Zornux docs
Get started Spec

Reference

Keywords

These words are reserved — they can't be used as names. Keywords are lowercase and case-sensitive (HTTP methods are uppercase by convention).

Declarations & bindings

KeywordRole
createDeclare a variable, or instantiate from a class
asBinds a value in create … as …
fromcreate x from Class — instantiation
functionDeclare a function
withIntroduce parameters, a request body, or a message
give backReturn a value from a function

Control flow

KeywordRole
ifConditional
elseelse / else-if (else if …)
repeat … timesCounted loop
whileConditional loop
for each … inCollection iteration
endUniversal block terminator

Operators (word form)

KeywordRole
isEquality / comparison lead-in
notNegation; is not, is not equal to
less / greater / thanis less than, is greater than [or equal to]
equal / tois equal to, … or equal to
and / orLogical conjunction / disjunction
moduloRemainder operator

I/O & collections

KeywordRole
showPrint to standard output
add … toAppend to a list

Classes (OOP)

KeywordRole
classDeclare a class
hasDeclare a field
publicA member reachable from anywhere (the default)
protectedA member visible to the class and its subclasses
privateA member visible only to its declaring class
extendsInheritance

Web services

KeywordRole
controller … atDeclare a stateless HTTP route group (controller Products at "/products")
webCompose controllers, own pipeline/health/lifecycle (web ProductApi … use Products … end)
serviceBusiness-logic component with methods, state, and dependency injection
onRoute declaration (on GET "/")
publish … on portStart a web block
statusgive back status N
message… with message …
ok / created / accepted / no contentSuccess response shorthands (give back ok data)
GET / POST / PUT / PATCH / DELETEHTTP methods

Security

KeywordRole
restrict toAuthorization guard
otherwiseThe fallback branch of a guard — restrict … otherwise, require … otherwise, protect … otherwise error
secureAttach an auth provider
usingsecure … using Passkey

Concurrency

KeywordRole
start taskStart a function in the background (start task X)
wait forWait for a started function to finish
cancelCancel a function that hasn't run yet
send … toSend a message to a channel
receive fromReceive a message from a channel
after … secondsRun a block once after a delay (after 5 seconds … end)
every … seconds, N timesRun a block on an interval, N times
… up to N secondsBound a send / receive with a timeout

Error recovery

KeywordRole
tryBegin a recoverable block (try … catch … end)
catchIntroduce a recovery block; catch error binds the caught error
catch Kind as errorA filtered clause matching one error kind (first match wins)
finallyA block that always runs, on success or failure
throwRaise an error of your own

Async execution

KeywordRole
async functionDeclare an awaitable function; calling it returns a handle
wait forAwait a handle and yield its give-back value (an expression)

Enterprise application layer

KeywordRole
record … endDeclare a DTO with validation rules (record CreateUserRequest … end)
validate xValidate a record — a fail-fast statement or a result-yielding expression
repository … endA data-access component with async, injectable methods
service … use … function …Business logic with injected dependencies and callable methods
application … use … endThe dependency-injection composition root
use Name [as singleton|scoped|transient]Inject a dependency / register a component

Configuration, secrets & environment

KeywordRole
configuration … endDeclare a typed settings schema (configuration AppConfig … end)
has … as … [is …]A setting: name, type (text/whole/number/truth/list/map/secret), optional default
secretA setting type whose value is redacted everywhere but reveal(...)
revealThe one explicit, auditable way to read a secret's value
use AppConfigInject the loaded configuration into a service or application

Middleware & request pipeline

KeywordRole
pipeline … endA service's ordered request pipeline, composed around every route
step … with request … endDeclare a reusable custom step; run it with use Name
next(request)Continue to the rest of the pipeline (an injected value, not a keyword)
catch errorsA failing route answers 500 instead of crashing
allow origins "…" / allow any originCORS: set Access-Control-Allow-Origin
add correlation idReuse or generate an X-Correlation-Id per request
limit N requests per second|minute|hourFixed-window rate limit — 429 when exceeded
limit request size to N kilobytesReject an over-large body with 413
log requestsA structured record per request to the host's injected sink
compress responsesMark gzip when the client accepts it (transport encodes)

Advanced authorization

KeywordRole
policy … endDeclare an authorization policy (a named set of requirements)
require authenticationThe principal must be signed in
require role "…" or "…"The principal holds one of the roles (permissions likewise)
require claim "name" is "value"A claim on the principal matches
require policy OtherCompose another (parameterless) policy — its whole decision must grant
with orderDeclare a policy's resources; the guard passes them the same way
check … endCustom decision code — user is the principal; fails closed
restrict to policy Name otherwise …Enforce a policy with the existing authorization guard
claim("name")Built-in that reads the current principal's claim (or nothing)

Background processing

KeywordRole
job Name [in queue "…"] … endDeclare a background job (queued, never called; a failing run is contained)
with a, bJob parameters, bound from the queue statement's arguments
retry 3 times [waiting 30 seconds]Re-run a failing job; the final failure is a dead-letter log event
queue Name [with args]Enqueue one run — it executes when the script ends or before the response returns
queue Name after 5 minutesDefer the run on the deterministic timeline (seconds / minutes / hours)
schedule Name every 15 minutesRecurring runs — also every day at "03:00" and every monday at "09:00"
jobs_pending() / jobs_failed() / queue_pending("…")Built-ins that read the queue state (failed = the dead-letter count)
job_workersHost setting: 0 turns serve's background pumping off; 1+ pumps between requests

Messaging & event bus

KeywordRole
event Name … endDeclare a message contract (event UserRegistered … has field … end)
handler Name for Event [with e] … endSubscribe to an event; a failing delivery is contained
retry N times [waiting M seconds]A handler's delivery-retry / dead-letter policy (same as a job)
use NameInject a service / repository / configuration into a handler
publish Event [with field value, …]Raise an event — fans out to every subscriber onto the background queue
events_published() / handlers_pending() / events_failed()Built-ins that read the bus (failed = dead-letters)

Enterprise hardening

KeywordRole
require value [otherwise "msg"]Fail-fast precondition — fails when the value is false or nothing (ZX3300)
on startup … end / on shutdown … endService lifecycle hooks — startup runs before serving (fail-fast), shutdown on stop
ready … endReadiness probe — registers GET /ready (ok / failing verdicts, like health)
resilience Name … endA named policy: timeout N seconds, retry N times [waiting M], break after N failures for M seconds
protect with Name … [otherwise [error]] … endRun a block under a resilience policy (retry / timeout / circuit breaker)
uptime_seconds() / memory_used()Production diagnostics built-ins

Logging & observability

KeywordRole
log debug|info|warning|error msg [with { … }]Emit a structured log event (destinations come from configuration)
count "name"Add one to a named counter
measure "name" as valueRecord a numeric measurement
audit "event" [with { … }]An always-recorded business event carrying the acting principal
health … endA service's health check, auto-registered as GET /health (200/503)
give back ok / failing "reason"The health verdict (recognized only inside a health block)
metric_count / metric_valuesBuilt-ins that read the metric registry back

Data layer (ORM)

KeywordRole
database … endDeclare a database (provider, connection, table … from Class)
table … fromMap a class to a table
save … intoInsert or update an item
find all fromQuery every row as a list
find one from … where … is …Query the first matching item, or nothing
where … is greater than / contains / and / orRich conditions — reuse the comparison words plus text operators
sorted by field [descending] [then by …]Order results (stable sort, multiple keys)
skip N / first NPagination — offset and limit on find all
find count / find any fromHow many rows match (number) / whether any match (truth)
sum / average / minimum / maximum of field fromNumeric aggregates over the matching rows
delete … fromRemove an item
transaction on … catch error … endCommit on success, roll back on a recoverable error

Schema migrations

KeywordRole
migration Name … endAn ordered, recorded schema change (create table / add / remove / rename field)
create table T from ClassA migration step: create the table from a class
add field f to T / remove field f from TA migration step: add or drop a column
rename field a to b in TA migration step: rename a column, keeping its data
migrate DBApply pending migrations, then the automatic additive diff (in one transaction)
rollback DBReverse the most recently applied migration (a remove is irreversible)
migrate on openA database line: auto-apply pending migrations as it opens

Native deployment & hosting

KeywordRole
deployment Name … endDescribe how a finished app ships (host-neutral)
serves ServiceNameThe service this deployment runs
target linux | windowsThe host platform (default linux)
reverse proxy nginx | caddy | noneThe proxy in front of the app (default none)
domain "…" / port NThe public domain and the port the app listens on

Modules & visibility

KeywordRole
moduleName a file's module (module Products)
importBring in another module (import Math)
showingImport specific symbols (import Math showing square)
publicExport a declaration from its module
privateKeep a declaration inside its module (also a field modifier)

Testing

KeywordRole
testDeclare a test (test "adds numbers")
expectStart an assertion
toexpect … to … (matcher lead-in)
equalexpect … to equal expected
beexpect … to be true / false / nothing
containexpect list or text to contain an item
throwexpect an expression to throw

Literals

KeywordRole
true / falseBoolean values
nothingAbsence of a value (null)