A tour of Salam's standard library: from networking and cryptography to databases, images and AI

The Salam standard library is the set of packages that ships with the compiler, so a program can import them with no download, no package manager and no C library to install for most of them. Salam's standard library has more than 170 documented packages, covering text and data formats, files and processes, HTTP and networking, cryptography and TLS, databases, mathematics, machine learning, audio, images and graphical user interfaces. Each one has a page in the library reference with an example for every public function, and every package and function also has a Persian name.

This article is a map. It goes through the library area by area, runs a few packages so you can see what typical code looks like, and links to the reference page of each package it mentions. It ends with an honest look at the trade-offs of a "batteries included" library in a young language.

How the standard library is organized

Packages are imported by path, import encoding.json or import net.http, and used with the last part of the name as a prefix: json.Marshal, http.Get. The reference sorts them into groups: basics, text, numbers and collections, encoding and data, system and tools, time and concurrency, network, security and cryptography, database, web and services, graphics and games, audio and AI, plus a few smaller ones.

Three properties hold across the library and are worth knowing before you use it:

• Most of it is written in Salam. HTTP, TLS 1.3, the PostgreSQL and MySQL protocols, JSON, compression, ONNX inference and the native UI's layout engine are Salam code compiled with your program. A few packages wrap C libraries that already exist and that nobody should rewrite: db.sqlite, gui.raylib, ai.opencv and the system web view in gui.webview.
• Heap values are yours to free. Packages that return a Vector, a buffer or an owned string say so, and you free them with .free() or the package's Free function, usually through defer. The memory lesson explains the rules.
• Errors use the language's own mechanisms. Functions that can fail either return a status the caller checks or are marked throws, in which case the compiler makes you handle them with try.

Text, data formats and encodings

The text packages are where most programs start: str for searching, slicing, replacing and building strings, regex for patterns, unicode for character properties, and template for text and HTML templates with automatic escaping. Because Salam is bilingual, the library has unusual depth for right-to-left text: bidi implements the Unicode bidirectional algorithm, arabic normalizes Arabic-script text (yeh and kaf variants, diacritics, tatweel, the zero width non-joiner), conv reads Persian digits, calendar converts between the Jalali, Hijri and Gregorian calendars, and i18n handles translated messages and plurals.

Data formats are just as broad: encoding.json from plain strings through struct marshalling to streaming, YAML, TOML, CSV, XML with XPath, MessagePack, Protocol Buffers with .proto parsing and code generation, serde for converting between them, excel for xlsx and ods spreadsheets, and npy for NumPy arrays.

import encoding.json
import regex
import calendar

struct Invoice:
    @json "number"
    pub number: str = ""
    @json "total"
    pub total: int = 0
    @json "paid"
    pub paid: bool = false
end

func main throws:
    inv := Invoice { number = "INV-1403-0042", total = 125000 }
    text := json.Marshal(inv)
    println text

    mut back := Invoice {}
    try json.UnmarshalLenient(`{"number":"INV-7","total":99,"paid":true,"extra":1}`, back)
    println back.number, back.total, back.paid

    digits := try regex.Compile("[0-9]+")
    println regex.FindAll(digits, inv.number)

    day := calendar.JalaliDate { year = 1403, month = 12, day = 29 }
    println calendar.FormatJalali(calendar.AddDaysJalali(day, 1)), calendar.JalaliMonthNameEn(12)
end

json.Marshal uses the @json names on the fields, UnmarshalLenient ignores the unknown extra key, and the regular expression and the calendar work without any setup. The last line shows a detail that only a calendar library that takes Persian dates seriously gets right: 1403 is a leap year in the Jalali calendar, so Esfand has a 30th day.

Files, processes and the operating system

For system programming the library has os and fs for files, directories and environment variables, fs.path for paths, os.process for running programs with pipes and time limits, os.pty for driving interactive programs on a pseudo terminal, os.dl for loading shared libraries at runtime, and os.mmap for memory pages with permissions.

Command-line tools get flag for options, cli for programs with subcommands such as git commit, term for colors, cursor movement, progress bars and key input, log for leveled and structured logs, config and env for settings, and testing for assertions. Time is covered by time and cron, which schedules jobs from cron expressions.

Concurrency lives here too: thread, sync, atomic, chan, pool and ctx, described in Concurrent programming in Salam. At the lowest level, mem gives direct allocation, arenas, pools and leak checking.

Networking, web services and databases

Networking is the largest group. The web stack is net.http (server and client), net.router, middleware, sessions, validation, OpenAPI documentation, HTTP/2, WebSocket, gRPC, JSON-RPC and GraphQL. net.httpd is a config-driven web server with virtual hosts and FastCGI, which salam serve runs. The article Building fast web servers with Salam covers this stack with code and benchmark numbers.

Lower down are net.tcp, net.udp, net.dns and encrypted DNS in net.doh. Protocol clients include net.email (SMTP, IMAP, POP3), ssh with SFTP, ftp, net.nats with JetStream and net.socketio. Service clients include aws (S3, SQS and STS with Signature Version 4), google service accounts, telegram.bot and webpush for browser notifications. A family of proxy packages, from net.socks to net.vpn, implements SOCKS, HTTP proxies and VPN-style tunnel protocols.

Databases have drivers for SQLite, MySQL and MariaDB, PostgreSQL, Redis and ClickHouse, search clients for Elasticsearch, OpenSearch, Meilisearch and Typesense, and db.sql, which checks SQL against your schema without a database. The details are in Database applications in Salam.

Security, cryptography and compression

crypto has SHA-1, SHA-2 and MD5 digests, HMAC, secure random numbers and password hashing. jwt signs and verifies tokens and guards API routes. tls implements TLS 1.3 and 1.2 with no OpenSSL dependency, and ssl puts a familiar OpenSSL-style interface on top of it. On the data side, compress has DEFLATE, gzip, bzip2, zstd and checksums, and archive creates and extracts ZIP, tar and compressed tar files and reads RAR archives, including password-protected and multi-volume ones.

import crypto
import jwt
import compress

func main throws:
    println crypto.Sha256Hex("salam")
    println crypto.HmacSha256Hex("server-key", "order=42&amount=1250")

    hash := crypto.HashPassword("correct horse battery staple")
    println crypto.VerifyPassword("correct horse battery staple", hash), crypto.VerifyPassword("wrong", hash)

    mut c := jwt.NewClaims()
    c.sub = "42"
    c.exp = 1900000000
    token := try jwt.SignHS256(c, "a-long-random-secret")
    mut o := jwt.DefaultOptions()
    o.now = 1800000000
    t := try jwt.Verify(token, "a-long-random-secret", o)
    println t.valid, t.claims.sub

    text := "salam salam salam salam salam salam salam salam"
    packed := compress.GzipCompressStr(text)
    mut ok := false
    unpacked := compress.GzipDecompressBuf(packed, ok)
    println text.len(), "bytes ->", packed.len, "bytes gzip, round trip:", ok and compress.BufToStrUnsafe(unpacked) == text
end

The digest and the HMAC match what sha256sum and openssl dgst -hmac print for the same input, which is the first thing to check about any cryptography code. Cryptography written in a young language deserves caution: the implementations are tested, but they have not had the years of independent review that OpenSSL, BoringSSL or Go's crypto packages have had.

Numbers, math and data structures

math has the usual functions, rand random numbers and shuffling, and sort sorting and binary search. collections adds stacks, queues, deques, sets, linked lists, priority queues and counters on top of the built-in Vector and HashMap. For exact arithmetic there are decimal for money and bigint for integers of any size. For analysis there are stats, matrix for linear algebra and graph for shortest paths, flows and centrality.

import decimal
import bigint
import stats

func main:
    price := decimal.FromScaled(1999, 2)
    vat := decimal.Percent(price, decimal.FromInt(9), 2)
    println "0.1 + 0.2 as f64:", 0.1 + 0.2
    println "price", decimal.ToStr(price), "VAT", decimal.ToStr(vat), "total", decimal.ToStr(decimal.Add(price, vat))

    println "30! =", bigint.ToStr(bigint.Factorial(30))

    mut ms := Vector {} as Vector<f64>
    defer ms.free()
    each v in [12.0, 15.0, 11.0, 48.0, 13.0]:
        ms.push(v)
    end
    println "mean", stats.Mean(ms), "median", stats.Median(ms)
end

The first line is the reason decimal exists: binary floating point cannot represent 0.1 exactly, and money should never be stored in it. The last line is a small reminder of why medians matter when one value is an outlier.

AI, images and audio

The AI group is unusually large for a systems language. ai.tensor provides multi-dimensional arrays, ai.autograd reverse-mode differentiation, ai.nn layers from linear to transformer, ai.optim SGD and Adam, and ai.ml classic machine learning such as regression, trees and clustering. For trained models, ai.onnx runs ONNX models with no outside dependency, ai.gguf reads llama.cpp's GGUF files, and ai.llm runs Llama and Qwen language models from them. ai.image reads, edits and writes images, and ai.opencv wraps OpenCV for computer vision. The article Machine learning with Salam goes deeper, and it is candid about scale: this is a CPU-oriented library, not a replacement for PyTorch on a GPU cluster.

Audio is its own family: audio for clips of samples, readers and writers for WAV, FLAC, AIFF and more, audio.dsp for Fourier transforms and filters, audio.synth for oscillators and envelopes, audio.midi for MIDI files, and audio.music for notes, scales and tunings, including the Persian dastgah system.

Graphics, GUI and the browser

For desktop programs there are gui.webview, a native window around HTML with a whole application layer on top, and the native UI runtime in gui.ui, which draws Salam pages without a browser using its own CSS engine, box layout, text shaping and painter. Games use gui.raylib. In the browser, dom works with page elements and events, web.canvas draws on a canvas, and web.keys tracks keyboard state for games. The articles on desktop and GUI applications and interactive UI components cover them.

The trade-offs of a large standard library

A big standard library is a deliberate choice, and it has costs as well as benefits.

The benefits are concrete. A new project can parse JSON, serve HTTPS, talk to PostgreSQL and hash passwords without choosing among competing third-party packages or auditing their dependency trees. Every package is documented in one place with runnable examples, and every package follows the same naming and memory conventions. The Persian names mean a Persian-speaking programmer can use the whole library in their own language, which no third-party ecosystem would provide.

The costs are real too:

• Depth varies. Some packages, such as net.http, encoding.json and db.sql, are central to the project and well exercised. Others are newer and thinner. Check the reference page and the tests before relying on a niche package.
• Young code. Much of the library is recent. Protocol implementations such as TLS, PostgreSQL and SSH have far less field experience than their established C, Go or Rust counterparts.
• One release cadence. A fix in a package ships with the next compiler release. Third-party packages, added with salam add from GitHub as described on the packages page, are where faster-moving code belongs.
• A small ecosystem around it. The standard library is large, but the wider community and the number of third-party packages are small compared with Python, Go or Rust.

Frequently asked questions

How many packages are in the Salam standard library?

More than 170 documented packages, each with its own page in the library reference. Some areas, such as networking, are split into many small packages, so the count reflects organization as much as size.

Does the Salam standard library depend on C libraries?

Mostly not. HTTP, TLS, the MySQL and PostgreSQL drivers, compression and ONNX inference are written in Salam. A few packages wrap established C libraries on purpose, including SQLite, raylib, OpenCV and the system web view.

Can I use the standard library from Persian code?

Yes. Every package and every public function has a Persian name, so a Persian program can call the whole library in Persian. The article One language, two scripts explains how.

Where do I find examples for a package?

Every page in the library reference has guide sections with complete programs and an example for each public function, and the free course uses many of the packages along the way.