fs.readFileSync(path, encoding?)

(string, string?) → string — UTF-8 text; throws a catchable Error naming the path if the file can't be read.

try {
  const data: string = fs.readFileSync("notes.txt");
  console.log(data);
} catch (e) {
  console.log(e.message); // cannot read 'notes.txt': FileNotFound
}

fs.readFile(path) Experimental Native only

string → Promise<string> — true non-blocking I/O, no thread pool, unlike Node's fs.promises.readFile.

async function main(): Promise<void> {
  const data: string = await fs.readFile("notes.txt");
  console.log(data);
}

fs.writeFile(path, data) Experimental Native only

(string, string) → Promise<void> — the async counterpart to fs.writeFileSync; creates the file or truncates it first, same as the sync version.

async function main(): Promise<void> {
  await fs.writeFile("notes.txt", "hello async world");
  console.log("done");
}

fs.appendFile(path, data) Experimental Native only

(string, string) → Promise<void> — the async counterpart to fs.appendFileSync; creates the file if it does not exist yet.

async function main(): Promise<void> {
  await fs.appendFile("log.txt", "line one\n");
  await fs.appendFile("log.txt", "line two\n");
  console.log("done");
}

fs.unlink(path) Experimental Native only

string → Promise<void> — runs on a real thread pool, unlike readFile/writeFile/appendFile above, so it never blocks the main thread — the same approach Node's own async fs uses. Genuinely cross-platform, not a Linux-only shortcut.

async function main(): Promise<void> {
  await fs.unlink("stale.txt");
  console.log("gone");
}

fs.mkdir(path) Experimental Native only

string → Promise<void> — thread-pool backed, see fs.unlink above. No recursive option this pass, matching mkdirSync's default-false convention.

async function main(): Promise<void> {
  await fs.mkdir("build");
}

fs.rmdir(path) Experimental Native only

string → Promise<void> — thread-pool backed, see fs.unlink above.

async function main(): Promise<void> {
  await fs.rmdir("build");
}

fs.stat(path) Experimental Native only

string → Promise<Stats> — thread-pool backed, see fs.unlink above. Same Stats shape as fs.statSync.

async function main(): Promise<void> {
  const st = await fs.stat("notes.txt");
  console.log(st.size);
}

fs.writeFileSync(path, data)

(string, string) → void — creates the file or truncates it first; throws a catchable Error on an I/O failure.

fs.writeFileSync("notes.txt", "hello world");

fs.appendFileSync(path, data)

(string, string) → void — creates the file if it does not exist yet.

fs.appendFileSync("log.txt", "new line\n");

fs.existsSync(path)

string → bool

if (fs.existsSync("config.json")) {
  console.log("found it");
}

fs.mkdirSync(path, recursive?)

(string, bool?) → void — recursive defaults to false.

fs.mkdirSync("build/output", true);

fs.unlinkSync(path)

string → void — delete a file.

fs.unlinkSync("scratch.tmp");

fs.renameSync(oldPath, newPath)

(string, string) → void

fs.renameSync("draft.md", "final.md");

fs.copyFileSync(src, dest)

(string, string) → void

fs.copyFileSync("template.txt", "output.txt");

fs.rmdirSync(path)

string → void — removes an empty directory.

fs.rmdirSync("empty-dir");

fs.rmSync(path, recursive?)

(string, bool?) → void — recursive removes a whole directory tree.

fs.rmSync("build", true);

fs.truncateSync(path, len)

(string, int) → void

fs.truncateSync("log.txt", 0);

fs.linkSync(existingPath, newPath)

(string, string) → void — hard link.

fs.linkSync("original.txt", "alias.txt");

fs.symlinkSync(target, path)

(string, string) → void

fs.symlinkSync("/etc/hosts", "hosts-link");

fs.readlinkSync(path)

string → string

console.log(fs.readlinkSync("hosts-link"));  // /etc/hosts

fs.chmodSync(path, mode)

(string, int) → void — POSIX mode bits.

fs.chmodSync("script.sh", 0o755);  // rwxr-xr-x

fs.accessSync(path, mode?)

(string, int?) → bool — mode bitmask R_OK=4 W_OK=2 X_OK=1; returns bool rather than throwing.

console.log(fs.accessSync("data.csv", 4));  // readable?

fs.cpSync(src, dest, recursive?)

(string, string, bool?) → void — falls back to a single file copy when src is not a directory.

fs.cpSync("assets", "dist/assets", true);

fs.mkdtempSync(prefix)

string → string — unique suffix from a timestamp + counter, not cryptographic; returns the created path.

const dir: string = fs.mkdtempSync("/tmp/build-");
console.log(dir);  // /tmp/build-1a2b3c4d

fs.statSync(path)

string → { size, isFile, isDirectory, mtimeMs } — the first record-returning builtin; isFile/isDirectory are bool fields, not methods.

const info = fs.statSync("report.pdf");
console.log(info.size);
console.log(info.isFile);

fs.openSync(path, flags)

(string, string) → int — a Lumen "fd" is an index into an internal file table, not a raw OS handle. flags is "r" (read, must exist), "w" (write, create/truncate), or "a" (append, create if missing, existing content kept, every writeSync lands at the current end of file — verified across separate open/close cycles, each reopen correctly re-seeks to wherever the file ends at that point, not just where it ended at the first open).

const fd: int = fs.openSync("data.bin", "r");
const logFd: int = fs.openSync("app.log", "a");
fs.writeSync(logFd, "another line\n");
fs.closeSync(logFd);

fs.closeSync(fd)

int → void

fs.closeSync(fd);

fs.readSync(fd, length)

(int, int) → string — reads up to length bytes from the current file position; works on string, not a Buffer (Lumen has none yet).

const fd: int = fs.openSync("data.bin", "r");
const chunk: string = fs.readSync(fd, 1024);
fs.closeSync(fd);

fs.writeSync(fd, data)

(int, string) → int — writes at the current file position, returns bytes written.

const fd: int = fs.openSync("out.bin", "w");
const n: int = fs.writeSync(fd, "hello");
fs.closeSync(fd);

fs.lstatSync(path) Experimental

string → { size, isFile, isDirectory, mtimeMs } — like statSync, but does not follow a symlink at path; stats the link itself.

const info = fs.lstatSync("hosts-link");
console.log(info.isFile);  // false: the link itself isn't a regular file

fs.fstatSync(fd) Experimental

int → { size, isFile, isDirectory, mtimeMs } — stats an already-open fd instead of resolving a path again.

const fd: int = fs.openSync("data.bin", "r");
console.log(fs.fstatSync(fd).size);
fs.closeSync(fd);

fs.fchmodSync(fd, mode) Experimental

(int, int) → void — fd-based form of chmodSync.

const fd: int = fs.openSync("script.sh", "w");
fs.fchmodSync(fd, 0o755);
fs.closeSync(fd);

fs.lchmodSync(path, mode) Experimental

(string, int) → void — chmod without following a symlink at path; best effort (not every OS lets you chmod a symlink directly).

fs.lchmodSync("hosts-link", 0o644);

fs.fchownSync(fd, uid, gid) Experimental

(int, int, int) → void — pass -1 for either id to leave it unchanged.

const fd: int = fs.openSync("data.bin", "w");
fs.fchownSync(fd, 1000, -1);  // change owner, leave group alone
fs.closeSync(fd);

fs.chownSync(path, uid, gid) Experimental

(string, int, int) → void — pass -1 for either id to leave it unchanged. Follows symlinks (see fs.lchownSync below for the one that shouldn't). Implemented by opening the file and reusing fchownSync's working fd-based path, since the path-based owner-change call panics unconditionally in this Zig version's runtime.

fs.chownSync("data.bin", 1000, 1000);

fs.lchownSync(path, uid, gid) Experimental

(string, int, int) → void — like chownSync but changes the symlink itself, not what it points to. Linux only (raw lchown, no libc) — unlike chownSync, this can't be built by opening the file first, since opening a symlink path normally follows it.

fs.symlinkSync("/data/real.bin", "link.bin");
fs.lchownSync("link.bin", 1000, 1000);

fs.realpathSync(path) Experimental

string → string — resolves symlinks and returns the canonical path. Returns path unchanged if it doesn't exist or can't be resolved.

console.log(fs.realpathSync("./current-link"));

fs.writevSync(fd, buffers) Experimental

(int, string[]) → int — writes every chunk in buffers in a single syscall, returns the total bytes written. Linux only (raw writev, no libc).

const fd: int = fs.openSync("out.bin", "w");
const n: int = fs.writevSync(fd, ["hello ", "world"]);
fs.closeSync(fd);

fs.readvSync(fd, sizes) Experimental

(int, int[]) → string[] — reads into sizes.length chunks in a single syscall, returning that many strings sized to what was actually read. Deviation from Node: Node's readv fills caller-provided mutable buffers; Lumen's string is immutable, so this takes desired chunk sizes instead and owns the buffers itself — same underlying vectored read, a shape that fits the type system. Linux only (raw readv, no libc).

const fd: int = fs.openSync("data.bin", "r");
const chunks: string[] = fs.readvSync(fd, [4, 100]);  // header, then the rest
fs.closeSync(fd);

fs.fsyncSync(fd) Experimental

int → void — flush file data and metadata to disk.

fs.fsyncSync(fd);

fs.fdatasyncSync(fd) Experimental

int → void — aliases fsyncSync (no data-only sync separate from a full sync is exposed here).

fs.fdatasyncSync(fd);

fs.ftruncateSync(fd, len) Experimental

(int, int) → void — fd-based form of truncateSync.

const fd: int = fs.openSync("log.txt", "w");
fs.ftruncateSync(fd, 0);
fs.closeSync(fd);

fs.futimesSync(fd, atimeMs, mtimeMs) Experimental

(int, int, int) → void — set access/modify times (milliseconds since epoch) on an open fd.

fs.futimesSync(fd, 1700000000000, 1700000000000);

fs.utimesSync(path, atimeMs, mtimeMs) Experimental

(string, int, int) → void — path-based form, follows symlinks.

fs.utimesSync("notes.txt", 1700000000000, 1700000000000);

fs.lutimesSync(path, atimeMs, mtimeMs) Experimental

(string, int, int) → void — like utimesSync, but sets the timestamps on a symlink itself rather than its target.

fs.lutimesSync("hosts-link", 1700000000000, 1700000000000);

fs.readdirSync(path) Experimental

string → string[] — entry names in a directory, in no particular order.

const names: string[] = fs.readdirSync(".");
for (const n of names) {
  console.log(n);
}

fs.watch(path, listener) Experimental Wasm: limited

(string, (string, string) → void) → void — blocking, never returns; calls listener with the name of the file that changed and an event type ("change" for a data modification, "rename" for a create/delete/move — matching Node's own fs.watch convention, not inotify's full granularity) on every event under path. Linux only (raw inotify, no libc). Not EventEmitter-based like Node's real FSWatcher — nothing drives an emitter asynchronously on its own here, so this calls the listener directly in a blocking loop instead, the same shape as http.createServer.

function onChange(name: string, eventType: string): void {
  console.log(name + " " + eventType);
}

fs.watch("./src", onChange);

fs.createReadStream(path) Experimental

string → ReadableStream — built the same way Map/Set/EventEmitter are, a real dedicated type. .read() returns the next chunk (up to 64KB), an empty string at EOF; .close() closes the file. A missing/unopenable file degrades to a stream that always reads "" rather than crashing, the same fallback shape every other fs function already uses. Synchronous/blocking, no async or backpressure integration yet.

const r = fs.createReadStream("large.log");
let chunk: string = r.read();
while (chunk != "") {
  console.log(chunk.length);
  chunk = r.read();
}
r.close();

fs.createWriteStream(path) Experimental

string → WritableStream — .write(chunk) appends a chunk to the file (opens/ truncates on creation); .close() flushes and closes.

const w = fs.createWriteStream("out.log");
w.write("line one\n");
w.write("line two\n");
w.close();

path.basename(path, suffix?)

(string, string?) → string — the last path segment, with suffix stripped if present.

console.log(path.basename("/foo/bar/baz.html"));        // baz.html
console.log(path.basename("/foo/bar/baz.html", ".html")); // baz

path.dirname(path)

string → string — returns "." for a path with no directory segment.

console.log(path.dirname("/foo/bar/baz.html")); // /foo/bar

path.extname(path)

string → string — "" for dotfiles like .gitignore.

console.log(path.extname("index.html")); // .html

path.isAbsolute(path)

string → bool

console.log(path.isAbsolute("/foo/bar")); // true

path.normalize(path)

string → string — collapses ./.. segments; does not require the path to exist.

console.log(path.normalize("/foo/bar//baz/asdf/quux/..")); // /foo/bar/baz/asdf

path.join(...paths)

(string, string, ...) → string — 2 to 6 arguments; joins then normalizes, matching Node's join definition.

console.log(path.join("/foo", "bar", "baz/asdf", "quux", "..")); // /foo/bar/baz/asdf

path.resolve(...paths)

(string, string, ...) → string — 1 to 6 arguments; "cd"-chains left to right, an absolute segment resets the result. If no argument is absolute, anchors to the real working directory to guarantee an absolute result, matching Node. The only path.* function that reads the real cwd — every other one stays pure string manipulation.

console.log(path.resolve("/foo/bar", "./baz")); // /foo/bar/baz
console.log(path.resolve("foo", "bar"));        // /foo/bar

path.parse(path)

string → { root, dir, base, name, ext } — the second record-returning builtin after fs.statSync.

const p = path.parse("/home/user/dir/file.txt");
console.log(p.dir);   // /home/user/dir
console.log(p.name);  // file

path.format(parts)

{ root, dir, base, name, ext } → string — the inverse of parse. Deviation from Node: all five fields are required (Node allows omitting any of them); round-tripping path.format(path.parse(p)) works perfectly, building a literal by hand needs every field filled in.

console.log(path.format(path.parse("/home/user/dir/file.txt")));
// /home/user/dir/file.txt

path.sep()

→ string — always "/" (Lumen is POSIX-only). Called as a function, not read as a property (see above).

console.log(path.sep()); // /

path.delimiter()

→ string — always ":".

console.log(path.delimiter()); // :

process.cwd()

→ string — the real current working directory.

console.log(process.cwd());

process.chdir(directory)

string → void

process.chdir("/tmp");
console.log(process.cwd());

process.exit(code)

int → void — terminates immediately; nothing after the call runs. Truncates to a byte-sized exit code, matching the OS.

console.log("before");
process.exit(42);
console.log("never runs");

process.env(key)

string → string | null — called as a function rather than indexed as a property (process.env.FOO in Node), since Lumen has no dynamic-object indexing.

const home = process.env("HOME");
if (home != null) {
  console.log(home);
}

process.platform()

→ string — "linux", "darwin", "win32", ...

console.log(process.platform()); // linux

process.arch()

→ string — "x64", "arm64", ...

console.log(process.arch()); // x64

process.pid() Wasm: limited

→ int

console.log(process.pid() > 0); // true

process.argv()

→ string[] — deviation from Node: follows C/POSIX argv convention (index 0 is the invoked binary itself), not Node's node-then-script convention where a user's first real argument is argv[2].

const argv: string[] = process.argv();
for (const a of argv) {
  console.log(a);
}

argsCount() · arg(i)

→ int · int → string — unnamespaced, pre-dates process.argv(); reads the same underlying argument data.

console.log(argsCount());
console.log(arg(0));

process.uptime()

→ number — fractional seconds since this process started. A start timestamp is recorded once at program startup (the same monotonic clock time.monotonic() uses); each call subtracts.

console.log(process.uptime() >= 0.0);

process.hrtime()

→ i64 — monotonic nanoseconds. Deviation from Node: a single scalar, not Node's [seconds, nanoseconds] tuple — Lumen's i64 is a real 64-bit integer (unlike a JS double), so there's no precision problem to work around by splitting it, the same reasoning Node's own newer hrtime.bigint() uses. Diff two readings for an elapsed duration.

const start: i64 = process.hrtime();
const end: i64 = process.hrtime();
console.log(end > start);

process.memoryUsage()

→ { rss: i64, vsize: i64 } (bytes) — parsed from /proc/self/status. Deviation from Node: only rss/vsize, not Node's full heapTotal/heapUsed/external/ arrayBuffers shape — those describe V8's garbage-collected heap, which has no Lumen-side equivalent.

const mem = process.memoryUsage();
console.log(mem.rss);
console.log(mem.vsize);

process.kill(pid, signal)

(int, string) → bool — sends a signal to another process. signal is a name ("SIGTERM" or "TERM", either works); an unrecognized name resolves to POSIX's signal 0 (existence/permission check only, never destructive) rather than guessing. Returns whether the syscall succeeded.

const ok: bool = process.kill(childPid, "SIGTERM");
console.log(ok);

process.umask() · process.setUmask(mask)

→ int · int → int — two names instead of one arity-overloaded call (Node's process.umask([mask]) dispatches on argument count; Lumen's checker has no call-site overloading, the same reason cwd()/chdir() are two names). setUmask returns the previous mask, matching what the real umask() syscall itself returns.

const old: int = process.umask();
console.log(old);

process.getuid() · getgid() · geteuid() · getegid() Wasm: limited

→ int — POSIX-only, raw syscalls, the same shape as pid().

console.log(process.getuid());
console.log(process.getgid());

process.abort()

→ void — abnormal termination via SIGABRT. Nothing after the call runs.

console.log("before");
process.abort();
console.log("never runs");

process.version()

→ string — not Node's version. Lumen's own version marker, matching the repository's latest release tag. Bumped by hand alongside future tags.

console.log(process.version());

process.stdin() Experimental

→ ReadableStream — each call allocates a fresh wrapper around the same real stdin file descriptor (no shared/ cached instance). .read() (64KB chunks) works exactly as it does on any other ReadableStream; see ReadableStream.readLine() below for line-oriented reading.

const input = process.stdin();
const chunk: string = input.read();
console.log(chunk);

process.stdout() Experimental

→ WritableStream — .write(chunk) flushes immediately, every call, so it interleaves correctly with console.log. Closing it (.close()) closes the real stdout fd — usually not something a program needs to do before it exits.

console.log("before");
process.stdout().write("interleaved\n");
console.log("after");

process.stderr() Experimental

→ WritableStream — same shape as process.stdout(), wired to fd 2 instead of fd 1.

process.stderr().write("warning: low disk space\n");

ReadableStream.readLine() Experimental

→ string — available on any ReadableStream (process.stdin() or fs.createReadStream(...) alike). Returns the next line with its trailing \n/\r\n kept, not stripped — deliberate: stripping it would make a genuinely blank line indistinguishable from real end-of-stream (both would be ""), silently truncating a while (line != "") read loop on ordinary blank input lines. "" means true EOF only; call .trim() for a stripped line. A final line with no trailing newline (a piped input cut off mid-line) is still returned intact, not dropped.

const input = process.stdin();
while (true) {
  const raw: string = input.readLine();
  if (raw == "") {
    break;
  }
  console.log(raw.trim());
}

readline.question(prompt) Experimental

string → string — writes prompt to process.stdout(), then blocks reading one line from process.stdin(). Deviation from ReadableStream.readLine(): the trailing \n/\r\n is stripped before returning, matching Node's own question() callback value — readLine() keeps it for its own blank-line-vs-EOF safety, which question() doesn't need. Every call shares one underlying stdin reader internally, so consecutive calls see consecutive lines rather than each silently discarding the next line's already-buffered bytes. Returns "" at true end-of-stream (piped input exhausted).

const name = readline.question("Name: ");
console.log("Hi " + name);

os.platform()

→ string — same as process.platform().

console.log(os.platform()); // linux

os.arch()

→ string — same as process.arch().

console.log(os.arch()); // x64

os.type() Wasm: limited

→ string — the kernel name, via uname(2).

console.log(os.type()); // Linux

os.release() Wasm: limited

→ string — the kernel release string.

console.log(os.release());

os.version() Wasm: limited

→ string

console.log(os.version());

os.machine() Wasm: limited

→ string

console.log(os.machine()); // x86_64

os.hostname() Wasm: limited

→ string

console.log(os.hostname());

os.endianness()

→ string — "LE" or "BE".

console.log(os.endianness()); // LE

os.tmpdir()

→ string — checks TMPDIR, TMP, TEMP, falls back to "/tmp".

console.log(os.tmpdir());

os.homedir()

→ string — the HOME environment variable. Deviation from Node: Node falls back to a passwd-database lookup when HOME is unset; Lumen returns "" instead, rather than introduce the compiler's first libc dependency for one rarely-hit fallback path.

console.log(os.homedir());

os.uptime() Wasm: limited

→ int — system uptime in seconds.

console.log(os.uptime() > 0); // true

os.totalmem() Experimental Wasm: limited

→ int — total system memory in bytes. Deviation from Node: truncates to a 32-bit int (the same tradeoff as fs.statSync's size field); on a host with more than ~2GB of RAM the value can come out negative.

console.log(os.totalmem() != 0);

os.freemem() Experimental Wasm: limited

→ int — same 32-bit truncation caveat as totalmem().

console.log(os.freemem() != 0);

os.loadavg() Wasm: limited

→ number[] — 1, 5, and 15 minute load averages, always exactly 3 elements.

const loads: number[] = os.loadavg();
console.log(loads[0]);

os.availableParallelism()

→ int

console.log(os.availableParallelism() > 0); // true

os.EOL()

→ string — always "\n" (Lumen is POSIX-only).

console.log(os.EOL() == "\n"); // true

os.devNull()

→ string — always "/dev/null".

console.log(os.devNull());

crypto.randomBytes(n)

int → string — n random bytes, hex-encoded (a 2n-character string). Kept as-is (not changed to return Buffer) now that Buffer exists — see randomBytesBuffer below for the raw-bytes form.

const token: string = crypto.randomBytes(16);
console.log(token.length); // 32

crypto.randomUUID()

→ string — a v4 UUID (xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx).

console.log(crypto.randomUUID());

crypto.sha256(data)

string → string — hex digest of the SHA-256 hash of data's bytes.

console.log(crypto.sha256("hello"));
// 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

crypto.randomBytesBuffer(n) Experimental

int → Buffer — the same entropy source as randomBytes, without the hex encoding. Additive, not a replacement: randomBytes keeps returning a hex string, since that's an already-shipped contract other code relies on.

const raw = crypto.randomBytesBuffer(16);
console.log(raw.length); // 16

crypto.hmacSync(key, data) Experimental

(Buffer, Buffer) → Buffer — HMAC-SHA256, a 32-byte MAC. One fixed algorithm, no name parameter — the same "one well-chosen option" shape as sha256 itself.

const key = Buffer.from("key");
const data = Buffer.from("The quick brown fox jumps over the lazy dog");
console.log(crypto.hmacSync(key, data).toString("hex"));
// f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8

crypto.encryptSync(key, iv, data) Experimental

(Buffer, Buffer, Buffer) → Buffer — AES-256-GCM authenticated encryption. key must be exactly 32 bytes and iv exactly 12 bytes (GCM's standard nonce length); either wrong-length input returns an empty Buffer rather than crashing. The result is ciphertext followed by a 16-byte authentication tag, concatenated into one Buffer — the simplest single-value shape, since decryptSync re-splits it internally.

const key = Buffer.alloc(32);  // in real use, crypto.randomBytesBuffer(32)
const iv = Buffer.alloc(12);   // in real use, a fresh nonce per message
const ct = crypto.encryptSync(key, iv, Buffer.from("attack at dawn"));
console.log(ct.length); // 30 -- 14-byte message + 16-byte tag

crypto.decryptSync(key, iv, data) Experimental

(Buffer, Buffer, Buffer) → Buffer — inverse of encryptSync. Deviation from Node: on a wrong-length key/iv, a too-short data, or a failed authentication check (tampered ciphertext or tag), returns an empty Buffer rather than throwing — the same fallback-don't-crash shape every other fallible builtin here uses.

const key = Buffer.alloc(32);
const iv = Buffer.alloc(12);
const ct = crypto.encryptSync(key, iv, Buffer.from("attack at dawn"));
const pt = crypto.decryptSync(key, iv, ct);
console.log(pt.toString("utf8")); // attack at dawn

const tampered = Buffer.alloc(ct.length);
console.log(crypto.decryptSync(key, iv, tampered).length); // 0 -- auth failed

crypto.createHash(algorithm) Experimental

string → Hash — a stateful hash builder. algorithm is a runtime string, matching Node's own real createHash('sha256') API: "md5" | "sha1" | "sha256" | "sha512"; an unrecognized name falls back to "sha256" rather than throwing (the same "fallback, don't crash" shape as Buffer.from(s, encoding)'s unrecognized encoding). Hash.update(data) (Buffer → Hash) feeds bytes in, any number of times, and returns self for chaining; Hash.digest() (() → Buffer) finalizes once. Deviation from Node: digest() returns a raw Buffer, not a string with an encoding argument — call .toString("hex")/ .toString("base64") on the result, which composes with every other Buffer-returning API here instead of reimplementing encoding a second time.

const h = crypto.createHash("sha256");
h.update(Buffer.from("ab"));
h.update(Buffer.from("c"));
console.log(h.digest().toString("hex"));
// ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad -- same as sha256("abc")

crypto.createHmac(algorithm, key) Experimental

(string, Buffer) → Hmac — the streaming, algorithm-selectable counterpart to hmacSync (which stays fixed at HMAC-SHA256). Same four algorithms and unrecognized-name fallback as createHash. Hmac.update(data)/Hmac.digest() have the identical shape and the same Buffer-return design as Hash's.

const key = Buffer.from("key");
const mac = crypto.createHmac("sha256", key);
mac.update(Buffer.from("The quick brown fox jumps over the lazy dog"));
console.log(mac.digest().toString("hex"));
// f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8 -- same as hmacSync

crypto.pbkdf2Sync(password, salt, iterations, keylen) Experimental

(Buffer, Buffer, int, int) → Buffer — PBKDF2-HMAC-SHA256 key derivation. One fixed PRF, no algorithm parameter, matching hmacSync's own "one well-chosen option" shape. iterations < 1 or keylen <= 0 returns an empty Buffer rather than throwing.

const key = crypto.pbkdf2Sync(Buffer.from("password"), Buffer.from("salt"), 4096, 20);
console.log(key.toString("hex"));
// c5e478d59288c841aa530db6845c4c8d962893a0

crypto.scryptSync(password, salt, keylen) Experimental

(Buffer, Buffer, int) → Buffer — scrypt key derivation with fixed cost parameters (N=16384, r=8, p=1, Node's own crypto.scrypt default). Cost parameters aren't exposed as an option in v1. keylen <= 0 returns an empty Buffer.

const key = crypto.scryptSync(Buffer.from("password"), Buffer.from("salt"), 32);
console.log(key.length); // 32

crypto.timingSafeEqual(a, b) Experimental

(Buffer, Buffer) → bool — constant-time byte comparison, for checking secrets (MACs, tokens) without leaking timing information about where two values first differ. Deviation from Node: a length mismatch returns false instead of throwing — lengths aren't secret, so this leaks nothing a length-mismatch throw wouldn't already reveal.

const a = Buffer.from("secret");
const b = Buffer.from("secret");
console.log(crypto.timingSafeEqual(a, b)); // true

url.parse(str)

string → { protocol, hostname, port, pathname, search, hash, href, query } — the second record-returning builtin family after path.parse, same pattern: a synthetic record type, all fields plain (non-optional) strings, except query. query is search (which stays the raw "?a=1&b=2" string, unchanged) additionally parsed into a real Map<string, string> — both are available, not a choice between them. A repeated key overwrites (last one wins), the same behavior any repeated Map.set() call already has.

const u = url.parse("https://example.com:8080/foo?a=1&b=hello#c");
console.log(u.hostname); // example.com
console.log(u.port);     // 8080
console.log(u.pathname); // /foo
console.log(u.search);   // ?a=1&b=hello
console.log(u.hash);     // #c
console.log(u.query.get("a")); // 1
console.log(u.query.get("b")); // hello

url.format(parts)

{ protocol, hostname, port, pathname, search, hash, href } → string — reconstructs a URL string from the record; round-trips with parse.

const u = url.parse("https://example.com/foo?a=1");
console.log(url.format(u)); // https://example.com/foo?a=1

child_process.spawnSync(command, args) Wasm: limited

(string, string[]) → { stdout, stderr, status } — runs command with args (no shell involved, matching Node's real spawnSync, not execSync's shell-string form -- safer by default, no shell-quoting needed), waits for it to exit. status is -1 if the command could not even be spawned (e.g. not found).

const r = child_process.spawnSync("echo", ["hello", "world"]);
console.log(r.stdout); // hello world
console.log(r.status); // 0

assert.ok(cond)

bool → void — panics if cond is false.

assert.ok(2 + 2 == 4);
console.log("still running");

assert.equal(a, b)

(T, T) → void — panics with both values shown if they are not equal. Strings compare by bytes.

assert.equal(2 + 2, 4);
assert.equal("hello", "hello");
console.log("still running");

time.now()

→ i64 — milliseconds since the Unix epoch (wall-clock/real time).

const n: i64 = time.now();
console.log(n);

Date.now()

→ i64 — the familiar JS spelling of time.now(): milliseconds since the Unix epoch. Promotes to number in float contexts. The rest of the Date object is planned.

const start: i64 = Date.now();
// ... work ...
console.log(Date.now() - start >= 0); // true

time.monotonic()

→ i64 — milliseconds from an arbitrary, consistent starting point; never goes backwards, safe for measuring elapsed durations, unaffected by the system clock being changed.

const start: i64 = time.monotonic();
// ... do work ...
const elapsed: i64 = time.monotonic() - start;
console.log(elapsed);

http.request(url, method, body, headers) Wasm: limited

(string, string, string, Map<string, string>) → { status, body, ok, headers } — pass "" for body on methods that don't take one, and an empty Map for headers if there are none to send. ok is status >= 200 and status < 300, computed once here so every caller doesn't have to write that range check themselves. status is -1 if the request could not even connect. The response's own headers is currently always an empty Map — reading real response headers needs a lower-level request flow than what's wired up yet, a deliberate, documented gap, not a silent one.

const headers = new Map<string, string>();
headers.set("X-Request-Id", "abc123");
const r = http.request("https://postman-echo.com/post", "POST", "hello=world", headers);
console.log(r.status); // 200
console.log(r.ok);     // true

http.get(url) Wasm: limited

string → { status, body, ok, headers } — http.request(url, "GET", "", ...) with an empty headers map.

const r = http.get("https://example.com");
console.log(r.status); // 200
console.log(r.body.includes("Example Domain")); // true

http.createServer(port, handler)

(int, (HttpRequest) → HttpResponse) → void — accepts connections forever, never returns. handler must be a named function (block-bodied inline arrow functions don't parse in this position yet), and returns the same { status, body, ok, headers } record the client side uses (ok goes unused server-side; headers is written into the real response, one line per entry). Superseded the old canned-response serve() global, which always returned the same body to every request; this one genuinely inspects each request.

function handleRequest(req: HttpRequest): HttpResponse {
  const headers = new Map<string, string>();
  headers.set("X-Powered-By", "lumen");
  if (req.path == "/notfound") {
    return { status: 404, body: "not found", ok: false, headers: headers };
  }
  return { status: 200, body: "hello from lumen (" + req.method + ")", ok: true, headers: headers };
}

http.createServer(8080, handleRequest);

Concurrent: each accepted connection's full handling (including its keep-alive requests) now runs on a worker thread from a dedicated thread pool, so accept() loops back for the next connection immediately instead of waiting for earlier ones to finish -- a genuinely blocking or slow handler on one connection no longer stalls every other client. Verified against a real compiled binary: three concurrent requests to a handler doing ~5s of real CPU work each completed in ~5.1s total (not ~15s), and a trivial request fired mid-flight against a slow one returned in under a millisecond. A handler now genuinely runs on multiple OS threads at once — a handler that reads or mutates shared global state without its own synchronization has a real data race, unlike Node's single-threaded http.createServer; Lumen has no general-purpose locking primitive yet, so this is a documented trade-off, not a solved problem. Still no idle-connection timeout: a connection stays open as long as the client keeps sending requests. (Under --wasm: unchanged from before, still a single-connection-at-a-time loop -- wasm32-wasi has no real OS threads.)

~1.1–1.2× faster than Node's native http.createServer on 300 sequential GETs (same Node.js client hitting both servers, isolating the server as the only variable): ~139ms vs Node's ~157ms. Wasn't always true — the first version closed the connection after every response, forcing a fresh TCP handshake per request and running ~1.3–1.5× slower than Node; this server now supports HTTP keep-alive (the connection stays open and serves further requests until the client sends Connection: close), the same thing Node's server does by default.

http.METHODS()

() → string[] — the 35 HTTP method name strings ("ACL", "BIND", ..., "UNSUBSCRIBE"), alphabetically sorted, matching Node's own http.METHODS value exactly. Called as a zero-arg function rather than read as a property, the same shape Math.PI()/ os.EOL() already use — Lumen has no static namespace property access.

const methods = http.METHODS();
console.log(methods.length); // 35

http.STATUS_CODES()

() → Map<int, string> — every standard HTTP status code (100 through 511) mapped to its reason phrase, verbatim from Node's own STATUS_CODES table.

const codes = http.STATUS_CODES();
console.log(codes.get(404) ?? "?"); // "Not Found"

net.connect(host, port) Wasm: limited

(string, int) → Socket — blocking connect, real DNS resolution for hostnames (via the same std.Io.net.HostName.connect path Lumen's own http.request client already uses internally to reach a hostname, not a new, unverified code path) as well as literal IPs. A failed connect (refused, unknown host, timeout) doesn't throw — it degrades to a Socket whose .read() always returns "" and .write() is a no-op, the same "fallback, don't crash" convention fs.createReadStream already established for a missing file.

const sock: Socket = net.connect("127.0.0.1", 9301);
sock.write("hello\n");
console.log(sock.read());
sock.close();

net.createServer(port, handler) Wasm: limited

(int, (Socket) → void) → void — accepts connections forever, never returns. Unlike http.createServer's (HttpRequest) → HttpResponse handler (a call-and-return shape that fits HTTP's own framing), a raw TCP handler gets the Socket itself and drives it in whatever order its own protocol needs. The socket is closed automatically once handler returns, whether or not the handler already called .close() itself (idempotent, no double-close error) — a handler that forgets to close won't leak the connection for the life of the server.

function handleConn(sock: Socket): void {
  const line = sock.read();
  sock.write("echo:" + line);
}

net.createServer(9301, handleConn);

Single connection at a time, unlike http.createServer's thread-pool-backed concurrency: nothing analogous has been benchmarked yet for a raw-bytes protocol with no request/response cadence to measure against, so a slow or long-lived handler blocks new connections from being accepted until it returns. The same worker-thread-pool mechanism http.createServer already uses is a direct, mechanical extension here later; not attempted this pass so the Socket type itself stayed the focus of this slice.

Socket.read()

() → string — the next chunk (bounded by a fixed 64KB internal buffer, matching ReadableStream.read()'s exact convention). "" at EOF, on a closed socket, or on a socket that never connected — a real empty chunk and end-of-stream are indistinguishable here, the same simplification Streams (spec 046) already documented and accepted.

Socket.write(chunk)

string → void — writes and flushes immediately on every call, unlike WritableStream.write() (which defers flushing to .close()): a long-lived socket conversation has no single "I'm done" moment the way a one-shot file write does, so buffering until some later .close() could mean the peer never sees the bytes in time. No-op on a closed or never-connected socket.

Socket.close()

() → void — closes the underlying connection. Safe to call more than once, or on a socket that never connected.

JSON.stringify(value)

T → string — T inferred from value, the same as every other Lumen builtin. Empty string on an encode failure.

type Person = { name: string, age: int, active: bool };
const p: Person = { name: "Ada", age: 30, active: true };
console.log(JSON.stringify(p)); // {"name":"Ada","age":30,"active":true}

JSON.parse<T>(text)

string → T — the first explicit type argument on a namespace call in Lumen (every other generic call site is a free function/class). Throws a catchable Error on invalid input.

type Person = { name: string, age: int, active: bool };
const p: Person = JSON.parse<Person>('{"name":"Grace","age":45,"active":false}');
console.log(p.name); // Grace

try {
  const broken: Person = JSON.parse<Person>("not json");
} catch (e) {
  console.log(e.message); // JSON.parse: invalid JSON (...)
}

zlib.gzipSync(data)

string → string — compresses data's bytes into a real gzip container (RFC 1952: 10-byte header, deflate body, CRC32 + size footer). The result is genuine gzip framing, not a private format — verified by writing it to a .gz file and decoding it with the system gunzip.

const input = "hello hello hello hello hello";
const gz = zlib.gzipSync(input);
console.log(gz.length < input.length); // true

zlib.gunzipSync(data)

string → string — inverse of gzipSync. Deviation from Node: on any decode error (bad header, truncated stream, checksum mismatch, or plain non-gzip garbage) returns "" rather than throwing — the same fallback-don't-crash shape every other fallible builtin here uses. A real gzip stream never decodes to "" in-band, so this is unambiguous as an error sentinel.

const input = "round trip me";
const back = zlib.gunzipSync(zlib.gzipSync(input));
console.log(back == input); // true
console.log(zlib.gunzipSync("not gzip data") == ""); // true

zlib.deflateSync(data)

string → string — raw deflate body only (RFC 1951), no gzip/zlib header or footer. 18 bytes smaller than gzipSync's output on the same input (the gzip container's 10-byte header + 8-byte footer).

const input = "hello hello hello hello hello";
console.log(zlib.deflateSync(input).length < zlib.gzipSync(input).length); // true

zlib.inflateSync(data)

string → string — inverse of deflateSync; same ""-on-error fallback as gunzipSync.

const input = "round trip me";
console.log(zlib.inflateSync(zlib.deflateSync(input)) == input); // true

Buffer.from(s) · Buffer.from(s, encoding)

string → Buffer — the one-argument form takes s's raw bytes verbatim, no decoding. The two-argument form decodes s under "utf8" (same as one-argument, the default) | "hex" | "base64". Deviation from Node: an unrecognized encoding string falls back to raw "utf8" bytes rather than throwing ERR_UNKNOWN_ENCODING — the same "fallback, don't crash" convention every other fallible builtin here uses; malformed hex (odd length, non-hex characters) or malformed base64 similarly fall back to an empty Buffer instead of throwing.

const b1 = Buffer.from("hi");
console.log(b1.toString("hex")); // 6869

const b2 = Buffer.from("6869", "hex");
console.log(b2.toString("utf8")); // hi

Buffer.alloc(n)

int → Buffer — n zeroed bytes. A negative n clamps to 0 rather than erroring.

const b = Buffer.alloc(4);
console.log(b.length);  // 4
console.log(b.at(0));   // 0

Buffer.length

() → int (field syntax, no parens) — the byte count. Follows Map/Set's .size precedent (a method call under a property-syntax surface, since Buffer is heap-pointer-wrapped, not a raw slice at the Lumen type level), not string/array's raw-slice .length.

console.log(Buffer.from("hello").length); // 5

Buffer.toString(encoding)

string → string — "utf8" (raw passthrough) | "hex" | "base64"; an unrecognized encoding falls back to "utf8".

console.log(Buffer.from("hi").toString("base64")); // aGk=

Buffer.at(i)

int → int — the byte value (0-255) at index i; out of range (including negative i) returns 0 rather than crashing. Deviation from Node: there is no buf[i] index syntax — Lumen's [i] index checker is array-type-specific today, so .at(i) is the only way to read a byte.

const b = Buffer.from("A");
console.log(b.at(0));  // 65
console.log(b.at(99)); // 0 -- out of range, not a crash

Buffer.slice(start, end)

(int, int) → Buffer — a new Buffer over [start, end), clamped into range the same way string.slice behaves.

console.log(Buffer.from("hello").slice(1, 3).toString("utf8")); // el

Buffer.equals(other)

Buffer → bool — byte-for-byte comparison.

console.log(Buffer.from("abc").equals(Buffer.from("abc"))); // true
console.log(Buffer.from("abc").equals(Buffer.from("abd"))); // false

Worker.run(fn)

(() => T) → Promise<T>, T one of i32 | i64 | f64 | bool — spawns a real, detached OS thread (one Worker = one thread, so a CPU-bound call never queues behind unrelated work), runs fn on it, and resolves the returned Promise once it finishes. fn may be a plain named function (no captures at all) or an arrow capturing only scalar outer bindings — Lumen's existing closure lowering copies each capture by value into a heap-allocated environment at the closure's creation point, so a captured scalar is a true snapshot with no live aliasing back to the caller's binding.

function fib(): i32 {
  let a: i32 = 0;
  let b: i32 = 1;
  let i: i32 = 0;
  while (i < 40) {
    const next = a + b;
    a = b;
    b = next;
    i = i + 1;
  }
  return a;
}

async function main(): Promise<void> {
  const p = Worker.run(fib);
  console.log("worker launched, main keeps going");
  console.log(await p);
}

What's safe to cross the thread boundary, stated narrowly on purpose: only the four scalar types above, checker- enforced — Lumen has no borrow checker and no Send/Sync distinction, so strings, arrays, Map/Set/Buffer, and class instances are deliberately not accepted as T yet (not verified safe without a real deep-copy/capture-safety analysis). This does not, by itself, make every closure safe: capturing a reference-shaped outer binding (an array, Map/Set/Buffer, a class instance) only copies the pointer/slice header into the worker's closure — the pointee is still the same shared, unsynchronized memory. If the main thread (or another Worker) mutates it while the worker reads or writes it too, that's a real data race, the same kind of trade-off http.createServer's concurrent handlers already document above. Not statically prevented this pass. For Map/Set specifically (spec 492) this is no longer silent: each instance detects an overlapping access from another thread and stops with an explicit runtime error instead of corrupting its own storage or crashing somewhere unrelated — still not safe to rely on, but no longer invisible when it happens. Arrays, Buffer, and class instance fields have no such guard yet and remain a real, silent data race.