--- slug: 90-builtins title: Builtins index description: A categorized index of Synsema's built-in functions — collections, text, math, bytes, time, JSON, I/O, HTTP, DB, memory and response helpers. example_ids: [builtins] --- # Builtins index A categorized map of the built-ins. The full signatures live on each topic page; the core ones are doctested here so this reference can't drift. ```synsema -- Doc reference: a few core builtins, doctested so the reference can't drift. intent: "doc reference: core builtins" print("upper(\"hi\") = " + upper("hi") + ", join([a,b],\"-\") = " + join(["a", "b"], "-")) test "collections" assert_eq(length([1, 2, 3]), 3) assert(contains([1, 2, 3], 2)) assert_eq(slice([1, 2, 3, 4], 1, 3), [2, 3]) -- Python-style end-exclusive assert_eq(keys({"a": 1, "b": 2}), ["a", "b"]) assert_eq(values({"a": 1, "b": 2}), [1, 2]) test "text" assert_eq(upper("hi"), "HI") assert_eq(trim(" x "), "x") assert_eq(split("a,b,c", ","), ["a", "b", "c"]) assert_eq(join(["a", "b"], "-"), "a-b") assert(starts_with("hello", "he")) test "intentional ops" assert_eq(apply((n) => n * 2, [1, 2, 3]), [2, 4, 6]) assert_eq(where([1, 2, 3, 4], (n) => n > 2), [3, 4]) assert_eq(reduce([1, 2, 3], (a, b) => a + b, 0), 6) test "intentional ops accept both orders (fn-first and list-first)" assert_eq(apply([1, 2, 3], (n) => n * 2), [2, 4, 6]) -- list-first also works assert_eq(where((n) => n > 2, [1, 2, 3, 4]), [3, 4]) -- fn-first also works assert_eq(reduce((a, b) => a + b, [1, 2, 3], 10), 16) -- extra args stay at the end test "unique and index_of" assert_eq(unique([3, 1, 3, 2, 1]), [3, 1, 2]) -- first-appearance order assert_eq(index_of([10, 20, 30], 20), 1) -- by item assert_eq(index_of([1, 2, 3], (n) => n > 1), 1) -- by predicate assert_eq(index_of([1, 2], 9), nothing) -- absent → nothing, not -1 test "program & subprocess: args() and self_path() (no capability)" assert_eq(type_of(args()), "list") -- the program's argv (empty under `synsema test`) assert_eq(type_of(self_path()), "text") -- this executable's path assert(length(self_path()) > 0) ``` ## By category - **Collections:** `length`, `contains`, `slice`, `keys`, `values`, `apply`, `where`, `reduce`, `sort_by`, `group_by`, `find_first`, `every`, `some`, `collect`, `count_where`, `flatten`, `chunk`, `zip_with`, `unique` (dedupe, first-appearance order, structural equality), `index_of` (0-based index of item or predicate match; absent → `nothing`, not -1). `enumerate(list)` → `[{index, item}, …]` for indexed loops (language and templates). The intentional ops that take a callable accept **both** orders — `apply(fn, list)` and `apply(list, fn)` read equally well; two tasks or two lists where one-and-one is expected is an explicit error. - **Text:** `upper`, `lower`, `fold`, `trim`, `starts_with`, `split`, `join`, `replace_text`, `replace_re`, `matches`, `capture`, `text`, `fmt`, `strip_ansi` (engine v0.6.8+: terminal output → plain text; CSI/OSC/charset escapes and control bytes removed, `\r` redraws keep the last frame). - **Numbers / math:** `+ - * / % **`, `number`, constants `pi`/`tau`/`e`/`inf`/`nan`; `abs`, `sign`, `min`, `max`, `clamp`, `sqrt`, `cbrt`, `hypot`, `pow`, `exp`, `ln`, `log10`, `log2`, `log_base`, `floor`, `ceil`, `round`, `trunc`, `round_to`, `sin`/`cos`/`tan`/`asin`/`acos`/`atan`/`atan2`, `radians`/`degrees`, `sinh`/`cosh`/`tanh`/`asinh`/`acosh`/`atanh`, `gcd`, `lcm`, `factorial`, `is_nan`/`is_infinite`/`is_finite`, `gamma`/`lgamma`/`erf`/`erfc`/`beta`; `decimal`, `complex`/`real`/`imag`/`conj`/`arg`; type predicates `is_decimal`, `is_complex`, `is_array`, `is_bytes`, `type_of`; arrays `array`, `arange`, `linspace`, `zeros`, `ones`, `eye`, `full`, `reshape`, `shape`, `ndim`, `size`, `transpose`, `trace`, `dot`, `norm`, `matmul`, `solve`, `det`, `inv`, `eig`, `svd`; `bytes_to_int`, `int_to_bytes`, `int_to_bytes_le` — see [Bytes, math & arrays](/en/0.6.x/35-bytes-math-arrays). - **Bytes / crypto:** `bytes`, `decode` (encodings: `utf8`, `hex`, `base64`, `base64url`, `base58`, `base32`), `sha256`, `sha512`, `hmac_sha256`, `verify_hmac`, `constant_time_eq`. - **Web auth** (engine v0.5.5+ — see [Login & sessions](/en/0.6.x/40a-web-auth)): `password_hash`, `password_verify`, `jwt_sign`, `jwt_verify`, `totp`, `totp_verify` (pure); `random_bytes`, `token` (`require random`); responses `with_header`, `set_cookie`, `clear_cookie`; `request.cookies`; 2-param `auth with` task. - **Web Push** (engine v0.6.15+ — see [Your app on the phone](/en/0.6.x/41b-pwa)): `push_vapid_keys()` → `{public, private}` (`require random`; the private key comes back as a `secret` labelled `vapid_private`); `push_send(subscription, payload, opts)` → `{status, ok, gone, retry_after, body}` (`require net("")` — `fcm.googleapis.com` and `jmt17.google.com` (Chrome uses either), `*.notify.windows.com`, `updates.push.services.mozilla.com`, `web.push.apple.com`; `opts.vapid = {public, private: secret, subject}` required, `ttl`, `urgency`, `topic`, `timeout`; payload text / map→JSON / bytes / `nothing`, ≤ 3993 bytes; `gone` on 404/410). RFC 8291 `aes128gcm` + RFC 8292 VAPID, no provider needed; not in the wasm profile. - **Agent identity & auth** (engine v0.5.6+ — see [Agent identity](/en/0.6.x/46-agent-identity)): capability tokens `captoken_mint`, `captoken_attenuate` (offline, no key), `captoken_verify`, `captoken_allows` (pure); signed requests `http_sign` (`require sign("KEY")` + audit) and `http_signature_verify` (pure, `opts.alg` mandatory); third-party OIDC `oidc_verify` (`iss`+`aud` mandatory; JWKS needs `require net(host)`); `mtls_identity(cert, key, opts?)` with `opts.hosts` scoping (`require file.read`); per-identity metering: `spend_total(unit, identity?)`, identity-scoped rate limits and `SYNSEMA_SPEND_CEILING_PER_IDENTITY="agent=UNIT:max"` (any unit — no currency is privileged); discovery at `/.well-known/synsema-auth`. - **Time / random:** `now`, `format_time`, `parse_time`, `date_parts` (→ `{year, month, day, hour, minute, second}`, UTC), `sleep`, `random`, `random_int` (`random`, `random_bytes` and `token` need `require random`). - **JSON:** `json_encode`, `json_decode`; `json_for_script` (same JSON with `<`/`>`/`&` escaped `\u00XX` — the safe way to embed data in an inline `