Web, HTTP & CLI

Module /http #

Core HTTP method, status code, content-type, and header inspection predicates.

(use /http)

content-type-of #

Constant (Any)

Constant in /http.

form-of #

Constant (Any)

Constant in /http.

get-header #

Constant (Any)

Constant in /http.

header-of #

Constant (Any)

Re-export case-insensitive header and URI lookup helpers

json-of #

Constant (Any)

Constant in /http.

path-of #

Constant (Any)

Constant in /http.

query-of #

Constant (Any)

Constant in /http.

query-string-of #

Constant (Any)

Constant in /http.

is-delete? #

(req)

Exported function in /http.

is-get? #

(req)

Request method and content inspectors

is-head? #

(req)

Exported function in /http.

is-json-request? #

(req)

Exported function in /http.

is-options? #

(req)

Exported function in /http.

is-patch? #

(req)

Exported function in /http.

is-post? #

(req)

Exported function in /http.

is-put? #

(req)

Exported function in /http.

request #

(method url headers body)

Request / Response constructors

response #

(status headers body)

Exported function in /http.

Module /http/client #

Asynchronous & synchronous HTTP/HTTPS client with connection pooling, headers, timeouts, and streaming bodies.

(use /http/client)

Client #

(Client ...)

Exported function in /http/client.

content-type-of #

(content-type-of req-or-resp) -> (Or String None)

Returns the Content-Type header of an HTTP request or response.

delete #

(delete ...)

Exported function in /http/client.

get #

(get ...)

Exported function in /http/client.

get-text #

(get-text ...)

Exported function in /http/client.

head #

(head ...)

Exported function in /http/client.

header-of #

(header-of req name) -> (Or String None)

Looks up a request or response HTTP header case-insensitively.

options #

(options ...)

Exported function in /http/client.

patch #

(patch ...)

Exported function in /http/client.

post #

(post ...)

Exported function in /http/client.

put #

(put ...)

Exported function in /http/client.

request #

(request ...)

Exported function in /http/client.

Module /http/client/json #

Convenience helpers for sending and decoding JSON HTTP requests (post-json).

(use /http/client/json)

post-json #

(client url body headers)

Exported function in /http/client/json.

Module /http/server #

High-performance Axum/Tokio HTTP/1.1 & HTTP/2 server supporting static file serving, SSE, multipart forms, and WebSockets.

(use /http/server)

close-websocket #

(close-websocket ...)

Exported function in /http/server.

content-type-of #

(content-type-of req-or-resp) -> (Or String None)

Returns the Content-Type header of an HTTP request or response.

form-of #

(form-of req) -> Map

Parses an application/x-www-form-urlencoded or multipart/form-data request body into a Map.

handle-static #

(handle-static {:dir path :fallback file?}) -> Handler

Creates an HTTP handler that serves static files from :dir with automatic MIME detection.

header-of #

(header-of req name) -> (Or String None)

Looks up a request or response HTTP header case-insensitively.

json-of #

(json-of req-or-resp) -> Any

Decodes a JSON HTTP request or response body into native Tangu data structures.

path-of #

(path-of req) -> String

Extracts and URL-decodes the request path from an HTTP request Map.

query-of #

(query-of req) -> Map

Parses the URL query string of an HTTP request into a key-value Map.

query-string-of #

(query-string-of req) -> String

Returns the raw query string portion of an HTTP request URI.

read-form-urlencoded #

(read-form-urlencoded ...)

Exported function in /http/server.

read-multipart-form-data #

(read-multipart-form-data ...)

Exported function in /http/server.

receive-websocket-message #

(receive-websocket-message ...)

Exported function in /http/server.

send-sse-event #

(send-sse-event ...)

Exported function in /http/server.

send-websocket-message #

(send-websocket-message ...)

Exported function in /http/server.

serve #

(serve ...)

Exported function in /http/server.

sse-response #

(sse-response ...)

Exported function in /http/server.

websocket-response #

(websocket-response ...)

Exported function in /http/server.

Module /web/app #

Core full-stack web application primitives: cookies, flash messages, query/form params, responses, and URL routing.

(use /web/app)

request #

Constant (Any)

Constant in /web/app.

add-classes #

Constant (Any)

Constant in /web/app.

close-websocket #

Constant (Any)

Constant in /web/app.

content-type-of #

Constant (Any)

Constant in /web/app.

cookies-of #

Constant (Any)

Constant in /web/app.

form-of #

Constant (Any)

Constant in /web/app.

get-header #

Constant (Any)

Direct zero-allocation native Rust header and URI lookups.

is-delete? #

Constant (Any)

Constant in /web/app.

is-get? #

Constant (Any)

Constant in /web/app.

is-head? #

Constant (Any)

Constant in /web/app.

is-json-request? #

Constant (Any)

Constant in /web/app.

is-options? #

Constant (Any)

Constant in /web/app.

is-patch? #

Constant (Any)

Constant in /web/app.

is-post? #

Constant (Any)

Constant in /web/app.

is-put? #

Constant (Any)

Constant in /web/app.

is-safe-external-url #

Constant (Any)

Constant in /web/app.

json-of #

Constant (Any)

Constant in /web/app.

merge-attrs #

Constant (Any)

Constant in /web/app.

parse-component-params #

Constant (Any)

Constant in /web/app.

path-of #

Constant (Any)

Constant in /web/app.

query-of #

Constant (Any)

Constant in /web/app.

query-string-of #

Constant (Any)

Constant in /web/app.

receive-websocket-message #

Constant (Any)

Constant in /web/app.

safe-origin #

Constant (Any)

Constant in /web/app.

send-sse-event #

Constant (Any)

Constant in /web/app.

send-websocket-message #

Constant (Any)

Constant in /web/app.

sse-response #

Constant (Any)

Constant in /web/app.

websocket-response #

Constant (Any)

Constant in /web/app.

with-cookie #

Constant (Any)

Constant in /web/app.

Cookie #

(params)

Cookie { name value path expires domain secure HttpOnly }

attach-cookie #

(resp cookie)

Adds a cookie to an existing response.

build-query-string #

(query-map)

Serializes a dictionary of query parameters into a URL query string component. Automatically sorts keys alphabetically for predictable and deterministic URLs.

clear-flash-cookie #

(resp)

Attaches a Set-Cookie header to clear the flash cookie on response.

clear-named-routes #

(...)

Clears all registered routes in the package default registry (useful for testing).

client-ip-of #

(req)

Resolves the client IP address from X-Forwarded-For, X-Real-IP, or remote-addr.

coerce-map-to-struct #

(raw-map struct-type)

Exported function in /web/app.

compile-template #

(path-template name)

Pre-compiles a route path template into an optimized token structure. Segments are tokenized into :literal, :param, or :wildcard.

construct-app-config #

(env-defaults-path)

Builds app config from process env vars and a fallback config data file.

construct-app-config-from-env #

(current-env env-defaults)

Builds app config by preferring env values and falling back to defaults.

cookie->header #

(cookie)

Exported function in /web/app.

cookie-base64-decode #

(encoded)

Restores base64 padding before decoding a cookie payload.

cookie-base64-encode #

(text)

Removes base64 padding so cookie values survive parser round-trips.

decode-form-value #

(value)

Decodes a single form-urlencoded field value.

get-bearer-token #

(req)

Exported function in /web/app.

get-cookie #

(req name default-val)

Exported function in /web/app.

get-cookies #

(req)

Exported function in /web/app.

get-flash #

(req)

Reads and decodes flash data from request cookies.

get-path-param #

(req name default-val)

Exported function in /web/app.

get-path-param-int #

(req name default-val)

Exported function in /web/app.

get-query-param #

(req name default-val)

Exported function in /web/app.

get-query-param-bool #

(req name default-val)

Exported function in /web/app.

get-query-param-int #

(req name default-val)

Exported function in /web/app.

has-flash? #

(req)

Returns true if the request contains a _flash= cookie header without decoding it.

header-map #

(headers)

Normalizes a map of HTTP headers so all keys are lowercase strings for O(1) lookup.

interpolate-template #

(compiled params)

Interpolates parameters into a pre-compiled route template. Consumed parameters are removed from the candidate pool; remaining parameters are appended to the URL as a query string.

is-fetch? #

(req)

Exported function in /web/app.

is-safe-external-url? #

(raw-url)

Validates whether a URL is a safe public target and not an internal network or cloud metadata address (SSRF guard).

is-stage-slots-request? #

(req)

Exported function in /web/app.

read-body #

(req)

Exported function in /web/app.

read-json #

(req struct-type)

Exported function in /web/app.

read-json-cookie #

(req cookie-name)

Reads and decodes a JSON payload stored in a cookie.

read-query #

(req struct-type)

Exported function in /web/app.

redirect #

(uri status-or-headers extra-headers)

Exported function in /web/app.

redirect-with-flash #

(url data)

Creates a redirect response with an ephemeral flash payload.

register-named-routes #

(routes-map)

Registers pre-compiled named routes into the package default registry.

remove-cookie-header #

(headers name)

Exported function in /web/app.

respond-css #

(css headers)

Exported function in /web/app.

respond-error #

(status code-or-err details-or-headers extra-headers)

Exported function in /web/app.

respond-html #

(html headers)

Exported function in /web/app.

respond-json #

(data status-or-headers extra-headers)

Exported function in /web/app.

respond-method-not-allowed #

(allowed req)

Exported function in /web/app.

respond-no-content #

(headers)

Exported function in /web/app.

respond-not-found #

(req)

Returns the default 404 Not Found HTML or JSON response.

respond-stage-slots #

(payload extra)

Exported function in /web/app.

respond-status #

(status raw-message headers)

Exported function in /web/app.

respond-text #

(text headers)

Exported function in /web/app.

respond-xml #

(xml headers)

Respond with XML content.

router #

(route-defs)

Exported function in /web/app.

safe-origin? #

(client-origin expected-origin)

Strictly compares a client-supplied origin against an expected origin, preventing prefix bypasses.

safe-referer-path #

(req fallback-args)

Resolves a safe redirect path from the request Referer header, falling back to a default path. Verifies the Referer is either a safe relative path or belongs to the current request host / localhost.

safe-relative-path #

(raw-path)

Validates and returns a safe relative path slice, strictly preventing path traversal attacks. Rejects leading slashes, backslashes, null bytes, and traversal segments (".." or ".").

sanitize-return-to #

(raw-return-to fallback-args)

Sanitizes a return-to parameter to prevent open redirect vulnerabilities. Returns fallback (defaulting to "/") if raw-return-to is empty, invalid, or external.

serve #

(handler options rt)

Exported function in /web/app.

set-cookie-header #

(headers cookie)

Exported function in /web/app.

url-for #

(args)

Polymorphic reverse routing constructor:

• (url-for name)
• (url-for name params)
• (url-for req name)
• (url-for req name params)
• (url-for registry name params)

url-for-with-registry #

(registry name params)

Resolves a route name within an explicit named routes registry map.

verify-webhook-signature #

(req secret header-name)

Verifies an HMAC-SHA256 webhook signature header against the raw request body in constant time.

with-header #

(resp name val)

Returns a response with a single header added or updated in-place.

with-headers #

(resp extra-headers)

Returns a response with multiple headers added or updated in-place.

with-status #

(resp status)

Returns a response with the status code updated in-place.

Module /web/app/server #

Opinionated HTTP server launcher reading HOST and PORT from the environment.

(use /web/app/server)

serve #

(server/serve handler options) -> ()

Starts an embedded HTTP server listening on the configured host and port.

(use server /web/app/server)
(server/serve (Func [req] {:status 200 :body "OK"}) {:port 8080})

Module /web/app/handlers #

Composable HTTP request handlers: chain-handlers, route-map, route-fs, handle-html, handle-css, and handle-not-found.

(use /web/app/handlers)

chain-handlers #

(handlers)

Composes an array of handlers, returning the first non-404 response or falling back to 404.

handle-css #

(path rest)

Serves a .css.tan stylesheet with in-memory caching and ?reload / ?nocache cache busting.

handle-html #

(path)

Exported function in /web/app/handlers.

handle-not-found #

(_req)

Default 404 Not Found handler.

route-fs #

(base-path)

Exported function in /web/app/handlers.

route-graph #

(graph)

Exported function in /web/app/handlers.

route-map #

(routes)

Exported function in /web/app/handlers.

Module /web/app/middleware #

Production HTTP middlewares: CSRF, CORS, session, ETag, rate limiting, security headers, bearer/basic auth, and scripts injection.

(use /web/app/middleware)

scripts-accumulator #

Constant (Any)

Constant in /web/app/middleware.

scripts-seen #

Constant (Any)

Constant in /web/app/middleware.

default-scripts-insertion-marker #

Constant (Any)

Constant in /web/app/middleware.

allow-methods-middleware #

(allowed-methods next-handler)

Rejects methods outside allowlist with 405 and Allow header.

basic-auth-middleware #

(args)

Exported function in /web/app/middleware.

bearer-auth-middleware #

(verify-fn next-handler)

Authenticates API requests via Authorization: Bearer <token>. Supports both (bearer-auth-middleware verify-fn next-handler) and curried ((bearer-auth-middleware verify-fn) next-handler) forms.

body-size-limit-middleware #

(max-bytes next-handler)

Limits request payload size and returns 413 when known size exceeds max-bytes.

cors-middleware #

(args)

Exported function in /web/app/middleware.

csrf-middleware #

(args)

Exported function in /web/app/middleware.

etag-middleware #

(inner-handler)

Middleware that generates Weak ETags (W/"<16-hex-hash>") using a-hash (15+ GB/s) for GET/HEAD 200 OK responses. Returns 304 Not Modified with zero body payload when the client If-None-Match header matches.

rate-limit-middleware #

(args)

Bounded in-memory fixed-window rate limiter middleware. Supports (rate-limit-middleware options next-handler), (rate-limit-middleware next-handler), and curried ((rate-limit-middleware options) next-handler).

request-id-middleware #

(next-handler)

Ensures request-id is available in attrs and returned in response headers.

scripts-middleware #

(args)

Exported function in /web/app/middleware.

security-headers-middleware #

(args)

Exported function in /web/app/middleware.

session-middleware #

(store options)

Session middleware factory. Creates middleware that manages sessions via cookies. Parameters: store - Session store instance (from construct-session-store) options - Configuration map: :cookie-name - Cookie name (default: "SESSION-ID") :max-age - Session lifetime in seconds (default: 3600) :secure - Set Secure flag on cookie (default: false) :same-site - SameSite policy: "Strict", "Lax", or "None" (default: "Lax") :path - Cookie path (default: "/") :domain - Cookie domain (default: not set)

static-files-middleware #

(next-handler)

Exported function in /web/app/middleware.

traceparent-middleware #

(next-handler)

Exported function in /web/app/middleware.

tracing-middleware #

(next-handler)

Exported function in /web/app/middleware.

use-script #

(script)

Exported function in /web/app/middleware.

Module /web/app/forms #

HTML form binding, type coercion, CSRF token fields (), and field validation error rendering ().

(use /web/app/forms)

Validation #

Constant (Any)

Constant in /web/app/forms.

ValidationErrors #

Constant (Any)

Constant in /web/app/forms.

is-valid? #

Constant (Any)

Constant in /web/app/forms.

validate #

Constant (Any)

Constant in /web/app/forms.

#

(args)

Exported function in /web/app/forms.

#

(target field)

Exported function in /web/app/forms.

coerce-field-value #

(raw-value type-name constraints)

Exported function in /web/app/forms.

extract-inner-type #

(type-str)

Exported function in /web/app/forms.

get-csrf-token #

(req)

Exported function in /web/app/forms.

is-maybe-type? #

(type-str)

Exported function in /web/app/forms.

read-form #

(req struct-type)

Exported function in /web/app/forms.

respond-form-errors #

(args)

Exported function in /web/app/forms.

validate-form #

(args)

Exported function in /web/app/forms.

Module /web/app/session #

Cookie and server-side session state management.

(use /web/app/session)

construct-session #

(options)

Constructs a new session with optional initial data. Options: :data - Initial session data map (default: {}) :max-age - Session lifetime in seconds (default: 3600)

construct-session-store #

(options)

Constructs a new session store with optional configuration. Options: :cleanup-interval - Interval in seconds for expired session cleanup (default: 300)

delete-session-value #

(session key)

Deletes a value from the session data. Returns the updated session.

get-session #

(req)

Gets the session from request attributes. Returns None if no session is attached.

get-session-value #

(session key)

Gets a value from the session data.

invalidate-session #

(session)

Marks a session as invalidated (expired). The middleware will clear the session cookie and remove from store.

set-session-value #

(session key value)

Sets a value in the session data. Returns the updated session.

store-cleanup #

(store)

Exported function in /web/app/session.

store-delete #

(store session-id)

Deletes a session from the store.

store-get #

(store session-id)

Retrieves a session by ID from the store. Returns None if session not found or expired.

store-put #

(store session)

Stores a session in the store.

valid-session? #

(session)

Checks if a session is valid (not invalidated and not expired).

Module /web/app/graph #

Filesystem-driven application route graph (App-Graph) for breadcrumbs, navigation trails, and static site crawling.

(use /web/app/graph)

App-Graph #

Struct in /web/app/graph

Struct type in /web/app/graph.

Field	Type	Default
spec	Any	—
index	Any	—

App-Node #

Constant (Any)

Constant in /web/app/graph.

construct-app-graph-from-fs #

(params)

Construct an App-Graph from html.tan files and sidecar metadata.

get-trail #

(graph path vars)

Exported function in /web/app/graph.

graph-to-assoc #

(graph)

Exported function in /web/app/graph.

make-app-graph #

(spec)

Construct a graph from a spec tree.

Module /web/app/graph/sitemap #

XML and plain-text sitemap generators and HTTP handlers constructed from an App-Graph.

(use /web/app/graph/sitemap)

construct-sitemap-url-list-handler #

(graph base-url rest)

Construct a handler that serves a sitemap URL list.

construct-sitemap-xml-handler #

(graph base-url rest)

Construct a handler that serves sitemap XML.

graph->sitemap-url-list #

(graph base-url rest)

Render sitemap as a plain-text URL list.

graph->sitemap-urls #

(graph base-url rest)

Collect sitemap URLs from an App-Graph.

graph->sitemap-xml #

(graph base-url rest)

Render sitemap as XML content.

Module /web/app/graph/openapi #

Automatic OpenAPI 3.1 specification generator from /web/app route graphs and Struct schemas.

(use /web/app/graph/openapi)

graph->openapi #

(graph info overrides)

Construct an OpenAPI spec from an App-Graph.

routes->openapi #

(routes info)

Constructs an OpenAPI 3.0.3 specification directly from route arrays and optional Struct metadata.

struct->openapi-schema #

(struct-type)

Converts a Tangu Struct type into an OpenAPI 3.0 JSON Schema map.

Module /web/push #

RFC 8291 Web Push payload encryption and VAPID key generation.

(use /web/push)

encrypt #

(encrypt ...)

Exported function in /web/push.

generate-keys #

(generate-keys ...)

Exported function in /web/push.

Module /websocket/client #

WebSocket client supporting text/binary frames, ping/pong, and clean closure.

(use /websocket/client)

close #

(close handle) -> None

Closes the underlying connection, pool, file descriptor, or stream.

connect #

(connect config) -> Pool

Establishes a connection or connection pool using a URI string or configuration Map.

receive #

(receive ...)

Exported function in /websocket/client.

send #

(send ...)

Exported function in /websocket/client.

Module /repr/html #

SHTML (#shtml / #html) element tree rendering, class merging, and template formatting (format-html).

(use /repr/html)

add-classes #

(add-classes ...)

Exported function in /repr/html.

escape-html #

(escape-html ...)

Exported function in /repr/html.

format-class #

(format-class ...)

Exported function in /repr/html.

format-html #

(format-html ...)

Exported function in /repr/html.

format-html-template #

(format-html-template ...)

Exported function in /repr/html.

merge-attrs #

(merge-attrs ...)

Exported function in /repr/html.

parse-component-params #

(parse-component-params ...)

Exported function in /repr/html.

shtml->html #

(shtml->html ...)

Exported function in /repr/html.

Module /repr/css #

CSS AST formatting and nested selector compilation (format-css, scss->css).

(use /repr/css)

format-css #

(format-css ...)

Exported function in /repr/css.

scss->css #

(scss->css ...)

Exported function in /repr/css.

Module /dialect/css-expr #

S-expression CSS dialect compiler lowering #css trees into standard CSS stylesheets.

(use /dialect/css-expr)

to-css #

(to-css ...)

Exported function in /dialect/css-expr.

Module /cli #

Declarative command-line argument parser supporting subcommands, flags, options, and automatic help generation.

(use /cli)

action #

(args)

Declarative route DSL constructors

cmd #

(args)

Exported function in /cli.

echo-help #

(router-arg target-path)

Prints help information for available CLI commands.

format-help #

(router-arg target-path)

Formats help information for available CLI commands as a string.

mount #

(args)

Exported function in /cli.

query #

(args)

Executes a SELECT query (routed to read replicas when configured) and returns an Array of row Maps.

router #

(route-defs)

Constructs a CLI Router with grouped queries and actions.

run #

(cli-router args)

Resolves and executes CLI router.

scope #

(args)

Exported function in /cli.

Module /ansi #

ANSI terminal escape sequences for styling text with foreground/background colors, bold, dim, italic, and underline.

(use /ansi)

blue #

(s)

Exported function in /ansi.

bold #

(s)

Exported function in /ansi.

green #

(s)

Exported function in /ansi.

italic #

(s)

Exported function in /ansi.

red #

(s)

example: (echo "hello " (a/red "George") ", how do you feel?")

reset #

(...)

Exported function in /ansi.

yellow #

(s)

Exported function in /ansi.

Module /color #

Color space conversion, hex parsing, WCAG contrast ratios, and tonal transformations (lighten, darken, saturate, mix).

(use /color)

HSL #

Struct in /color

Cylindrical HSL color space:

• h: hue angle in degrees (0.0..360.0)
• s: saturation (0.0..1.0)
• l: lightness (0.0..1.0)
• a: alpha (0.0..1.0, default 1.0)

Field	Type	Default
h	Float	—
s	Float	—
l	Float	—
field_7	Any	—

Oklch #

Struct in /color

Perceptual Oklch color space:

• l: perceived lightness (0.0..1.0)
• c: chroma (0.0..~0.4)
• h: hue angle in degrees (0.0..360.0)
• a: alpha (0.0..1.0, default 1.0)

Field	Type	Default
l	Float	—
c	Float	—
h	Float	—
field_7	Any	—

RGB #

Struct in /color

3-channel linear or sRGB color (0.0..1.0). Derives Eq and Vec for full Euclidean vector arithmetic (+, -, *, /, cmul, lerp, dot).

Field	Type	Default
r	Float	—
g	Float	—
b	Float	—

RGBA #

Struct in /color

4-channel sRGB color with alpha (0.0..1.0, default alpha 1.0).

Field	Type	Default
r	Float	—
g	Float	—
b	Float	—
field_7	Any	—

contrast-ratio #

(contrast-ratio ...)

Exported function in /color.

darken #

(darken ...)

Exported function in /color.

desaturate #

(desaturate ...)

Exported function in /color.

invert #

(invert ...)

Exported function in /color.

lighten #

(lighten ...)

Exported function in /color.

linear-to-srgb #

(linear-to-srgb ...)

Exported function in /color.

luminance #

(luminance ...)

Exported function in /color.

mix #

(mix ...)

Exported function in /color.

parse #

(parse ...)

Exported function in /color.

rotate-hue #

(rotate-hue ...)

Exported function in /color.

saturate #

(saturate ...)

Exported function in /color.

srgb-to-linear #

(srgb-to-linear ...)

Exported function in /color.

to-css #

(to-css ...)

Exported function in /color.

to-hex #

(to-hex ...)

Exported function in /color.

to-hsl #

(to-hsl ...)

Exported function in /color.

to-int #

(to-int ...)

Exported function in /color.

to-oklch #

(to-oklch ...)

Exported function in /color.

to-rgb #

(to-rgb ...)

Exported function in /color.

to-rgba #

(to-rgba ...)

Exported function in /color.

to-u8 #

(to-u8 ...)

Exported function in /color.

with-alpha #

(with-alpha ...)

Exported function in /color.