What is LOOK?

LOOK is a language designed to keep web development as direct as possible. Define a route, connect to a database, return JSON — without setting up a framework or writing configuration files.

The language is written in C++23 and can be copied into an Apache/XAMPP environment and run. In FastCGI mode, the server loads the script once when it starts; every subsequent request is handled through the already-warm runtime.

# A LOOK application starts this simply

$conn = db::connect("mysql://root:@127.0.0.1/blog")
route("GET", "/posts", function() use ($conn) {
    $posts = db::query($conn, "SELECT id, title, date FROM posts ORDER BY date DESC", [])
    print(json::encode(["ok" => true, "data" => $posts]))
})
route("GET", "/posts/{id}", function($id) use ($conn) {
    $rows = db::query($conn, "SELECT * FROM posts WHERE id=?", [$id])
    if (count($rows) == 0) {
        return response::error(404, "Not found")  # status + {"ok":false,"error":...}
    }
    response::json(["ok" => true, "data" => $rows[0]])
})
route("404", fn() => response::error(404, "Endpoint not found"))

Technical Summary

Getting Started

5 steps to install LOOK and run your first application — no framework, no configuration file.

Your first index.lk

# index.lk — this file is everything; no framework, no config

$conn = db::connect("mysql://root:@127.0.0.1/blog")  # DB optional

route("GET", "/", function() {
    print(json::encode(["ok" => true, "message" => "Hello LOOK!"]))
})
route("GET", "/posts/{id}", function($id) use ($conn) {
    $rows = db::query($conn, "SELECT * FROM posts WHERE id=?", [$id])
    if (count($rows) == 0) { response::status(404) print("Not found") return }
    print(json::encode($rows[0]))
})
route("404", function() {
    response::error(404, "Not found")
})

Learning Path

Binary Selection

lk --check only parses and reports undefined function calls (e.g. echo(...)) — it does not run the code (no DB/mail is triggered). The VS Code extension uses this for live error checking.

Design Decisions

LOOK deliberately leaves some things out. These aren't limitations — they're design decisions.

Routing built into the language

There's no separate router library. route() is a built-in — when you run the file, routes register automatically, and the end of the script dispatches.

No global variables

HTTP data is accessed via request::get(), request::post(), request::json(). Sessions via session::, cookies via cookie::. Everything is explicit and traceable.

Function scope is isolated. Assigning a variable inside a function creates a function-local — it never silently overwrites an outer/top-level variable (reading an outer value still works). To share mutable state, register it once with app::set() and read it with app::get() / app::<name>().

Explicit closure capture

To access an outer variable you must write use ($conn). Which data goes where is always visible.

No OOP — on purpose

LOOK has no classes, interfaces or traits. The vast majority of web applications can be written with functions + data structures. For scenarios that need richer data modelling, an optional ORM-style module may be offered later — as a module, not a language feature.

No mixed arrays

Numeric arrays and associative arrays are separate concepts and don't blend together. Data-structure clarity is preferred.

Architecture

Binaries

Source Files (cpp/src/)

Headers (cpp/include/look/)

token.h · lexer.h · parser.h · ast.h · interpreter.h · fcgi.h · http_server.h · event_loop.h · websocket.h · sse.h · timer.h · bytecode.h · compiler.h · vm.h · logger.h

Mode Compatibility

Variables & Types

All variables start with $. No type declaration — dynamically typed.

Basic Types

$intval = 42
$decimal  = 3.14
$text  = "hello"
$flag  = true
$none    = null

Number Literals

$hex    = 0xFF        # 255  — hexadecimal
$bin    = 0b1010      # 10   — binary
$big    = 1_000_000   # underscores group digits (ignored)
$sci    = 6.022e23    # scientific notation (float)
$mask   = 0xFF_FF      # 65535 — underscores work in any base

Numeric Array

$list = [1, 2, 3, 4, 5]
print($list[0])  # 1
print(count($list))  # 5

Associative Array (Assoc Array)

$person = ["name" => "Ali", "age" => 30, "city" => "Izmir"]
print($person["name"])  # Ali
print($person["age"])  # 30

# Update a value
$person["city"] = "Ankara"

Nested Array

$product = [
    "name"     => "Burger",
    "price"  => 89.90,
    "tags" => ["veggie", "gluten-free"]
]
print($product["tags"][0])  # veggie

Type Conversions

$s = "42"
$n = int($s)  # string → int
$f = float($s)  # string → float
$b = bool($s)  # string → bool
$t = string(99)  # int → string

Built-in Functions

Operators

Arithmetic

$a + $b    # addition
$a - $b    # subtraction
$a * $b    # multiplication
$a / $b    # division
$a % $b    # modulo
$a ** $b   # power (2**10 = 1024)

String Concatenation

$full = "Hello" . " World"  # "Hello World"
$full .= "!"  # "Hello World!"

Comparison

$a == $b    # equal
$a != $b    # not equal
$a < $b     # less than
$a > $b     # greater than
$a <= $b    # less than or equal
$a >= $b    # greater than or equal
$a <=> $b   # spaceship: -1 / 0 / 1

0 == "abc"   # false  (number vs string — never equal)
"5" == 5     # false  (string vs number)
5 == 5.0     # true   (int and float are one "number" kind)
null == 0    # false  (null only equals null)

Logical

$a && $b    # and
$a || $b    # or
!$a          # not

Bitwise

$a & $b     # AND
$a | $b     # OR
$a ^ $b     # XOR
~$a          # NOT
$a << 2     # left shift
$a >> 2     # right shift

Compound Assignment

$x += 5 $x -= 3 $x *= 2 $x /= 4
$x %= 7 $x .= "!" $x &= 0xFF $x |= 0x01
$x ^= 0xF0

Increment / Decrement

$i++  # postfix
++$i  # prefix
$i--  # postfix
--$i  # prefix

Null Coalescing

$name = $data["name"] ?? "Unknown"
# Chained:
$val = request::get("name") ?? request::post("name") ?? "default"

Ternary Operator

$label = $active ? "Active" : "Inactive"
$status  = $age >= 18 ? "Adult" : "Child"
# Nested ternary
$grade = $score >= 90 ? "A" : $score >= 70 ? "B" : $score >= 50 ? "C" : "F"
# Combined with null coalescing
$name  = request::get("name") ?? ""
$msg = $name != "" ? "Hello {$name}" : "Hello guest"

Strings & Interpolation

Double Quotes — Interpolation On

$name = "Ahmet"
$age = 25
print("Hello {$name}!")  # Hello Ahmet!
print("{$name} is turning {$age+1}.")  # Ahmet is turning 26.
print("Total: {$price * 1.18} USD")  # full expression
print("Result: {compute($x, $y)}")  # function call

Single Quotes — Raw String

$s = 'This $variable is not interpolated'  # literal $variable

Backtick — Raw String (no escaping, interpolation on)

$json = `{"key": "value", "num": 42}`
$sql = `
    SELECT u.*, c.name AS category
    FROM products u
    JOIN categories c ON c.id = u.category_id
    WHERE u.company_id = {$id}
    ORDER BY u.sort
`
print(`C:\Users\{$user}\Desktop`)  # backslashes just work

Escape Sequences (inside double quotes)

Control Flow

if / elseif / else

if ($age < 18) {
    print("Child")
} elseif ($age < 65) {
    print("Adult")
} else {
    print("Senior")
}

Ternary ?:

$label = $active ? "Active" : "Inactive"
# Nested chaining
$msg = $score >= 90 ? "Excellent" : ($score >= 70 ? "Good" : "Study more")

switch

Go-style switch — no break needed, each case exits automatically (no fall-through). Multiple case values are written comma-separated. A break written by habit is harmless: it ends the switch only, never the enclosing loop; a continue inside a case applies to the surrounding loop as expected.

switch($status) {
    case "active":
        print("Running")
    case "inactive", "pending":
        print("Stopped")
    default:
        print("Unknown")
}

Numeric value

switch($http_code) {
    case 200:
        print("OK")
    case 404:
        print("Not found")
    case 500, 503:
        print("Server error")
    default:
        print("Other")
}

switch(true) — range pattern

switch(true) {
    case $score >= 90:
        print("A")
    case $score >= 80:
        print("B")
    case $score >= 70:
        print("C")
    default:
        print("F")
}

Loops

while

$i = 0
while ($i < 5) {
    print("{$i} ")
    $i++
}

for

for ($i = 0 $i < 10 $i++) {
    print("{$i}\n")
}

foreach — numeric array

$colors = ["red", "green", "blue"]
foreach ($colors as $color) {
    print($color . "\n")
}

foreach — associative array

$person = ["name" => "Ali", "age" => 30]
foreach ($person as $key => $value) {
    print("{$key}: {$value}\n")
}

break / continue

foreach ($list as $item) {
    if ($item == "skip") { continue }
    if ($item == "stop")  { break }
    print($item)
}

Functions

Named Function

function add($a, $b) {
    return $a + $b
}

print(add(3, 7))  # 10

Default Parameters

Trailing parameters can carry a default value ($param = expr). If the argument is omitted at the call site, the default is used — evaluated fresh on each call. A default may reference earlier parameters.

function greet($name, $greeting = "Hello") {
    return $greeting . ", " . $name
}
print(greet("Ali"))              # Hello, Ali
print(greet("Ali", "Hi"))        # Hi, Ali

# works with fn / arrow too
$box = fn($w, $h = 10) => $w * $h
print($box(5))                 # 50

Parameters without a default remain required — omitting one is a clear runtime error, never a silent null.

Anonymous Function (Lambda)

$square = function($x) {
    return $x * $x
}
print($square(5))  # 25

Short Lambda — fn + arrow (=>)

fn is an exact alias of function; the expression-bodied arrow form shortens one-line callbacks. Both can be used anywhere.

# expression-bodied arrow: body is a single expression, auto return
$square = fn($x) => $x * $x
$add = fn($a, $b) => $a + $b

# use capture + arrow together
$scale = fn($n) use ($factor) => $n * $factor

# higher-order — ideal in route callbacks
route("GET", "/ping", fn() => response::json(["ok" => true]))

# a block body can also be written with fn (multi-line)
$greet = fn($name) { return "hello " . $name }

Variadic (Variable Number of Parameters)

function sum_all(...$numbers) {
    $total = 0
    foreach ($numbers as $s) {
        $total += $s
    }
    return $total
}

print(sum_all(1, 2, 3, 4, 5))  # 15

Recursive

function factorial($n) {
    if ($n <= 1) { return 1 }
    return $n * factorial($n - 1)
}

print(factorial(10))  # 3628800

Function as a Value

function apply($fn, $value) {
    return $fn($value)
}

$result = apply(function($x) { return $x * 2 }, 21)
print($result)  # 42

Closures & Capture

Closures can't access outer variables automatically — they must be captured explicitly with use.

$factor = 3
$triple = function($x) use ($factor) {
    return $x * $factor
}
print($triple(7))  # 21

Closures with route — DB Connection

$conn = db::connect("mysql://root:@127.0.0.1/mydb")
# without use, $conn is invisible — BUG
route("GET", "/products", function() {
    $rows = db::query($conn, "SELECT * FROM products", [])  # $conn = null!
})
# CORRECT
route("GET", "/products", function() use ($conn) {
    $rows = db::query($conn, "SELECT * FROM products", [])
    print(json::encode($rows))
})

Capturing Multiple Values

route("POST", "/action", function() use ($conn, $config, $limit) {
    # $conn, $config, $limit are all accessible
})

app:: — Service Registry (an alternative to capture)

There are no global variables, so a shared connection has to be carried into every route with use ($conn). With many services or nested closures this repetition gets tiring. app:: registers a service once at setup; routes access it without capture. The explicit-capture philosophy is preserved — use still applies, and app:: is just an optional escape hatch.

# setup — once
app::set("db", db::connect(env("DB_DSN")))
app::set("config", ["limit" => 50])

# route — NO use ($conn)
route("GET", "/menu/{company}", function($company) {
    $conn = app::db()              # shortcut for app::get("db")
    $cfg  = app::get("config")
    # ...
})

try / catch / finally

try {
    $conn = db::connect("mysql://root:@127.0.0.1/db")
    $rows = db::query($conn, "SELECT * FROM missing", [])
} catch ($err) {
    log::error("DB error: {$err}")
    print(json::encode(["ok" => false, "error" => $err]))
} finally {
    # runs in every case
    log::info("Operation complete")
}

Standard Pattern — db_check()

$conn = null
try {
    $conn = db::connect(
        "mysql://" . env("DB_USER", "root") . ":" . env("DB_PASS", "")
        . "@" . env("DB_HOST", "127.0.0.1") . "/" . env("DB_NAME", "mydb")
    )
} catch ($e) {
    log::error("DB connection error: {$e}")
}

function db_check($conn) {
    if ($conn == null) {
        response::error(503, "Database unavailable")
        return false
    }
    return true
}

route("GET", "/products", function() use ($conn) {
    if (!db_check($conn)) { return }
    # ... normal flow
})

Error System (Phase 9.8)

LOOK errors are SourceLocation-based — with file name, line and column. Parse errors and runtime errors are thrown as separate types.

Error Types

Stack Trace

Runtime errors also show the call stack:

[RUNTIME ERROR] index.lk:88:5 — undefined variable: $user_id
Stack trace:
  admin_check()        index.lk:32
  route callback       index.lk:88
  dispatch_routes()    [runtime]

Throwing your own errors — throw

Use the throw keyword to raise a business-logic error that try/catch will catch. You can throw any value — a plain string, or a structured error from error::new(). The thrown value is bound to the catch ($e) variable.

# Throw a plain string
function check_age($age) {
    if ($age < 18) { throw "too young" }
    return true
}
try { check_age(15) } catch ($e) { print($e) }  # "too young"

# Throw a structured error (carries type + code)
throw error::new("unauthorized", "Invalid token", 401)

Catching with try/catch

Runtime errors and string throws arrive as their value; structured errors as an assoc — read them safely with error::message() / error::code():

try {
    $conn = db::connect("mysql://root:@127.0.0.1/mydb")
    $rows = db::query($conn, "SELECT * FROM nonexistent_table", [])
} catch ($e) {
    log::error("DB error: {$e}")
    response::status(500)
    print(json::encode(["ok" => false, "error" => $e]))
}

Stack Overflow Protection

Recursive calls that exceed the 500-depth limit throw a LookRuntimeError — the process doesn't crash.

function infinite($n) { return infinite($n + 1) }

try {
    infinite(0)
} catch ($e) {
    print($e)  # "Stack overflow: maximum call depth (500) exceeded"
}

runtime::stats()

Runtime statistics — to monitor memory usage and request count:

route("GET", "/monitor", function() {
    print(json::encode(runtime::stats()))
})

error:: — Structured Errors

error:: has been a core module since v1.x — no use error; needed, always ready. It's used to throw and catch structured errors that carry type information and a code.

API

Basic Usage

# Throw a structured error
function find_user($conn, $id) {
    $rows = db::query($conn, "SELECT * FROM users WHERE id=?", [$id])
    if (count($rows) == 0) {
        error::new("not_found", "User not found: {$id}", 404)
    }
    return $rows[0]
}

route("GET", "/user/{id}", function() use ($conn) {
    try {
        $u = find_user($conn, request::param("id"))
        print(json::encode($u))
    } catch ($e) {
        if (error::is($e, "not_found")) {
            response::status(error::code($e))
            print(json::encode(["ok" => false, "error" => error::message($e)]))
        } else {
            response::status(500)
            print(json::encode(["ok" => false, "error" => $e]))
        }
    }
})

Auto-loaded as a Core Module

Module System

use math  # math:: prefix
use string  # string:: prefix
use array  # array:: prefix
use string as str  # with an alias

print(math::sqrt(144))  # 12
print(string::upper("hello"))  # HELLO
print(str::length("test"))  # 4 (using the alias)

struct — Grouping Data

Inspired by Go, struct is designed purely for grouping data, without inheritance or methods. There is no OOP — on purpose.

Definition

struct User {
    name
    age
    email
}

# Fields with default values
struct Product {
    name
    price: 0.0
    stock:  0
    active: true
}

Literals and Field Access

$u = User{name: "Ali", age: 30, email: "ali@example.com"}
print($u.name)  # Ali
print($u.age)  # 30

# Update a field
$u.name = "Mehmet"
print($u.name)  # Mehmet

# Unspecified fields take the default value
$pr = Product{name: "Burger"}
print($pr.price)  # 0
print($pr.active)  # true

Nested Struct

struct Address {
    city
    district
}

struct User {
    name
    address
}

$k = User{name: "Ali", address: Address{city: "Istanbul", district: "Kadıköy"}}
print($k.address.city)  # Istanbul

Nested & Chained Assignment

You can assign through a chained path — nested struct fields, array elements, and assoc values all update in place (structs and arrays are reference types):

$k.address.city = "Ankara"          # nested struct field

$users = [User{name: "A"}, User{name: "B"}]
$users[0].name = "Ali"            # field of an array element

$grid = [[1, 2], [3, 4]]
$grid[0][1] = 99              # nested array index

$m["user"].active = true         # field of an assoc value

Array of Structs

$products = [
    Product{name: "Burger", price: 45.0, stock: 10},
    Product{name: "Pizza",  price: 89.9, stock: 5},
    Product{name: "Salad", price: 25.0, stock: 20}
]
foreach ($products as $u) {
    print($u.name . " — " . $u.price . " USD")
}

JSON Encode

$u = User{name: "Ali", age: 30, email: "ali@example.com"}
print(json::encode($u))
# {"name":"Ali","age":30,"email":"ali@example.com"}
# Note: the runtime tag (__struct__) is not included in the JSON

const / iota — Constant Groups

Constant groups inspired by Go's const + iota approach. There is no enum keyword — const is enough.

Basic iota

const {
    PENDING = iota   # 0
    ACTIVE               # 1
    INACTIVE             # 2
    DELETED              # 3
}

if ($order.status == ACTIVE) {
    print("Your order is active.")
}

switch ($order.status) {
    case PENDING:  print("Pending")
    case ACTIVE:   print("Active")
    case INACTIVE: print("Inactive")
}

Expression iota — Go-Style Chain

const {
    SMALL = iota * 10   # 0  (iota=0 → 0*10)
    MEDIUM                # 10 (iota=1 → 1*10)
    LARGE                 # 20 (iota=2 → 2*10)
}

# Entries without a value re-evaluate the previous expression with the new iota
# (identical to Go's behavior)

Constant Values (without iota)

const {
    HTTP_OK         = 200
    HTTP_NOT_FOUND  = 404
    HTTP_ERROR      = 500
}

const {
    ROLE_ADMIN  = "admin"
    ROLE_EDITOR = "editor"
    ROLE_MEMBER = "member"
}

response::status(HTTP_NOT_FOUND)
print(json::encode(["error" => "Not found"]))

const + struct Together

const {
    ROLE_ADMIN  = "admin"
    ROLE_EDITOR = "editor"
}

struct User {
    name
    role: "member"
}

$admin = User{name: "Can", role: ROLE_ADMIN}
print($admin.name . " — " . $admin.role)  # Can — admin

route() — Routing

Routing is built into the language. No framework to set up.

Basic Usage

route("GET", "/", function() {
    print(json::encode(["message" => "Hello World!"]))
})
route("POST", "/user", function() {
    # handle the POST request
})
route("PUT", "/user/{id}", function($id) {
    # the $id parameter is passed automatically
})
route("DELETE", "/user/{id}", function($id) {
    # ...
})

URL Parameters

# Single parameter
route("GET", "/product/{id}", function($id) {
    print("Product ID: {$id}")
})
# Multiple parameters
route("GET", "/menu/{company}/{category}", function($company, $category) {
    print("{$company} / {$category}")
})

Parameters use {name} braces and arrive both as function arguments (in order) and via request::param("name") — use whichever reads better.

404 Handler

route("404", fn() => response::error(404, "Endpoint not found"))

Global Middleware — before_route()

before_route(fn) applies to every request and runs before route matching. You can stop the chain with stop().

# Add a header to every request
before_route(function() {
    response::header("X-Powered-By", "LOOK")
})

# Token check — stop with stop() if it fails
before_route(function() {
    $token = request::header("Authorization")
    if (!$token) {
        response::json(["error" => "Unauthorized"], 401)  # status = 2nd arg
        stop()
    }
})

Multiple before_route() handlers can be defined — they run in registration order. If any one calls stop(), the rest and the route handler don't run.

Route-Level Middleware

To apply middleware to specific routes, use the 4-argument form. The middleware array is evaluated at route-registration time (not per request).

$auth = function() {
    $token = request::get("token")
    if ($token != "secret") {
        response::json(["error" => "Unauthorized"], 401)
        stop()
    }
}

$require_role = function($role) {
    return function() use ($role) {
        if (request::get("role") != $role) {
            response::json(["error" => "Forbidden"], 403)
            stop()
        }
    }
}

$require_admin = $require_role("admin")  # runs at setup time

# No middleware — the old syntax is unchanged
route("GET", "/public", function() {
    response::json(["ok" => true])
})

# Auth-protected route
route("GET", "/private", [$auth], function() {
    response::json(["route" => "private"])
})

# Chained middleware — runs in order
route("GET", "/admin", [$auth, $require_admin], function() {
    response::json(["route" => "admin"])
})

route::

route() itself is a built-in, but the route:: module gives access to information about the active route.

route("GET", "/product/{id}", function($id) {
    # $id comes in directly as a parameter — the preferred way

    # Alternative — via the route module:
    $id2     = route::param("id")
    $pattern = route::matched()  # "/product/{id}"
})

request::

route("POST", "/login", function() {
    $body = request::json()
    $email = $body["email"] ?? ""
    $password = $body["password"] ?? ""
    # ...
})

response::

response::error collapses the frequently-repeated 3-line pattern into one line:

# before — 3 lines
response::status(404)
response::json(["ok" => false, "error" => "Not found"])
return

# after — one line (same output)
return response::error(404, "Not found")

# VERBOSE — every primitive by hand (to learn what they do)
route("GET", "/api/data", function() {
    response::status(200)                                # 200 is the default anyway
    response::header("Content-Type", "application/json") # response::json does this AUTOMATICALLY
    response::header("Cache-Control", "no-cache")        # custom header — needed by hand
    print(json::encode(["ok" => true]))
})

# PRO — response::json handles Content-Type + status(200 default); custom headers remain
route("GET", "/api/data", function() {
    response::header("Cache-Control", "no-cache")
    response::json(["ok" => true])
})

# SHORTEST — one line when there's no custom header (fn + arrow)
route("GET", "/api/ping", fn() => response::json(["ok" => true]))

# response::json — shortcut: Content-Type automatic, optional status
route("POST", "/api/product", function() {
    response::json(["id" => 42, "ok" => true], 201)
})

route("GET", "/api/missing", function() {
    response::json(["error" => "not found"], 404)
})

json::

# Encode — array → JSON string
$data = ["name" => "Ali", "age" => 30, "list" => [1, 2, 3]]
$json = json::encode($data)
# → {"name":"Ali","age":30,"list":[1,2,3]}

# Decode — JSON string → array
$str  = '{"key":"value"}'
$arr  = json::decode($str)
print($arr["key"])  # value

# Typical REST endpoint
function json_ok($data) {
    print(json::encode(["ok" => true, "data" => $data]))
}
function json_error($message, $code) {
    response::error($code, $message)
}

session::

# ❌ WRONG — no HTTP context in the setup phase, Set-Cookie isn't sent
session::start()
route("GET", "/", function() { /* ... */ })
# ✅ CORRECT — inside every route callback that uses the session
route("POST", "/login", function() {
    session::start()  # ← first line
    # ...
})

Multi-Server / Load Balancer — Redis Session

Your LOOK code doesn't change. The driver is selected via env var only:

# add to the systemd service file
Environment=LOOK_SESSION_DRIVER=redis
Environment=LOOK_REDIS_URL=redis://127.0.0.1:6379/0
Environment=LOOK_SESSION_TTL=3600

# Login
route("POST", "/login", function() use ($conn) {
    $body = request::json()
    # ... validation ...
    session::start()
    session::set("admin_id", $admin["id"])
    session::set("email", $admin["email"])
    print(json::encode(["ok" => true]))
})
# Protection
function auth_check() {
    session::start()
    if (!session::has("admin_id")) {
        response::error(401, "Unauthorized")
        return false
    }
    return true
}

route("GET", "/admin/panel", function() {
    if (!auth_check()) { return }
    # ... admin page ...
})

cookie::

# A 7-day preference cookie
cookie::set("theme", "dark", 604800)
$theme = cookie::get("theme") ?? "light"

db::

Connection

$conn = db::connect("mysql://user:password@host/database")
$conn = db::connect("mysql://root:@127.0.0.1/mydb")
# Optional config — timeout and reconnect
$conn = db::connect("mysql://root:@127.0.0.1/mydb", [
    "timeout"   => 5000,   # ms
    "reconnect" => 3       # retry count
])
# with .env (standard)
$conn = db::connect(
    "mysql://" . env("DB_USER", "root") . ":" . env("DB_PASS", "")
    . "@" . env("DB_HOST", "127.0.0.1") . "/" . env("DB_NAME", "mydb")
)

Query — db::query (SELECT)

# Always returns an array (may be empty)
$rows = db::query($conn, "SELECT * FROM products", [])
$rows = db::query($conn, "SELECT * FROM products WHERE id=?", [$id])
$rows = db::query($conn, "SELECT * FROM p WHERE company_id=? AND active=?", [$fid, 1])
if (count($rows) == 0) {
    json_error("Not found", 404)
    return
}

$row  = $rows[0]
$price  = $row["price"]  # DECIMAL column → already float
$qty   = $row["qty"]  # INT column → already int
$total = $price * $qty  # works — no conversion needed

Type Mapping Table

Command — db::exec (INSERT/UPDATE/DELETE)

db::exec($conn, "INSERT INTO log (message, date) VALUES (?,NOW())", [$message])
db::exec($conn, "UPDATE products SET price=? WHERE id=?", [$price, $id])
db::exec($conn, "DELETE FROM products WHERE id=?", [$id])

Helper Functions

db::begin / commit / rollback — Transaction

db::begin($conn)
try {
    db::exec($conn, "INSERT INTO orders (user_id, total) VALUES (?,?)", [$uid, $total])
    $order_id = db::last_id($conn)
    db::exec($conn, "UPDATE stock SET qty=qty-1 WHERE product_id=?", [$product_id])
    db::commit($conn)
    print(json::encode(["ok" => true, "id" => $order_id]))
} catch ($e) {
    db::rollback($conn)
    response::status(500)
    print(json::encode(["error" => error::message($e)]))
}

db::transaction — Automatic Wrapper

# db::transaction — runs the closure between BEGIN/COMMIT, ROLLBACK on exception
$result = db::transaction($conn, function() use ($conn, $uid, $total) {
    db::exec($conn, "INSERT INTO orders (user_id, total) VALUES (?,?)", [$uid, $total])
    return db::last_id($conn)
})
# if an exception is thrown, rollback happens automatically and the exception propagates

db::exec($conn, "INSERT INTO products (name) VALUES (?)", [$name])
$new_id = db::last_id($conn)  # comes back as int

$total = db::col($conn, "SELECT COUNT(*) FROM products WHERE company_id=?", [$fid])
# COUNT(*) → INT column → already int

env() / config()

.env File

# C:\xampp\htdocs\.env
APP_ENV=development
DB_HOST=127.0.0.1
DB_PORT=3306
DB_NAME=mydb
DB_USER=root
DB_PASS=
LOG_DIR=C:/xampp/htdocs/logs

Using env()

$host  = env("DB_HOST", "127.0.0.1")  # second arg = default
$environment = env("APP_ENV")  # "development"

Using config()

# for config.ini or a similar file
$limit = config("pagination.per_page")  # dot-notation

log::

log::info("User logged in: {$email}")
log::error("DB connection error: {$e}")
log::warn("High memory usage")
log::query($sql, 1250)  # query that took 1250ms

Logs are written to daily files in LOG_DIR (look-2026-06-08.log). On Windows they're concurrent-safe via FILE_SHARE_WRITE.

look::

Loaded with use look;. The language's own tooling, callable from LOOK code.

look::check() returns an assoc array. It lexes, parses, and scans for undefined bare calls — no execution, no side effects, safe on untrusted input.

use look;

$r = look::check($user_code)
if ($r["ok"]) {
    print("Gecerli LOOK kodu")
} else {
    print("Hata: " . $r["line"] . ":" . $r["col"] . " " . $r["msg"])
}

runtime::

Runtime statistics. No use required — always active.

stats() Output

# /monitor endpoint — protect with auth in production
route("GET", "/monitor", function() {
    print(json::encode(runtime::stats()))
})
# Memory monitoring under load
$stats = runtime::stats()
if ($stats["working_mb"] > 500) {
    log::warn("High memory: {$stats[\"working_mb\"]}MB")
    runtime::gc()
}

use math

use math
$area  = math::pi() * math::pow($r, 2)
$n  = math::random(1, 6)  # rolling a die

use string

use string
$slug  = string::lower(string::replace($name, " ", "-"))
$parts = string::split("a,b,c,d", ",")  # ["a","b","c","d"]
$joined = string::join($parts, " | ")  # "a | b | c | d"
$clean    = string::trim($input)
$length  = string::len("Hello")  # 5

# string::format — printf-like
$message = string::format("Name: %s, Age: %d, Price: %.2f USD", $name, $age, $price)
# "Name: Ali, Age: 30, Price: 45.68 USD"
$hex = string::format("0x%x", 255)  # "0xff"
$pad = string::format("%05d", 42)  # "00042"

# string::regex_match — regex match test
if (string::regex_match($email, "[a-z0-9._%+\\-]+@[a-z0-9.\\-]+\\.[a-z]{2,}")) {
    # valid email
}
$digits_only = string::regex_match($v, "^[0-9]+$")  # true/false

# string::regex_replace — pattern replacement
$slug     = string::regex_replace($title, "[^a-z0-9]+", "-")
$clean    = string::regex_replace($html, "<[^>]+>", "")  # strip tags
$masked   = string::regex_replace($phone, "\\d{3}$", "***")  # mask the last 3 digits

# string::regex_match_all — all matches
$emails = string::regex_match_all($text, "[a-z]+@[a-z]+\\.[a-z]+")
foreach ($emails as $m) { print($m[0]) }   # $m[0] = full match

# Group capture
$dates = string::regex_match_all($text, "(\\d{4})-(\\d{2})-(\\d{2})")
foreach ($dates as $t) {
    print($t[1] . "/" . $t[2] . "/" . $t[3])  # year/month/day
}

use type

use type
print(type::of(42))  # "int"
print(type::of("hello"))  # "string"
print(type::of([]))  # "array"
print(type::is_string($v))  # true / false

use array

use array
$numbers = [5, 2, 8, 1, 9, 3]
$sorted  = array::sort($numbers)  # [1,2,3,5,8,9]

$evens = array::filter($numbers, function($x) {
    return $x % 2 == 0
})  # [2,8]

$squares = array::map($numbers, function($x) {
    return $x * $x
})  # [25,4,64,1,81,9]

$total  = array::reduce($numbers, function($acc, $x) {
    return $acc + $x
}, 0)  # 28

$distinct = array::unique([1,2,2,3,3,3])  # [1,2,3]
$keys    = array::keys(["a"=>1, "b"=>2])  # ["a","b"]

# find / any / all
$products = [
    ["name" => "Pizza",  "price" => 120],
    ["name" => "Burger", "price" => 80],
    ["name" => "Salad", "price" => 45]
]
$expensive   = array::find($products, function($u) { return $u["price"] > 100 })
print($expensive["name"])  # Pizza

$has_cheap = array::any($products, function($u) { return $u["price"] < 50 })
print($has_cheap ? "has cheap" : "no cheap")  # has cheap

$all_positive = array::all($products, function($u) { return $u["price"] > 0 })
print($all_positive)  # true

# find returns null if nothing matches — use a ternary to be safe
$result = array::find($products, function($u) { return $u["price"] > 500 })
print($result != null ? $result["name"] : "not found")  # not found

# array::flatten — flatten a nested array
$nested  = [1, [2, 3], [4, [5, 6]]]
$flat     = array::flatten($nested)  # [1,2,3,4,5,6]
$one_level = array::flatten($nested, 1)  # [1,2,3,4,[5,6]] — depth 1

# array::chunk — split into chunks (ideal for pagination)
$ids     = [1,2,3,4,5,6,7]
$chunks = array::chunk($ids, 3)  # [[1,2,3],[4,5,6],[7]]
foreach ($chunks as $group) {
    # Run a batched DB query for each group
    $in_str = string::join($group, ",")
    $rows = db::query($conn, "SELECT * FROM products WHERE id IN (?)", [$in_str])
}

# array::zip — pair two arrays by position
$names  = ["Ali", "Veli", "Ayşe"]
$ages   = [30, 25, 28]
$zipped   = array::zip($names, $ages)  # [["Ali",30],["Veli",25],["Ayşe",28]]
foreach ($zipped as $pair) {
    print($pair[0] . ": " . $pair[1])  # Ali: 30
}

# zip + map combination — a numbered list
$order   = [1, 2, 3]
$ordered = array::zip($order, $names)  # [[1,"Ali"],[2,"Veli"],[3,"Ayşe"]]

use http

A zero-dependency HTTP/HTTPS client — uses the system OpenSSL on Linux and Schannel (WinSSL) on Windows. No libcurl required.

$headers — assoc array (optional): ["Authorization" => "Bearer token"]
$opts — assoc array (optional): ["timeout" => 5000] (ms, default 10000)

http::stream — live streaming

http::stream() does not buffer the whole response; instead it calls your $callback with each body chunk as it arrives. Pairs naturally with route("SSE", ...) and channel() — the building blocks for forwarding an upstream token stream (e.g. a Claude/LLM SSE response) straight to your client. Returns a response assoc (status, headers, error); the body arrives via the callback.

http::stream("POST", $url, $json_body, $headers, function($chunk) {
    # her parca geldikce — SSE cikisina / kanala yaz
    print($chunk)
}, ["timeout" => 60000])

Return value — always an assoc array:

use http
# Basic GET
$resp = http::get("https://api.example.com/users")
if ($resp["status"] == 200) {
    $data = json::decode($resp["body"])
    # use $data
} else {
    log::error("API error: " . $resp["status"])
}

# POST JSON — data is auto-encoded
$resp = http::post_json("https://api.example.com/order", [
    "product_id" => 42,
    "qty"    => 3,
    "note"     => "mild spicy"
])
# Authorization header
$resp = http::get("https://api.example.com/profile", [
    "Authorization" => "Bearer {$token}"
])
# With a timeout — 5 seconds
$resp = http::get("https://slow-service.com/data", [], ["timeout" => 5000])
if ($resp["error"] != null) {
    log::error("Network error: " . $resp["error"])
    response::status(503)
    print(json::encode(["error" => "Connection timeout"]))
    return
}

# DELETE
$resp = http::delete("https://api.example.com/record/{$id}", [
    "Authorization" => "Bearer {$token}"
])
# PUT update
$resp = http::put("https://api.example.com/record/{$id}",
    json::encode(["status" => "active"]),
    ["Content-Type" => "application/json",
     "Authorization" => "Bearer {$token}"]
)
# Concurrent calls with parallel() — fan-out pattern
$result = channel(3)
parallel(function() use ($result) {
    use http
    send($result, http::get("https://service-a.com/data"))
})
parallel(function() use ($result) {
    use http
    send($result, http::get("https://service-b.com/data"))
})
$a = receive($result)
$b = receive($result)
# $a and $b arrived at the same time — total latency is max(service-a, service-b)

use auth

Secure password hashing with PBKDF2-SHA256 — zero dependency.

use auth
# Signup — hash the password
$hash = auth::hash("user_password")
# → "pbkdf2$sha256$100000$<salt_b64>$<hash_b64>"
db::exec($conn, "INSERT INTO admins (email,password) VALUES (?,?)", [$email, $hash])
# Login — verify
$rows = db::query($conn, "SELECT password FROM admins WHERE email=?", [$email])
if (count($rows) == 0) { # no such user }
if (!auth::verify($password, $rows[0]["password"])) { # wrong password }

use crypto

SHA-256, HMAC-SHA256, Base64, UUID, secure random generation — zero dependency. The foundation for JWT and payment integrations.

RS256 (JWT) signing

use crypto
# Generate a JWT RS256 signature with a PEM private key
$pem     = file::read("/secrets/rsa_private.pem")
$header  = crypto::base64url_encode(json::encode(["alg" => "RS256", "typ" => "JWT"]))
$payload = crypto::base64url_encode(json::encode(["sub" => $user_id, "exp" => $exp]))
$signing_input = $header . "." . $payload
$sig     = crypto::rs256_sign_b64url($signing_input, $pem)
$token   = $signing_input . "." . $sig

# Verification (with the public key)
$pub   = file::read("/secrets/rsa_public.pem")
$parts = string::split($token, ".")
$ok    = crypto::rs256_verify($parts[0] . "." . $parts[1], $parts[2], $pub)

Verifying a webhook signature

use crypto
# Verify an incoming webhook signature (e.g. GitHub, Stripe)
$payload  = request::body()
$given    = request::header("X-Hub-Signature-256")
$expected = "sha256=" . crypto::hmac_sha256($payload, $WEBHOOK_SECRET)
if (!crypto::constant_compare($given, $expected)) {
    response::json(["error" => "Invalid signature"], 401)
    return
}

Secure token generation

use crypto
# Password-reset / email-verification token
$token = crypto::random_string(32)  # 32 bytes of entropy — URL-safe
$id    = crypto::uuid()  # UUID v4

db::exec($conn, "INSERT INTO tokens (id,token,user_id) VALUES (?,?,?)",
    [$id, $token, $user_id])

Using it with the JWT module

# the jwt module is built on top of crypto::
use "pkg/jwt/jwt.lk"
$token = jwt_sign(["user_id" => 42], "secret", ["exp" => 3600])
$payload = jwt_verify($token, "secret")
if ($payload == null) {
    response::status(401)
    return
}
print($payload["user_id"])  # → 42

JWT — pkg/jwt

LOOK's official JWT package. Built on top of the crypto:: module — zero extra dependency. HS256 (HMAC-SHA256) signing, verification, payload reading. Installed with look install.

Installation

look install github.com/Codlook/look-packages

After installation it extracts to pkg/Codlook/look-packages/jwt/jwt.lk. For a shortcut you can use a pkg/jwt/ symlink folder in your project root, or the direct path.

Functions

jwt_sign — Options ($opts)

Basic Usage

use "pkg/jwt/jwt.lk"
# Generate a token — valid for 1 hour
$token = jwt_sign(
    ["user_id" => 42, "role" => "admin"],
    env("JWT_SECRET", "secret"),
    ["exp" => 3600]
)
# Verify a token — null: invalid signature or expired
$payload = jwt_verify($token, env("JWT_SECRET", "secret"))
if ($payload == null) {
    response::json(["error" => "Unauthorized"], 401)
    return
}
print("User: " . $payload["user_id"])  # → 42

API Protection — Middleware Pattern

use "pkg/jwt/jwt.lk"
function auth_required() {
    $header = request::header("Authorization") ?? ""
    if (string::starts_with($header, "Bearer ")) {
        $token = string::substr($header, 7)
    } else {
        $token = request::header("X-Token") ?? ""
    }
    $payload = jwt_verify($token, env("JWT_SECRET", ""))
    if ($payload == null) {
        response::json(["error" => "Invalid token"], 401)
        return null
    }
    return $payload
}

route("GET", "/api/profile", function() use ($conn) {
    $user = auth_required()
    if ($user == null) { return }

    $rows = db::query($conn, "SELECT * FROM users WHERE id=?", [$user["user_id"]])
    print(json::encode($rows[0]))
})
route("POST", "/api/login", function() use ($conn) {
    $email    = request::post("email") ?? ""
    $password    = request::post("password") ?? ""
    $rows     = db::query($conn, "SELECT * FROM users WHERE email=?", [$email])
    if (count($rows) == 0 || !auth::verify($password, $rows[0]["password_hash"])) {
        response::json(["error" => "Invalid credentials"], 401)
        return
    }
    $token = jwt_sign(["user_id" => $rows[0]["id"]], env("JWT_SECRET", ""), ["exp" => 86400])
    print(json::encode(["ok" => true, "token" => $token]))
})

Official Package Repository

JWT and other official packages live in the github.com/Codlook/look-packages repository.

# Install the official Codlook package repository (jwt, stripe-wrapper, etc.)
look install github.com/Codlook/look-packages

# Then use it:
use "pkg/Codlook/look-packages/jwt/jwt.lk"
# Or the shortcut (as an extra line in look.lock):
use "pkg/jwt/jwt.lk"  # pkg/jwt/ → pkg/Codlook/look-packages/jwt/ symlink

use validator

Rule strings: "required", "email", "integer", "numeric", "min:N", "max:N", "in:a,b,c" — these are rule names passed to check(), not independently callable functions.

validator::check — Batch Validation

use validator
$body = request::json()
$result = validator::check($body, [
    "email" => ["required", "email"],
    "password" => ["required", "min:6"],
    "age"   => ["integer", "min:0", "max:120"],
    "type"   => ["in:percent,fixed"]
])
if (!$result["ok"]) {
    response::json(["ok" => false, "errors" => $result["errors"]], 400)
    return
}
# $result["ok"] == true → all fields valid

use html

use html
$clean = html::escape($user_input)  # XSS protection
$attr  = html::attr($title)
$plain   = html::strip($html_content)

use file

File read/write and secure upload. Loaded with use file;.

File Operations

use file
# Write / read / append
file::put("./log.txt", "Started\n")
file::append("./log.txt", "Done\n")
$content = file::read("./log.txt")
print($content)
# Check / delete
if (file::exists("./cache.json")) {
    print(file::size("./cache.json"))
    file::remove("./cache.json")
}

LOOK_FILE_ROOT — File Sandbox

Secure by default. file:: operations are sandboxed to a directory subtree; path traversal (../) and absolute paths outside it throw an error. The root is chosen as follows:

Internal modules (sessions, cache, jobs) do not go through file:: and are unaffected by this sandbox.

# in the systemd service file:
Environment=LOOK_FILE_ROOT=/var/www/vhosts/domain.com/httpdocs

# Allowed — under LOOK_FILE_ROOT
file::read("/var/www/vhosts/domain.com/httpdocs/data/config.json")

# These throw an error — trying to escape LOOK_FILE_ROOT
file::read("/etc/passwd")
file::read("../../etc/passwd")

Secure Upload

request::file() is in core — no use needed. Magic-byte checking, MIME validation, SHA-256 hashing and a random file name are applied automatically. It can't be disabled.

⚠️ Serving mode matters. multipart/form-data is parsed on the FastCGI path (lk-fcgi behind Apache/nginx with mod_proxy_fcgi). It is not parsed when you run the built-in HTTP server with --mode http — there request::file() returns null even though the browser sent the file. If you deploy with --mode http, upload the file as base64 inside a JSON body (request::json()) instead, or put it behind FastCGI.

use file
# Basic upload
$file = request::file("avatar", [
    "max_size"   => 2097152,
    "allow_mime" => ["image/jpeg", "image/png", "image/webp"]
])
# $file["path"]   → temporary file path
# $file["mime"]   → validated MIME
# $file["size"]   → bytes
# $file["sha256"] → SHA-256 hex hash

# Move to permanent storage
$record = file::store($file, "avatars")
# $record["path"]   → /storage/uploads/avatars/abc123.jpg
# $record["url"]    → https://site.com/uploads/avatars/abc123.jpg
# $record["sha256"] → same hash (deduplication)

# SVG — a separate permission is required
$logo = request::file("logo", [
    "max_size"   => 512000,
    "allow_mime" => ["image/svg+xml"],
    "allow_svg"  => true
])

# Full upload route example
use file
route("POST", "/profile/photo", function() use ($conn) {
    if (!db_check($conn)) { return }

    try {
        $file  = request::file("avatar", [
            "max_size"   => 2097152,
            "allow_mime" => ["image/jpeg", "image/png"]
        ])
        $record  = file::store($file, "avatars")
        db::exec($conn,
            "UPDATE users SET avatar=? WHERE id=?",
            [$record["url"], session::get("user_id")]
        )
        print(json::encode(["ok" => true, "url" => $record["url"]]))
    } catch ($e) {
        response::error(400, $e)
    }
})

UPLOAD_DIR=/var/www/storage/uploads
UPLOAD_URL=https://site.com/uploads

use date

Date and time operations. Loaded with use date;. All dates are in ISO 8601 format — "YYYY-MM-DD" or "YYYY-MM-DD HH:MM:SS".

Format Tokens

Units

For add / sub / diff: "second", "minute", "hour", "day", "week", "month", "year"

use date
# Basics
print(date::now())  # "2026-06-09 14:32:00"
print(date::today())  # "2026-06-09"
print(date::timestamp())  # 1749470520

# Format
print(date::format(date::today(), "d.m.Y"))  # "09.06.2026"
print(date::format(date::now(), "l, d F Y H:i"))  # "Tuesday, 09 June 2026 14:32"

# Parse — from a different format to ISO
$date = date::parse("09.06.2026", "d.m.Y")  # "2026-06-09"
$date = date::parse("09/06/26", "d/m/y")  # "2026-06-09"

# Add / Sub
date::add("2026-06-09", 7, "day")  # "2026-06-16"
date::add("2026-06-09", 1, "month")  # "2026-07-09"
date::sub("2026-06-09", 1, "year")  # "2025-06-09"

# Diff
$day_diff = date::diff("2026-12-31", "2026-06-09", "day")  # 205

# Validation
date::is_valid("2026-02-29")  # false — 2026 is not a leap year
date::is_valid("2024-02-29")  # true

# Real-world usage — compute days since signup
use date
$signup_date = $rows[0]["created_at"]  # "2025-01-15 10:30:00" (from DB)
$days        = date::diff(date::today(), $signup_date, "day")
print("Membership length: {$days} days")
# Orders in the last 30 days
$start = date::sub(date::today(), 30, "day")
$rows = db::query($conn,
    "SELECT * FROM orders WHERE created_at >= ?",
    [$start]
)

use template — Template Engine

Loaded with use template;. Renders HTML templates from a file or a string. It returns a string — you must use print(template::render(...)).

API

Directives

Basic Usage

use template
# Render from a file
$html = template::render("/app/views/blog/index", [
    "title"   => "Blog",
    "posts" => $posts
])
print($html)
# Inline render
print(template::render_string("<h1>{$title}</h1>", ["title" => "Hello"]))
# The .html extension is added automatically — views/blog/index → views/blog/index.html

Layout Inheritance

<!-- views/layout/base.html -->
<!DOCTYPE html><html><body>
<header>...</header>
{#block "content"}{/block}
<footer>...</footer>
</body></html>
<!-- views/blog/index.html -->
{#extends "views/layout/base"}
{#block "content"}
<h1>{$title}</h1>
{#each $posts as $y}
  <article>
    <h2>{$y.title}</h2>
    <p>{$y.summary}</p>
  </article>
{#empty}
  <p>No posts yet.</p>
{/each}
{/block}

use "file.lk" — File Module System

Lets you split large projects into multiple .lk files. Explicit-scope principle: only functions and constants are exported — $variables never leak.

3 Core Rules

Syntax

# blog.lk — bootstrap (~43 lines)
use template
use "helpers.lk"  # db_check(), admin_check(), slugify()
use "routes/public.lk"  # register_public_routes($conn, $tpl)
use "routes/auth.lk"  # register_auth_routes($conn, $tpl)
use "routes/admin.lk"  # register_admin_routes($conn, $tpl)

$conn = db::connect("mysql://...")
$tpl  = env("BLOG_VIEWS", "/app/views")
register_public_routes($conn, $tpl)  # $conn is an explicit parameter — required
register_auth_routes($conn, $tpl)
register_admin_routes($conn, $tpl)

# routes/public.lk — $conn isn't visible, it arrives as a parameter
use template
function register_public_routes($conn, $tpl) {
    route("GET", "/blog/", function() use ($conn, $tpl) {
        if (!db_check($conn)) { return }
        $posts = db::query($conn, "SELECT * FROM posts WHERE published=1", [])
        print(template::render($tpl . "/blog/index", ["posts" => $posts]))
    })
}

use "file.lk" vs use module;

FastCGI Warm Start

LOOK's most important performance feature. In FastCGI mode, index.lk is loaded, parsed and interpreted only once.

How It Works

# look-fcgi.exe --port 9000

First request arrives → setup phase:
  1. index.lk is parsed → AST (kept in WarmApp::program)
  2. set_setup_mode(true) → interpret()
     - route() calls → registered in route_registry_
     - db::connect() → $conn stays in interpreter globals_
     - a DB error is caught via try/catch, $conn stays as null
  3. set_setup_mode(false)

EVERY subsequent request → dispatch phase:
  1. make_web_context(req) → REQUEST_URI, METHOD, headers, cookies
  2. dispatch_routes() → pattern match → callback($param...)
  3. $conn is ready → no new DB connection is opened

Hot Reload

When the index.lk file changes (mtime), FastCGI reloads automatically. No need to restart the server.

Critical Rules

Platform & DB Support

The table below shows every combination a developer will encounter when installing LOOK from scratch. ✅ Works = verified, ⚠️ Limited = works but with a step to watch, ❌ None = unsupported.

Platform × Mode × DB Support

¹ On Ubuntu, CGI requires mpm_prefork — mpm_event + mod_cgid doesn't work.
² AlmaLinux 8.10, nginx→Apache→look-fcgi:9000, MariaDB.
³ Plesk has no CGI Action/ScriptAlias; standalone .lk scripts run via look-fcgi direct mode.
⁴ Docker images are for the build environment — Ubuntu/AlmaLinux Apache test containers are also available.
⁵ In the CLI, request::, db::, session:: return empty since they require an HTTP context.

Where Does the Binary Come From?

Windows — Build and Install

# 1. Build (in a Visual Studio developer environment)
cd cpp\build
cmake .. -DCMAKE_BUILD_TYPE=Release
cmake --build . --config Release

# 2. Copy the binaries
copy cpp\build\Release\look-fcgi.exe C:\xampp\cgi-bin\
copy cpp\build\Release\look-cgi.exe  C:\xampp\cgi-bin\

# 3. Start FastCGI
Start-Process "C:\xampp\cgi-bin\look-fcgi.exe" -ArgumentList "--port 9000" -WindowStyle Hidden

Fastest — run the published image (no build)

# The official image is on Docker Hub. Your app lives in ./app, mounted at /app.
docker run -p 7400:7400 -v "$PWD/app:/app" codlook/look
# First run pulls ~43 MB, then serves http://localhost:7400/ (put index.lk in ./app).

Linux server — one portable binary for every distribution

Build once on AlmaLinux 8 (glibc 2.28 + statically linked OpenSSL). The result is a single binary that runs unchanged on Ubuntu, Debian, AlmaLinux, Rocky and RHEL (8·9·10 and newer) — no per-distribution builds, no glibc mismatch. This replaces the old separate Ubuntu/AlmaLinux build recipes.

# 1. Build the portable binary (static OpenSSL + static libstdc++)
docker build -t look-build -f cpp/Dockerfile.build cpp/
docker run --rm -v "$PWD/cpp:/look/cpp" -w /look/cpp look-build bash build-portable.sh
# Output: cpp/build-portable/{lk, lk-fcgi, lk-cgi} — glibc + libz only

# 2. Transfer to the server (scp strips the execute bit — chmod is required!)
scp cpp/build-portable/lk-fcgi root@server:/opt/look/lk-fcgi
scp cpp/build-portable/lk-cgi  root@server:/opt/look/lk-cgi
chmod +x /opt/look/lk-fcgi /opt/look/lk-cgi

# 3a. Debian/Ubuntu Apache modules (order matters!)
sudo a2dismod mpm_event; sudo a2enmod mpm_prefork cgi rewrite proxy proxy_fcgi actions
sudo systemctl restart apache2

# 3b. systemd service (any distribution)
cat > /etc/systemd/system/look-fcgi.service << 'EOF'
[Unit]
Description=LOOK FastCGI
After=network.target mariadb.service
[Service]
Type=simple
ExecStart=/opt/look/lk-fcgi --port 9000
WorkingDirectory=/var/www/vhosts/domain.com/httpdocs
Restart=on-failure
RestartSec=3
[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload && systemctl enable look-fcgi && systemctl start look-fcgi

Plesk — .htaccess (AllowOverride FileInfo)

# /var/www/vhosts/domain.com/httpdocs/.htaccess
# NOTE: don't write Options +FollowSymLinks — Plesk blocks it (returns 500)
# NOTE: vhost_ssl.conf doesn't work — Plesk doesn't auto-include it
RewriteEngine On
RewriteRule ^index\.lk$ / [R=301,L]
RewriteCond %{REQUEST_URI} \.(html|htm|css|js|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot|pdf|txt|map|webp)$ [NC]
RewriteCond %{REQUEST_FILENAME} -f
RewriteRule ^ - [L]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]
# Standalone .lk scripts → look-fcgi direct mode (a route-less script)
RewriteCond %{REQUEST_URI} \.lk$ [NC]
RewriteCond %{REQUEST_FILENAME} -f
RewriteRule ^(.+\.lk)$ fcgi://127.0.0.1:9000/$1 [P,QSA,L]
# Router
RewriteRule ^ fcgi://127.0.0.1:9000/index.lk [P,QSA,L]

DB Connection DSNs

Common Installation Problems

Concurrent Runtime (Phase 12)

look-fcgi runs fully concurrently. Each HTTP request is handled on a separate worker thread; your LOOK code never changes. For more advanced concurrency, use parallel() + channel().

Two dispatch modes — worker pool (default) or fibers

Besides the worker pool, LOOK ships a fiber runtime: stackful green threads parked on epoll (the Go netpoller model). It is opt-in:

LOOK_FIBER_DISPATCH=1 lk-fcgi --mode http --port 9000 --workers 4

Which one to use is a workload question, and the answer is measured, not guessed:

Rule of thumb: if a route spends most of its time waiting on a slow external service (http:: calls to third-party APIs, webhooks), turn fibers on — http:: is fiber-aware, so one thread can overlap many outbound calls. If your routes are CPU- or DB-bound and fast, keep the default pool. Fibers are stable at c=200/500/1000 (zero errors), they are simply not the faster choice for short requests.

Note: the fiber runtime is Linux-only (--mode http). Channels (channel()/send/receive) are currently thread-blocking, so a channel receive inside a fiber blocks that worker — keep channel use to parallel() tasks for now.

Starting

# Windows XAMPP — 4 worker threads
Start-Process "C:\xampp\cgi-bin\look-fcgi.exe" -ArgumentList "--port 9000 --workers 4" -WindowStyle Hidden

# Linux systemd
ExecStart=/opt/look/lk-fcgi --port 9000 --workers 8

# if workers isn't specified → hardware_concurrency() (at least 2)

Architecture

look-fcgi --port 9000 --workers N

Each request → a worker thread from the ThreadPool:
  1. shared_mutex (read lock for the duration of dispatch)
     if a hot reload is needed → write lock → run_setup() → return to read lock
  2. make_dispatch_copy()   — built ONCE PER WORKER (thread_local), not per request
                              (rebuilt only when the app is hot-reloaded)
  3. acquire_thread_connections()  — one connection borrowed from each pool
  4. dispatch_routes() / interpret()  — fully isolated, thread-safe
  5. release_thread_connections()  — connections returned to the pool
  6. HTTP response is written

Core Components

Your LOOK Code Doesn't Change

You write it the same way — the runtime handles everything:

$conn = db::connect("mysql://root:@127.0.0.1/blog")  # once at setup

route("GET", "/posts", function() use ($conn) {
    # Each request runs on a different thread, borrowing a connection from $conn automatically
    $rows = db::query($conn, "SELECT * FROM posts", [])
    print(json::encode($rows))
})

--mode http — Event Loop (Phase 13)

With look-fcgi --mode http, look-fcgi runs its own HTTP/1.1 server — bypassing Apache/FastCGI. Required for WebSocket.

Starting

# Windows XAMPP — independent of Apache
Start-Process "C:\xampp\cgi-bin\look-fcgi.exe" `
  -ArgumentList "--mode http --port 8090 --workers 4 C:\xampp\htdocs\index.lk" `
  -WindowStyle Hidden

# Linux systemd
ExecStart=/opt/look/look-fcgi --mode http --port 8090 --workers 4 /var/www/myapp/index.lk

The Two Modes Compared

Architecture

look-fcgi --mode http --port 8090

Request flow:
  Client TCP connection
    → EventLoop (epoll Linux / select Windows) async read
    → HTTP/1.1 parse complete → WorkerPool thread
    → make_dispatch_copy() → dispatch_routes()
    → EventLoop async write → response → close fd

WebSocket Upgrade (Upgrade: websocket):
    → WorkerPool thread: 101 Switching Protocols is sent
    → WsConnection created, added to WsRegistry
    → route("WS", ...) callback is called
    → ws::on() callbacks registered, parallel() task starts
    → EventLoop async read → RFC 6455 frame decode → message callback

SSE Upgrade (Accept: text/event-stream):
    → WorkerPool thread: HTTP 200 + SSE headers are sent
    → SseConnection created, added to SseRegistry
    → route("SSE", ...) callback is called
    → timer::every() timers registered (TimerManager background thread)
    → sse::on("close") disconnect callback registered
    → EventLoop async read → disconnect detection → on_close_cb → timer::cancel

Reverse Proxy with Nginx (recommended)

# /etc/nginx/sites-available/myapp
server {
    listen 443 ssl
    server_name domain.com
    location / {
        proxy_pass http://127.0.0.1:8090
        proxy_set_header X-Forwarded-For $remote_addr
    }

    location /chat {
        proxy_pass http://127.0.0.1:8090
        proxy_http_version 1.1
        proxy_set_header Upgrade $http_upgrade
        proxy_set_header Connection "upgrade"
        proxy_read_timeout 3600s
    }
}

HTTP Rate Limiter

Works only in --mode http. A two-layer token-bucket algorithm: global first (botnet protection), then per-IP (a single attacker). When the limit is exceeded it returns 429 Too Many Requests — your LOOK code doesn't change.

# systemd service — behind an nginx proxy
[Service]
Environment=LOOK_RATE_LIMIT_RPM=120
Environment=LOOK_RATE_LIMIT_BURST=8
Environment=LOOK_RATE_LIMIT_GLOBAL_RPM=5000
Environment=LOOK_RATE_LIMIT_GLOBAL_BURST=200
Environment=LOOK_TRUSTED_PROXY=127.0.0.1

parallel() + channel() — Concurrent Tasks (Phase 14)

LOOK brings language-level concurrency. parallel() starts a new task and channel() passes the result back — LOOK-specific terminology, not Go's.

Basic API

# channel([size]) — create a channel
$ch = channel()  # default buffer: 128
$ch = channel(10)  # 10-slot buffer
$ch = channel(0)  # unbuffered — synchronous rendezvous (Go semantics)

# send / receive / close / chan_size
send($ch, 42)  # send a value to the channel (blocks if the buffer is full)
$val = receive($ch)  # receive from the channel (blocks if empty; null if closed+empty)
close($ch)  # close the channel — receive() starts returning null
chan_size($ch)  # number of items in the queue

# parallel(fn) — start a new task
parallel(function() use ($ch, $conn) {
    $rows = db::query($conn, "SELECT count(*) as n FROM products", [])
    send($ch, $rows[0]["n"])
})
$count = receive($ch)

Fan-out Pattern — Parallel Queries

# 3 DB queries concurrently — total time is that of the longest query
$result = channel(3)
parallel(function() use ($result, $conn) {
    $n = db::query($conn, "SELECT count(*) as n FROM companies", [])
    send($result, $n[0]["n"])
})
parallel(function() use ($result, $conn) {
    $n = db::query($conn, "SELECT count(*) as n FROM categories", [])
    send($result, $n[0]["n"])
})
parallel(function() use ($result, $conn) {
    $n = db::query($conn, "SELECT count(*) as n FROM products", [])
    send($result, $n[0]["n"])
})
$companies    = receive($result)
$categories = receive($result)
$products     = receive($result)

Pipeline Pattern — Producer → Consumer

$pipe = channel(100)
$out  = channel()
# Producer
parallel(function() use ($pipe, $conn) {
    $rows = db::query($conn, "SELECT id FROM products WHERE active=1", [])
    foreach ($rows as $row) { send($pipe, $row["id"]) }
    close($pipe)
})
# Consumer
parallel(function() use ($pipe, $out) {
    $ids = []
    while (true) {
        $id = receive($pipe)
        if ($id == null) { break }
        push($ids, $id)
    }
    send($out, count($ids))
})
$total = receive($out)

Rules

parallel:: — Task Monitoring API

Helper functions to monitor and control running tasks. No use parallel; needed.

# Task monitoring — a /status endpoint
route("GET", "/status", function() {
    print(json::encode([
        "active_tasks"  => parallel::active(),
        "limit"         => parallel::limit(),
        "at_capacity"   => parallel::at_capacity()
    ]))
})

# Check capacity before enqueuing
if (parallel::at_capacity()) {
    response::json(["error" => "Server busy"], 503)
    return
}
parallel(function() { /* ... */ })

LOOK_PARALLEL_LIMIT — Task Limit

The maximum number of parallel() tasks that can run at once. Unlimited by default. When exceeded, the parallel() call throws an error.

# in the systemd service file:
Environment=LOOK_PARALLEL_LIMIT=100

# in the .env file:
LOOK_PARALLEL_LIMIT=50

WebSocket (Phase 15)

Full WebSocket support in LOOK. RFC 6455, SHA-1, Base64 — zero dependency. Works only in --mode http.

Basic Chat Example

# Hub channel — top-level (created in the setup phase, passed to all WS routes)
$hub = channel()
route("WS", "/chat", function($ws) use ($hub) {

    # A task that receives messages from the hub and forwards them to this client
    parallel(function() use ($ws, $hub) {
        while (true) {
            $msg = receive($hub)
            if ($msg == null) { break }   # hub closed
            ws::send($ws, $msg)
        }
    })
    # On an incoming message, write to the hub and broadcast to all clients
    ws::on($ws, "message", function($data) use ($hub) {
        $parsed = json::decode($data)
        $out    = json::encode(["from" => request::ip(), "msg" => $parsed["msg"]])
        send($hub, $out)
        ws::broadcast($out)
    })
    ws::on($ws, "close", function() {
        log::info("WS connection closed")
    })
})

ws:: API

Architecture

HTTP GET /chat
  Upgrade: websocket
  Sec-WebSocket-Key: ...
    → WorkerPool thread: ws_handshake_101() → 101 Switching Protocols
    → WsConnection{fd} is created
    → added to WsRegistry (the global list for broadcast)
    → route("WS", "/chat", fn) callback is called
      → ws::on() callbacks are registered
      → a parallel() task is started (reading from the hub)
    → frames start being read via EventLoop async_read(fd)

When a frame arrives (EventLoop thread):
    → ws_try_decode_frame() — RFC 6455, masked client frames
    → text/binary: WorkerPool thread → on_message callback
    → ping: pong is answered automatically
    → close: a close frame is sent, on_close is called, fd is closed

ws::broadcast():
    → WsRegistry shared_lock → the client list is copied → lock released
    → sent to each client individually (no deadlock)

Browser JavaScript Example

const ws = new WebSocket('ws://localhost:8090/chat')
ws.onopen    = () => console.log('Connected')
ws.onmessage = e => console.log('Message:', JSON.parse(e.data))
ws.onclose   = () => console.log('Closed')
ws.send(JSON.stringify({ msg: 'Hello!' }))

Starting the App (--mode http)

# Windows
Start-Process "C:\xampp\cgi-bin\look-fcgi.exe" `
  -ArgumentList "--mode http --port 8090 --workers 4 C:\xampp\htdocs\index.lk" `
  -WindowStyle Hidden

# Linux systemd
ExecStart=/opt/look/look-fcgi --mode http --port 8090 --workers 4 /var/www/myapp/index.lk

timer:: + SSE — Server-Sent Events (Phase 16)

Timer management and Server-Sent Events in LOOK. timer:: runs on a global background thread; route("SSE",...) is the one-way sibling of WebSocket.

timer:: API

sse:: API

Live Stats Example

# SSE route — to a client arriving with Accept: text/event-stream
route("SSE", "/events", function($sse) {

    # Send a tick every 2 seconds
    $tick = timer::every(2000, function() use ($sse) {
        $data = json::encode([
            "t"       => date::now(),
            "clients" => sse::clients()
        ])
        $ok = sse::send($sse, $data, "tick")
        if (!$ok) { timer::cancel($tick) }  # disconnected
    })
    # A keepalive ping every 30 seconds
    $ping = timer::every(30000, function() use ($sse) {
        sse::send($sse, "keepalive", "ping")
    })
    # Cancel the timers when the connection closes
    sse::on($sse, "close", function() use ($tick, $ping) {
        timer::cancel($tick)
        timer::cancel($ping)
        log::info("SSE connection closed")
    })
})

Browser JavaScript

const es = new EventSource('/events')
es.addEventListener('tick', e => {
    const d = JSON.parse(e.data)
    console.log(d.t, 'clients:', d.clients)
})
es.addEventListener('ping', e => console.log('ping', e.data))
es.onerror = () => console.log('Disconnected')

timer:: Standalone Usage

# One-shot — log after 5s
$id = timer::after(5000, function() {
    log::info("5 seconds passed")
})
timer::cancel($id)  # changed my mind

# Repeating — keep statistics
timer::every(60000, function() use ($conn) {
    $n = db::col($conn, "SELECT count(*) FROM sessions WHERE active=1", [])
    log::info("Active sessions: " . $n)
})

Architecture

SSE Upgrade:
  Client GET /events
    Accept: text/event-stream
      → http_server.cpp: req.upgrade_sse = true
      → handle_sse_upgrade(): HTTP 200 + SSE headers are sent
      → SseConnection{fd} is created, added to SseRegistry
      → sse_handler lambda → worker thread
        → make_dispatch_copy() → web.method = "SSE"
        → set_sse_connection(conn)
        → dispatch_routes() → route("SSE",...) callback
          → timer::every() is registered (TimerManager)
          → sse::on("close") is registered
      → EventLoop async_read(fd): disconnect detection

TimerManager (global singleton, background thread):
  std::map<int, Entry> entries_  (sorted by next_fire time)
  condition_variable::wait_until → sleep until the nearest deadline
  Callback fires OUTSIDE THE LOCK (deadlock prevention)
  one-shot: removed | repeating: next_fire updated
  timer:: callback: make_dispatch_copy() + acquire/release_thread_connections()

Nginx — SSE Proxy (X-Accel-Buffering)

# proxy_buffering must be off for SSE
location /events {
    proxy_pass http://127.0.0.1:8090
    proxy_buffering off
    proxy_cache off
    proxy_set_header X-Forwarded-For $remote_addr
    proxy_read_timeout 3600s
}

Bytecode VM — the default engine

A register-based bytecode VM is now the default engine for both the CLI (lk, lk -c) and the web server (lk-fcgi, in both --mode fcgi and --mode http). The compiler (AST → FunctionProto bytecode) + VM (switch(opcode) dispatch) pair replaced the tree-walk interpreter as the hot path: roughly 41–51× faster on the CLI and up to 7.8× on compute-bound web workloads. The tree-walk interpreter remains only as a fallback (and still powers the REPL, lk-cgi and lk test, where the VM isn't linked).

Architecture

Important Bug Fixes (Phase 16.5)

Benchmark — Docker Ubuntu, 8 workers

Conclusion: the VM gains 7.8x on compute-bound workloads. On HTTP+I/O-bound workloads the difference is dominated by HTTP overhead.

Usage

# --mode http — VM active (default), a separate port from FastCGI
./look-fcgi --mode http --port 8090 --workers 8 /var/www/myapp/index.lk

# VM disabled — interpreter fallback
LOOK_BYTECODE=0 ./look-fcgi --mode http --port 8090 --workers 8 /var/www/myapp/index.lk

# the chat service (Phase 17)
LOOK_BYTECODE=1 ./look-fcgi --mode http --port 9001 --workers 8 chat.lk

# --mode fcgi — FastCGI (via Apache mod_proxy_fcgi) — VM also default here
./look-fcgi --port 9000 --workers 8

Phase 17 — Chat Live

A real-time chat application using WebSocket + broadcast + timer:: keepalive. 500/500 bots PASS, zero memory leak verified.

chat.lk Routes

Core Architecture

# Hub channel — created in the setup phase
$hub = channel()
route("WS", "/chat", function($ws) use ($hub) {
    # Keepalive ping — every 30 seconds
    $ping_id = timer::every(30000, function() use ($ws) {
        ws::send($ws, json::encode(["type" => "ping"]))
    })
    # Read from the hub → forward to this client
    parallel(function() use ($ws, $hub) {
        while (true) {
            $msg = receive($hub)
            if ($msg == null) { break }
            ws::send($ws, $msg)
        }
    })
    ws::on($ws, "message", function($data) use ($hub) {
        send($hub, $data)  # write to the hub
        ws::broadcast($data)  # broadcast to all clients
    })
    ws::on($ws, "close", function() use ($ping_id) {
        timer::cancel($ping_id)
    })
})

Test Results — Phase 17 + 17.1 (June 16, 2026)

timer::cancel Fix (Phase 17)

Fix: entries_.erase(id) immediately + the thread is woken with cv_.notify_one(). The cancel call is now instant.

Memory Behavior

LOOK Concurrency Model

LOOK offers concurrency at two levels: at the runtime level (each HTTP request on a separate thread) and at the language level (parallel() + channel()).

Two Layers

When to Use What?

LOOK Concurrency Model

Thread Safety

Apache / XAMPP Configuration

Windows XAMPP — Automatic Install

One step: run platforms/windows/xampp/install.bat as administrator.

# what install.bat does:
# 1. copies lk-cgi.exe → C:\xampp\cgi-bin\
# 2. adds a CGI handler to httpd.conf (with mod_rewrite rules)
# 3. restarts Apache
# 4. verifies with http://localhost/test.lk

Once complete, open http://localhost/test.lk — you should see Hello LOOK!.

httpd.conf — CGI Mode (Manual)

If install.bat doesn't work, add the block below inside <Directory "C:/xampp/htdocs">:

    # --- LOOK Language CGI ---
    Action look-handler /cgi-bin/lk-cgi.exe
    AddHandler look-handler .lk

    <IfModule mod_rewrite.c>
        RewriteEngine On
        RewriteCond %{REQUEST_FILENAME} -f [OR]
        RewriteCond %{REQUEST_FILENAME} -d
        RewriteRule ^ - [L]
        RewriteRule ^ /index.lk [L]
    </IfModule>
    # --- /LOOK Language ---

Then restart Apache.

How CGI Mode Works

Ubuntu / Linux Apache

# mpm_prefork + CGI required
sudo a2dismod mpm_event
sudo a2enmod mpm_prefork cgi rewrite actions
sudo systemctl restart apache2

Detailed guide: docs/ubuntu-deployment.md | docs/plesk-apache-deployment.md

Performance

Apache Bench — 5000 requests, 500 concurrent connections:

The core advantage of FastCGI warm start: the DB connection is established once and stays alive for the life of the process. The cost of opening a new connection on every request is zero.

Real Load Test — Plesk VPS (v1.0.0, June 15, 2026)

Apache Bench — 10 minutes, 32 workers, 17 endpoints, 4.7 million requests:

Note: the RPS ceiling of fcgi mode comes from the Apache mod_proxy_fcgi layer — the bottleneck is Apache, not look-fcgi. --mode http bypasses Apache entirely.

Bytecode VM Benchmark — Docker Ubuntu (v1.0.0, June 16, 2026)

8 workers, --mode http, VM active:

On compute-bound workloads the VM gains 7.8x. On HTTP/I/O-bound workloads the difference is dominated by HTTP overhead.

Load Ladder — --mode http, direct port (July 2026)

AlmaLinux 8 VPS — --mode http, 64 workers, Bytecode VM active, kernel tuning (backlog 16384, syn_backlog 8192), ApacheBench. The same SELECT 1+1 route at all concurrency levels:

Findings:

• Throughput is flat from c=1,000 to c=20,000 (~7.5–10k) — this proves the system is CPU-bound, with no scheduler/lock bottleneck.
• 1,000,000 requests, 0 errors — RSS stayed at 28 MB from start to finish, not a single byte grew (no memory leak).
• ~1.75M requests total in this run, 0 errors. The walls were the OS, not LOOK: tcp_max_syn_backlog and the listen() backlog — overcome with persistent tuning.
• TLS chain (nginx→direct FCGI): ~1,100–1,240 RPS — the difference is double TLS termination + the proxy layer, not LOOK.
• DB-bound: the bottleneck is the MySQL round-trip — the VM has no effect, linear up to connection-pool saturation.
• Note: real c=100,000+ concurrent from a single machine is physically impossible (ephemeral ports ~64k). 1M total requests was tested as endurance.

Security & Concurrency Tests (July 2026)

The zero-dependency philosophy makes every parser (HTTP, MySQL, RESP2, PostgreSQL) our responsibility. So beyond benchmarks, the runtime has been put through fuzzing, ThreadSanitizer and data-integrity tests:

Vulnerabilities closed:

• DoS — unbounded body: exceeding LOOK_MAX_BODY_SIZE (10 MB) → 413; memory exhaustion prevented.
• Request smuggling: Content-Length + Transfer-Encoding together → 400 (RFC 7230 §3.3.3).
• Malformed Content-Length: invalid value → 400 (worker doesn't crash); full RFC 7230 §4.1 chunked Transfer-Encoding support.
• SQL injection: db::query is parameterized (? placeholder) — driver-correct escaping, locale-independent.
• Session: 128-bit /dev/urandom token, HttpOnly + Secure + SameSite cookie.
• Slowloris: read/write timeout (30s) + kernel backlog tuning.
• Data race (date::now): std::localtime shared-buffer + tzset race → localtime_r + startup tzset(). Caught by ThreadSanitizer, fixed.
• JSON stack overflow: deeply nested body → recursion bounded with JSON_MAX_DEPTH (256) — network input via request::json() can't crash the worker.
• Protocol-parser DoS: RESP2/HTTP-client/PostgreSQL/SMTP — unguarded std::sto* number conversion + unbounded allocation (RESP2 read_bulk/read_line) closed.
• Arithmetic undefined behavior (UB): signed-integer overflow (+/−/*), INT_MIN/-1, shift amount and -INT_MIN → promoted to float on overflow; zero runtime errors under UBSan.
• IMAP server (RFC 3501/2177): APPEND literal size is validated before reading (NO [TOOBIG], OOM prevention) · LOGINDISABLED before TLS (passwords don't go in the clear) · path traversal rejected in 3 layers (mailbox+user+SMTP recipient) · sequence stability (the wrong message isn't deleted) · Slowloris/brute-force protection · ASan+UBSan fuzz 0 UB.

Layered defense: manual review (17 points) + fuzzing (16,000+ iterations) + ThreadSanitizer + regression (9/9) + CI. No absolute "zero bugs" is claimed — the main attack surface (network I/O, protocol parsers, VM arithmetic) has been scanned and hardened.

Fuzzing, ASan/UBSan and TSan run automatically in CI on every push (.github/workflows/security.yml). Details: SECURITY.md in the repo root.

Phase 18: Blog Live

A live blog — template engine, CRUD, auth, file upload. June 18, 2026.

Features

• template:: — layout inheritance, partial include, HTML-safe variables
• Auth — session-based admin login, PBKDF2/SHA-256 password hash
• Post CRUD — create, edit, delete, publish state
• Category management — slug-based, post counts
• File upload — magic-byte-checked cover image
• Flash messages — success/error notifications via the session

Route Structure

GET  /blog/                    → Post list (published, category filter)
GET  /blog/category/{slug}     → Posts by category
GET  /blog/{slug}              → Post detail
GET  /blog/admin/login         → Login form
POST /blog/admin/login         → Auth check + session
GET  /blog/admin/logout        → Session destroy
GET  /blog/admin/              → Management panel
GET  /blog/admin/new           → New post form
POST /blog/admin/new           → Save post + image upload
GET  /blog/admin/edit/{id}     → Edit form
POST /blog/admin/edit/{id}     → Update post
POST /blog/admin/delete/{id}   → Delete post
GET  /blog/admin/categories    → Category list
POST /blog/admin/categories/new → Add category
POST /blog/admin/categories/delete/{id} → Delete category

Phase 18.5: File Module System

Splitting large projects into multiple files with use "file.lk". June 18, 2026. 5/5 tests PASS.

Blog.lk Refactor Example

Split from a single 421-line file into 5 files — a 43-line bootstrap:

blog/
  blog.lk          ← 43-line bootstrap
  helpers.lk       ← db_check(), admin_check(), slugify()
  routes/
    public.lk      ← register_public_routes($conn, $tpl)
    auth.lk        ← register_auth_routes($conn, $tpl)
    admin.lk       ← register_admin_routes($conn, $tpl)

Test Results

Anatomy of a LOOK File

Login and data fetching — one file, no framework. See how LOOK is designed for the web in a single example.

Login + Data Fetching

use auth;

$conn = db::connect("mysql://root:@localhost/blog");
# Opened once — stays alive across every request (warm start)

route("POST", "/login", function() use ($conn) {
    session::start();
    $d = request::json();

    # ? parameterized — SQL injection protection is automatic
    $rows = db::query($conn,
        "SELECT * FROM users WHERE email=?",
        [$d["email"]]);

    if (count($rows) == 0 ||
     !auth::verify($d["password"], $rows[0]["hash"])) {
        response::status(401);
        print(json::encode(["ok" => false]));
        return;
    }
    session::set("user_id", $rows[0]["id"]);
    response::redirect("/panel");
});

route("GET", "/posts", function() use ($conn) {
    $rows = db::query($conn,
        "SELECT * FROM posts", []);
    print(json::encode($rows));
});

What It Provides

Feature Table

LOOK v1.0.0 — all completed features.

Available in v1.0.0

Intentionally Absent