Code is cheap to generate. Expensive to trust.

The AI-native language where code explains itself.

Aver is a language where every function carries its intent, side effects are visible in the type system, and tests are executable specs next to the code. The optimization target is the reviewer, not the generator.

Three backends: VM, Rust, standalone WASM. For agents: llms.txt

Try in browser Install

MIT licensed · Written in Rust · v0.16 · crates.io

fn safeDivide(a: Int, b: Int) -> Result<Int, String>
    ? "Safe integer division. Returns Err on zero."
    match b
        0 -> Result.Err("Division by zero")
        _ -> Result.Ok(a / b)

verify safeDivide
    safeDivide(10, 2) => Result.Ok(5)
    safeDivide(7, 0)  => Result.Err("Division by zero")

fn reportDivide(a: Int, b: Int) -> Unit
    ? "Prints the result of safeDivide."
    ! [Console.print]
    Console.print(safeDivide(a, b))

Why Aver?

Intent is explicit

Every function carries a prose description. The why stays with the code.

fn classify(c: Float) -> String
    ? "Human-readable category."
    match c <= 0.0
        true  -> "freezing"
        false -> "comfortable"

Effects are tracked

I/O, network, disk — declared on every function. No hidden side effects. Run a tracked Console.print in-browser.

fn greet(name: String) -> Unit
    ? "Greeting to stdout."
    ! [Console.print]
    Console.print("Hi, {name}!")

Verify blocks are specs

Tests live next to the function. Checks, docs, and regression guards — in one place.

verify divide
    divide(10, 2) => Result.Ok(5)
    divide(7, 0)  => Result.Err("zero")
    divide(9, 3)  => Result.Ok(3)

Decisions are first-class

Architectural choices live in the code, not a wiki. Searchable and exportable.

decision UseResult
    chosen = "Result"
    rejected = ["Exceptions"]
    reason =
        "Exceptions hide in sigs.
         Result forces handling."

Effect policies

aver.toml controls which hosts, paths, and env vars your code can touch. Deployment guardrails.

# aver.toml
[effects.Http]
hosts = ["api.example.com"]

[effects.Disk]
paths = ["./data/**"]

Errors that teach

Diagnostics built for humans and LLMs — precise, actionable, with hints. See an effect-violation diagnostic rendered live.

Error [3:5]: 'greet' calls
  'Console.print' but does
  not declare the effect.

Hint: add ! [Console.print]

AI-native navigation

aver context exports types, effects, intents — sized to fit an LLM window. Also runs in-browser via the playground Context panel.

$ aver context app.av

# Module: Main
> "Payment ops entry."
effects: [Console, Disk]

fn run(cmd) -> Result<Report, String>

Formal verification

Verify blocks state laws the compiler checks and exports to Lean 4 proofs and Dafny lemmas. Effectful functions get proofs too via Oracle — see the randomness paradox or try a pure law in-browser.

verify add law commutative
    given a: Int = -10..10
    given b: Int = -10..10
    add(a, b) => add(b, a)

Multiple backends

VM for dev, native Rust for production, WASM for browsers. Same source.

$ aver run hello.av
$ aver compile hello.av --target rust
$ aver compile hello.av --target wasm-gc

What Aver deliberately omits

The safest code is code that can't go wrong. Aver removes entire categories of bugs by not having the features that cause them.

No null Option<T> with Some / None — the compiler forces you to handle both.

No closures All functions are top-level. No captured variables — what you see is what it uses.

No exceptions Result<T, E> only — errors are values, never invisible control flow.

No if/else match is exhaustive — the compiler catches every missing case.

No mutable state All bindings are immutable. No hidden side channels, no spooky action at a distance.

No async runtime Independence (?!) for parallelism — explicit, not implicit.

No loops Recursion + match + TCO. Termination is visible in the structure.

No magic No decorators, no implicit behaviour, no runtime reflection. Code is what it says.