Gray

Gray is a server language with an integrated compiler and runtime. It includes HTTP, database, concurrency, session, and deployment APIs.

server.gy source process · replace on validation

set $server = http_server();

http_handler($server, "GET", "/hello", fn($request) {
    return response_json([
        "runtime": "Gray",
        "policy": "Live"
    ]);
});

http_serve($server, "0.0.0.0", 8080);

response 200 application/json

{
  "runtime": "Gray",
  "policy": "Live"
}

Start: Source
Change: Validated replacement
Ship: Project tree

Quickstart

Create a project and start the development server.

01gray new hello-gray

02cd hello-gray && gray run

03gray dev

<?gray
set String $name = "Ada";
?>
Hello, {$name}!

Gray files can combine source and literal output. Expressions inside {...} are rendered in place.

Language and runtime

Core syntax and built-in server capabilities.

Output

`<?gray ... ?>`, includes, and `{expr}`

Compose ordinary files in shared scope and render expressions inside literal text.

Types

Checked at the boundaries that matter

Mix typeless values with checked parameters, returns, fields, and storage.

Structure

Classes, schemas, and identity

Model state with constructors, methods, visibility, typed records, and JSON encoding.

Database

Native SQLite and PostgreSQL execution

Use parameterized SQL, typed rows, transactions, and readiness-driven continuation paths.

Security

Session Fabric is a runtime primitive

Opaque encrypted sessions, typed state, CSRF, recent authentication, bounded risk, and redacted events.

Concurrency

Structured tasks and bounded native state

spawn, await, cancellation, caches, and source-aware errors share one execution model.

Tooling

One syntax model

gray fmt, gray lint, and the LSP consume the compiler's grammar.

Execution

Policy is explicit

Run source, ship a standalone artifact, or replace ready workers after validation.

Tutorials

Runnable examples checked by the repository test suite.

Example

Session Fabric

Session lifecycle, storage adapters, key rotation, and privacy controls.

APISession lifecycle and browser policyRead guide StorageMemory, encrypted SQLite, Redis, and ValkeyRead guide OperationsActive and retiring encryption keysRead guide PrivacySignals, retention, and redactionRead guide

Current preview lineage

RC9 built the runtime. RC10 corrected the proof.

The releases belong to different parts of the story: one expanded what Gray can do; the next repaired the HTTP path and tightened what the evidence can claim.

Release	Source commit	Measured change
RC8	`dc12539311e5`	Distribution, remote packages, version management, installer and doctor
RC9	`01241dde5fd1`	140 commits across 555 files; the major runtime expansion
RC10	`ac76c79693b7`	5 commits across 9 files; focused HTTP and qualification correction

RC8 → RC10: 145 commits, 560 files changed, 59,925 insertions, and 4,790 deletions. Much of that volume is tests, documentation, benchmark fixtures, and qualification evidence.

RC9Functional milestone

A production-capable native value and concurrency surface.

RC9 added ownership-safe Bytes, dynamic JSON, dynamic collections and call edges, native request/response handling, checked projection, and explicit VM fallback.

task_group, parent-to-child cancellation, deterministic draining
Bounded typed channels and cancellation-aware channel_select
AES-256-GCM, ChaCha20-Poly1305, password hashing, HKDF, Ed25519, and X25519
TLS rotation, session resumption, disconnect handling, and OpenSSL qualification
Short-circuit logic, !=, postfix ++/--, typed integer lowering, and read-only $this

RC10Performance and evidence correction

The HTTP fast path returned, and the comparison became auditable.

RC10 coalesced plaintext headers, borrowed response bodies through sendmsg, repaired the reproducible comparison image, proved Static execution, and selected the registered PostgreSQL continuation route.

One-hour Static plaintext, JSON, and PostgreSQL continuation evidence retained
Exact source, host, toolchain, execution mode, samples, gates, and limitations published
Go remains the immediate comparison target; Rust remains a longer-term bar

Plaintext: 49,994.87 req/s
JSON: 39,998.26 req/s
PostgreSQL continuation: 7,999.19 req/s

Preview boundary. RC10 is not a stable release or a redistribution-clearance claim. Licensing, signing and key custody, vulnerability reporting, dependency policy, rollback policy, and final public documentation remain release controls.

Inspect exact RC10 evidence

API reference

Declarations generated from the compiler's syntax model.

Filter declarations

Loading gray.docs.v1