Kaya

Kaya is a compiled, statically typed scripting language for the web, created in the mid-2000s by Edwin Brady and Chris Morris at the University of Durham. Its pitch was unusual for the CGI era it inhabited: keep the convenience of PHP-style web scripting - write a program, drop it on a server, get a web page - but back it with a Haskell-grade type system, whole-program type inference, algebraic data types, and a web framework that encrypted its own form state so entire classes of injection attacks became much harder to mount. The official site reportedly put the philosophy bluntly: Kaya was designed to solve real, practical problems, not to showcase exciting research into type systems or language features.

That modesty was half the story. Kaya really was a practical tool - it shipped in Debian and Ubuntu, compiled to native code through C, and came with libraries for databases, networking, cryptography, and image manipulation. But it is also a fascinating historical waypoint: the “serious” language from the two people best known for Whitespace, the famous joke language made entirely of invisible characters, and the proving ground Edwin Brady worked in before creating Idris, one of the most influential dependently typed languages of the following decade.

History and origins

Brady and Morris met at the University of Durham, and their first public collaboration was anything but serious: Whitespace, released on April 1, 2003, a Turing-complete language whose only meaningful characters are spaces, tabs, and linefeeds. It became one of the most beloved esoteric languages ever made - Brady has reportedly noted, with some chagrin, that the joke language long remained his most widely known work.

Kaya was the earnest counterpart. The project was registered on SourceForge on September 27, 2005, and the earliest releases still preserved there - the 0.2.x series - began appearing in November 2006. Development was reportedly supported by the Durham University Computing Society and coordinated through a mailing list, with the source reportedly versioned in darcs, the distributed version control system of choice in the Haskell world the compiler itself was written in.

The motivation, as the official site reportedly described it, was dissatisfaction with the available options for complex scripting tasks and small-to-medium-scale web applications. Dynamic languages like PHP and Perl made web development easy but deferred whole categories of error to runtime - or worse, to production security incidents. Statically typed mainstream languages caught those errors but buried the programmer in declarations and casts. Kaya’s creators wanted both halves: static checking with the ceremony inferred away.

Releases came steadily through 2007, jumped to 0.4.0 in March 2008 and 0.5.0 that May, and the project even maintained a dual-branch discipline, shipping bug-fix release 0.4.3 alongside feature release 0.5.1 on the same day in August 2008. Then it stopped. Version 0.5.2, released April 13, 2009, was the last. Brady, by then at the University of St Andrews, was increasingly absorbed by the dependently typed language Idris - whose earliest versions date to around 2007 - and his energies went where his research was.

Design philosophy

Kaya’s design can be read as a series of refusals to accept standard trade-offs:

• Static typing without type annotations. Kaya is statically and strongly typed, but the compiler infers the types of local variables entirely. The documentation’s guideline was that a programmer should never need to write a type outside function signatures and data declarations. Safe conversions (such as integer-to-string in string context) happened automatically, removing the cast noise that made static typing feel bureaucratic.

• Scripting-language convenience with compiled delivery. The kayac compiler translated Kaya source through an internal bytecode to generated C, which gcc then compiled to native code - with options for position-independent code for shared web deployment, a REPL for interactive experimentation, and even a variant runtime tuned for short-lived processes like web requests.

• Functional power inside imperative syntax. Kaya code looks like C - braces, semicolons, for loops, mutable assignment - but carries first-class functions, anonymous functions, partial application, and algebraic data types - features more commonly associated with functional languages such as OCaml and Haskell, which the official site reportedly cited as the models.

• Security as a language property. Rather than documenting best practices and hoping, Kaya’s web model made the safe path the default path: HTML was constructed through a typed document model that ensured well-formed output, and form state passed between pages was protected with AES-256 encryption so a user could not forge a request that invoked an arbitrary function with arbitrary arguments.

Key features

Type inference in an imperative language

An example in the style of the archived official documentation shows the flavor - statically typed throughout, with not one type annotation in the body:

String printSquares(Int num) {
    output = "";
    for i in [1..num] {
        // types of 'i' and 'output' are obvious, so no need to give them
        square = i*i;   // 'square' is another Int
        output += i+"*"+i+"="+square+"\n";
    }
    return output;
}

According to archived documentation, the primitive types were Int (machine-native size), Float (double precision), Char and String (both Unicode), Bool, Void, Exception, and Ptr for foreign objects, plus automatically sized nestable lists.

Algebraic data types

Kaya brought tagged unions - the bread and butter of ML-family languages - into a C-flavored syntax. A polymorphic linked list was declared like this:

data List<a> = nil | cons(a head, List<a> tail);

Combined with polymorphic records, ad-hoc function overloading, and type synonyms for readability, this let programmers model complex data - database query results, directory trees, HTML documents - precisely enough that the compiler could catch structural mistakes that dynamic web languages only revealed at runtime.

The web development model

Kaya offered two modes for the web: a simple CGI model for rapid prototyping, and a richer “webapp” model for real applications. The webapp model’s signature trick was state management. In a multi-page form flow, archived examples show a single call wiring a submit button to the function that should handle the next stage, carrying the accumulated state along:

void(addLocalControlInput(f1, "Next step", formStage3@(), state));

The @ is Kaya’s partial application syntax - formStage3@() is a reference to a function awaiting its arguments. Critically, the encoded function-and-state payload embedded in the page was encrypted with AES-256, so a malicious user could not tamper with it to call arbitrary code - a pointed contrast with the era’s habit of passing function names through raw form fields. The same design aimed to ensure well-formed cross-browser HTML output and to minimize the risk of cross-site scripting and remote code execution by construction.

Batteries for the practical web

The distribution bundled libraries for database access, networking, image manipulation, cryptography, system interaction, and data manipulation. Because the same language served web applications and stand-alone programs, a team could share data-access code between the public web front end, back-end maintenance scripts, and offline static-page generators - an argument for full-stack consistency made a decade before that phrase was common.

Platform support

According to the official documentation, Kaya ran on Linux, Mac OS X, and Windows, and was expected to work on any POSIX-compliant system, across a variety of hardware architectures. The Debian and Ubuntu archives back this up concretely: Ubuntu 12.04 carried the kaya package built for amd64, i386, powerpc, armel, and armhf.

Decline and dormancy

Kaya’s story after 2009 is the quiet kind of ending common to university languages. Upstream releases stopped at 0.5.2. The Debian-packaged 0.4.4 continued shipping in distribution archives for several more years, giving the language a longer afterlife in apt than it had on its own website. The kayalang.org domain eventually lapsed and was taken over by an unrelated content site - today the old URLs redirect to a photography portfolio, and the original documentation survives only in the Internet Archive. The SourceForge project page, with its full release history and source tarballs, remains the language’s most durable monument.

Why did it fade? Kaya occupied a narrow ridge: too statically typed and unusual to peel users away from PHP’s enormous ecosystem, yet deliberately un-novel by its own account - no exciting type-system research, on purpose - at the exact moment its own creator was proving that exciting type-system research was where his leverage lay. When Brady’s focus turned to Idris in 2009, Kaya lost its engine, and a two-person GPL language without an institution or company behind it has no second engine.

Why it matters

Kaya deserves remembering on three counts. First, it was early and right about web security as a language-design problem: encrypted, unforgeable form state and typed HTML generation anticipated by years the “make the insecure state unrepresentable” ethos that frameworks and languages now advertise proudly. Second, it was an early entrant in what became a recognizable genre - statically typed, inference-heavy, functional-flavored languages aimed at the web - a space later explored by Opa, Ur/Web, and Elm, whether or not any of them ever heard of Kaya. Third, it is a singular biographical document: the missing link between Whitespace, the most famous joke in programming languages, and Idris, one of the most serious efforts to bring dependent types to working programmers - both from the same Edwin Brady, with Kaya the practical middle chapter where the lessons were learned.

For the code archaeologist, Kaya is a rewarding dig: a complete, GPL-licensed language with a Haskell compiler, a C runtime, real documentation preserved in the Wayback Machine, and packages still sitting in old distribution archives - a small, finished world from the last years of the CGI web.