Standard Library

1. Abstract

This RFC outlines the Aura standard library for servers and CLIs: prelude, collections, I/O, networking primitives, JSON, logging, synchronization, crypto baseline, testing support types, and FFI helpers. It is core-only—no HTTP application framework, ORM, or DI container.

Implementation is primarily Aura, with thin runtime/FFI bridges where required.

Toolchain today (2026-07-21, C12r): repo packages std/io (console + file: print/println/eprint/eprintln, readFile/tryReadFile/writeFile/appendFile/fileExists/fileSize; process: args/readLine/readAllStdin/exit), std/assert (assert), and std/collections (Map/Set/HashMap String→Int / HashMapStr String→String / Iterable + Int·String HOF + join). Package builds auto-prelude std.io and resolve std.* path deps. Strict file I/O throws String on error; tryReadFile returns String? (C12p). Full Result wrappers deferred. No net/json/async I/O yet.

2. Motivation

2.1 Problem statement

A language without a solid stdlib cannot bootstrap an ecosystem. Conversely, a stdlib that includes full web frameworks freezes opinions and bloats core.

2.2 Why now

Compiler MVP needs types to lower; users need I/O and collections for non-toy programs.

2.3 Success metrics

3. Goals

• Batteries for collections, text, time, I/O, net primitives, JSON, log, sync, crypto basics.
• Async-friendly APIs matching RFC-003.
• Stable naming and package layout under std.*.
• Safe defaults; unsafe isolated.

4. Non-goals

• HTTP router/framework, GraphQL, gRPC codegen (ecosystem).
• Database drivers / ORM.
• GUI, mobile, browser DOM.
• Full TLS policy engine beyond practical client/server primitives (detail open).

5. Prior art & alternatives

6. Design

6.1 Package map (v1)

6.2 Error conventions

• Expected failures: Result<T, E> with typed errors (IoError, ParseError).
• Abnormal: throw hierarchy under Error.
• I/O: prefer Result for recoverable IO.

6.3 Collections sketch

let xs = List.of(1, 2, 3)
let ys = xs.map((x) => x * 2)
var m = Map<String, Int>()
m.put("a", 1)

• Generics monomorphized per RFC-002.
• Iteration via Iterable interface.
• Naming: one growable List<T> in std.collections; language builtin Array<T> stays for dense buffers. No separate Vec type.

6.4 Concurrency surface

val ch = Channel<Int>()
spawn { ch.send(1) }
val v = ch.receive()
Mutex.withLock(mu) { /* ... */ }

6.5 I/O & net

• Async methods: await file.readToEnd(), await tcp.accept().
• Blocking variants available for scripts; prefer async in servers.

6.6 JSON

val user = Json.parse<User>(text)?  // or Result
val text = Json.stringify(user)

• Uses attributes for field names (RFC-009) when available; MVP may require manual serializers.

6.7 Crypto baseline

• Secure random, SHA-256, HMAC-SHA256.
• Password hashing: recommend ecosystem or carefully chosen one (open).
• TLS: client/server streams—implementation may wrap OS/backend libraries.

6.8 Versioning

• Stdlib versioned with toolchain.
• std is not published as a normal registry package users replace casually; ship with compiler.

6.9 Examples

import std.io.println
import std.net.TcpListener
import std.task.spawn

fun main() {
  // conceptual
  println("ok")
}

6.10 Error model / edge cases

6.11 Compatibility & migration

• Deprecations via @deprecated.
• Major toolchain bumps may remove deprecated APIs.

7. Open questions

8. Rationale & trade-offs

Go-like pragmatic breadth without framework lock-in. Async-first net matches runtime. Keeping HTTP frameworks out preserves modularity. Cost: users assemble stacks from packages early—desired for ecosystem health.

9. Unresolved / future work

• Full API reference site
• Capability-based FS/net permissions (sandbox)
• SIMD / performance utilities

10. Security & safety considerations

• Crypto APIs hard to misuse (no ECB footguns in public API).
• TLS defaults modern.
• Path traversal helpers safe-by-default.
• std.ffi clearly unsafe-adjacent.

11. Implementation plan (optional)

12. References

• Go standard library overview
• RFC-001–003, RFC-006, RFC-009, RFC-011

Changelog