Chuks Programming Language | Blog

Chuks v0.0.7 — The Ecosystem Release

Fri, 27 Mar 2026 00:00:00 GMT

Chuks v0.0.7 is the biggest release yet — 80 files changed, +7,806 lines. This release adds a full package manager with supply chain security, a watch mode for development, route groups with middleware, 83 new math functions, and a complete generic monomorphization system in the AOT compiler.

Package Manager

Chuks now has a built-in package manager. No separate tool needed — it’s part of the chuks CLI.

chuks add chuks_redis          # Add a package to your project
chuks install                  # Install all dependencies from chuks.json
chuks remove chuks_redis       # Remove a package
chuks update chuks_redis       # Update a package to latest
chuks info chuks_redis         # Show package details
chuks list                     # List installed packages
chuks publish                  # Publish your package to the registry

Packages are declared in chuks.json and installed into a local chuks_packages/ directory. The package manager resolves dependencies from the Chuks package registry, validates versions, and manages the full lifecycle — add, install, remove, update, publish.

Semver Constraints

Version requirements in chuks.json support the full semver constraint syntax:

{
  "dependencies": {
    "chuks_redis": "^1.2.0",
    "chuks_kafka": "~2.1.0",
    "chuks_csv": ">=1.0.0"
  }
}

Constraint	Meaning
`^1.2.3`	>=1.2.3, <2.0.0 (compatible with major)
`~1.2.3`	>=1.2.3, <1.3.0 (compatible with minor)
`>=1.0.0`	Any version 1.0.0 or higher
`<2.0.0`	Any version below 2.0.0
`1.2.3`	Exact version only
`*`	Any version

Caret constraints handle 0.x versions correctly — ^0.2.3 resolves to >=0.2.3, <0.3.0 since pre-1.0 versions treat the minor as the compatibility boundary.

Resolution happens server-side. The CLI sends the constraint to the registry, which returns the best matching version. This means the registry can account for yanked versions and package status without the CLI needing that logic locally.

Transitive Dependencies

When you install a package, the package manager automatically discovers and installs its dependencies — and their dependencies, recursively. A breadth-first resolution pass walks the full dependency tree, detects cycles, and locks every transitive dependency into chuks.lock.

Each transitive dependency requires the same permission consent as a direct dependency. Nothing gets installed silently.

Lockfile Integrity

Every chuks.lock file is signed with an HMAC-SHA256 signature using a machine-local key stored at ~/.chuks/lockfile.key. The key is generated automatically on first use (256-bit random, owner-only permissions).

When chuks install runs, it verifies the lockfile signature before proceeding. If the lockfile has been manually tampered with — or modified outside the CLI — the signature check fails and installation is blocked:

⚠ lockfile signature mismatch — chuks.lock may have been tampered with
Run 'chuks install --resign' to re-verify and re-sign.

This prevents an attacker from editing chuks.lock to swap a trusted package version for a compromised one. The signing is non-fatal if the key file is unavailable (e.g., fresh CI environment), but emits a warning.

Supply Chain Security

The package manager enforces a multi-layered security model at every stage — install, build, and runtime.

Every package declares what system capabilities it needs (file system access, network binding, database access, process execution, etc.). When you install a package for the first time, the CLI shows an interactive consent prompt:

📦 chuks_redis v1.3.0
   Status: active
   Integrity: sha256:a1b2c3d4e5f6...

   Permissions requested:
     ✔ net.connect     Connect to external services
     ✔ net.bind        Listen on network ports
   ⚠ Elevated:
     ⚠ db.access       Full database control

   Outbound domains:
     → redis.example.com

   Accept? [y/n]

Elevated permissions (file system writes, process execution, database access, install scripts) are marked with ⚠️ so they stand out. You approve once; the decision is recorded in chuks.lock.

Permission Enforcement

Approved permissions aren’t just informational — they’re enforced.

At compile time: before building your project, the compiler scans every installed package to verify it only imports standard library modules consistent with its declared permissions. If chuks_redis declares net.connect but also imports std/fs, the build fails:

✗ permission violation — chuks_redis uses std/fs but fs.read was not granted

At runtime (AOT): AOT-compiled binaries embed a startup check that re-validates all package permissions when the binary launches. Even if the compile-time check is bypassed, the binary refuses to run if permissions don’t match:

✗ runtime permission violation — package chuks_redis uses net.bind
  but none of its required permissions were granted

This is defense-in-depth. The lockfile is the source of truth, and enforcement happens at two independent stages.

Content Integrity Verification

Every package installation includes a SHA-256 content hash verification against the registry. The registry returns the expected hash for the exact version being installed, and the CLI compares it against the downloaded content:

✗ integrity check failed for chuks_redis@1.3.0
  Expected: sha256:a1b2c3d4...
  Got:      sha256:x9y8z7w6...
  This could indicate a supply chain attack.

If the hash doesn’t match, installation is blocked. This catches scenarios where package contents are modified after publication — whether by a compromised registry, a man-in-the-middle, or a storage-level attack.

Permission Escalation Detection

When you run chuks update, the package manager compares the new version’s permissions against what you previously approved. If the update adds new permissions, you’re prompted to re-consent before the upgrade proceeds:

📦 chuks_redis 1.3.0 → 2.0.0

   New permissions requested:
   ⚠ fs.write          Write to the file system
   ⚠ proc.exec         Execute system commands

   Accept? [y/n]

This prevents a trusted package from silently gaining new capabilities in a minor or major update.

Package Status Validation

The registry assigns a status to every package: active, under_review, rejected, or yanked. The CLI checks this status before installation and blocks anything that isn’t active:

✗ package chuks_badpkg has status 'rejected' — cannot install

Yanked versions are excluded from version resolution entirely.

CI/CD Mode

The CLI detects whether it’s running in an interactive terminal or a CI/CD pipeline. In non-interactive mode (no TTY), chuks install requires an existing chuks.lock — it never prompts for permission consent. This prevents CI pipelines from hanging on a [y/n] prompt and ensures that production installs always use pre-approved lockfiles.

API Tokens & CI/CD Publishing

Chuks now supports API tokens for automated publishing from CI/CD pipelines. Instead of interactive OAuth login, generate a scoped, expiring token from the dashboard and use it in your pipeline.

Tokens are scoped — you choose exactly what each token can do:

Scope	What it allows
`packages:read`	List packages, view download stats
`packages:publish`	Publish new package versions
`packages:yank`	Yank and restore versions
`packages:permissions`	Update package permissions

Using Tokens

Pass a token directly:

chuks publish --token chuks_pk_a1b2c3d4...

Or set an environment variable:

export CHUKS_TOKEN=chuks_pk_a1b2c3d4...
chuks publish

GitHub Actions Example

name: Publish Package
on:
  push:
    tags: ["v*"]
jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: curl -fsSL https://chuks.org/install.sh | bash
      - run: chuks publish --token ${{ secrets.CHUKS_TOKEN }}

Security: tokens are stored as SHA-256 hashes — the raw token is shown once at creation and never stored. Tokens can be revoked instantly from the dashboard, and each token shows its last-used date for auditing.

See the full CI/CD Publishing guide for GitLab CI, Bitbucket Pipelines, and security best practices.

Watch Mode

chuks watch monitors your source files and automatically rebuilds + restarts on every save:

chuks watch src/main.chuks

Under the hood it listens for filesystem events and manages child processes with proper isolation, the running server is killed and restarted cleanly on each change. Hot reload for Chuks development.

Route Groups & Route-Level Middleware

You can now organize routes into groups with shared prefixes and middleware chains:

var api = app.group("/api", authMiddleware)
api.get("/users", getUsers)
api.post("/users", createUser)

// Nested groups inherit parent middleware
var admin = api.group("/admin", adminMiddleware)
admin.get("/stats", getStats)  // has both auth + admin middleware

Route-level middleware is eagerly flattened at registration time — when a route is added to a group, its middleware chain is computed once by merging parent middleware with group middleware. No per-request traversal.

This works in both VM and AOT modes with identical behavior.

83 New Math Functions

The math standard library now has 83 new functions covering:

Trigonometric: sin, cos, tan, asin, acos, atan, atan2
Hyperbolic: sinh, cosh, tanh, asinh, acosh, atanh
Exponential/Logarithmic: exp, exp2, expm1, log, log2, log10, log1p, logb
Rounding: trunc, roundToEven
Special: erf, erfc, erfinv, erfcinv, gamma, lgamma
Bessel: j0, j1, jn, y0, y1, yn
Utility: cbrt, copysign, dim, hypot, mod, remainder, nextafter, ldexp, frexp, ilogb, scalbn
Classification: isInf, isNaN, signbit, inf, nan

import { math } from "std/math"

var angle: float = math.pi / 4.0
println(math.sin(angle))       // 0.7071067811865476
println(math.gamma(5.0))       // 24
println(math.erf(1.0))         // 0.8427007929497149

Generic Monomorphization in AOT

The AOT compiler now fully monomorphizes generic classes. When you write Box<int>, the compiler generates a dedicated specialized type with concrete typed fields — no dynamic dispatch, no runtime type switches.

class Box<T> {
    var value: T
    constructor(value: T) {
        this.value = value
    }
    get(): T {
        return this.value
    }
}

var intBox = new Box<int>(42)
var strBox = new Box<string>("hello")

The AOT compiler:

Scans the program for all generic instantiations (Box<int>, Box<string>)
Generates specialized types with concrete field types
Rewrites all references to use the specialized types

This means generic code compiles to the same efficient native code as hand-written specialized classes. The specialization system handles nested generics, generic superclass instantiation, and method-level generic parameters.

Task.all()

Task.all() runs multiple async tasks in parallel and waits for all of them to complete:

var results = await Task.all([
    fetchUsers(),
    fetchProducts(),
    fetchOrders()
])

All tasks run concurrently and results are collected in order. If any task fails, errors are aggregated.

Channel Module Redesign

The std/channel module has been refactored from standalone exported functions to a class-based API:

import { channel } from "std/channel"

var ch = channel.create(1)
channel.send(ch, "hello")
var msg = channel.receive(ch)

Typechecker Improvements

Route group types — the typechecker now understands app.group() return types and validates middleware + handler signatures on grouped routes
Channel types — proper type tracking through channel send/receive operations
Method-level generic parameters — methods can define their own generic type parameters independent of the class
Generic superclass instantiation — class Foo extends Bar<int> correctly resolves the parent’s generic types
Variadic route handler typing — route methods accept variable numbers of middleware + handler arguments with correct type checking

Compiler Architecture

The old monolithic bytecode compiler (1,177 lines) has been replaced by an IR-based pipeline. The new architecture is:

Parser → AST
IR Generator → intermediate representation
Optimizer → dead code elimination (now handles AddressOf, Deref, IterKeys nodes)
IR Compiler → bytecode

This also powers the new OP_ITER_KEYS opcode for for-in loops over maps, and deterministic map output (keys are now sorted alphabetically in string() representation).

IDE & Developer Experience

Hover information expanded significantly (+452 lines) — richer type info, documentation hints, and signature details in the VS Code extension
Completion improvements for the new language features
ASI (Automatic Semicolon Insertion) fixed for complex nested expressions — the lexer now tracks block scope depth for parentheses and brackets separately

CI/CD Improvements

Cross-platform testing — CI now runs on ubuntu-latest, macos-latest, and windows-latest
Code coverage — new Codecov integration for tracking test coverage
Manual dispatch — CI can now be triggered manually via workflow_dispatch

Runtime Improvements

The AOT runtime has been upgraded with significant performance improvements — a new garbage collector, faster hash maps, and improved memory allocation. These benefits apply automatically to all AOT-compiled Chuks programs.

Database — Production Ready

The std/db module now provides a complete, production-grade SQL toolkit. Every feature works across all four supported databases (SQLite, PostgreSQL, MySQL, MSSQL) in both VM and AOT modes — 540 database tests passing.

Transaction Convenience Wrapper

No more manual begin/commit/rollback boilerplate. db.transaction() auto-commits on success and auto-rolls back on error:

import { db, DbDriver } from "std/db"

var conn = db.open(DbDriver.Postgres, databaseUrl)

var result = db.transaction(conn, (tx) => {
    db.txExec(tx, "INSERT INTO orders (userId, total) VALUES (?, ?)", [1, 99.99])
    db.txExec(tx, "UPDATE users SET balance = balance - ? WHERE id = ?", [99.99, 1])
    return db.txQuery(tx, "SELECT balance FROM users WHERE id = ?", [1])
})
// If anything throws, both the insert and update are rolled back
println(result[0]["balance"])

Connection Pool Stats

Monitor your connection pool at runtime:

db.setPool(conn, "maxOpenConns", 25)
db.setPool(conn, "maxIdleConns", 10)

var stats = db.poolStats(conn)
println(stats["openConnections"])  // total open connections
println(stats["inUse"])            // currently in use
println(stats["idle"])             // idle connections
println(stats["maxOpen"])          // configured max
println(stats["waitCount"])        // total waits for a connection

Bulk Insert & Upsert

Insert multiple rows in a single call, or upsert (insert-or-update on conflict):

import { QueryBuilder } from "std/db/query"

var qb = new QueryBuilder(conn)

// Bulk insert
qb.table("products").insertMany([
    { "name": "Widget", "price": 9.99 },
    { "name": "Gadget", "price": 24.99 },
    { "name": "Gizmo", "price": 14.99 }
])

// Upsert — insert or update on conflict
qb.table("products").upsert(
    { "name": "Widget", "price": 12.99, "stock": 50 },
    ["name"]  // conflict columns
)

Repository equivalents: createMany() and upsert().

Aggregate Functions

The Query Builder and Repository now have built-in sum(), avg(), min(), and max():

var totalRevenue = await qb.table("orders").sum("amount")
var avgPrice = await qb.table("products").avg("price")
var cheapest = await qb.table("products").min("price")
var mostExpensive = await qb.table("products").max("price")

Advanced WHERE Clauses

New query methods for common SQL patterns:

// Range queries
qb.table("products").whereBetween("price", 10, 50).all()
qb.table("products").whereNotBetween("price", 100, 999).all()

// IN / NOT IN
qb.table("users").whereIn("role", ["admin", "moderator"]).all()
qb.table("users").whereNotIn("status", ["banned", "suspended"]).all()

// Raw WHERE for complex expressions
qb.table("orders").whereRaw("total * quantity > ?", [1000]).all()

// Distinct results
qb.table("orders").distinct().select(["customerId"]).all()

// HAVING for aggregate filters
qb.table("orders")
    .select(["customerId", "SUM(total) as totalSpent"])
    .groupBy(["customerId"])
    .having("SUM(total)", ">", 500)
    .all()

Pagination & Chunking

Process large datasets efficiently:

// Paginate — returns { data, total, page, perPage, lastPage }
var page = await qb.table("products").orderBy("name").paginate(1, 20)
println(page["total"])     // total matching rows
println(page["lastPage"])  // last page number
println(page["data"])      // array of rows

// Chunk — process rows in batches (memory-efficient)
await qb.table("logs").orderBy("id").chunk(100, (batch) => {
    for (var i = 0; i < length(batch); i++) {
        processLog(batch[i])
    }
})

Raw SQL on Repository

Execute arbitrary SQL through the repository:

var results = await userRepo.raw(
    "SELECT u.*, COUNT(o.id) as orderCount FROM users u LEFT JOIN orders o ON u.id = o.userId GROUP BY u.id"
)
var single = await userRepo.rawOne("SELECT COUNT(*) as total FROM users")
await userRepo.rawExec("TRUNCATE TABLE sessions")

Index Management

Create and drop indexes at runtime:

// Add a regular index
await UserSchema.addIndex(conn, ["email"], false)

// Add a unique composite index
await UserSchema.addIndex(conn, ["firstName", "lastName"], true)

// Drop an index
await UserSchema.dropIndex(conn, ["email"])

Soft Deletes & Timestamps

Schemas now support auto-timestamps and soft deletes:

const UserSchema = db.define<User>(conn, "users", (schema) => {
    schema.pk("id").auto()
    schema.string("name").notNull()
    schema.timestamps()    // adds createdAt + updatedAt
    schema.softDeletes()   // adds deletedAt (records are "soft deleted", not removed)
})

// Soft-deleted records are hidden by default
var users = await userRepo.all()              // excludes soft-deleted
var all = await userRepo.withTrashed().all()  // includes soft-deleted
var deleted = await userRepo.onlyTrashed().all()  // only soft-deleted
await userRepo.where("id", 1).restore()       // un-delete
await userRepo.where("id", 1).forceDelete()   // permanently remove

Lifecycle Hooks

Override hooks in your repository for cross-cutting concerns:

class UserRepo extends Repository<User> {
    constructor() { super(UserSchema) }

    override beforeCreate(data: any): any {
        data["createdBy"] = getCurrentUserId()
        return data
    }

    override afterCreate(data: any, result: any): void {
        sendWelcomeEmail(data["email"])
    }

    override beforeDelete(): void {
        logDeletion("users")
    }
}

Health Check

Verify database connectivity:

if (db.ping(conn)) {
    println("Database is reachable")
}

CPU Core Limiting

By default, Chuks uses all available CPU cores. On shared servers where Chuks runs alongside other services (Node.js, databases, etc.), you can limit core usage with the --cpus flag:

# Limit to 4 cores
chuks run --cpus 4 src/main.chuks

# Equals syntax also works
chuks run --cpus=2 src/main.chuks

For AOT-compiled binaries, use the CHUKS_CPUS environment variable:

# Limit compiled binary to 4 cores
CHUKS_CPUS=4 ./build/my-app

Priority: --cpus flag > CHUKS_CPUS env var > default (all cores).

New: `bool()` Type Conversion

Chuks now supports bool() as a built-in type conversion function, joining int(), float(), and string(). It evaluates truthiness of any value:

var a: bool = bool(1)        // true
var b: bool = bool(0)        // false
var c: bool = bool("hello")  // true
var d: bool = bool("")       // false
var e: bool = bool(null)     // false

This is especially useful when working with dynamic data from json.parse(), where field types are any and need to be explicitly converted:

var parsed: any = json.parse(req.body)
if (parsed.done != null) {
    todo.done = bool(parsed.done)
}

bool() works in both VM and AOT modes.

HTTP Server Improvements

Case-Insensitive Header Parsing

The HTTP server now handles headers case-insensitively, following the HTTP/1.1 specification (RFC 7230). Previously, the server expected title-case headers like Content-Length, but many HTTP clients (including Node.js fetch) send lowercase headers like content-length. This caused request body parsing to silently fail when headers didn’t match the expected casing.

All header matching — Content-Length, Transfer-Encoding, and Expect — is now case-insensitive.

Content-Length Edge Case Fix

Fixed body parsing when Content-Length is the last header before the blank line separator. The header value parser previously relied on finding a \r delimiter after the value, which doesn’t exist for the final header. This caused the content length to be silently ignored, resulting in empty request bodies.

AOT Compiler Fixes

This release includes several important fixes to the AOT (ahead-of-time) compiler that improve correctness and VM/AOT parity.

Method Global Variable Shadowing

Methods that reference module-level global variables no longer incorrectly shadow them with local declarations. Previously, a method like:

var hookLog: string = ""

class ItemRepo extends Repository<Item> {
    override beforeCreate(data: any): any {
        hookLog = hookLog + "beforeCreate,"
        return data
    }
}

would generate a local variable inside each method body in the AOT output, meaning writes to hookLog were discarded when the method returned. The global was never modified. Now, the compiler detects that the variable is a known module-level global (not a new var declaration) and skips the local declaration — assignments target the module-level variable directly.

Intentional local shadows still work correctly. If a method declares var hookLog = "local", the explicit declaration scopes it to the method, so subsequent assignments reference the local as intended.

Devirt Dispatch Type Assertion Fix

The devirtualization (devirt) dispatch system — which converts interface method calls into direct concrete-type calls for performance — had an issue with inferred return types. When a method returns any but the compiler’s inference pass determines it returns a closure, the devirt code incorrectly assumed the native method signature had that concrete return type and skipped the type assertion. This caused compilation errors at the native code generation stage.

The fix restricts inferred-type usage in devirt to only “return this” patterns — where the method signature genuinely returns the concrete type — and leaves all other inferred types (closures, computed values) with proper type assertions.

Array Literal Type Narrowing Fix

Array literals containing maps (e.g. [{"name": "Alice"}, {"name": "Bob"}]) were incorrectly narrowed to a map-specific array type instead of []any. The narrowed type is not assignable to []any at the native code level, causing compilation failures at call sites expecting the broader type. The fix ensures map-element arrays always use the []any representation.

Closure Capture AOT Fix

Fixed a bug where AOT-compiled closures that capture variables from their enclosing scope could fail to properly capture certain variable types, particularly when the closure was used as a callback in class methods or event handlers. The compiled output now correctly captures all referenced variables regardless of their type.

Array Method Parity & New Methods

This release brings full array method parity between the VM and AOT compiler, and adds three new methods.

New Methods

clear() — removes all elements from an array (VM + AOT)
keys() — returns an array of indices (VM + AOT)
flat() in AOT — was VM-only, now works in both runtimes

var nums = [10, 20, 30];

nums.clear();
println(nums.length); // 0

var items = ["a", "b", "c"];
println(items.keys()); // [0, 1, 2]

var nested: [][]int = [[1, 2], [3, 4]];
println(nested.flat()); // [1, 2, 3, 4]

Callback Argument Fix

Array callback methods (find, map, filter, forEach, some, every, reduce, flatMap, findIndex, findLast, findLastIndex) now consistently pass two arguments — (element, index) — in both VM and AOT. Previously the VM passed three arguments (element, index, array) while the AOT passed two, causing behavioral differences between runtimes.

The callback signature is now (element, index?) — the index is always optional:

var nums = [1, 2, 3, 4, 5];

// Simple — just the element
var found = nums.find((val: int): bool => {
    return val > 3;
});

// With index
nums.forEach((val: int, idx: int) => {
    println(idx, ":", val);
});

// Reduce — (accumulator, element, index?)
var sum = nums.reduce((acc: int, val: int): int => {
    return acc + val;
}, 0);

Numbers

Metric	Count
Files changed	80+
Lines added	7,806+
Lines removed	2,119+
Golden tests (VM + AOT)	268
Database tests	540 (4 DBs × VM + AOT)
New math functions	83
New CLI commands	9 (watch, add, install, remove, update, info, list, publish, publish —token)
Platforms supported	5 (macOS arm64/amd64, Linux arm64/amd64, Windows amd64)

Chuks v0.0.6 — Benchmark Champion

Wed, 18 Mar 2026 00:00:00 GMT

Chuks v0.0.6 polishes the AOT compiler and proves its performance story with comprehensive benchmarks. This release fixes edge cases, adds 22 new tests, and puts Chuks at the top of the leaderboard.

#1 in Warm-Cache Benchmarks

After converting the remaining benchmarks from any-typed to fully typed code, Chuks AOT now ranks #1 overall in warm-cache benchmarks across 9 test categories — ahead of Go, Node.js, Python, Java, and C#.

The warm-cache metric matters because it measures steady-state performance — how fast your code runs after JIT compilation, OS caches, and memory allocation have stabilized. This is what production servers experience.

Compute Benchmarks (cold-start, wall-clock time)

Benchmark	Chuks VM	Chuks AOT	Java	Node.js	Bun	Python
Fibonacci (fib(38))	0.276s	0.138s	0.079s	0.300s	0.223s	5.167s
Matrix Multiply (200²)	0.132s	0.033s	0.031s	0.035s	0.027s	1.062s
Prime Sieve (1M)	0.138s	0.035s	0.030s	0.029s	0.014s	0.134s
Quicksort (100K)	0.222s	0.044s	0.034s	0.041s	0.044s	0.144s
String Concat (100K)	0.120s	0.034s	0.026s	0.022s	0.010s	0.023s
Binary Trees (depth 16)	0.177s	0.059s	0.037s	0.038s	0.028s	0.597s
N-Body (500K steps)	0.147s	0.046s	0.054s	0.048s	0.037s	4.519s
OOP (100K objects)	0.140s	0.035s	0.027s	0.021s	0.011s	0.058s
Map Operations (100K)	0.163s	0.046s	0.056s	0.040s	0.028s	0.057s

Cold-start times include ~130ms macOS page-cache overhead for compiled binaries. Warm-cache results below show the true computation cost.

Warm-Cache Results — Chuks AOT vs Go (median of 3, user time)

Benchmark	Chuks AOT	Go	Ratio
Fibonacci (fib(38))	0.088s	0.084s	1.05x
Matrix Multiply (200²)	0.006s	0.005s	1.2x
Quicksort (100K)	0.007s	0.007s	1.0x
Binary Trees (depth 16)	0.028s	0.028s	1.0x
N-Body (500K steps)	0.018s	0.018s	1.0x

5 of 9 benchmarks within 1.0–1.2x of Go. Chuks AOT ranked #1 overall by average position across all 9 benchmarks.

Parallel Compute — Prime Count to 5M (4 workers)

Runtime	Single	Parallel	Speedup
Chuks AOT	111ms	40ms	2.8x
Go	117ms	39ms	3.0x
Java	129ms	49ms	2.6x
Node.js	182ms	71ms	2.6x
Bun.js	127ms	51ms	2.5x
Python	7933ms	2661ms	3.0x

Why Typed Code Matters

Two benchmarks (binary_trees and map_operations) were previously written with any types, which forced the AOT compiler to use dynamic dispatch. Converting them to explicit types unlocked the full optimization pipeline:

// Before (v0.0.5) — forces dynamic dispatch
var node: any = createNode(depth)

// After (v0.0.6) — direct struct access, zero overhead
var node: TreeNode = createNode(depth)

This isn’t just a benchmark trick — it’s the same performance difference your production code gets when you use typed variables instead of any.

AOT Compiler Fixes

Nil Comparison for Typed Pointer Fields

When a class had a property typed as another class (a pointer field), comparing it to null in AOT mode generated incorrect native code. The compiler was emitting the wrong comparison for reference types vs value types.

class Node {
    var left: Node? = null
}

// This comparison now works correctly in AOT
if (node.left != null) {
    // ...
}

Windows Upgrade Fix

The chuks upgrade command on Windows was failing with a gzip error because Windows releases are distributed as .zip files, not .tar.gz. The upgrade logic now detects the platform and uses the correct extraction method.

Additionally, the Windows binary replacement strategy now uses a rename-to-.old approach to handle locked executables — a common issue when the running binary is the one being replaced.

22 New Tests

New stability and edge-case tests covering:

Async pipelines and try/closure patterns
Boundary conditions and deeply nested structures
Class hierarchy and complex inheritance
Closure stress testing
Concurrency patterns
Data processing pipelines
Error propagation
Functional patterns
Generic advanced patterns
Interface comprehensive tests
Real-world patterns and recursion algorithms
Scope isolation and state management
String edge cases
Type coercion and type system stress

All 157 tests pass in both VM and AOT modes.

Numbers

Metric	Count
Golden tests (VM + AOT)	157
New tests added	22
Benchmark categories	9
Benchmark ranking	#1 overall (warm-cache)
Platforms supported	5 (macOS arm64/amd64, Linux arm64/amd64, Windows amd64)

Chuks v0.0.5 — Production Hardening

Sun, 15 Mar 2026 00:00:00 GMT

Chuks v0.0.5 is about reliability. This release fixes fundamental concurrency issues, adds graceful shutdown, and publishes the first official performance benchmarks.

Graceful Shutdown

HTTP servers now handle SIGINT and SIGTERM correctly:

import { createServer } from "std/http"

function main() {
    var app = createServer()

    app.get("/", (req, res) => {
        res.json({ status: "ok" })
    })

    app.listen(8080) // Ctrl+C → graceful stop, no zombie processes
}

When you press Ctrl+C or send a termination signal:

The server stops accepting new connections
In-flight requests complete
The HTTP engine shuts down cleanly
No zombie processes, no leaked tasks

Required Port Argument

app.listen() now requires an explicit port — no more implicit default of 3000. If the port is already in use, you get a helpful error message with an lsof hint to find the conflicting process.

Concurrency Fixes

Two critical concurrency issues were identified and fixed:

Thread-Safe Task Map

The global task map used for tracking async tasks was not thread-safe. Under high concurrency, this caused data races and unpredictable behavior.

Fix: Replaced the global map with a concurrent map, keyed by task ID. Each concurrent execution context now has isolated task tracking — no shared mutable state.

Context Propagation

Async functions and spawn tasks weren’t inheriting the parent context correctly. This meant cancellation signals didn’t propagate to child tasks, and HTTP request contexts weren’t available inside async handler code.

Fix: Both the VM and AOT paths now derive child contexts from the parent task, ensuring cancellation cascades correctly through the entire task tree.

Benchmark Results

The first official CPU benchmarks are in:

Benchmark	Chuks AOT	Node.js	Python
Fibonacci (35)	52ms	78ms	2,410ms
N-Body (500K)	68ms	92ms	8,120ms
Quicksort (1M)	112ms	145ms	3,890ms
Binary Trees (15)	89ms	105ms	1,250ms
Prime Sieve (1M)	156ms	168ms	4,670ms

Chuks AOT matches or beats Node.js across all benchmarks. For typed scalar workloads (fibonacci, n-body, quicksort), it’s within striking distance of native compiled languages. Array-heavy benchmarks (binary trees, prime sieve) have a performance gap due to dynamic dispatch — a known ceiling we’re working to reduce.

New Language Features

Short-Circuit Evaluation

&& and || now properly short-circuit:

var result = false && expensiveCall() // expensiveCall() is never executed

Bitwise Operators

Full support for &, |, ^, ~, <<, >> — in both VM and AOT:

var flags = 0b1010 | 0b0101  // 0b1111
var masked = flags & 0xFF
var shifted = 1 << 8          // 256

String Escape Sequences

\n, \t, \r, \\, \", \0, \x41 (hex), \u0041 (unicode) — all standard escapes work.

Null-Safe Index Access

Indexing a null value now returns null instead of a fatal runtime error:

var arr = null
println(arr[0])   // null (no crash)

Map Dot-Notation Access

Maps support dot-notation for reading and writing keys, and missing keys return null:

var config = { "host": "localhost", "port": 6379 }
println(config.host)       // "localhost"
println(config.password)   // null (missing key)

config.host = "127.0.0.1"

`crypto.sha1` Builtin

New SHA-1 hash function in the crypto standard library:

import { crypto } from "std/crypto"
var hash = crypto.sha1("hello world")
println(hash)  // "2aae6c35c94fcfb415dbe95f408b9ce91ee846ed"

Try/Catch/Finally Fixes

try/catch now properly catches runtime errors. finally blocks with return work correctly. Error objects support code and data fields:

try {
    throw new Error("validation failed", "VALIDATION_ERROR", "email field")
} catch (e) {
    println(e.message)  // "validation failed"
    println(e.code)     // "VALIDATION_ERROR"
    println(e.data)     // "email field"
} finally {
    println("cleanup ran")
}

Two-Tier Builtin System

Built-in functions now have a deprecation mechanism. Old names continue to work with a warning, while new names follow consistent conventions.

Build Progress Spinner

chuks build now shows a visual spinner with phase messages during AOT compilation, giving feedback on each compilation stage.

HTTP Benchmarks

The first official HTTP benchmarks are in:

wrk (4 threads, 100 connections, 10s)

Runtime	Req/s
Chuks AOT	182,000
Go (gnet)	176,000
Bun	173,000
Node.js	115,000
Java (Javalin)	111,000
Go (net/http)	84,000
Python (Flask)	5,000

hey (100K requests, 200 concurrency)

Runtime	Req/s
Chuks AOT	143,000
Go (gnet)	142,000
Bun	106,000
Java (Javalin)	92,000
Node.js	89,000
Python (Flask)	4,000

Numbers

Metric	Count
Golden tests (VM + AOT)	135
HTTP integration tests	60
Async bridge tests	24
Shutdown tests	12
Concurrency bugs fixed	2 critical

Chuks v0.0.4 — The HTTP Release

Fri, 13 Mar 2026 00:00:00 GMT

Chuks v0.0.4 is the biggest release yet. The HTTP server gets a complete API overhaul, the testing infrastructure matures with 127 golden tests, and the toolchain gains self-update capabilities.

Highlights

Fiber-Inspired HTTP API

The HTTP server now has a rich, Express/Fiber-style API:

import { createServer } from "std/http"

function main() {
    var app = createServer()

    app.get("/users/:id", (req, res) => {
        var id = req.params.id
        var page = req.query.page

        res.status(200)
        res.header("X-Request-Id", "abc123")
        res.cookie("session", "xyz", { httpOnly: true })
        res.json({ id: id, page: page })
    })

    app.listen(8080)
}

New response methods: res.redirect(), res.type(), res.cookie(), res.clearCookie()

New request properties: req.ip, req.hostname, req.protocol, req.secure, req.originalUrl, req.cookie

Typed Request Body Parsing

Parse incoming JSON directly into a typed structure:

dataType CreateUser {
    name: string
    email: string
}

app.post("/users", (req, res) => {
    var user = req.parseBody<CreateUser>()
    res.json({ created: user.name })
})

File Uploads

Full multipart/form-data support with req.files and req.formData:

app.post("/upload", (req, res) => {
    var file = req.files[0]
    println(file.filename)   // "photo.jpg"
    println(file.extension)  // ".jpg"
    println(file.size)       // 1048576
    res.json({ uploaded: file.filename })
})

Channels

First-class communication between concurrent tasks:

import { Channel } from "std/channel"

async function producer(ch: Channel): Task<void> {
    ch.send("hello")
    ch.send("world")
    ch.close()
}

function main() {
    var ch = new Channel(10)
    spawn producer(ch)

    var msg = ch.receive()
    println(msg) // "hello"
}

Default Parameters

Functions can now have default parameter values:

function greet(name: string = "World"): string {
    return "Hello, " + name + "!"
}
println(greet())        // Hello, World!
println(greet("Chuks")) // Hello, Chuks!

Function Type Annotations

Arrow function type syntax in function signatures:

function apply(value: int, transform: (int) => int): int {
    return transform(value)
}
var result = apply(5, (x: int): int => x * 2)

Self-Update Command

chuks upgrade              # upgrade to latest
chuks upgrade 0.0.3        # install a specific version
chuks upgrade --list       # list all available versions

Downloads the correct platform binary, extracts it, and atomically replaces the current executable. Handles macOS codesign and xattr automatically.

Silent Toolchain Auto-Installer

When you run chuks build for the first time, Chuks automatically downloads and installs everything it needs. No prompts, no manual setup — it just works.

Testing Infrastructure

127 golden tests passing on both VM and AOT
60 HTTP integration tests covering routes, middleware, uploads, error handling
Tests run in parallel, comparing VM and AOT output for behavioral parity
Nondeterministic tests (timestamps, random) handled gracefully

Bug Fixes

AOT scoping: Variables declared inside if/else branches within loops now scoped correctly
TCP fragmentation: HTTP server correctly reassembles TCP segments split across network callbacks
AOT type assertions: Fixed invalid type assertions on Request.params/query struct fields
Error handling: finally block with return and throw-in-finally now behave correctly
Map access: Dot-notation access/set on maps works properly; missing keys return null
5 AOT transpiler limitations resolved (string conversion, array references, bitwise operators)

Numbers

Metric	Count
Golden tests (VM + AOT)	127
HTTP integration tests	60
AOT divergences fixed	23 → 0
New commits	25

Chuks v0.0.3 — LSP, HTTP Enhancements & Community Foundations

Sun, 08 Mar 2026 00:00:00 GMT

Chuks v0.0.3 brings a major leap in developer experience with a rich Language Server, expands the HTTP API, squashes edge-case bugs, and lays the groundwork for community collaboration.

LSP Server — Rich Hover & Completion Docs

The built-in Language Server now provides detailed hover documentation and completion item documentation for all built-in types, functions, keywords, and methods — no extension updates required.

Hover Documentation

25+ built-in types — int, float, string, bool, any, void, null, map, Error, HttpServer, Request, Response, Task, Context, Channel, dataType, and all numeric types (int8–uint64, byte, rune, float32, float64)
20+ built-in functions — println, print, length, append, delete, copy, clear, typeof, and more
35+ keywords — var, const, function, class, interface, enum, if, else, for, while, return, try, catch, finally, throw, async, await, spawn, import, export, new, extends, implements, abstract, final, override, access modifiers, switch/case/default, break, continue, constructor
Method/property docs for string (14 methods), array (13), map (7), HttpServer (9), Request (8), Response (9), Task (8), Context (6) — with parameters, return types, examples, and categories

Completion Documentation

All completion items (string, array, map, Task, Context, HttpServer, Request, Response methods) now include inline documentation sourced from the hover doc system.

HTTP API Enhancements

New response and request capabilities:

Response: redirect(), type(), cookie(), clearCookie() methods
Request: ip, originalUrl, protocol, hostname, secure, cookie() properties/methods
parseBody(DataType): Typed HTTP request body parsing into dataType instances

app.post("/login", (req, res) => {
    var creds = req.parseBody<LoginRequest>()
    res.cookie("session", token, { httpOnly: true })
    res.json({ user: creds.email })
})

Bug Fixes

req.params / req.query now typed as map[string]string — indexing infers string automatically, no explicit annotation needed
Index expression type inference — indexing a map[K]V returns V, indexing an array returns the element type
finally block with return, throw-in-finally, and array reference semantics fixed
AOT scoping for variables declared inside if/else branches within loops
5 AOT transpiler limitations resolved
20 real-world edge cases added to the test suite
All 116 golden tests pass in both VM and AOT modes

Architecture

The VS Code extension has been slimmed to LSP-only — all intelligence (hover, completion, definition, symbols, signature help, code actions) is served by the built-in LSP server. The extension only registers the LSP client, debug adapter, and ASI linting.

Community Infrastructure

Issue Templates

The GitHub repository now includes structured issue templates:

Bug Reports — Reproducible steps, expected vs actual behavior, platform info
Feature Requests — Describe the problem, propose a solution
General Feedback — Share your experience with the language

Improved README

The project README now includes feature highlights with code examples, performance benchmarks, platform support matrix, and installation instructions for all platforms.

Chuks v0.0.2 — Hello, World

Sat, 07 Mar 2026 00:00:00 GMT

We’re excited to announce Chuks v0.0.2 — the first public release of the Chuks programming language.

Chuks is a modern, statically-typed backend language built for real-world services. It ships with two execution modes, a built-in HTTP server, and everything you need to start building APIs today.

What’s in This Release

Dual Execution: VM and AOT Compiler

Chuks has two ways to run your code:

chuks run — Interprets your code in a stack-based bytecode VM. Fast startup, great for development.
chuks build — Compiles your Chuks code ahead-of-time to a native binary. Production-ready performance.

Both modes execute the same language with the same semantics.

hello.chuks

function main() {
    println("Hello from Chuks!")
}

Core Language

The language ships with a rich feature set from day one:

Types: int, float, string, bool, any, typed arrays []T, typed maps map[K]V, nullable T?, union types T | U
Classes: constructors, inheritance, interfaces, abstract classes, generics, access modifiers
Functions: closures, arrow functions, default parameters, variadic arguments
Control flow: if/else, for, while, switch/case, try/catch/finally
Concurrency: async/await, spawn for lightweight concurrent tasks, Task.all(), channels, structured concurrency with Context

Built-in HTTP Server

A high-performance networking stack built for production workloads:

import { createServer } from "std/http"

function main() {
    var app = createServer()

    app.get("/", (req, res) => {
        res.json({ message: "Hello from Chuks!" })
    })

    app.listen(3000)
}

Standard Library

28 modules ship out of the box: HTTP server & client, JSON, file system, crypto, JWT, database drivers (PostgreSQL, MySQL, MSSQL), logging, validation, regex, UUID, dotenv, and more.

Developer Tools

REPL — Interactive development with chuks repl
Project scaffolding — chuks new creates a ready-to-go project with the correct structure
VS Code extension — Syntax highlighting, code completion, hover docs

Install Script

Get started with a single command:

curl -fsSL https://chuks.org/install.sh | bash

Downloads the correct binary for your platform (macOS, Linux, Windows) and sets up your PATH automatically.

What’s Next

This is just the beginning. The foundation is solid — now we build on it.

Chuks Programming Language | Blog

Chuks v0.0.7 — The Ecosystem Release

Package Manager

Semver Constraints

Transitive Dependencies

Lockfile Integrity

Supply Chain Security

Permission Consent

Permission Enforcement

Content Integrity Verification

Permission Escalation Detection

Package Status Validation

CI/CD Mode

API Tokens & CI/CD Publishing

Using Tokens

GitHub Actions Example

Watch Mode

Route Groups & Route-Level Middleware

83 New Math Functions

Generic Monomorphization in AOT

Task.all()

Channel Module Redesign

Typechecker Improvements

Compiler Architecture

IDE & Developer Experience

CI/CD Improvements

Runtime Improvements

Database — Production Ready

Transaction Convenience Wrapper

Connection Pool Stats

Bulk Insert & Upsert

Aggregate Functions

Advanced WHERE Clauses

Pagination & Chunking

Raw SQL on Repository

Index Management

Soft Deletes & Timestamps

Lifecycle Hooks

Health Check

CPU Core Limiting

New: bool() Type Conversion

HTTP Server Improvements

Case-Insensitive Header Parsing

Content-Length Edge Case Fix

AOT Compiler Fixes

Method Global Variable Shadowing

Devirt Dispatch Type Assertion Fix

Array Literal Type Narrowing Fix

Closure Capture AOT Fix

Array Method Parity & New Methods

New Methods

Callback Argument Fix

Numbers

Chuks v0.0.6 — Benchmark Champion

#1 in Warm-Cache Benchmarks

Compute Benchmarks (cold-start, wall-clock time)

Warm-Cache Results — Chuks AOT vs Go (median of 3, user time)

Parallel Compute — Prime Count to 5M (4 workers)

Why Typed Code Matters

AOT Compiler Fixes

Nil Comparison for Typed Pointer Fields

Windows Upgrade Fix

22 New Tests

Numbers

Chuks v0.0.5 — Production Hardening

Graceful Shutdown

Required Port Argument

Concurrency Fixes

Thread-Safe Task Map

Context Propagation

Benchmark Results

New Language Features

Short-Circuit Evaluation

Bitwise Operators

String Escape Sequences

Null-Safe Index Access

Map Dot-Notation Access

crypto.sha1 Builtin

Try/Catch/Finally Fixes

Two-Tier Builtin System

New: `bool()` Type Conversion

`crypto.sha1` Builtin