cherokee, the one script in the database whose fold is to upper case.

tests/js/p25.sl is the corpus that keeps all of this honest, and it is a corpus rather than a set of expectations for the reason every file under tests/js/ is: it is run by both and diffed.

`onSignal` needs a process, so node has it and a browser does not

slate:process‘s signals are process.on and process.off here, with the interpreter’s own list of names and its own refusal of SIGKILL and SIGSTOP. A host with no process is not a thing that can be signalled, and says so in those words rather than installing a handler nothing will ever call.

stat answers modified here as it does under the interpreter — an instant in microseconds, from node’s mtimeMs. It was missing for one release, which nothing noticed until a program walking a directory tree asked a file for its modification time and reached a field that was not there.

Arity is checked here too, and until 0.0.28 it was not

A JavaScript function ignores an argument it was not expecting and binds undefined for one it was not given. slate refuses both, and the interpreter always has — so an emitted f(1, 2) for a one-parameter f quietly dropped the 2 and ran, where the same program under the interpreter faulted. That is a disagreement about what a program means, not about how a complaint is worded. A call with too few failed further in, with a sentence about undefined not being passable that named neither the function nor the count.

Every slate call goes through one place in the runtime, and the signature the emitter already attaches for named arguments is what the check reads — a length comparison per call. A function taking no parameters carried no signature at all, which is why a component given props it does not declare was the silent case; it carries one now.

A callback is trimmed rather than refused, on both back ends — see Functions. The document’s on, the WebSocket handlers and the timers all go through that path here, so on(node, "click", () -> …) is what a page writes and what it has always written; what changed is that the two hosts now agree about it for the same reason rather than by accident.

A diagnostic about a function names it, and the emitter says what to call it

`Counter` takes 0 arguments and was given 1 rather than “this function”. The caret is on the call, which is very often somewhere the reader has never opened — a framework invoking a component, a sort given a comparison — so a sentence with nothing to grep for left them stranded.

A lambda, a method and a generated new have no name to give, all three being compiled as lambdas, and all three say “this function”. That takes saying here because the two hosts would otherwise offer two different wrong names: the interpreter’s chunk is called a function, which is what print calls a function value, and a JavaScript function’s own name is the emitter’s temporary — $t21, a name nobody wrote. So the emitter states the name to show alongside the signature it already attaches, and says nothing for those three.

A builtin is a parameter, not a name taken from the host

The emitted program is a function whose parameters are the builtins, applied to the runtime’s own table. It is not a script that installs two hundred names into the host’s global scope, which is what it used to be.

That change is a browser-parity decision rather than a tidying. A page’s other scripts and the browser’s own APIs share setTimeout, fetch and close; a slate program that took those names took them from everybody, for as long as the page lived. node’s own WebSocket is what found it: its handshake calls setTimeout and calls .unref() on what comes back, and slate answers its own integer id — which has no such method, so the socket never opened and nothing anywhere named a timer.

A program may still declare a name a builtin has. The builtins are the outer function’s parameters and the program is an inner function, so val print = 1 shadows exactly as it did when the names were globals — two scopes are what keeps that from being a redeclaration.

The names come from the same scope the interpreter’s builtins are installed into, so a builtin added to the language is a parameter on the next build and there is no second list to go stale.

Blocks and order

JavaScript has no block expression, so val x = if c then 1 else 2 becomes an if statement over a temporary. An immediately-called function would have been the other way and is wrong: return, break, await and yield all mean the enclosing function, and a wrapper takes every one of them away. The one place a wrapper is written is a default parameter, where there is no statement position to hoist into and nothing of the enclosing function to lose.

slate:image

2026-09-06T00:36:22.158815252Z

`slate:image`

Photographs and avatars — decoding what somebody uploaded, scaling it down, and writing it back out.

import { readImage, imageShape, resizeImage, encodePNG, encodeJPEG, encodeWebP } from slate:image

// An image is a record. Four pixels, three channels, rows packed and the top row first.
val square = { width: 2, height: 2, channels: 3,
    pixels: [255, 0, 0, 0, 255, 0, 0, 0, 255, 255, 255, 255] }

val png = encodePNG(square)

print(png[0], png[1], png[2], png[3])        // the PNG signature

val back = readImage(png)

print(back.ok, back.value.width, back.value.height, back.value.channels)

val bigger = resizeImage(back.value, 4, 4)

print(bigger.width, bigger.height, len(bigger.pixels))

// The shape without decoding anything, which is what to ask of an upload.
print(imageShape(png).value.width, imageShape(png).value.height)

print(readImage(toBytes("not an image")).ok)

137 80 78 71
true 2 2 3
4 4 48
2 2
false

An image is a record, not a handle

{ width, height, channels, pixels }, where pixels is a byte array of width * height * channels — rows packed with no padding, the top row first, and the channels interleaved. Every name here either answers one or takes one, so a thumbnail is one expression:

val small = encodeJPEG(resizeImage(readImage(upload).value, 200, 200), 80)

Nothing in the middle is a resource to give back, and the pixels are ordinary slate values: a program can read them, store them, send them, or build an image itself and encode that — which is what the runnable program above does.

What it reads and what it writes


read	PNG, JPEG, GIF (first frame), WebP, BMP, TGA, PSD, PIC, PNM, Radiance
write	PNG, JPEG, WebP

The format is recognised from the bytes, so there is nothing to tell readImage what to expect and a file with the wrong extension is read correctly anyway. A GIF decodes to its first frame; there is no animation.

WebP, which is what a browser writes

Everything above but WebP is Sean Barrett’s stb_image, which has never read one — WebP is VP8 in a RIFF container, a video codec’s worth of code. WebP is libwebp, and it is here because it is what a modern browser produces: a page that re-encodes a photograph before uploading it usually writes one, so without it the commonest upload a form meets would be the one readImage refuses.

Nothing about the call changes. The header says which decoder answers, and channels comes back as 3 or 4 — a WebP carries RGB or RGBA and there is no greyscale form of the file, though readImage(bytes, 1) converts one for you exactly as it does a PNG.

import { readImage, imageShape, encodeWebP } from slate:image

val src = { width: 2, height: 2, channels: 4,
    pixels: [255, 0, 0, 255, 0, 255, 0, 255, 0, 0, 255, 255, 255, 255, 255, 128] }

val file = encodeWebP(src, { lossless: true })

print(file[0], file[1], file[2], file[3])       // "RIFF"
print(file[8], file[9], file[10], file[11])     // "WEBP"

val shape = imageShape(file).value

print(shape.width, shape.height, shape.channels)
print(readImage(file).value.pixels == src.pixels)

// A quality instead of a record is the lossy coder, which keeps the alpha either way.
print(len(encodeWebP(src, 40)) < len(encodeWebP(src, 100)))

82 73 70 70
87 69 66 80
2 2 4
true
true

An animated WebP is refused, and says which library reading one would take. Its frames live in ANMF chunks that only libwebpdemux walks, and that is a second library nothing here binds:

val anim = readImage(bytes)

if !anim.ok then print(anim.error)
// "this is an animated WebP; reading one needs libwebpdemux, which this package does not bind"

A truncated WebP says it is truncated rather than that it is damaged, which is the difference between an upload worth asking for again and one that is not:

print(readImage(partial).error)   // "the WebP data stops before the image does"

`channels`, and asking for a different number

readImage(bytes) converts nothing: channels comes back as 1, 2, 3 or 4 depending on what the file held. readImage(bytes, 4) converts on the way out, which is the call an avatar pipeline makes — uploads arrive greyscale, RGB and RGBA in whatever mixture the people using a site happened to have, and code that composites or scales them wants one shape.

val avatar = readImage(upload, 4).value    // always RGBA, whatever arrived

The two channels

readImage and imageShape answer a result; resizeImage and the three encoders fault. That is the rule the whole library follows: bytes from somewhere else are an answer the caller has to look at — a corrupt JPEG is a 400 to send, not a defect in the program reading it — and a value the program built itself is a fault. So a mismatched pixels, a width of zero, or a quality of 200 stops the program where it is written.

`imageShape` is the size guard, and that is why it exists

A decoded image is width * height * channels bytes however small the file was. A PNG of four kilobytes can say it is 20,000 by 20,000, which is 1.2 GB the moment anything decodes it — the same shape of attack a compression bomb is, wearing a picture’s clothes. imageShape reads the width, height and channel count out of the header without decoding anything, so a handler can answer 413 instead:

val shape = imageShape(body)

if !shape.ok then return { status: 400, text: shape.error }
if shape.value.width * shape.value.height > 40_000_000 then return { status: 413 }

val img = readImage(body).value

Scaling

resizeImage(image, width, height) answers the same image at another size, eight bits a channel, and keeps the channel count it was given. The filtering happens in sRGB space, which is the right answer for every 8-bit image a page holds: averaging two sRGB bytes as though they were quantities of light is what makes a naively downscaled photograph come out too dark.

Nothing here preserves the aspect ratio for you — the two numbers are what the answer will be — so work them out from the shape you read:

val wide = 200 / max(img.width, img.height)
val thumb = resizeImage(img, integer(img.width * wide), integer(img.height * wide))

The quality is written at every call

encodeJPEG(image, quality) takes a number from 1 to 100 and there is no default, for slate:zstd‘s reason and slate:brotli‘s: it is the one number a caller has to think about, and no single value is right often enough to be the quiet one. 80 is a photograph on a page, 60 a thumbnail, 95 something that will be edited again.

encodePNG takes no such number — PNG is lossless, and it is what to reach for unless the image really is a photograph. The encoder is stb’s baseline JPEG writer: no progressive mode and no subsampling control, which is small, fast, and read by everything.

encodeWebP takes either, and that is the one signature here with two forms:


`encodeWebP(image, quality)`	lossy, 1 to 100, roughly a quarter smaller than a JPEG at the same quality — and it keeps an alpha channel, which JPEG cannot
`encodeWebP(image, { lossless: true })`	nothing thrown away, and about a fifth smaller than the PNG of the same image

Two forms rather than two names, because the second argument is what a caller has to think about either way and lossless is a value it can take. { lossless: false } is refused rather than read as “lossy”, since a lossy encode needs a number nobody wrote.

A one- or two-channel image is widened to RGB or RGBA on the way out — there is no greyscale WebP — which is what a browser decoding the file would have shown anyway.

Not in the JavaScript back end, on either host

All six names refuse under slate js, and the two hosts refuse for different reasons. node has no image support in its standard library at all — there is no zlib-shaped module for pictures, and every reader anybody uses is an npm dependency. A browser does decode, through createImageBitmap and OffscreenCanvas — WebP as readily as PNG — but the whole of that surface answers promises, where these six answer on the spot, so a browser half would make the two back ends disagree about what an image even is. That is the same rule crypto.subtle is held to: a host that has a thing only in a different shape does not have it.

So this is a server’s module. Resize and re-encode where the interpreter runs, and send the browser the answer.

slate:http

2026-09-06T00:36:22.158815252Z

`slate:http`

An HTTP server, written in slate over slate:net.

import { serve, close } from slate:http

val server = serve(8080, req -> "hello")


`serve(port, handler, onUpgrade = null)`	the whole request, body included
`serveStream(port, handler, onUpgrade = null)`	the head, then the body in pieces
`close(server)`	stop serving, and end the connections
`router()`
`files(root, options = {})`	a handler serving a directory
`setCookie(name, value, options = {})`	a header value
`parseQuery(s)`, `parseForm(body)`, `parseCookies(header)`
`encodeComponent(s)`, `percentDecode(s, plusIsSpace)`	`slate:url`‘s, forwarded

Request, Response and Router are exported as types too.

parseQuery, encodeComponent and percentDecode are slate:url‘s and are exported here as well, so nothing written against this module changed. Import them from slate:url in anything that is not a server — a browser page importing this module to reach them grows by 239 KB, which is a file server and an HTTP/2 speaker downloaded to read a query string.

The third argument to either server is for a protocol upgrade — see slate:ws.

HTTPS is listen told a certificate, so serve did not have to change: TLS lives one layer down.

`close(server)`

Closing a server stops it accepting, closes every idle connection it had accepted at once, and lets a connection with a request in flight finish that response before closing it. There is no keep-alive after close: a second request on a connection that was busy is not served, and the connection ends with the response it was writing.

That is what makes close the thing that lets a program exit. A connection is a handle the event loop waits on, so closing only the listening socket would leave a program that had shut everything down still waiting — on connections whose clients may already be gone.

A connection nobody is using is closed by the server anyway, after five seconds, over either version. A client may keep a connection and then simply go away, and without that clock the socket would be held for the life of the server.

The request

method, path, search (the raw text after the ?), query, cookies, params, address, body and bytes where the server read one, keepAlive, upgrade.

body is the text and bytes is what arrived, and both are there on every request serve answers. A body that is not UTF-8 — a PNG, a zip, a binary part of a multipart/form-data upload — decodes to nothing, so body is "" and bytes is exact. Until 0.0.30 there was only body, and such an upload was the same value as a request that carried no body at all: no header, no status, no fault. A large upload still wants serveStream, which hands the bytes over as they arrive rather than holding the whole of them twice.
address is the IP that connected, or null where the socket cannot say. It is slate:net‘s remoteAddress asked of this request’s connection, so an IPv4 client of a dual-stack server reads as 127.0.0.1 rather than as ::ffff:127.0.0.1. What a proxy wrote is still a header: x-forwarded-for is what a server behind one must read, and this is who actually opened the socket.
search and query are the URL API’s two names. A program wanting the raw text still has it — which matters because a repeated name in query is the last one. That is a decision: an array where a name repeats makes the type of q.name depend on what a client sent, so a program that read it as a string works until somebody sends the field twice.
params and cookies are {} rather than absent, because a field that is there only sometimes is one every handler must test for.
Percent-decoding works over bytes, %C3%A9 being two bytes that are one character, and answers its input unchanged where the bytes are not text — a query string is something a peer wrote, and a fault there would let any peer stop a program.

The answer

A handler answers a string, an object, or an array of bytes:

serve(3000, req -> "hello")
serve(3000, req -> { status: 201, headers: { "X-Kind": "note" }, body: toJSON(v) })
serve(3000, req -> { headers: { "Content-Type": "image/png" }, body: pngBytes })

An array body is sent as it stands, which is what serves an image, a font or a pre-compressed asset. toJSON(xs) is what an array of data has to be.

A header whose value is an array is written once per element, which is the only way to say Set-Cookie twice: an object has one value per name and HTTP does not. Link, Vary and Via all repeat.

`serveStream`

The handler is called as soon as a request’s head is complete and is given the body as it arrives, so the memory a request costs stops depending on how big the request is:

serveStream(3000, async (req) ->
    var total = 0

    for await chunk in req
        total = total + len(chunk)

    "that was " + string(total) + " bytes")

for await is the shape to reach for, and req.each(fn) is the same bytes pushed instead of pulled — it answers a promise for the byte count, which is the one number an upload handler usually wants:

serveStream(3000, async (req) ->
    counted(c) = c

    val n = await req.each(counted)

    "that was " + string(n) + " bytes")

Two exports rather than one with an option, because the two differ by what the handler is given rather than by what the server was told — a streamed request having no body and answering each instead. Everything else about the connection is the same server: the same keep-alive rule, the same order, the same clock.

A response that arrives in pieces

A handler may answer a source — a generator, or anything with a next(), which is what for await drives — and the server writes it as chunked transfer as the pieces arrive:

counting()
    yield "one "
    yield "two "
    yield "three"

app.get("/count", req -> counting())
app.get("/big", req -> { status: 202, headers: { "X-Kind": "report" }, body: rows() })

No Content-Length and no compression. Both are facts about the last piece, and a server that buffered the body to find them out would be undoing what streaming is for.
A piece may be text or bytes, exactly as a whole body may.
A source that faults mid-stream ends the response and the fault is put back. The client sees a chunked body with no terminator, which is the only thing HTTP can say once the status line has gone, and the defect stops the program as any other does.
Both versions carry one. Over HTTP/1.1 the pieces are chunks and over HTTP/2 they are DATA frames, and nothing a handler wrote says which.

A source is told when its reader has gone

A source may have a close, and the server calls it where the response ends with the source unexhausted — the client hung up, the socket was closed under the response, the peer reset the stream, or the source itself faulted. A source that ran to done is told nothing, having finished.

subscribe(topic)
    val q = queue()

    async pull()
        { done: false, value: await q.take() }

    shut()
        forget(topic, q)

    { next: pull, close: shut }

app.get("/events", req -> sse(subscribe("orders")))

It is optional and is asked for exactly as next is, so every source already written keeps working: a generator has no close and is left alone, and so is an object that does not name one.

Without it, a subscription outlives its reader for the life of the program. That is the shape a source usually has — a topic, a query, a tail of a file — and a writer that simply stopped pulling left the thing behind it holding a reader that would never read again. sse forwards the message to the source it was given, so an event stream gets it through the wrapper.

It is called once. There are several ways a streamed response can end early, and a source that counted its own readers would go wrong if any of them said so twice.

`sse(source)`

Server-sent events, which is a streamed response with one format on top of it:

import { sse } from slate:http

app.get("/events", req -> sse(ticks()))
app.get("/quiet", req -> sse(ticks(), { heartbeat: 0 }))

A piece may be a string, which is its data, or an object naming any of event, id, retry and data — and a data that is not a string is JSON, which is what a browser’s JSON.parse(e.data) wants anyway. Every line of the data is prefixed, a bare newline inside one being what would otherwise end the event.

heartbeat is a member of the response, not something the server guesses. sse sets it to 15 seconds; the writer sends : keep-alive on that interval while nothing else is going down the stream, which is what keeps a proxy from closing an idle connection. 0 turns it off, and any streamed response may ask for one:

{ status: 200, headers: { "Content-Type": "text/plain" }, heartbeat: 30, body: rows() }

HTTP/2

A server that was given a certificate and an alpn list speaks either version, and the handler is written once. What decides is ALPN and nothing else: h2 and http/1.1 arrive on one port over one socket, and HTTP/2’s own preface is bytes a malformed HTTP/1.1 request could also begin with.

serve({ port: 8443, cert: pem, key: keyPem, alpn: ["h2", "http/1.1"] }, app)

The Request is the same value. method, path, search, query, cookies, params and headers are all filled in the same way, and a reply may be a string, an object or an array of bytes exactly as before — the same compression rule and the same header rules apply.
:authority arrives as host, so a handler reading req.headers.host need not know which version it was spoken to over.
Repeated cookie fields are joined with "; ", which RFC 9113 §8.2.3 asks for: HTTP/2 lets a client split its cookies one per field so that each compresses on its own, and browsers do. Every other repeated header name keeps the last, which is what the HTTP/1.1 path does with one.
A body is bounded by the same megabyte the HTTP/1.1 server applies, and one past it is answered 413 — the limit a program thinks it has is the same limit on both versions of one listener.
keepAlive is always true and there is no pipelining question: a connection carries many streams at once and each is answered on its own.
A header name goes out lowercased, an upper-case field name being malformed in HTTP/2 rather than merely unconventional. On HTTP/1.1 what you wrote is what is sent.
A streamed response goes out as a DATA frame per piece, and sse works with its heartbeat — the head is sent before the source is asked for anything, which is what lets a response whose source never ends say 200 at all.
serveStream hands the body over as it lands, one arrival per DATA frame, and a stream the peer resets ends the body the handler is reading rather than leaving it waiting.

Without a certificate there is no ALPN and nothing changes — h2c, which is HTTP/2 in the clear, is not spoken here. The framing layer on its own is slate:nghttp2.

`router()`

A router is an ordinary object holding functions, and serve asks an object for its handle — so serve(3000, app) works and nothing in the server knows what routing is.

val app = router()

app.get("/notes/:id", req -> find(req.params.id))
app.post("/notes", req -> create(req.body))
app.any("/health", req -> "ok")
app.notFound(req -> { status: 404, body: "nothing here" })

serve(3000, app)

get, post, put, patch, delete, head, options, any, and notFound. Patterns take :name and *rest.

Routes are tried in the order they were added, the only rule a reader can predict.
A path that is there under another method is 405 with an Allow, not 404 — the difference between a client being told what to send and being told the thing is not there.
No middleware, and that is a decision. A chain each link may short-circuit is a control flow of its own to learn; app.get("/x", authed(handler)) says what it does at the site that needs it.

`files(root)`

Serves a directory.

ETag and If-None-Match, deliberately not Last-Modified. A validator a client never received is one it can never send, so the two are not both needed — and the older pair costs an HTTP date, a rendering in English of a moment in one zone.
The tag is the size and the modification time, not a hash of the contents. Hashing a file per request is what a static server exists not to do.
A missing file and a directory with no index answer the same 404, telling a client which is which mapping out the disk for it.

What it refuses, and why refusing rather than repairing

A path that climbs out is refused and not sanitised. Such a request is not a request with a mistake in it, and quietly rewriting the name would hide what was attempted.

Every part of the path is percent-decoded before it is judged, which is the whole of the rule: .. is a climb however it was spelled, and /%2e%2e/x and /..%2fx are the same request as /../x. A request is answered 403 when any part of it, after decoding:

is ..;
carries a /, a \ or a NUL byte. An encoded separator is one part naming two, and a NUL ends a name at the system call rather than here — so /logo.png%00.txt is a request for one file wearing another’s extension;
came from a % that is not followed by two hexadecimal digits. A browser reads a stray % as a literal % and so does percentDecode, which is right for something a person typed into a query string; a path is the one place where taking that guess makes the guess a file name.

An empty part and a . part are dropped, so //a, /./a and a are one path. The path that comes out is then normalised and checked to be under the root a second time, so a mistake in the part rules is a 403 rather than a file.

A symlink is followed like any other file, and that is the operator’s choice. The check is on the name the request asked for and not on what the file system would make of it, so a link inside the root pointing outside it serves what it points at — nginx answers the same way. A root that must not be escaped that way is one with no such links in it.

Compression

A response is compressed without asking the handler. Every browser sends Accept-Encoding: zstd, br before gzip, and a server that made this a per-handler choice would be making everybody write the same three lines.

zstd at level 3 where the client takes it, and brotli at quality 5 otherwise. The order is the only decision: zstd at 3 compresses about as well as brotli at 5 in a fraction of the time, which is what matters for a body being encoded on the way out rather than built ahead of time. Content-Encoding says which one it was.
Over a kilobyte. Below that either encoding usually makes a body larger, having a frame to write.
A body that does not get smaller is sent as it was.
Vary: Accept-Encoding goes on whether or not this one was compressed, on every response that consulted the header. What a cache must not do is hand a compressed body to a client that did not ask, and it cannot know that unless the response says so.
The escape hatch is to set Content-Encoding yourself, which says the body is already encoded. It is the only one.
Accept-Encoding is split into tokens rather than searched for two letters, so br;q=0 is a client saying it would rather not — which is not the same as not mentioning it. It is asked once per name, so zstd;q=0, br gets brotli rather than nothing.

slate:gzip

2026-09-06T00:36:22.158815252Z

`slate:gzip`

gzip and zlib — the compression a program has wherever slate runs, including a browser.

import { gzip, gunzip, deflate, inflate } from slate:gzip

async main()
    val page = toBytes(repeat("<p>hello</p>", 40))
    val small = await gzip(page)
    val back = await gunzip(small, 1 << 20)        // the limit is not optional

    print(len(small) < len(page))
    print(back.ok, fromBytes(back.value).value == fromBytes(page).value)

    val zipped = await deflate("the same text, wrapped as zlib instead")
    val flat = await inflate(zipped, 1 << 20)

    print(fromBytes(flat.value).value)
    print((await gunzip(toBytes("not a gzip stream"), 1 << 20)).ok)

main()

true
true true
the same text, wrapped as zlib instead
false


`gzip(data)`	a promise of the bytes, wrapped as a gzip member
`gunzip(data, limit)`	a promise of `{ ok, value }` — the bytes, or why not
`deflate(data)`	a promise of the bytes, wrapped as zlib
`inflate(data, limit)`	a promise of `{ ok, value }`

data is text or bytes; text crosses as its UTF-8, which is what goes on a wire either way.

Which of the two wrappers

gzip is the file format — the one gzip, curl and Content-Encoding: gzip all mean, with a ten-byte header and a trailer carrying a length and a CRC-32.

deflate is zlib — two bytes of header and an adler-32, which is what Content-Encoding: deflate means in practice and what every HTTP client expects under that name, despite what the name says.

Neither is the bare deflate stream that sits inside both. A program that needs that is writing a container of its own, and has to say so byte by byte anyway.

Every one of them answers a promise

A browser’s compression is a stream, and there is no synchronous way to ask it. So the surface is promise-shaped on every host rather than being synchronous in the interpreter and absent in a browser — which is the trade this module exists to avoid making. Nothing is waiting for a network here; on the interpreter the answer is a promise that has already been settled.

slate:brotli is synchronous and stays so: its signature was written before there was a second host, and a program already holds it.

The limit is required

A deflate stream carries no length, and a crafted few hundred bytes expands without bound. So the two that read say how large an answer the caller is prepared to hold, and there is no form that omits it.

For a gzip stream the trailer states the length, so the refusal happens before a byte is allocated. For a zlib stream there is nothing to state it, so the output is counted as it arrives.

The two channels

Compressing faults and decompressing answers a result, which is the rule everywhere in slate: a value the program built cannot fail to be compressed, and bytes that came from somewhere else can be anything.

The sentences are about the container — this does not begin with gzip’s two magic bytes, this expands past the N bytes it was allowed, this gzip stream’s checksum does not match its contents — and slate reads that container itself on both back ends, so they are the same words wherever the program runs. The JavaScript back end names the one sentence that is not.

What compresses to what is not promised

Two deflate implementations agree about the format and not about the stream. The same text packed by the interpreter and by a browser is a different length and a different set of bytes, and both are correct — so a program may compare what came back, and never the compressed bytes themselves.

slate:http compresses a response without asking the handler; that page says what the rules are.

Globals

2026-09-06T00:36:22.158815252Z

Globals

The names a program has in scope with no import.

Printing and tests


`print(…)`	any number of values, separated by a space
`assert(condition)`, `assert(condition, message)`	raises where the condition is false
`assertEq(got, wanted)`	renders both sides, quoting a string

The two assertions raise rather than answer, because a failed assertion is not a condition the test was going to handle. See Tests.

Kinds and conversions

string number integer real boolean len

The type words are the conversions, and the same word tests in a pattern.

print(string(123) + "!")
print(number("42"), number("nonsense"))
print(integer(2.9))
print(boolean(0))           // only false and null are false
print(len("日本語"))        // in characters

123!
42 null
2
true
3

Text

chars split join contains indexOf lastIndexOf startsWith endsWith trim trimStart trimEnd upper lower normalize casefold replace repeat

Every position is in characters, never in bytes.

indexOf answers null rather than -1, because slate has a null and the operators that go with it: indexOf(s, x) ?? 0 says what a sentinel makes a reader work out.
A search may be told where to start. indexOf(s, x, from) and lastIndexOf(s, x, from) take a third position, and a negative one counts back from the end.
split on an empty separator splits into characters.
Case is the whole Unicode database, so upper("Straße") is STRASSE and lower("ΟΔΟΣ") ends in a final sigma. A case mapping may change a string’s length; both back ends answer the same thing.
trim is Unicode’s White_Space, so a no-break space comes off and a zero-width no-break space — which the database does not call a space — stays.
normalize(s, form) takes one of "NFC", "NFD", "NFKC" and "NFKD" and faults on anything else rather than falling to a default.
casefold is not lower. It is the key to store beside a name somebody will search for: ß folds to ss, folding is idempotent, and what it answers is composed.

print(upper("Straße"), lower("ΟΔΟΣ"))
print(casefold("STRASSE") == casefold("Straße"), lower("STRASSE") == lower("Straße"))
print(normalize("e\u{301}", "NFC") == "é")

STRASSE οδος
true false
true

As methods, a string answers: len chars split contains indexOf lastIndexOf startsWith endsWith trim trimStart trimEnd upper lower normalize casefold replace repeat number integer real boolean string.

Numbers

abs floor ceil round trunc sqrt pow min max

The four roundings leave an integer alone, an integer already being whole.
min and max take as many arguments as they are given and answer an integer when every one of them was — a min that answered a real for two integers would make every use of it in an index a conversion.
pow of two integers with a non-negative exponent answers an integer.

As methods, a number answers: abs floor ceil round trunc sqrt integer real boolean string.

Arrays

push pop shift unshift insert removeAt clear map filter flatMap forEach reduce find findIndex findLast findLastIndex every some sort sorted reverse reversed slice at concat flat sum join contains indexOf lastIndexOf

print([4, 1, 3, 2].sorted().slice(1, 3).flatMap(n -> [n, n]).at(-1))
print([1, 2, 3].sum(), [1, [2, [3]]].flat())
print(indexOf([1, 2], 9), find([1, 2, 3], n -> n > 1))
print([1, 2, 3].at(-1), [1, 2, 3].reversed())

3
6 [1, 2, [3]]
null 2
3 [3, 2, 1]

Where slate parts from JavaScript it is to remove a case rather than add one:

A mutator answers nothing, so sort and unshift cannot be mistaken for the copying forms sorted and concat. The bare verb changes the array and the participle answers a new one.
Nothing answers absence. pop, shift and at fault where there is nothing there, while find and indexOf answer null — a search that found nothing is an answer, and reaching past the end is a mistake.
at and slice count back from the end where the position is negative, which is the whole reason JavaScript grew at beside xs[i].
A comparator answers a number whose sign orders the pair, as compare does.

Objects

keys values entries has without

val o = { a: 1, b: 2 }

print(keys(o), values(o), has(o, "a"))
print(without(o, "a"), o)

for [k, v] in entries(o)
    print(k, v)

["a", "b"] [1, 2] true
{b: 2} {a: 1, b: 2}
a 1
b 2

without answers a NEW object, which is with‘s rule read the other way: a slate object’s shape is not a thing one name changes under another’s feet. A key that is not there is not an error, so a table forgetting something it is unsure of is one line — and a copy of a data value is a data value, as with‘s is.

A proto a declaration wrote is not a field these report. A class instance and a data variant reach what they are through it, so keys, values, entries, has, len and without all pass over it — which is what print has always done. A proto a program wrote on a plain object is an ordinary field and is reported like any other.

An object answers no methods of its own — its names belong to the program, and a builtin o.keys would give every object a field nothing put there. The four universal methods are the exception, and a field the program wrote wins over those.

JSON


`parseJSON(text)`	a result
`toJSON(v)`, `toJSON(v, indent)`	a string; faults where the value has no JSON form

The two directions use the two channels, and they genuinely differ: text from a file, a socket or a person is a condition every caller was going to handle, and a function or a circle in a value the program built itself is a defect in that program. JSON.parse and JSON.stringify both throw, so node treats the two alike.

A value with no JSON form is named rather than dropped. JSON.stringify drops a function silently from an object and turns it into null inside an array, so a request body goes out with a field missing and nothing says which.
A non-string key is refused, rendering it as text would make { 1: "a" } and { "1": "a" } one document.
A class says what it encodes as with toJSON(self) — see Objects.
The parse error is the whole rendering, not one sentence. A JSON document is usually machine-written and long, so “expected a string” on its own says nothing a person can act on.

Bytes


`toBytes(s)`	an array of numbers
`fromBytes(bs)`	a result — arbitrary bytes are not text

len(toBytes(s)) is the byte count, so there is no third name. These are the one place a slate program sees UTF-8, and two things need them: a Content-Length, and a read where a character may be split across two arrivals.

Timers

setTimeout(fn, ms) setInterval(fn, ms) clearTimeout(id) clearInterval(id)

The callback comes first, which is node’s order. Both ms forms also take a duration. A timer keeps the program alive.

Promises

sleep resolve reject pending settle fail

See Asynchrony.

Generators

next(g), which is g.next() — see Asynchrony.

`fetch`

val r = await fetch(url, options)

node’s name and the browser’s, and it answers a result rather than throwing — which is slate’s rule for anything that reaches the network, not a disagreement with either. It is native because HTTPS needs OpenSSL; the server half is slate:http and is written in slate.

It works on both back ends, over the host’s own fetch under slate js — a status, a headers object with lower-cased names, and a body. Nothing in this file says “not in the JavaScript back end yet” any more.

Two things differ there and JavaScript says why: trust refuses, no JavaScript host letting a program add a certificate authority for one request, and the redirect rule is the host’s — the interpreter follows at most five and refuses one that leaves https for http, where a browser follows them itself and gives a page no way in.

A response header that repeats is joined with ", ", on both. An object has one value per name and HTTP does not: Link, Vary and Via all repeat, and combining them is what RFC 9110 allows and what a browser’s Headers hands over already done.

Set-Cookie is the exception and is a LIST, of the lines as they arrived, absent when there were none. The same section of RFC 9110 excludes it and the reason is arithmetic: a cookie carries commas inside itself — Expires=Wed, 21 Oct 2026 07:28:00 GMT — so two cookies joined by commas cannot be taken apart again by anything. In a browser it is absent however many arrived: Set-Cookie is a forbidden response-header name, so a page never reads one. The browser still applies the cookie.

A body that is not UTF-8 is "" rather than a string of replacement characters, which is the same answer run gives and for the same reason: slate has no byte value for it to be.

Functions

2026-09-06T00:36:22.158815252Z

Functions

There is no keyword on a function. The shape is what identifies it: a name, a parameter list in brackets, and then either = and an expression or an indented block.

double(x) = x * 2

add(a, b)
    a + b

grade(mark)
    if mark >= 90
        "A"
    else
        "C"
end grade

print(double(21), add(1, 2), grade(95), grade(20))

42 3 A C

A block’s value is its trailing expression, so return is for leaving early and nothing else.

Functions are values. A definition binds a name in the scope it is written in, so a nested definition is a closure over that scope:

counter()
    var count = 0

    bump()
        count = count + 1
        count

    bump

val c = counter()

print(c(), c(), c())

1 2 3

Lambdas

-> with the parameters on its left:

val double = x -> x * 2
val add = (a, b) -> a + b
val zero = () -> 0

print(double(21), add(1, 2), zero())

42 3 0

-> is the one right-associative operator, so x -> y -> x + y is a function answering a function.

A lambda’s body may be a block, written where the lambda is passed. A newline inside brackets normally means nothing, so a callback would otherwise have to be lifted out and named before the call that wanted it:

forEach([1, 2, 3], x ->
    val doubled = x * 2
    print(x, doubled))

1 2
2 4
3 6

-> and match are the two tokens that suspend the bracket rule, and only where they end a line. A block lambda has to be the last argument, because its block runs to the end of its last line and a , arriving there has nothing to mean. Every callback slate itself takes is last for that reason; setTimeout(fn, ms) keeps node’s order and so takes a one-line function.

A lambda’s parameters may be annotated; its result may not, the arrow already standing between the parameters and the body. What it answers is read off that body — see Types.

`_`, a lambda with its parameter left out

A _ where a value goes is the parameter of a function nobody wrote. What that function’s body is is the smallest thing around the _: a call’s argument, a bracketed group, or the value of a binding, an assignment or a return.

val ns = [1, 2, 5, 9]

print(map(ns, _ * 2))
print(filter(ns, _ > 3))
print(map(["ada", "grace"], upper(_)))

[2, 4, 10, 18]
[5, 9]
["ADA", "GRACE"]

Every _ is a parameter of its own, left to right. Two of them make a function of two parameters, which is exactly what a comparator wants:

val people = [{ name: "grace", age: 45 }, { name: "ada", age: 36 }]

print(map(sorted(people, _.age < _.age), _.name))

["ada", "grace"]

That rule is also this notation’s one surprise. _ > 3 && _ < 9 is a function of two parameters and not one test of one number, so it is refused where a callback taking one was wanted. Write the parameter out when you mean to mention it twice: n -> n > 3 && n < 9.

A lone _ is handed outward to the thing around it, which is what makes f(_) a way of naming f rather than a way of handing it an identity — and what makes add(_, 1) the partial application it reads as. Where there is nothing around it, a _ on its own is the identity function:

add(a, b) = a + b

print(map([1, 2, 3], add(_, 1)))

val id = _

print(id(7))

[2, 3, 4]
7

A _ with no argument, no group and no right-hand side around it has nothing for its function to be, and is refused where it stands:

_.length

`_` stands for the parameter of a function

_ in a pattern is untouched. A match arm’s _, a destructuring’s and the name in val _ = f() all mean the wildcard they always did — the notation here is about _ standing where a value goes.

Type parameters

[T] after the name says the definition is generic over a type, and the answer is said in terms of what the call was given:

first[T](xs: array of T) -> T = xs[0]

print(first(["ada", "grace"]), first([1, 2]))

ada 1

There are no type arguments at a call — they are solved from the arguments, and every argument has to fit the type the parameter was solved to, so pair(1, "x") for pair[T](a: T, b: T) is refused. Types says how the answer is picked and what a union does.

Defaults

A parameter may carry what it is when nobody gives one, on a definition, a lambda, a method, or a class’s new. The annotation comes first and the default after it:

greet(name, greeting = "hello") = greeting + ", " + name
f(n: integer = 0) = n

print(greet("ada"))
print(greet("ada", "hi"))
print(f(), f(7))

hello, ada
hi, ada
0 7

The default is worked out at the call, not where the function was written. Everything else follows from that:

f(xs = []) gives every call an array of its own.
A default may read the parameters to its left: slice(xs, from, to = len(xs)).
A default that would fault costs nothing to a call that gave the argument.

A parameter that may be left out has to come last, or leaving it out would slide every later argument one place left. The parser says so where it is written, and an arity complaint then names a range rather than only its upper end.

A parameter nobody gave is not bound at all, which is why there is no sentinel: slate refuses to store absence, so there is no “given, and the value was absence” to tell from “not given”. f(1, null) therefore passes null and does not take the default — which is the simpler rule, JavaScript’s f(1, undefined) doing the opposite.

Named arguments

An argument may say which parameter it fills, which is what makes a default in the middle reachable:

greet(name, greeting = "hello", punct = "!") = greeting + ", " + name + punct

print(greet("ada"))
print(greet("ada", punct = "?"))            // greeting skipped
print(greet(greeting = "hi", name = "ada"))

hello, ada!
hello, ada?
hi, ada!

= and not :, because the declaration already writes the default after an equals. Assignment is a statement in slate, so = never appears inside an expression and there is nothing for it to be confused with; == is its own token, so f(ok == true) is an ordinary positional argument.

A name comes after every positional argument, and it may pick out any parameter. A class’s new and a data variant’s maker are ordinary functions, so Rect(h = 4, w = 3) and Circle(r = 7) read the same way. A method names its parameters and not its receiver.

Naming a parameter twice, naming one the function does not have, naming an argument to a builtin, or naming one to a function that gathers with ... are each refused with their own sentence — the second lists the parameters it does have.

`...rest`

A function may gather what is left over:

total(first, ...others) = reduce(others, (a, b) -> a + b, first)
val xs = [1, 2, 3]

print(total(1))
print(total(1, 2, 3))
print(total(...xs))         // the spread it is the counterpart of

1
6
6

...rest is always bound, to an empty array where a call gave nothing past the fixed parameters, so there is no absence to test for. It must be last and takes no default — one could never fire. A default before it is fine.

Callbacks take as many arguments as they declare

A call the program writes is strict: f(1, 2) where f takes one argument is refused, and so is f() where it takes one. The count is a claim you made, and getting it wrong is a mistake.

A callback is different. Where a builtin calls a function you supplied, it passes as many arguments as that function declares and no more:

print(map([1, 2, 3], () -> 9))          // the element is there and this one ignores it
print(map([1, 2, 3], (v) -> v * 2))     // and this one reads it

forEach([1, 2], () -> print("tick"))

setTimeout(() -> print("later"), 0)

[9, 9, 9]
[2, 4, 6]
tick
tick
later

This is what a handler wants to look like — on(node, "click", () -> setCount(n + 1)) for one that does not read the event, onData(socket, () -> stop()) for a reader that does not care what arrived — and it is the rule everywhere a native calls back: array walks, sorted, timers, sockets, WebSocket handlers, the document‘s events.

Declaring more than the caller has is still a fault, and it names the caller, because your function is not the thing that is wrong:

map([1], (a, b) -> a)

`map` takes (integer) -> any here, and this is (integer, any) -> integer

That is the checker, which knows what map hands over. Reached through a value it cannot see, the machine says the same thing in its own words — “map calls this with 1 argument and it takes 2 arguments”.

TypeScript draws the line in nearly the same place, and the difference is worth knowing: there a function of fewer parameters is usable wherever more are supplied, including through a type you declared yourself, because the call that follows ignores the extra argument. A slate call does not — it passes what you wrote — so the relaxation holds only where the caller is a builtin that adapts to the callee. A parameter you annotated is compared strictly:

apply(f: (integer, integer) -> integer) = f(1, 2)

print(apply(n -> n))

`apply` takes (integer, integer) -> integer here, and this is (any) -> any

Destructuring parameters

A parameter may take its argument apart, on a definition or a lambda:

f({ n }) = n * 2
val g = ({ n }) -> n + 1

print(f({ n: 21 }), g({ n: 1 }))

42 2

The pattern is any pattern that binds.

Annotations

Per parameter, and per result:

type Point = { x: number, y: number }

double(x: number) -> number = x * 2
f(a, b: Point, c) = b.x + a + c     // nothing has to be annotated for anything to be

print(double(3), f(1, { x: 2, y: 0 }, 3))

6 6

An annotation is checked at the call for a parameter, and where the function answers for a result. See Types for what the compiler will say about one before the program runs.

`async` and generators

async in front of a definition or a lambda makes it answer a promise; a function holding a yield is a generator, with no word on the definition. Both are in Asynchrony.

Methods

A function stored in an object field is a method. Whether it is handed a receiver depends on where it was found — see Objects.

slate:fs

2026-09-06T00:36:22.158815252Z

`slate:fs`

Ten operations, each in a promise-shaped and a blocking form.

import { readFile, writeFile, mkdir, readDir, rename, remove, rmdir } from slate:fs

async main()
    await mkdir("scratch")
    await writeFile("scratch/notes.txt", "one line")

    val notes = await readFile("scratch/notes.txt")

    if notes.ok
        print(notes.value)
    else
        print("could not read it:", notes.error)

    await readDir("scratch") match
        { ok: true, value: names } -> print(names)
        { error: e } -> print(e)

    await rename("scratch/notes.txt", "scratch/kept.txt")
    await remove("scratch/kept.txt")
    await rmdir("scratch")

main()


`readFile(path)`	text
`readBytes(path)`	an array of numbers
`writeFile(path, v)`	replaces whatever was there
`appendFile(path, v)`	adds to it, and makes the file where there is none
`writeBytes(path, bs)`	the same, given the bytes themselves
`appendBytes(path, bs)`
`readDir(path)`	the names in it
`stat(path)`	size, kind, and `mtime` as an instant
`exists(path)`	a plain `true` or `false` — the one call with no failure case
`remove(path)`
`mkdir(path)`
`rmdir(path)`
`rename(from, to)`

Every one has a blocking twin under a Sync suffix — readFileSync, writeFileSync, appendFileSync, statSync and the rest — which is node’s arrangement and node’s spelling:

mkdirSync("scratch")
writeFileSync("scratch/notes.txt", "one line")

print(readFileSync("scratch/notes.txt").value)

Results, not rejections

A call that can fail answers a result — { ok: true, value: v } or { ok: false, error: text } — and the promise never rejects. A file that is not there is not a defect in the program asking for it, so the caller is handed something it has to look at rather than an unwind it has to be ready for.

Giving a builtin the wrong kind of argument still raises: readFile(42) faults, readFile("/gone") answers.

Every error carries libuv’s own sentence — cannot read x: ENOENT: no such file or directory.

A file that is not valid UTF-8 has no slate string to become, so readFile answers an error naming readBytes. writeFile renders anything that is not a string the way print would.

writeBytes and appendBytes are the writing side of readBytes, and they are what a program holding bytes wants: writeFile would render an array of numbers as the text [137, 80, ...], which is a picture of a PNG rather than one. Each takes an array of numbers from 0 to 255; anything else is a fault naming writeFile as the call that renders things.

Why the plain names are the asynchronous ones

A language whose entire event story is one loop has a lot to lose from a call that stops it: a server that blocks on a read stops answering everybody. The Sync forms are there because a great many programs are not servers — a script that reads a configuration file before it does anything gains nothing from a promise and pays for it in an async function that exists only to hold an await.

The naming is what keeps that from being a trap. The blocking call is the one with the longer name and the suffix, so reaching for it is a decision rather than an accident. The two halves agree on everything but the waiting: a Sync call answers the same result its promise would have settled to, error and all.

Faults

2026-09-06T00:36:22.158815252Z

Faults

slate has two failure channels, and which one a thing uses says what kind of failure it is.

A result — { ok: true, value: v } or { ok: false, error: text } — is for a condition the caller was always going to deal with: a file that is not there, a connection refused, text that will not parse, a password that does not match. The caller is handed something it has to look at.
A fault unwinds until something catches it, and is for a defect in the program: the wrong kind of argument, a division by zero, a value with no JSON form, an index past the end.

Neither is used for the other’s job anywhere in slate. readFile(42) faults; readFile("/gone") answers.

A result costs no new machinery — it is an ordinary object, so match already destructures one and the collector already traces one.

`throw`

throw v is a statement, like return and break: nothing after it runs, and the value is not optional — a fault with nothing in it says nothing to whoever catches it.

side(w)
    if w < 0 then throw "a side cannot be negative"

    w

print(side(3))
print(side(-1))

a side cannot be negative

A caught fault re-thrown keeps its own words. throw e reads an object’s message field rather than rendering it — rendering would replace the fault with a description of one. A string is its own message; anything else is rendered as print would.

The location becomes the throw‘s own and does not travel. By the time a program holds a fault it is a line number and a file name, which no span can be rebuilt from — so a re-thrown fault says the words of the original and points at the line that put it back.

`catch`

Two forms of one thing. The postfix one is an expression, so it stands where a value is wanted:

toPort(text)
    val n = number(text)

    if n == null then throw "that is not a port"

    n

val port = toPort("nonsense") catch e ->
    print(s"${e.message}, so using the default")
    8080

print(port)

that is not a port, so using the default
8080

and the block one is for a run of statements:

setUp() = print("set up")

go()
    throw "it went wrong"

try
    setUp()
    go()
catch e
    print(e.message, e.line, e.file is string)

set up
it went wrong 4 true

catch binds looser than every arithmetic operator, so a + b catch … guards the sum, and tighter than the lambda arrow, so x -> risky() catch e -> 0 gives the lambda a body that guards.

The fault object

A fault is an ordinary object — message, line and file — for the same reason a module is one: slate objects already sort, print, go in arrays and match against patterns, so there is nothing here the rest of the language does not already do.

risky()
    throw "gone"

recover() = "recovered"

try
    print(risky())
catch e
    print(e match
        { message: "gone" } -> recover()
        _ -> "something else")

recovered

What `catch` does and does not reach

It works across an await. A coroutine carries its handlers with it when it is set aside, so a promise that fails minutes later still raises inside the try that was written around the await. See Asynchrony.
It does not reach a callback. try setTimeout(...) guards the scheduling and nothing else, the callback running from the loop long afterwards. That is inherent: there is no statement of the program’s left to attach it to.

What is not here

There is no finally. A try with nothing to handle the fault is refused rather than allowed to swallow it silently.

Expressions

2026-09-06T00:36:22.158815252Z

Expressions

The precedence table

Loosest at the top. Everything is left-associative except the lambda arrow.

power	operators
5	`->`	right-associative, so `x -> y -> x + y` is a function answering a function
6	`match`, `catch`	a transformation of the thing to the left
9	`??`
10	`\\|\\|`
20	`&&`
25	`is`
30	`==` `!=` `<` `<=` `>` `>=`	one level, because a chain of them is one comparison
35	`..` `..<`	non-associative
40	`\\|`
42	`^`
44	`&`
50	`+` `-`
60	`*` `/` `%` `<<` `>>`	a shift binds like a multiplication
80	`++` `--` (postfix), call, `[…]`, `.`, `?.`, `with`

Three placements are worth knowing because they decide what a line means:

match and catch sit below every arithmetic operator, so a + b match … transforms the sum rather than just b, and a + b catch … guards the sum. They sit above the arrow, so x -> y match … gives the lambda a body that matches rather than matching on the lambda.
?? is looser than ||, so a ?? b || c reads as a ?? (b || c). A program that writes both usually means the defaulting to happen last. (JavaScript refuses to mix them without parentheses.)
A shift binds like a multiplication, not like C’s, so 1 << 2 + 3 groups the way it reads. &, ^ and | sit above the comparisons, so a & b == c is not C’s surprise either.

Prefix operators are -, !, ~, ++ and --, all binding tighter than any infix operator and looser than a call — -f(x) negates the result.

_ where a value goes is not an operator and is not in the table, because what it reaches is decided by the nearest enclosing argument, bracketed group or right-hand side rather than by a binding power: map(xs, _ * 2) is map(xs, n -> n * 2). See Functions.

Arithmetic and bitwise

+ - * / % over integers and reals; see Values for what / does between two integers. + on two strings concatenates.

| ^ & ~ and the shifts << >> work on 64-bit integers.

Comparison

Comparisons chain rather than associate, which is mathematics’ reading and sysl’s:

val n = 5

print(0 <= n < 10)          // `n` is evaluated once

true

== and != compare by value; see Values.

Logic

&& and || short-circuit and answer the operand that decided, not a boolean:

print(1 && 2, null || "x")

2 x

?? answers its left operand unless that is null:

print(false ?? "d")         // `false` is a value
print(null ?? "d")

false
d

`is`

is puts a pattern where a condition is wanted, using the same grammar a match arm does:

print(3 is number, 3 is not string, 3 is 1 | 3 | 5)

true true true

It sits between && and the comparisons, so a is P && b > 0 is two terms.

Ranges

A range is a value:

val xs = [1, 2, 3, 4]

print(xs[1..<3])            // exclusive
print(xs[1..2])             // inclusive
print("hello"[..2])         // an end left out is taken from what it is used on
print(xs[2..])

[2, 3]
[2, 3]
hel
[3, 4]

An end left out is taken from whatever the range is used on. Ranges do not associate, so a..b..c is refused. a..=b is refused by name, since a reader arriving from Rust writes it once.

Field and index

. reads a field, […] indexes an array, a string or an object.

?. guards its own link and not the rest of the chain, which is Kotlin’s rule:

val a = { b: { c: 1 } }

print(a?.b?.c)
print(a.missing?.c)         // `?.` on the link that may be absent

1
null

a?.b.c reads b off a or answers null, and then asks .c of whatever that was — so a nullish a faults at .c, and a?.b?.c is what the reader means. The rule is the one slate states everywhere about absence: it stops at the boundary it arose at, and one character quietly excusing every link after it is the opposite of that.

o?.m(a) does not evaluate its arguments where there is nothing to call the method on.
There is no a?.[i].
o?.f = v is refused: there is no answer to what writing into absence should do.

`with`

a with b answers a copy of a with b‘s fields written over it. The right-hand side may be a literal or any expression answering an object:

val base = { a: 1, b: 2 }

print(base with { b: 9 })
print(base with { c: 3 })

{a: 1, b: 9}
{a: 1, b: 2, c: 3}

It binds as tightly as a field selection, so a + b with { … } changes b rather than the sum.

There is no spread in a literal. { ...o, b: 2 } is o with { b: 2 } and [...xs, y] is concat(xs, [y]), both of which slate has, so a second spelling would buy nothing.

Spread in a call

f(...xs) is the one spread slate has, and it exists because a computed argument list had no spelling at all:

show(...parts) = join(parts, "-")
val xs = ["b", "c"]

print(show(...xs))
print(show("a", ...xs, "d"))        // in any order, any number of times

b-c
a-b-c-d

Spreading something that is not an array is a fault naming the spread rather than the call. The checker says nothing about a call that spreads, the argument count being a run-time fact.

`match`

match is postfix — a transformation of the thing to its left, as in Scala and sysl. It is an expression, so it stands where a value is wanted:

what(v) = v match
    { kind: "point", at: [0, 0] } -> "origin"
    [first, ...rest] -> "a list starting " + string(first)
    n @ number if n < 0 -> "a negative number"
    _ -> "something else"

print(what({ kind: "point", at: [0, 0] }))
print(what([9, 1]))
print(what(-4))
print(what(true))

origin
a list starting 9
a negative number
something else

See Patterns for what an arm may be written with, and for when the arms have to cover everything.

A subject matching no arm is a fault, as Scala’s MatchError is.

`catch`

The postfix form of fault handling is an expression too:

toPort(text)
    val n = number(text)

    if n == null then throw "that is not a port"

    n

val port = toPort("nonsense") catch e ->
    print(s"${e.message}, so using the default")
    8080

print(port)

that is not a port, so using the default
8080

Blocks

A block’s value is its trailing expression, so a lambda or a definition whose body is several statements answers the last one. return is for leaving early and nothing else.

Every loop is an expression too, and break is what gives it a value.

Elements

2026-09-06T00:36:22.158815252Z

Elements

<div class="x">hi {name}</div> parses. slate calls it slx, after tsx — the surface is JSX’s, and the mechanism it is meant to serve is React’s.

Elements are read in every file. .slx is a name for a reader and an editor and says nothing to the compiler: slate’s type parameters are written [T] and never <T>, so a < where an operand would begin can only be an element — which is the entire reason .tsx had to be a separate parse mode from .ts and slx does not.

What an element is

An element adds nothing to the tree. It is desugared in the parser:

<div class="x">hi</div>   →   createElement("div", { class: "x" }, ["hi"])

So what an element means is a function a program can read rather than a rule inside the compiler. createElement and Fragment come from wherever the program gets them — lath is one such — and a file that writes an element and imports neither is refused by the undefined-name check.

import { createElement, Fragment, mount, useState } from lath
import { domHost } from lath/dom

Counter({ start = 0 }) =
    val [count, setCount] = useState(start)

    <div class="counter">
        <p>{count}</p>
        <button onClick={() -> setCount(count + 1)}>+1</button>
    </div>

mount(<Counter/>, domHost("#app"))

The rules

< in prefix position begins nothing else, which is the whole of the ambiguity: < is otherwise always an infix operator, so where an operand is expected it can only be a tag. The byte after the < is checked too, so << and <= are never mistaken for a tag with a strange name.

A lowercase tag is a host element and travels as the string "div"; a capitalised one is a name in scope. React’s rule, kept because it is learned behaviour costing no syntax.

class, not className; for, not htmlFor. React’s spellings exist only because JSX compiles into a JavaScript object literal where those were reserved words. An attribute here is its own lexical context and can take the right name.

A bare attribute is true — <input disabled>.

An attribute’s value is a quoted string or a { … }, and a bare word is refused. class=wide would be a variable in every other position and a string to everyone who writes it.

{...props} is the spread an object literal already takes, folded into the same with, so an attribute written after a spread wins over it.

A hyphen is part of a name inside a tag and a subtraction outside one — data-id, aria-label, <my-widget>. A dot stays a token, so <Menu.Item> is an ordinary field selection.

Whitespace inside a tag is skipped whole, newlines included, since a tag with an attribute per line is the ordinary way to write one.

A mismatched closing tag names both names, either one being possibly the mistake.

The children

The children travel as one array, not as trailing arguments. React spells its own createElement(type, props, ...children); an array is the better answer anyway, being what props.children holds in the end, so a component passing its children on writes them as the value they already are.

The whitespace rule is JSX’s. A run of text holding no line break is kept exactly as written — the space in <h1>Count: {n}</h1> is one the reader meant. A run that spans lines is trimmed per line, blank lines dropped, the rest joined with one space, because it is mostly the indentation that lined it up under its tag. Any other rule makes an indented element read differently from the same element on one line.

Inside an element

Between a tag’s > and the < that ends it, a space is a character, // is not a comment and a newline is not a line ending.

A { inside an element opens a hole, and a { inside that hole is an ordinary brace — so the } of an object literal written in a hole is not taken for the one closing the hole.

An element opens a layout bracket at its < and closes it at its end, which is what lets a tag be written across lines with its children indented under it. It is the same mechanism ( uses, so an -> written inside a hole still opens a block and a callback can be written where it is passed.

slate:dom

2026-09-06T00:36:22.158815252Z

`slate:dom`

The document. The one module that works in one host out of three — it is real only in a browser, reached through slate js.

import { byId, setText, on } from slate:dom


`createElement(tag)`, `createText(s)`, `createComment(s)`
`setAttribute`, `removeAttribute`, `setProperty`
`on(node, event, fn)`, `off(node, id)`
`setChildren(node, kids)`, `setText(node, s)`
`insertBefore(parent, node, before)`	one child, in front of another; `null` appends
`removeChild(parent, node)`	one child, out
`byId(id)`, `query(selector)`
`children(node)`	the child nodes, as handles, in order
`tagName(node)`	the tag in lower case, or `null` for a text node
`nodeText(node)`	what the node says, as text
`attribute(node, name)`	one attribute, or `null` where there is none
`nodeKind(node)`	`"element"`, `"text"`, `"comment"`, `"fragment"`, `"document"` or `"other"`
`property(node, name)`	what the node HOLDS, or `null`
`splitText(node, at)`	cut a text node in two; answers the tail
`markup(node)`
`release(node)`	give a handle back
`dispatch(node, event)`	send an event; answers whether nothing cancelled it
`observe(node, options, fn)`	be told what changed; answers `{ disconnect }`
`events(url, options)`	read a server’s event stream; answers `{ close }`
`location()`	where the page is, as a record
`pushPath(url)`, `replacePath(url)`	move the address bar without a reload
`back()`, `forward()`	move through what the page has visited
`onNavigate(fn)`	the user moved — not a push the program made
`stored(key)`, `store(key, v)`	`localStorage`, as results
`unstore(key)`, `storedKeys()`, `clearStored()`

on and off rather than addEventListener, and byId rather than getElementById. The DOM’s names are long because JavaScript had no modules when they were chosen; these are reached through an import that already says dom.

Reading a page somebody else rendered

children, tagName, nodeText and attribute are what hydration walks with, and three more are what it walks with once the markup came from a server rather than from the same program.

nodeKind(node) tells a comment from a text node, which tagName calls null alike — so a reconciler counting children read a comment as a piece of text and adopted the wrong node from there on. It is asked outright rather than by widening what tagName answers: a program reading null as not an element is right and stays right.

property(node, name) is what the node HOLDS, where attribute is what its markup said. They are the pair a form turns on: setting the value attribute says what a field started as and setting the property says what is in it now, so a re-render comparing what it would set against what is there has to read the property. Only a value slate can hold comes back — a string, a boolean or a number — and anything else answers null, exactly as a name the node does not carry does.

setAttribute(field, "value", "written")
setProperty(field, "value", "typed")

print(attribute(field, "value"), property(field, "value"))

splitText(node, at) cuts one text node in two and answers a handle for the tail. A component rendering {a}{b} writes two text nodes and a server’s markup carries the one string they made, so a hydrating reconciler that cannot split has to throw the text away and rebuild it. The offset is in characters, which is slate’s rule wherever a string is measured and is not the DOM’s — splitText counts UTF-16 units there, so a cut written after an emoji would land inside one.

createComment(s) is the other half of nodeKind: a comment is what a server writes to mark a place a component’s output begins, and a page could read one and not write one.

Sending an event, and watching for a change

dispatch(node, event) sends what on reads, which is the whole of why its shape is the event record’s fields and not the DOM’s constructors: type, and optionally key, button, mods, bubbles and cancelable. A string is the ordinary spelling.

dispatch(button, "click")
dispatch(button, { type: "click", button: 1, mods: { meta: true } })
dispatch(field, { type: "keydown", key: "Enter" })

It answers true where nothing cancelled the event, which is what the DOM’s own dispatchEvent answers and is all a sender can learn. The event’s class is chosen from its name — a click is a MouseEvent and a keydown a KeyboardEvent — because a handler reading e.button off a plain Event gets null, and a router telling a left click from a middle one would let every dispatched click through to the browser.

observe(node, options, fn) is a MutationObserver, and it answers an object whose disconnect is the one thing that stops it. The options are children, attributes, text and subtree, and at least one of the first three has to be asked for.

val watcher = observe(list, { children: true, subtree: true }, (records) -> redraw(records))

watcher.disconnect()

A record carries no nodes, which is the decision an event record already makes: a handle is a table slot the program has to give back, and a re-render makes hundreds of records. What a record says is type ("children", "attributes" or "text"), attribute (the name, or null), and added and removed as counts. A program that needs the nodes asks the page with children or query.

Reading a server’s event stream

events(url, options) is the reading end of slate:http‘s sse, which slate could write and had no way at all to consume. It answers an object whose close ends the subscription.

val feed = events("/updates", {
    onMessage: (m) -> apply(m.data),
    onError: (e) -> if e.closed then warn("the stream is over") })

feed.close()

A message is { data, lastEventId, type }. An error record says only closed: an EventSource reconnects by itself, so nearly every error a page sees is a retry in progress, and a program that stopped on those would stop on a hiccup.

A lastEventId is refused rather than ignored. A browser’s EventSource sends the last id it saw on its own reconnections and gives a page no way to set one on the first request — so taking the option and dropping it would be a program that believed it had resumed and had not. What a program resuming after a reload does instead is keep the lastEventId it read off each message and ask the server for what it missed.

A node is a slate integer

That is the decision everything else follows from. The engine keeps the elements in a table and hands out the index, so no foreign object ever becomes a slate value: == compares what slate says it compares, print has something to say, a node travels through an array or a pattern like any other value, and the checker learns nothing new. It is the arrangement the timers already use.

The cost is that a handle is held until release gives it back.

An event arrives as a slate object

{ type, value, checked, key, mods, button, stop, prevent }, built when the handler fires. A MouseEvent has no representation in slate, and inventing one would mean inventing a value that could not be printed, compared or stored.

mods is { meta, ctrl, shift, alt } and button is an integer or null — 0 for the left button, 1 for the middle, 2 for the right, and null for every event that is not a mouse event. They are here because a link cannot be written without them: a framework that intercepts a click has to let a cmd-click, a ctrl-click, a shift-click and a middle click through to the browser, or it swallows the most ordinary thing anybody does to a link.

value and checked are set as properties and not attributes, and an input is where the difference shows: the attribute says what the field started as and the property says what it holds now, so a re-render that set the attribute would leave a typed-in field alone and the page would appear frozen.

Reading a page that is already there

Four of the names above read rather than write, and they exist because hydration needs exactly them. Everything else either makes a node or changes one; a program adopting markup a server rendered has to walk what is there and ask what it found.

import { byId, children, tagName, nodeText, attribute } from slate:dom

val app = byId("app")

for kid in children(app)
    if tagName(kid) == null
        print("text: " + nodeText(kid))
    else
        print("<" + tagName(kid) + "> class=" + string(attribute(kid, "class")))

children answers EVERY child node and not only the elements, because a text node between two elements is a position: a reconciler counting children has to count what the browser counts, or it adopts the wrong node. tagName answering null is how the two are told apart.
tagName is lower case, because that is what a program wrote — the DOM answers DIV for HTML.
attribute answers true for a bare attribute, which is the reading setAttribute writes: it puts the empty string for true, so a program comparing what it would set against what is there gets the same value back.
A handle from children is released like any other, and release gives back the HANDLE and not the node. The element stays exactly where it is in the page. That reads oddly the first time and is the rule handles have always followed: byId and query have minted one for an element the program never created since this module shipped.

parent, the siblings and an innerHTML reader are deliberately absent. A page is walked downwards from something the program already holds; the rest is a general traversal API, which is a different thing to want and a much larger one.

Where the page is, where it has been, and what it remembers

A browser has location, history and localStorage, and nothing else does — there is no address bar in an interpreter and no per-origin store on a server. So these refuse everywhere else, naming which of the three is missing rather than saying something about the document. That is the same rule slate:time‘s abbrev follows, read from the other side.

import { location, pushPath, onNavigate, stored, store } from slate:dom

val here = location()          // { href, protocol, host, hostname, port, path, query, hash }

show(path) = render(path)

onNavigate(show)               // the user pressed back, or forward

pushPath("/notes/7")           // the address bar moves; onNavigate does NOT fire
show("/notes/7")               // so a router renders after its own push

store("theme", "dark")
print(stored("theme").value)   // "dark", or null when nothing is stored

query and hash carry their punctuation — "?a=1" and "#top" — which is what a program pasting one back into a url needs. An empty one is "" and never null.

A push does not raise onNavigate. A browser raises it for a movement the user made and never for one the program made itself, so a router renders after its own push and waits to be told about everything else. Getting this wrong is how a router renders twice.

There is no state object, and that is a measurement. pushState structured-clones what it is given and structuredClone strips the prototype, so a slate object put in comes back a plain object nothing in the language could read. The url is the whole of the state — which is also what keeps a router’s two sources of truth from disagreeing after a back.

The store answers results, which is readFileSync‘s channel and its reason: what comes back was written by somebody else — another tab, an earlier visit, a user who cleared it. A key that is not there is { ok: true, value: null } and not a failure; a browser told to keep no data is { ok: false, error }. A value that is not a string is stored as slate prints it, a store holding nothing else.

Under the interpreter

Every name faults, and the module still exists. Leaving it out would make import { byId } from slate:dom a complaint about the module, which sends a reader looking for a spelling mistake in the one line that is right. The refusal instead names the command, because the command is the mistake — the same program is correct in a browser.

The framework

slate:dom is the seam, not the framework. lath is React’s model and React’s mechanism, written in slate over elements, with this module as one of its two hosts — the other rendering to markup beside slate:http, so server-side rendering is a by-product rather than a project.

$ slate add github.com/slate-language/lath

It is a package rather than part of the language, and deliberately so: a UI framework iterates far faster than a compiler, and baking one in would tie every framework fix to a language release.

Moving one child

setChildren writes the whole list and the two beside it move one node. Both spellings are here because they cost different things: replacing a list is what makes a re-render idempotent, and it is what a browser records a mutation for per child — a keyed reconciler moving three rows of a thousand should not make the page do a thousand pieces of work.

insertBefore(list, row, list.children()[2])
insertBefore(list, row, null)
removeChild(list, row)

before of null appends, which is Node.insertBefore‘s own rule and is what makes the last position no more work than any other. A node already in the page MOVES rather than being copied, so it keeps its focus, its scroll position and whatever it was playing. The parent is named for the removal too, where a browser needs only the child: a reconciler holds both, and naming the parent is what turns “that node is somewhere else entirely” from a silent success into a sentence.

Data types

2026-09-06T00:36:22.158815252Z

Data types

data declares a closed set of variants — an algebraic data type — and that closed set is what makes a match over one worth checking.

data Shape
    Circle(r)
    Rect(w, h)
    Empty

    area(self) = self match
        Circle(r) -> 3 * r * r
        Rect(w, h) -> w * h
        Empty -> 0

print(Circle(3), Circle(3).area())
print(Empty, Empty.area())

Circle(3) 27
Empty 0

A variant is a class from the data type, which is the whole of the implementation: is Shape, an annotation, export, a cross-file import and a method on the shared body are all machinery class already had. Circle(3) is the generated constructor, reached by the rule that calling an object calls its new.

A variant that declares no fields is a value rather than a maker. Empty is the value, not Empty(), and the test for it is identity.

A data value does not change

A write to one of its fields is refused, and v with { r: 4 } answers a new one that differs there. Two equal ones are equal and hash alike, so a data value is an ordinary table key.

data Shape
    Circle(r)

val c = Circle(3)

print(c with { r: 4 }, c)
print(Circle(3) == Circle(3))

Circle(4) Circle(3)
true

Exhaustive `match`

A match over an annotated subject must cover every variant, and the complaint names each one left out:

data Shape
    Circle(r)
    Rect(w, h)
    Empty

sides(s: Shape) = s match
    Circle(_) -> 0
    Rect(_, _) -> 4
    Empty -> 0

print(sides(Circle(1)), sides(Rect(1, 2)), sides(Empty))

0 4 0

It is checked exactly where the shape was written down — an unannotated subject is said nothing about — and a _ arm is how a program says it has finished listing.

Patterns

Variants take the same two forms a class does — Circle(r) by position, Circle { r } by name — and a field name the variant does not carry is refused where it is written. See Patterns.

The data name and each variant name are shape values, so Figure.test(v) asks whether v was made by one of the variants and Circle.test(v) asks about that one — the run-time form of the is above. mismatch and name come with them; see Types.

Encoding

Without a toJSON, a variant encodes as its own fields: Circle(3) is {"r":3}, never the chain it hangs from. A toJSON(self) on the shared body says otherwise — see Objects.

slate:crypto

2026-09-06T00:36:22.158815252Z

`slate:crypto`

Digests, HMAC, key derivation and randomness.

import { sha256, hmac, randomBytes, timingSafeEqual } from slate:crypto

val nonce = randomBytes(18)
val tag = hmac("SHA-256", "a key", "the message")

print(len(nonce), len(sha256("abc")), len(tag))
print(timingSafeEqual(tag, hmac("SHA-256", "a key", "the message")))
print(timingSafeEqual(tag, hmac("SHA-256", "a key", "another message")))

18 32 32
true
false


`md5 sha1 sha256 sha384 sha512`	text or bytes in, the digest as bytes out
`hmac(name, key, message)`
`pbkdf2(name, password, salt, rounds, length)`
`randomBytes(n)`	from the operating system
`timingSafeEqual(a, b)`
`argon2(password)`	a promise of a PHC record — Argon2id, 19 MiB, two passes
`argon2Verify(record, attempt)`	a promise of `true` or `false`
`argon2NeedsRehash(record)`	`true` or `false`, at once

hmac takes the digest by name — "MD5", "SHA-1", "SHA-256", "SHA-384", "SHA-512" — because what a program is speaking to decides it, and a default here would be a decision taken by whoever wrote the module rather than by the protocol. pbkdf2 takes the same names without "MD5": every other name here reads a protocol somebody else chose, and deriving a key is the one thing a program chooses for itself.

Why the module exists

A package cannot have a native. slate:jwt and slate:ws are carried in the binary and are compiled against the scope the natives live in; a package installed with slate add is not — so one speaking a protocol with a challenge in it (SCRAM, SASL, a signed webhook, a request signed for S3) had no digest at all and no source of unpredictability at all. A nonce a program worked out from the clock is not a nonce, and that half cannot be written in slate at any price.

What a program can write, it writes. Hex, base64 and the message layout of whatever protocol is being spoken are ordinary slate, so they are not here. What is here is the compression functions and the kernel.

pbkdf2 is here for a reason that is not tidiness: one SCRAM handshake is 4,096 HMACs, which is some eight thousand SHA-256 compressions — a millisecond as a native and seconds in the interpreter.

`timingSafeEqual`

What a program checks a tag it was sent with. == on two byte arrays stops at the first byte that differs, which tells an attacker how much of a forged tag was right, and a tag can be guessed a byte at a time from that.

`md5` and `sha1`

Both are exported and neither is an endorsement. Each is what an existing protocol asks for — a WebSocket handshake, a Git object, an old server’s SASL, PostgreSQL’s md5 login, HTTP Digest, an S3 ETag — and a program speaking one has no say in the matter. Nothing new should be signed with either, and no content address may be one.

For a password, none of these is the answer. argon2 below is deliberately slow, which is the whole difference — and it is why there is no hash in this module. Every name here says which algorithm it is, so a reader checking a login path by eye can see that the slow one was used.

`argon2` — the one hash here meant to be slow

Argon2id, in the PHC format every other Argon2 implementation reads.

import { argon2, argon2Verify, argon2NeedsRehash } from slate:crypto

async main()
    val stored = await argon2("correct horse")

    print(startsWith(stored, "$argon2id$v=19$m=19456,t=2,p=1$"))
    print(await argon2Verify(stored, "correct horse"))
    print(await argon2Verify(stored, "wrong"))
    print(argon2NeedsRehash(stored))

main()

true
true
false
false

A password is the one thing a server stores that must be expensive to check. Everything else in this module wants to be fast, and for a password that is the whole vulnerability: a stolen table of fast hashes is tried at billions of guesses a second on a graphics card. Argon2 is slow and memory-hungry, so the card’s thousands of cores cannot each hold a copy of the working state. The memory is the lever that matters, and it is why a default call reserves 19 MiB.

The salt is a fresh sixteen bytes from the operating system per call, so hashing one password twice gives two different records and both verify.

The parameters, and where the heavier profile went

argon2 and argon2NeedsRehash each take an optional record of parameters:


`memoryCost`	19456	kibibyte blocks — 19 MiB
`timeCost`	2	passes over that memory
`parallelism`	1	lanes
`hashLength`	32	bytes of tag
`salt`	the kernel’s	text or bytes, 8 to 32 of them

The defaults are OWASP’s first recommendation for a login. 64 MiB and three passes — for something hashed rarely and worth more than a session, a key-encrypting key or a recovery code — is argon2(secret, { memoryCost: 65536, timeCost: 3 }) rather than a second name: once the numbers are parameters at all, a name for one particular pair of them is a second way to say the same thing.

A salt you give is a footgun, and it is accepted anyway because a published test vector and a record being reproduced from another implementation both need it. A program that passes a constant has given up the only thing a salt is for: one precomputed table would then break every account at once.

An unknown key is refused rather than ignored. { memoryCosts: 65536 } would otherwise be a login that was thought to have been strengthened and was not.

The parameters travel inside the record

So raising what a program asks for invalidates nothing: existing records keep verifying, because argon2Verify uses the parameters the password was hashed with. argon2NeedsRehash says which records are below what is written today — ask it after a successful verify, while the plaintext is still in hand, and re-hash the ones that answer true. That is the whole upgrade path.

Where a program hashes with something other than the defaults, tell argon2NeedsRehash so: argon2NeedsRehash(stored, { memoryCost: 65536, timeCost: 3 }).

The derivation runs on a thread, which is why two of these are promises

Hashing a password is supposed to take a tenth of a second, and a loop is one thread. Done on the loop, that tenth of a second is a tenth of a second in which the server answers nobody — so ten simultaneous logins were ten seconds of a dead process. argon2 and argon2Verify hand the derivation to a thread pool and answer promises; everything else the server is doing carries on while it runs.

argon2NeedsRehash is not one of them, and the difference says what the pool is for: it reads the parameters out of the record and compares them, which is microseconds and no derivation at all.

The pool is four threads unless UV_THREADPOOL_SIZE says otherwise, and it is shared with file reads and name resolution.

Neither answers a result, and that is a decision

A wrong password is false; a stored record that will not parse faults. They are not the same failure — a record that is not an Argon2 record is a defect in whatever wrote the column — and collapsing them would make a corrupted row read as an intruder, which is the one confusion a login path must not have.

await argon2(p) is the record itself and await argon2Verify(r, p) is a boolean, not the { ok, value } a file read answers. Those carry a result because what they read came from outside the program and may not be there; a derivation is a value the program built, and every way it can go wrong is a fault raised where the call is written, before anything reaches a thread.

The record comes first and the password second. Both are text, so a swap would answer false forever and never say why — a second argument that is a record while the first is not is caught and named.

Classes

2026-09-06T00:36:22.158815252Z

Classes

A class is an object with a proto and a word in front of it. class binds a name to an object literal and from is that object’s proto, so what runs is what protos already did.

class Shape
    val sides = 0

    describe(self) = s"a ${self.name()} of area ${self.area()}"

class Square from Shape
    val sides = 4
    var side

    name(self) = "square"

    area(self) = self.side * self.side

print(Square.new(4).describe())

a square of area 16

A class belongs to the top level of a file, as a type does and for the same reason: its name is resolved while compiling. class is a soft word, so a program already using it as a variable name is untouched.

What the word buys

A method is written in the ordinary definition syntax. A field’s value is an expression, so a method in a literal is a lambda and its body is whatever fits after ->. A definition’s body may be an indented run of statements, take annotated or destructured parameters, be async, or yield. A class of twenty methods reads like twenty functions rather than like twenty fields.

is asks which class a value was made from, and walks the whole chain. This is the one thing class adds that a hand-written proto could not have:

class Shape
class Square from Shape
    var side

val sq = Square.new(1)

print(sq is Square, sq is Shape)
print({ side: 1, proto: Square } is Square)
print({ side: 1 } is Square)
print(Square is Square)

true true
true
false
false

A bare name in pattern position is a binding unless something has declared it, and a class declaration is what declares it — so the name works everywhere a type does: in is, in a match arm, and in a parameter’s annotation. A class crosses a file under export as both halves at once, the value and the type.

`val` and `var`

val is the class’s and var is each object’s, and that distinction is the one that bites. A val is one value however many objects there are; a var declares a field each object gets, and its initialiser runs once per object:

class Bag
    var items = []          // a NEW array for every bag
    val kind = "bag"        // one string, shared

val a = Bag()
val b = Bag()

push(a.items, 1)

print(a.items, b.items, a.kind)

[1] [] bag

A mutable literal under val is refused, and the message names var as the fix:

class Bag
    val items = []

var

TypeScript spells the per-instance one items = [], so a reader coming from TS writes val and gets one array every instance pushes into. A mutable literal under val is therefore refused, and the message names var as the fix. Only a literal is refused: an object bound outside the class and named here is sharing somebody asked for, and still compiles.

The generated `new`

A class that declares fields and writes no constructor is given one, taking all of them — the fields with no initialiser first, then the initialised ones, each optional with its initialiser as its default:

class Square
    var side
    var tags = []

print(Square.new(4))            // tags is a fresh []
print(Square.new(4, ["red"]))   // and tags said otherwise

Square(side = 4, tags = [])
Square(side = 4, tags = ["red"])

A default is worked out at the call, so leaving tags out still gives every square its own array. An initialiser may read a field bound before it — var side then var area = side * side.

An initialised field comes after an uninitialised one whatever order they were written in, since a default has to be trailing: var kind = "plain" above var side gives new(side, kind = "plain").

A class that declares nothing gets no new at all, rather than one answering an empty object; { side: 4, proto: Square } still works and is how such a class is made.

Writing your own `new`

Write one when it has something to do. var in its parameter list declares the field and assigns it — TypeScript’s parameter property — and self is the object being made. The body runs for its effect and the object is what comes back:

class Rect
    var area = 0

    new(var w, var h)
        if w < 0 || h < 0 then throw "a side cannot be negative"

        self.area = w * h

print(Rect(3, 4).area)
print(Rect(-1, 4).area catch e -> e.message)

12
a side cannot be negative

A class with no declared fields keeps the plain form, where the body’s value is the object: new(v) = { v: v }. It is given the class as its proto on the way out.

Class patterns

A class name written with fields after it tests and takes apart at once, which is what a Scala case class does — by position, or by name:

class Square
    var side

class Circle
    var radius

class Rect
    var w
    var h

tell(v) = v match
    Square(n) -> s"a square of side ${n}"
    Circle { radius: r } -> s"a circle of ${r}"
    Rect { w, h } -> s"${w} by ${h}"
    _ -> "something else"

print(tell(Square(3)), tell(Circle(7)), tell(Rect(2, 5)), tell(42))

a square of side 3 a circle of 7 2 by 5 something else

The positional order is the constructor’s, and that holds by construction rather than by convention — the field list a pattern is checked against is the parameter list of the new the class was given, so Square(n) binds what Square.new(4) sets and the two cannot drift apart.

A class that builds its own object in a hand-written new has no such list and is refused the positional form by name, with the named one offered instead.

Naming the class is what lets a misspelled field be caught: a bare { raduis: r } is a legal pattern that never matches, where Circle { raduis: r } is refused where it stands.

The class name is also a shape value, so Circle.test(v) asks at run time what v is Circle asks where it is written, and Circle.mismatch(v) and Circle.name() answer too — see Types. A static the class declares under one of those three names wins over it.

`is` in the header

is in a class header is TypeScript’s implements — a promise, checked where the class is written:

type Drawable = { draw: function }

class Pen is Drawable
    var ink

    draw(self) = "pen with " + self.ink

print(Pen("blue").draw())

pen with blue

Leave draw out and the fault names the class, rather than arriving wherever something first wanted to draw one:

type Drawable = { draw: function }

class Pen is Drawable
    var ink

    scribble(self) = "pen"

Drawable

It inherits nothing; from does that. What it buys is when you find out: leave draw out and the fault names the class rather than arriving wherever something first wanted to draw one. A class may promise several types (is Drawable, Named) and descend from one.

A promise is kept by a method a base supplies, because an object pattern counts a field a proto supplies.

There is no `super`

And none is needed. A base class is an ordinary value in scope, and a method stored on it directly is handed no receiver — so passing one is how you call it:

class Shape
    describe(self) = s"a shape of area ${self.area()}"

class Square from Shape
    var side

    area(self) = self.side * self.side

class Loud from Square
    new(side) = { side: side }

    describe(self) = upper(Shape.describe(self)) + "!"

print(Loud(2).describe())

A SHAPE OF AREA 4!

Shape.describe(self) names the class the call was written in, which is what a super call means. Counting links from whatever object turned up — self.proto.proto — is a different and wrong thing.

Calling a class

An object with a new is callable, so Square(4) is Square.new(4). That is what makes a data variant‘s constructor an ordinary function.

slate:brotli

2026-09-06T00:36:22.158815252Z

`slate:brotli`

import { compress, decompress } from slate:brotli

val page = toBytes(repeat("<p>hello</p>", 40))
val small = compress(page, 5)               // quality 0-11
val back = decompress(small, 1 << 20)       // the limit is not optional

print(len(small) < len(page))
print(back.ok, fromBytes(back.value).value == fromBytes(page).value)
print(decompress(toBytes("not brotli"), 1 << 20).ok)

true
true true
false

The two channels

compress faults — it cannot fail on input the program already holds. decompress answers a result, because what is being decompressed came from somewhere else: a request body that is not a brotli stream is an ordinary thing to be sent and a 400 to answer, not a defect in the program reading it.

The three failures are three sentences, since they mean three different things to whoever sent the bytes: expands past the N bytes it was allowed, ends in the middle, is not a brotli stream.

The limit is required

A brotli stream carries no length and a crafted one of a few hundred bytes expands without bound. There is no form of decompress that omits the limit.

Not in a browser

No JavaScript host has a brotli encoder, so compress and decompress refuse under slate js, naming brotli rather than promising a release. slate:gzip is the compression a browser has, and it is promise-shaped for that reason; this module is synchronous and stays so.

slate:http compresses a response without asking the handler; that page says what the rules are.

Asynchrony

2026-09-06T00:36:22.158815252Z

Asynchrony

`async` and `await`

An async function answers a promise rather than a value, and await waits for one:

async work(name, ms, turns)
    var i = 0

    while i < turns
        await sleep(ms)
        i = i + 1

    name + " finished"

async main()
    val a = work("a", 8, 3)
    val b = work("b", 20, 2)

    print("started both")
    print(await a)
    print(await b)

main()

started both
a finished
b finished

Everything above a function’s first await runs before its caller sees the promise, and everything below it runs after the caller has moved on — which is node’s rule, and why started both prints before either worker’s first step. The two workers then interleave by their own clocks: with those numbers a takes its first two steps, b takes one, a finishes, and b finishes last.

Top-level await is refused, so a program that wants to wait writes an async main and calls it:

val x = await sleep(1)

`await` belongs in an `async` function

async goes in front of a definition, a lambda, or a method. Making the whole program a coroutine is a real design and one to make on purpose.

The order things run in

A settled promise still resumes through the queue rather than continuing in place, so what was scheduled first runs first; await of a plain value answers it and still yields, so a program cannot tell which of the two it was handed by watching what runs next.

There are two queues and the order between them is fixed. One answers something happened outside the program — a timer, a socket, a file. A second, drained to empty between every turn of the first, answers a value a suspended call is owed is now known. That is JavaScript’s microtask/macrotask split, and it is not a refinement: a program that resolved a promise from a timer callback and then ran the next timer before the awaiting function had moved would interleave in an order nothing could predict.

Failure

A failed promise raises where it was awaited. A promise fails when the async function running it faults; awaiting that promise raises the same fault in the awaiting function, so a chain of awaits carries a fault to whoever is waiting at the end of it — and a catch anywhere along that chain stops it.

catch works across an await. A coroutine carries its handlers with it when it is set aside, so a promise that fails minutes later still raises inside the try that was written around the await rather than escaping to the scheduler.

A failure nothing was waiting for is the program’s failure, reported against the line that raised it. That is the one thing node gets wrong by default and warns about instead.

A call whose promise was thrown away fails at once; everything else is asked at the end. The question “was this handled?” usually cannot be answered when a promise fails — val p = risky() and await p three lines later is ordinary — so it is asked once, after everything has settled. But a call written on a line of its own, main(), was never given to anybody: there is no name for it and no line that could ever await it, so its failure is final where it happens. That distinction is what makes the report reach a server, which never settles and would otherwise hold the diagnostic for as long as the process lived — a fault in a coroutine that looks, from outside, exactly like a hang.

Making a promise


`sleep(ms)`	a promise for later; takes a duration too
`resolve(v)`	one that has already settled with a value
`reject(message)`	one that has already failed
`pending()`	one nobody has answered yet
`settle(p, v)`	answer a pending one
`fail(p, message)`	fail a pending one

resolve and reject adapt something that has already happened; pending/settle/fail adapt something that has not. Without them a program could only await what slate itself started, and anything with a callback of its own would be stuck in callbacks. They are JavaScript’s Promise.withResolvers() under slate’s own names.

Timers

setTimeout(fn, ms) and setInterval(fn, ms) answer an id; clearTimeout(id) and clearInterval(id) stop one. A timer keeps the program alive, so an interval nothing clears is a program that never exits.

The callback comes first, which is node’s order — and a callback in that position cannot be a block lambda, those having to be last.

A fault in a callback is not caught by the call that scheduled it. try setTimeout(...) guards the scheduling and nothing else, because the callback runs from the loop long afterwards. That is inherent rather than a gap: there is no statement of the program’s left to attach it to.

`for await`

for await x in source asks the subject for next() and awaits the answer, stopping when it says it is done. It is legal only inside an async function.

counted(n)
    var i = 0
    val it = {}

    it.next = async () ->
        await sleep(1)

        if i >= n then { done: true, value: null }
        else
            i += 1
            { done: false, value: i * 10 }

    it

async main()
    for await v in counted(3)
        print(v)

main()

10
20
30

A source is anything with a next(), and that is the whole protocol — there is no second well-known name and no symbol. A generator already has one, so a synchronous subject works unchanged:

twoOf()
    yield 1
    yield 2

async main()
    for await x in twoOf()
        print(x)

main()

1
2

What makes one rule enough is that await of a plain value answers it. A generator’s next() answers { value, done } outright and an asynchronous source answers a promise of the same shape, so there is no fallback branch to write and nothing for a reader to choose between.

It is a loop like any other: break gives it a value, a label says which loop to leave, and an else runs when it finished on its own.

counted(n)
    var i = 0
    val it = {}

    it.next = () ->
        if i >= n then { done: true, value: null }
        else
            i += 1
            { done: false, value: i * 10 }

    it

async main()
    val found = 'search for await v in counted(9)
        if v == 30 then break 'search v

    print(found)

    for await v in counted(0)
        print("never")
    else
        print("nothing arrived")

main()

30
nothing arrived

The subject is evaluated once, so a call in the head makes one source and not one per turn.

An array is not a source. It has no next(), and the refusal says so rather than naming a method the program never wrote:

async main()
    for await x in [1, 2]
        print(x)

main()

a `for await` asks its subject for `next()`, and an array has none -- write `for` without `await` to walk an array

Outside an async function it is refused where the awaiting would happen:

twoOf()
    yield 1

for await x in twoOf()
    print(x)

`for await` belongs in an `async` function

There is no async generator yet. A source is written by hand as an object with a next, which is how node’s streams implement theirs; the sugar for producing one came second in JavaScript and can come second here.

Generators

A function is a generator because it holds a yield — Python’s rule, with no word on the definition.

counter(from)
    var n = from

    loop
        yield n
        n = n + 1

val g = counter(1)

print(next(g))
print(g.next())

for x in counter(1)
    print(x)

    if x == 3 then break

{value: 1, done: false}
{value: 2, done: false}
1
2
3

Calling one runs nothing. The body starts on the first next.
next(g) and g.next() are the one call, next being a free function like every other method.
next answers { value, done }, and a generator whose body has finished answers { value: null, done: true } from then on.
for x in g is an ordinary loop over one, and stops when the generator does.
A generator does not touch the event loop, so generators work in a program with no loop running.
val got = yield x is how a value is sent in: the driver’s value is written over the slot the yielded one left.

echoer()
    val got = yield 1

    yield got * 10

val e = echoer()

print(next(e))
print(e.next(5))

{value: 1, done: false}
{value: 50, done: false}

yield takes the whole expression where await takes one operand. await f() + 1 waits for the call and adds to the answer; yield x * x yields the product. A yield used inside a larger expression is bracketed. JavaScript and Python both put yield at the bottom of the ladder.

An async function may not yield. Two things would be entitled to put one machine back and there is no rule for which, so calling one fails its promise with “an async function may not yield – an async generator is not slate”. It is refused at the call rather than at the compile.

An abandoned generator’s state is held for the life of the program — there is no finalizer, so a generator never run to the end keeps what it was holding.

slate

slate:zstd

slate:zstd

Why it is here beside brotli and gzip

The names are the format’s own verbs

The two channels

The limit is required

The level is written at every call

Both hosts have it, and a browser does not

slate:ws

slate:ws

open(url) — the client

The upgrade seam

What is in the module

Values

Values

The kinds

Truth

Equality

Numbers

Strings

Conversion

Reference and copy

Absence

slate:url

slate:url

It exists so that a page can import it

Decoding is over bytes, not characters

Encoding is the unreserved set and nothing more

A repeated name is the last one

parsePairs is the grammar the three of them share

base64urlEncode and base64urlDecode

Types

Types

The rule the checker obeys

type

The type expressions

array of T

? and |

&

A function type

Annotating

A binding

An object literal written where a shape is expected

A rest parameter

What the checker knows before the program runs

A call answers in terms of what it was given

A callback knows what it is handed

Type parameters

Every argument must fit the type the parameter was solved to

What a type parameter still does not do

It reads the rest of the block before it says what a name holds

Where it steps aside

A type is a value under its own name

Interfaces

slate:time

slate:time

Making one

Duration against period

Reading one

at

The two channels

Comparison

format

Timers

Tests

Tests

The assertions

A call that is supposed to fail

Leaving a test out

Setting up, and tidying away

When one of them goes wrong

Running only some of them

Where tests live

Two rules worth knowing

Statements

Statements

Declarations

What is in scope where

Assignment

`slate:zstd`

`slate:ws`

`open(url)` — the client

`slate:url`

`parsePairs` is the grammar the three of them share

`base64urlEncode` and `base64urlDecode`

`type`

`array of T`

`?` and `|`

`&`

`slate:time`

`at`

`format`

`if`

`throw`

`slate:sqlite`

`exec` runs several statements and `query` runs one

`slate:regex`

`slate:redis`

There is no `get` and no `set`

`slate:process`

`stderr`

`args` and `exit`

`env`

`run`

`match`

`@`

`|` and `&`

`is`

`slate.sum`

`proto`

`toString` and `toJSON`

`slate:nghttp2`