Standard library reference

v0.15.x state. Layer 3 stdlib complete: every kernel module surfaced as Sky source under sky-stdlib/{Sky/Core,Std,Sky/Http}/*.sky. Browse the full surface with sky doc --serve (HTTP server with type-signature search, Markdown rendering, in-module filter), or sky doc <Module> in the terminal. Fully-typed Go output; whole-program DCE prunes unused code + FFI bindings; auto-TCO for tail-recursive functions. v0.15 adds type-directed lowering end-to-end (lambdas, record fields, list literals) and Go generics on parametric record aliases (type alias Cfg msg = { ... } compiles to Cfg_R[msg any] so callback shapes stay typed across the FFI boundary).

Sky's standard library is batteries-included — one canonical module per concern, no plugin ecosystem, no npm install for crypto. This page is the complete user-facing reference.

Each kernel module is reachable via its bare name. import Log works the same as import Std.Log as Log. The long Sky.Core.X / Std.X paths are kept for cross-language familiarity, but you can usually drop them.

Conventions you'll see throughout this page:

• Pure functions return bare values (a) — referentially transparent, deterministic.
• Fallible-pure functions return Result Error a or Maybe a — pure CPU work that can fail on malformed input.
• Effects return Task Error a — anything that touches the outside world (clock, env, stdout, disk, network, DB, entropy).
• Default-supplied helpers stay bare even when the underlying op could fail — the default plugs the failure case at the call site.

See the Effect Boundary doctrine for the full reasoning.

Pure modules (no I/O, no Task wrap)

Basics — auto-imported essentials

Implicitly available everywhere via Sky.Core.Prelude exposing (..). Nothing to import.

String — text manipulation

import Sky.Core.String as String

main =
    println (String.toUpper "hello")          -- "HELLO"
        ++ println (String.fromInt 42)        -- "42"
        ++ println (String.split "," "a,b,c") -- ["a","b","c"]

All 33 entries: length, isEmpty, reverse, append, concat, split, join, replace, slice, contains, startsWith, endsWith, toInt, fromInt, toFloat, fromFloat, toUpper, toLower, trim, trimStart, trimEnd, repeat, padLeft, padRight, lines, words, fromChar, toList, fromList, casefold, equalFold, isEmail, isUrl.

List — sequences

import Sky.Core.List as List

doubled = List.map (\n -> n * 2) [ 1, 2, 3 ]              -- [2, 4, 6]
sum     = List.foldl (\n acc -> n + acc) 0 [ 1, 2, 3 ]    -- 6
evens   = List.filter (\n -> modBy 2 n == 0) [ 1, 2, 3, 4 ] -- [2, 4]

map, filter, foldl, foldr, length, head, tail, take, drop, append, concat, concatMap, reverse, member, any, all, range, zip, isEmpty, indexedMap, find, cons.

v0.17 closed Limitation #8 — all 13 list ops in scope now run on constant Go stack. foldl / find / any / all / member / drop / reverse plus length / range / zip / concatMap / indexedMap are auto-TCO'd (tail-recursive helper compiled to for { ... continue }). map / filter / foldr / concat / take / append / Maybe.combine / Result.combine were CPS-rewritten in v0.17 to delegate through the same constant-stack form. Million-entry lists are safe across the surface.

Dict — key-value maps

import Sky.Core.Dict as Dict

prefs = Dict.fromList [ ("theme", "dark"), ("lang", "en") ]
theme = Dict.get "theme" prefs   -- Just "dark"

empty, insert, get, remove, member, keys, values, toList, fromList, map, foldl, union, size, isEmpty.

Key types. The runtime representation is map[string]V regardless of the Sky-level key type, so keys are encoded to strings on the way in. Lookup (get / member / insert / remove) encodes the probe the same way and works for any key type; the operations that hand the key back — toList, keys, values, foldl, map — decode it to its Sky type, and String, Int, Float, Char and Bool decode. Enumeration is ordered by the decoded key, so a Dict Int v visits 9 before 10.

The encoded key carries its own type tag, so the decode works with no type information from the call site — a helper written over Dict k v, where the compiler has erased the key, hands back Ints from a Dict Int v just as a Dict Int v-typed call site does. A Dict String v is encoded verbatim, so the shape that crosses into JSON objects, Std.Db rows and HTTP headers keeps exactly the keys you gave it.

Composite keys (tuple, list, record, custom type) do not decode — their stringification is not reversible; see KNOWN_LIMITATIONS.md.

Set — unique-element collections

empty, insert, remove, member, union, diff, intersect, fromList, toList, size.

Maybe — optional values

import Sky.Core.Maybe as Maybe

name : String
name = Maybe.withDefault "Anonymous" maybeName

withDefault, map, andThen, map2, map3, map4, map5, andMap, combine, isJust, isNothing.

Result — fallible computations

import Sky.Core.Result as Result

id = 
    case fallibleComputation of                                       
        Ok result ->                                                    
            println result                                              
                                                                          
        Err e ->                                                    
            println ("computation failed: " ++ Error.toString e) 

withDefault, map, andThen, mapError, map2, map3, map4, map5, andMap, combine. The Result → Task bridges live on Task (Task.fromResult / Task.andThenResult) — see Result/Task bridges.

Math — numerical functions

sqrt, pow, abs, floor, ceil, round, sin, cos, tan, pi, e, log, min, max.

Regex — pattern matching

import Sky.Core.Regex as Regex

match : Bool
match = Regex.match "^[a-z]+$" "hello"   -- True

match, find, findAll, replace, split.

Char — character predicates

isUpper, isLower, isDigit, isAlpha, toUpper, toLower.

Path — file path manipulation

base, dir, ext, isAbsolute. (For joining paths, use string concatenation with String.append or interpolation — the Sky-source surface is intentionally minimal; reach for Sky.Ffi.callPure "path/filepath.Join" if you need Go's full path API.)

Crypto — hashes, MAC, signatures, entropy

import Sky.Core.Crypto as Crypto

digest = Crypto.sha256 "hello"   -- hex string
hmac   = Crypto.hmacSha256 "secret" "message"

Bytes — byte-buffer helpers (Sky.Core.Bytes)

type alias Bytes = String — Go strings ARE byte sequences; Bytes is a typed alias for documenting "this string holds raw bytes, not text". Same value at runtime as the underlying String so passing back and forth costs nothing.

Jwt — JSON Web Tokens

import Sky.Core.Jwt as Jwt

token =
    Jwt.encode (Jwt.hs256 secret)
        (Jwt.claims
            |> Jwt.issuer "my-app"
            |> Jwt.subject "user-1"
            |> Jwt.expiresAt 1999999999
        )
-- token : Result Error String

payload = Jwt.decode (Jwt.hs256 secret) now token
-- → Result Error String (the verified payload JSON)

encode / decode support HS256 (HMAC) and RS256 (RSA — what GitHub Apps and service accounts sign with). decode verifies the signature and the exp / nbf claims against the now you pass (unix seconds), then returns the payload JSON — decode it further with Sky.Core.Json.Decode.

Encoding — base64, URL, hex

import Sky.Core.Encoding as Encoding

encoded = Encoding.base64Encode "hello"            -- "aGVsbG8="
decoded = Encoding.base64Decode encoded            -- Result Error String
urlSafe = Encoding.urlEncode "https://example.com/?q=hello world"

base64Encode, base64Decode, urlEncode, urlDecode, hexEncode, hexDecode. Encode functions return bare strings; decode functions return Result Error String.

Json.Encode / Json.Decode — JSON

import Sky.Core.Json.Encode as Enc
import Sky.Core.Json.Decode as Dec

-- Encode
payload =
    Enc.encode 0
        (Enc.object
            [ ( "name", Enc.string "Alice" )
            , ( "age", Enc.int 30 )
            ]
        )

-- Decode
case Dec.decodeString (Dec.field "name" Dec.string) payload of
    Ok name -> name
    Err _   -> "anonymous"

For long records use the pipeline form:

import Sky.Core.Json.Decode.Pipeline as Pipeline

userDecoder =
    Dec.succeed User
        |> Pipeline.required "id"   Dec.int
        |> Pipeline.required "name" Dec.string
        |> Pipeline.optional "age"  Dec.int 0

Uuid — UUID generation + parsing

import Sky.Core.Uuid as Uuid

myId : String
myId = Uuid.v4   -- "f47ac10b-58cc-4372-a567-0e02b2c3d479"

v4 (random), v7 (time-ordered), parse (validate string).

Std.Decimal — arbitrary-precision decimal arithmetic

import Std.Decimal as Dec

For money, billing, tax, invoices — anything where exact fractional value matters. Decimal is opaque; backed by shopspring/decimal at the runtime, so 0.1 + 0.2 == 0.3 exactly.

Std.Money — currency-aware Money built on Decimal

import Std.Money as Money exposing (Money, Currency)

ISO 4217 minor-unit awareness (JPY=0dp, USD=2dp, BHD=3dp). Currency is a typed enum of 50+ codes (USD, EUR, GBP, JPY, CHF, AUD, CAD, …, BTC, ETH, USDT, USDC) plus CurrencyRaw String for the long tail. All arithmetic enforces currency match.

Std.Time — IANA-zone helpers complementing kernel Time

import Std.Time as Stime

Embedded time/tzdata, so it works in containers without /usr/share/zoneinfo. Note the import alias Stime rather than Time — the kernel Time already owns that name. Zones are IANA strings ("UTC", "America/New_York", "Asia/Tokyo"); a bad zone name returns Err Error. Timestamps are unix-millis Int, matching Time.unixMillis. 32 entries.

Effects (Task Error a)

These touch the outside world. They compose uniformly — Task.parallel, Cmd.perform, Task.andThen.

Task — the effect monad

import Sky.Core.Task as Task

main =
    Task.succeed 42
        |> Task.andThen (\n -> println (String.fromInt n))
        |> Task.run

Cmd / Sub — Sky.Live commands and subscriptions

import Std.Cmd as Cmd
import Std.Sub as Sub

update msg model =
    case msg of
        LoadData ->
            ( { model | loading = True }
            , Cmd.perform (Http.get "/api/data") DataLoaded
            )

Time — clock + duration

import Sky.Core.Time as Time

now =
    Time.now
        |> Task.andThen (\t -> println (Time.formatISO8601 t))

now, unixMillis, sleep, every, format, formatISO8601, formatRFC3339, formatHTTP, addMillis, diffMillis, timeString.

For zone-aware formatting, parsing, calendar arithmetic, and period boundaries reach for Std.Time.

Random — pseudo-random generation

import Sky.Core.Random as Random

dice = Random.int 1 6   -- Task Error Int

int : Int -> Int -> Task Error Int (inclusive low/high) and float : Float -> Float -> Task Error Float. For cryptographic entropy use Crypto.randomBytes / Crypto.randomToken.

Http — HTTP client

import Sky.Core.Http as Http

response =
    Http.get "https://api.example.com/users"
        |> Task.map (\resp -> resp.body)
        |> Task.andThen println

-- HttpResponse is a typed record (v0.15.44+) — annotate and
-- destructure directly:
--   HttpResponse = { status : Int, body : String, headers : Dict String String }

HttpResponse is a typed record alias. Annotate handlers as resp : HttpResponse and read .status / .body / .headers directly — no opaque kernel boundary any more.

The builder API on HttpRequest covers custom headers, timeout, redirect policy:

req =
    Http.defaultRequest "https://api.example.com/v1/foo"
        |> Http.withMethod "POST"
        |> Http.withHeader "Authorization" ("Bearer " ++ token)
        |> Http.withBody jsonBody
        |> Http.withTimeout 60000              -- 60 s; 0 disables

Pair with Task.retryWith for flaky upstreams:

fetchData =
    Task.retryWith
        (Task.exponentialBackoff 5 500 |> Task.withJitter)
        (Http.request req)

get, post, request (custom method/headers/timeout). parseQuery parses a URL query string into a Dict String String (pure — backed by Go's net/url, proper percent-decoding).

For streaming response bodies (LLM completions, SSE, large downloads), use Sky.Core.Http.Stream:

import Sky.Core.Http.Stream as HttpStream exposing (StreamId, ChunkEvent(..))

-- Cmd.perform kicks off the request; chunks arrive via Sub.
( model, Cmd.perform (HttpStream.open req) StreamOpened )

-- subscriptions: attach `chunks` only while a stream is live.
subscriptions model =
    case model.activeStream of
        Just sid -> HttpStream.chunks sid Chunked
        Nothing  -> Sub.none

See docs/skylive/http-streaming.md for the full design + examples/28-streaming-chat for the canonical pattern.

WebSocket — bidirectional sockets (v0.15.46)

For bidirectional, long-lived connections (collab editor ops, multiplayer game state, bidirectional LLM chat, financial feeds), use Sky.Core.WebSocket (client) + Sky.Http.Server.WebSocket (server-side upgrade).

Client side (Sky.Core.WebSocket):

import Sky.Core.WebSocket as Ws exposing (WebSocketMessage(..))
import Sky.Core.Cmd as Cmd
import Sky.Core.Sub as Sub

-- Open the connection via Cmd.perform; the runtime returns a
-- typed `WebSocket` handle.
( model, Cmd.perform (Ws.connect "wss://api.example.com/feed") Connected )

-- Subscribe to incoming frames while the socket is live.
subscriptions model =
    case model.socket of
        Just sock ->
            Sub.batch
                [ Ws.onMessage sock GotFrame
                , Ws.onClose   sock SocketClosed
                ]

        Nothing ->
            Sub.none

-- Send a text frame.  Blocks up to 30 s if the write buffer is full.
update msg model =
    case msg of
        SendPing sock ->
            ( model, Cmd.perform (Ws.send sock "ping") Sent )

        GotFrame (Text text) ->
            -- handle incoming text frame
            ( { model | latest = text }, Cmd.none )

        GotFrame (Binary bytes) ->
            ( { model | latestBlob = bytes }, Cmd.none )

Server side (Sky.Http.Server.WebSocket): turn any Sky.Http.Server route into a WebSocket upgrade endpoint.

import Sky.Http.Server as Server
import Sky.Http.Server.WebSocket as Ws

handleWs : Request -> Task Error Response
handleWs req =
    Ws.upgrade req
        (Ws.defaultCfg
            |> Ws.withOnConnect (\sock ->
                Ws.sendToClient sock "welcome!")
            |> Ws.withOnMessage (\sock msg ->
                Ws.sendToClient sock ("echo: " ++ msg))
            |> Ws.withOriginPatterns
                [ "https://*.example.com" ]
        )

main =
    Server.listen 8000
        [ Server.get "/ws" handleWs
        ]

broadcast fans a single text frame across a list of peers and tolerates partial failure (one slow / dead peer doesn't poison the others — those connections are closed silently).

Stdlib-typed-record convention (v0.15.46+). Every public typed record (WebSocketCfg, WebSocketServerCfg, HttpRequest, …) ships with a default* constructor and one with* builder per field. Always build via the builders (Ws.defaultCfg "wss://x" |> Ws.withTimeout 5000) rather than record literals — adding a new optional field in a future patch release won't break your call sites.

See examples/33-websocket-echo for the canonical pattern.

File — filesystem

import Sky.Core.File as File

readme =
    File.readFile "README.md"
        |> Task.andThen (\content -> println content)

readFile, readFileLimit, readFileBytes, writeFile, append, mkdirAll, readDir, exists, remove, isDir, tempFile, tempDir, copy, rename.

exists / isDir return Task Error Bool (effects — the disk could be unmounted between successive calls). tempFile / tempDir create uniquely-named entries in the system temp dir and return the absolute path; caller is responsible for remove-ing when done.

Io — stdin / stdout / stderr

readLine, writeStdout, writeStderr — all Task Error …-typed. For password input with stdin echo disabled, use Sky.Cli.readPassword.

System — environment + arguments

import System

apiKey =
    System.getenvOr "API_KEY" ""    -- bare String (default supplied)

main =
    System.args
        |> Task.andThen (\args -> println ("Got " ++ String.fromInt (List.length args) ++ " args"))

System.exit has a polymorphic return so it works in any case branch — no need to make every other branch Task-shaped.

Env-var namespace prefix (v0.11.5+). Sky's internal runtime reads (Sky.Live, Std.Auth, Std.Log, Std.Db) use the SKY_ prefix by default — SKY_LIVE_PORT, SKY_AUTH_TOKEN_TTL, etc. Set [env] prefix = "FENCE" in sky.toml to switch the binary's namespace to FENCE_LIVE_PORT, FENCE_AUTH_TOKEN_TTL, etc. Useful when running multiple Sky binaries on the same host. User-supplied env-var names (passed to System.getenv) are unaffected — only Sky's internal reads route through the prefix.

Process — subprocess execution

import Sky.Core.Process as Process

result =
    Process.run "ls" [ "-la" ]
        |> Task.andThen (\output -> println output)

Process.run is the entire surface. (exit, getEnv, getCwd, loadEnv moved to System in v0.10.0.)

Db / Auth / Log

These are big enough to deserve their own pages:

• Std.Db overview — SQLite + Postgres, one API
• Std.Auth overview — bcrypt, JWT, register / login
• Std.Log — see below

Std.Codec + Std.Db.Store — codec-driven persistence (v0.19)

The recommended default for record-shaped tables: write ONE Codec per type (Std.Codec) and Std.Db.Store drives the schema, reads, and writes — no hand-written SQL, no row mappers. The same codec also serves JSON.

• Std.Codec — Codec.auto blank reflection-derives from a zero-value witness (scalars → columns, Maybe → nullable, list/nested/ADT → JSON blob, nullary enum → readable name); snake_case columns/keys by default (Codec.autoCamel keeps camelCase). Codec.autoWith [ ("active", intBool) ] blank overrides specific fields' codecs while auto-deriving the rest (a Bool stored 0/1, a custom enum format) — no full hand-written codec for a one-field tweak. toJson / fromJson / fromJsonSafe; explicit object/field/taggedUnion/enum for full control. Pure Sky.
• Std.Db.Store — fromCodec |> primaryKey/serial/unique/defaultNow/ touchOnUpdate/defaultWith/generated (schema), insert/insertMany/update/ updateWhere/upsert/delete/deleteWhere (writes), setFields/updateFields (partial-column PATCH — SET only the named columns, by PK or Cond) + adjust (atomic SET col = col + delta for counters/stock/balances), all/findBy + the composable query builder (where_/and_/or_/order/limit/toList/count) + selectRaw codec sql params for typed JOIN/aggregate reads. Deliberately a single-table mapper, not an ORM.

Full walkthrough: Std.Db overview → Std.Db.Store. Exact signatures: sky doc Std.Db.Store · sky doc Std.Codec.

Std.Db.Decode — typed DB row decoders (v0.15.45)

Mirror of Sky.Core.Json.Decode's combinator shape but targets SQL row maps instead of JSON values. Replaces the Db.getString "field" row / Db.getInt "field" row boilerplate with declarative decoders.

import Std.Db.Decode as DbDecode

type alias User =
    { id : Int, name : String, email : String, age : Maybe Int }

userDecoder : Decoder User
userDecoder =
    DbDecode.succeed (\i n e a -> { id = i, name = n, email = e, age = a })
        |> DbDecode.andMap (DbDecode.int "id")
        |> DbDecode.andMap (DbDecode.string "name")
        |> DbDecode.andMap (DbDecode.string "email")
        |> DbDecode.andMap (DbDecode.nullable (DbDecode.int "age"))

users : Db -> Task Error (List User)
users db = Db.queryDecode db "SELECT id, name, email, age FROM users" [] userDecoder

userById : Db -> Int -> Task Error (Maybe User)
userById db uid = Db.getByIdDecode db "users" uid userDecoder

Surface: string / int / float / bool / money / nullable (per-column primitives), succeed / fail, map / andThen / andMap, map2 / map3 / map4 / map5, required / optional (pipeline-style). See docs/skydb/overview.md for the full decoder pipeline pattern.

Std.Db.SqlValue — typed SQL parameter binding (v0.16.26)

Mixed-type SQL params (INSERT … VALUES (?, ?, ?) with a String + Maybe Int + Bool tuple) flow through Db.exec / Db.query as a homogeneous List SqlValue with full per-column type fidelity to the driver. Closes the no-stringify gap — the recursive SqlNull SqlValue carries a type-witness so the driver knows what column type to bind NULL as.

import Std.Db as Db exposing (SqlValue(..), SqlField(..))
import Std.Money as Money

-- INSERT with mixed types
saveOrder : Db -> Int -> String -> Money -> Maybe Int -> Task Error Int
saveOrder conn orderId customer total maybePaidAt =
    Db.exec conn
        "INSERT INTO orders (id, customer, total, paid_at) VALUES (?, ?, ?, ?)"
        [ SqlInt orderId
        , SqlString customer
        , SqlMoney total
        , Db.fromMaybeTime maybePaidAt   -- nullable column
        ]

-- PATCH-style partial update — only SetField columns appear in the SQL
updateOrder : Db -> Int -> Maybe String -> Bool -> Task Error Int
updateOrder conn orderId maybeStatus refunded =
    Db.updateFields conn "orders"
        [ ("id", SqlInt orderId) ]                                       -- WHERE
        [ ( "status"
          , case maybeStatus of
                Just s  -> SetField (SqlString s)
                Nothing -> OmitField                                     -- leave alone
          )
        , ( "refunded", SetField (SqlBool refunded) )
        ]

Variants (9 total) — SqlString / SqlInt / SqlFloat / SqlBool / SqlBytes / SqlDecimal / SqlTime / SqlMoney / SqlNull SqlValue. Money serialises lossless as "ISO_CODE AMOUNT" TEXT; round-trip via Db.Decode.money. Maybe-lifting helpers: fromMaybeString / fromMaybeInt / fromMaybeFloat / fromMaybeBool / fromMaybeBytes / fromMaybeDecimal / fromMaybeTime / fromMaybeMoney. SqlField (SetField SqlValue | OmitField) for partial updates via Db.updateFields and DEFAULT-omittable INSERTs via Db.insertFields (#585) — OmitField columns drop from the SQL so the database applies their DEFAULT; all-omit → INSERT … DEFAULT VALUES. Db.insertFieldsReturning table fields projection decoder (#586) appends RETURNING <projection> to the same builder and decodes each returned row via Std.Db.Decode — for picking up assigned autoincrement ids / applied DEFAULTs / generated columns at INSERT time (SQLite ≥ 3.35 / PostgreSQL).

Log — structured logging

import Std.Log exposing (println)
import Std.Log as Log

-- Simple println — auto-forced by `let _ =` discard
let
    _ = println "Starting up"
    _ = Log.info "Connection established"
in
    continue

-- Structured (key-value pairs)
Log.infoWith "user logged in" [ "userId", "42", "ip", "1.2.3.4" ]

SKY_LOG_FORMAT (plain | json) and SKY_LOG_LEVEL (debug | info | warn | error) control output format and threshold. Configure defaults in sky.toml [log] format = "json". See Logging precedence.

Trace — opt-in application tracing spans

import Std.Trace as Trace

checkout : Cart -> Task Error Receipt
checkout cart =
    Trace.span "checkout"
        (reserveStock cart
            |> Task.andThen chargeCard
            |> Task.andThen issueReceipt)

Tier-1 spans (HTTP request, session load/save, Msg dispatch, DB / Auth / Http / File operations) are emitted automatically by the runtime — you only reach for Std.Trace when you want a named application-level span that groups the auto-spans underneath.

Spans surface in /_sky/console's Trace tab and export to OpenTelemetry when OTEL_EXPORTER_OTLP_ENDPOINT is set. See observability docs for the full model.

Markdown — render markdown to Std.Ui

import Std.Markdown as Markdown

view model =
    Ui.column []
        [ Ui.text model.title
        , Markdown.render model.body          -- → Element msg
        ]

Renders straight into Std.Ui Element trees (no HTML round-trip), so text, headings, lists, blockquotes and images take colour and typography from the surrounding theme. Code blocks, inline code, tables and rules carry a fixed dark palette of their own and will not follow a light theme.

Subset is "chat-grade": headings (#-######), paragraphs, fenced code, bullet lists (- / *), ordered lists (any <digits>. ), horizontal rules (a run of 3+ of - / * / _), blockquotes (> ), tables (pipe syntax with a | --- | separator row), **bold** / *italic* / `code` / [text](url) / ![alt](url).

Deliberate behaviours: an ordered list is renumbered from 1; a code fence's info string (```rust) is dropped; a table's alignment colons parse but do not change alignment; emphasis is delimiter-only (no _underscore_, no backslash escapes, no ***bold-italic***, no reference links, no autolinks, no setext === headings); a blockquote's lines join into one paragraph and nested > levels are not distinguished.

Not supported, declared with a dated expiry that rust/crates/project/tests/declared_stdlib_gaps.rs enforces — the test goes red on its own when a date arrives: footnotes (needs a two-pass document model), math (needs a formula renderer Std.Ui has no primitive for), mermaid (needs a graph layout engine; ```mermaid renders as an ordinary code block meanwhile), and a hard line break from a trailing double space (needs a Std.Ui line-break primitive that does not exist — note this was documented as supported until v0.20.1 and never was). Raw HTML is unsupported by design and permanently: the untrusted-input guarantee below is exactly the statement that this parser cannot emit it.

Safe with untrusted input — never emits raw HTML or event handlers; every node routes through typed Std.Ui constructors, and a link's URL is neutralised by the renderer, so a javascript: / vbscript: / non-image data: href becomes about:blank. (Before v0.20.1 the href was NOT filtered: [x](javascript:alert(1)) reached the page verbatim, because HTML-escaping does not help against a payload that needs no metacharacter.)

Stdlib quality-of-life batch (v0.15.47)

Seven additions covering the modules every production Sky app reinvents today. Each ships under the v0.15.46 typed-record convention — every record carries a default* constructor + with* builder helpers so future field additions never break downstream record literals.

Std.Cache — LRU + TTL in-memory cache

import Std.Cache as Cache

cfg : Cache.CacheCfg
cfg =
    Cache.withTTL 60000 (Cache.withMaxEntries 10000 Cache.defaultCfg)

usersCache : Task Error (Cache String User)
usersCache = Cache.new cfg

-- ...
Cache.get cache "alice"           -- Task Error (Maybe User)
Cache.put cache "alice" newUser   -- Task Error ()
Cache.stats cache                 -- { hits, misses, evictions }

Backed by hashicorp/golang-lru/v2. Lazy TTL: expired entries are pruned on next access (no background goroutine to leak).

Std.Email — Resend / SES / SendGrid / SMTP under one API

import Std.Email as Email

provider = Email.Resend (System.getenvOr "RESEND_API_KEY" "")

msg = Email.defaultMessage
        { from = "noreply@example.com"
        , to = [ "alice@example.com" ]
        , subject = "Hi"
        }
        |> Email.withTextBody "Hello, world!"

Email.send provider msg     -- Task Error String (provider message ID)

SKY_EMAIL_DRY_RUN=1 short-circuits every provider for unit tests. SKY_EMAIL_ENDPOINT_<PROVIDER> (UPPERCASE) overrides the URL when pointing at a local mock.

Attachments are delivered by all four providers. withAttachment adds one; SMTP and SES send a multipart/mixed MIME message (base64, so arbitrary bytes survive), Resend and SendGrid send the provider's own base64 attachment array. An attachment with no mimeType goes out as application/octet-stream. A message carrying BOTH withTextBody and withHtmlBody is sent as multipart/alternative — both bodies reach the recipient, and the client picks.

Std.Compression — gzip + zstd

import Std.Compression as Compression

compressed : Task Error String
compressed = Compression.gzip "large payload"

Compression.zstdCompress payload    -- Task Error String
Compression.zstdDecompress encoded  -- Task Error String

compress/gzip (stdlib) + klauspost/compress/zstd.

Std.Csv — RFC 4180 encode/decode + streaming reader

import Std.Csv as Csv

case Csv.parse "name,age\nAlice,30\nBob,25\n" of

    Ok csv ->
        -- csv.header : List String, csv.rows : List (List String)
        ...

    Err _ ->
        ...

-- Stream a large file row-by-row:
Csv.parseStreamFromFile "users.csv"    -- Task Error (List (List String))

Sky.Core.Random — range, weighted, shuffle, seeded*

Random.range 1 100              -- Task Error Int (inclusive both ends)
Random.weighted [ (0.7, "a"), (0.3, "b") ]
                                -- Task Error (Maybe a)
Random.shuffle [1, 2, 3, 4, 5]  -- Task Error (List a)

-- Deterministic, reproducible:
s0 = Random.seed 42
( v, s1 ) = Random.seededInt s0 1 100
( f, s2 ) = Random.seededFloat s1

Seeded variants thread a Seed state via splitmix64 — same seed produces the same sequence across runs (use for tests and content generation).

String.containsIn / startsWithIn / endsWithIn — pipeline-friendly

Haystack-first companions to the existing needle-first helpers:

"hello world" |> String.containsIn "world"      -- True
"/api/users"  |> String.startsWithIn "/api"     -- True
"image.png"   |> String.endsWithIn ".png"       -- True

String.contains / startsWith / endsWith stay for backwards compatibility.

Std.Config — typed TOML / YAML / JSON decoders

Mirror of Sky.Core.Json.Decode's shape — code that already decodes JSON gets a consistent vocabulary for TOML and YAML:

import Std.Config as Config

dbDecoder : Decoder DbCfg
dbDecoder =
    Config.field "host" Config.string
        |> Config.andThen (\h ->
            Config.map (\p -> { host = h, port = p })
                (Config.field "port" Config.int))

Config.loadFromFile "config/database.toml" dbDecoder
    -- Task Error DbCfg (extension dispatch: .toml/.yaml/.yml/.json)

TOML via BurntSushi/toml, YAML via gopkg.in/yaml.v3, JSON via the stdlib encoding/json.

Naming-consistency surface (v0.15.48)

Three additive batches improving discoverability without disturbing any existing public types or function names.

Sky.Core.ToString — uniform fromX naming

import Sky.Core.ToString as ToString

ToString.fromInt   42      -- "42"   — routes to String.fromInt
ToString.fromFloat 3.14    -- "3.14" — routes to String.fromFloat
ToString.fromBool  True    -- "True"
ToString.fromTime  ms      -- canonical Time.timeString

Zero runtime overhead — the bindings are tail-call aliases to the existing kernels. The point is editor + sky doc discoverability: AI-written code is encouraged to default to ToString.fromInt n rather than memorising which sub-namespace each type lives under. The canonical kernel-direct call (String.fromInt, Time.timeString) stays available for code that prefers the explicit shape.

Std.Auth.signTokenWithClaims / verifyTokenWithAlgorithm

The arity-3 Auth.signToken : String -> a -> Int -> Result Error String shape stays canonical for the simple secret + claims + expiry case. For richer JWT shapes, reach for the typed-builder companion:

import Std.Auth as Auth
import Sky.Core.Jwt as Jwt

token : Result Error String
token =
    Auth.signTokenWithClaims
        (Jwt.rs256 privateKeyPem)
        (Jwt.claims
            |> Jwt.subject "user-42"
            |> Jwt.audience "https://api.example.app"
            |> Jwt.expiresAt (now + 86400)
            |> Jwt.jwtId tokenId
            |> Jwt.withClaim "scope" "admin"
        )

verified : Result Error String   -- raw JSON claims string
verified = Auth.verifyTokenWithAlgorithm (Jwt.hs256 "secret") now token

Std.Time *Utc infallible companions

Every zone-aware String -> Int -> Result Error _ ships a Int -> _ UTC variant for server-internal timestamp work that doesn't need TZ-awareness:

The UTC variants plug "UTC" (always-valid IANA zone) at the call site, so the Result Error _ wrap collapses to the bare value. Reach for them in logs / audit rows / server-internal timestamp arithmetic. For user-facing UI, keep using the zone-aware form.

Arity-0 consistency surface (v0.15.50)

Pre-v0.15.50 the stdlib was inconsistent about whether arity-0 helpers took ():

For new code preferring a uniform Pure.foo () shape, reach for Sky.Core.Pure. Every entry is a typed () -> Task Error a companion that re-routes to the canonical kernel — same runtime performance, but one consistent call shape:

import Sky.Core.Pure as Pure
import Sky.Core.Task as Task
import Std.Log exposing (println)

main =
    Pure.systemCwd ()
        |> Task.andThen (\cwd  -> Pure.uuidV4 ())
        |> Task.andThen (\uuid -> Pure.timeNow ())
        |> Task.andThen (\now  -> println (String.fromInt now))

Full Pure.* surface (9 entries):

Pure.uuidV4         : () -> Task Error String
Pure.uuidV7         : () -> Task Error String
Pure.timeNow        : () -> Task Error Int
Pure.timeUnixMillis : () -> Task Error Int
Pure.systemArgs     : () -> Task Error (List String)
Pure.systemCwd      : () -> Task Error String
Pure.systemLoadEnv  : () -> Task Error ()
Pure.ioReadLine     : () -> Task Error String
Pure.dbConnect      : () -> Task Error Db

Inclusion criterion: a stdlib binding belongs to Sky.Core.Pure when (a) it takes no real Sky-level argument that disambiguates the call AND (b) it returns a Task Error a — i.e. entropy / clock / env / I/O / database-connection surfaces where the inconsistency bit users most often. Non-zero-arg helpers like Random.int, Crypto.randomToken, System.exit, Process.run are NOT candidates — their argument list carries semantic information.

Existing names + shapes are unchanged (per the v0.15.44 backwards-compat lesson). Pure.* is purely additive — call sites preferring the legacy convention keep working exactly as before.

Web modules

Server — Sky.Http.Server

import Sky.Http.Server as Server

main =
    Server.listen 8000
        [ Server.get "/" (\_ -> Task.succeed (Server.text "Hello!"))
        , Server.get "/api/users/:id" getUser
        , Server.post "/api/data" handlePost
        , Server.static "/assets" "./public"
        ]

Routing: get, post, put, delete, any, static, group (prefix), use (middleware), listen.

Extractors (Layer 3 Sky source — Sky.Http.Server.sky): param (path :id), queryParam, header, getCookie. Kernel-side extras: formValue, body, path, method.

Responses: text, json, html, withStatus, redirect, cookie, withCookie, withHeader.

Live — Sky.Live (server-driven UI)

import Sky.Live as Live

main =
    Live.app
        (Live.config
            { init = init
            , update = update
            , view = view
            , subscriptions = subscriptions
            , routes = [ Live.route "/" HomePage ]
            , notFound = HomePage
            }
        )
    -- v0.19: the app config is a typed builder — optional fields attach with
    -- `|> Live.withHead …` / `withGuard` / `withAnalytics` / `withStatic` / … .

See Sky.Live overview for the full TEA flow.

Std.Live.Head — per-page <head> injection (v0.15.58+)

Optional per-page <head> injection — attach via Live.withHead (a Model -> List (Html msg)). Runtime renders the list and splices it into <head> on every full GET, after the runtime's required baseline meta tags and before the inline <style> reset. Absent field → empty insert (byte-identical to pre-v0.15.58 output).

import Std.Live.Head as Head

headFor model =
    [ Head.title (titleFor model.page)
    , Head.meta "description" (descriptionFor model.page)
    , Head.canonical (canonicalFor model.page)
    , Head.metaProperty "og:title" (titleFor model.page)
    , Head.themeColor "#1a1a2e"
    , Head.jsonLd (jsonLdFor model.page)
    ]

Helpers (all return Html msg):

SSE patches scope to <body>, so head updates require a full reload — fine for the typical case (head depends on page identity, which changes via sky-nav navigation that already does a full-body fetch + history push).

Std.Webview — desktop UI backend (v0.16+)

The cross-backend mirror of Live.app and Tui.app — same TEA shape (init / update / view / subscriptions), view : model -> Html returns a post-Ui.layout Element tree, and the runtime opens a native window (WKWebView on macOS in v0.1; Linux + Windows in v0.2). No HTTP server, no SSE, no session store — the bridge is in-process Bind + Eval via webview_go.

import Std.Webview as Webview

main =
    Webview.app
        { init = init
        , update = update
        , view = view
        , subscriptions = subscriptions
        , window =
            Webview.defaultWindow
                |> Webview.withTitle "Sky Stopwatch"
                |> Webview.withSize 800 600
        }
        |> Task.run

WindowCfg v0.1 is { title : String, size : (Int, Int) }; v0.2 reopens for alwaysOnTop / transparent / decorated + adds tray icons, native file dialogs, global hotkeys, and Linux + Windows smoke validation. Build it via defaultWindow + withTitle + withSize builders so future field additions stay source-compat.

sky build auto-detects Sky.Webview projects and flips CGO_ENABLED=1 on the first build pass; the stub runtime-go/rt/webview_stub.go covers !cgo || !darwin so non-macOS builds link cleanly and surface a runtime Err Error on call. Example: examples/31-webview-stopwatch-ui.

Event — typed DOM event bindings (Std.Html.Events)

v0.13: Std.Html.Events (renamed from Std.Live.Events). Each builder returns an Attribute msg carrying a typed Event msg, so the compiler flags a handler-shape mismatch (onInput bound to a msg instead of a String -> msg) at the call site. onClick, onInput, onChange, onSubmit, onFocus, onBlur, onMouseOver, onMouseOut, onKeyDown, onKeyUp, onKeyPress, onCheck, onImage (with fileMaxWidth / fileMaxHeight / fileMaxSize), onFile, on (generic escape hatch).

Html — HTML elements

v0.13: a typed Sky-source stdlib module. ~75 element builders returning the typed Html msg ADT (text, div, span, p, h1-h6, a, button, input, form, table, tr, td, …). render : Html msg -> String for server-side rendering; raw for trusted un-escaped HTML.

Attr — HTML attributes (Std.Html.Attributes)

v0.13: ~60 builders returning the typed Attribute msg ADT, so the compiler rejects disabled "yes" / rows "five". String-valued (class, id, href, src, style, …), Int-valued (rows, cols, width, height, tabindex, …), Bool-valued (checked, disabled, required, readonly, autofocus, …). type_ (keyword clash with type). attribute / dataAttribute / boolAttribute escape hatches; none : Attribute msg for the False branch of a conditional attr.

Css — typed stylesheets

v0.13: a typed Sky-source stdlib module — typed where the value space is bounded, String + rawProp escape hatch where it is not.

import Std.Css as Css

myStyles =
    Css.stylesheet
        [ Css.rule ".btn"
            [ Css.display Css.Flex          -- keyword enum
            , Css.padding (Css.rem 0.5)     -- Length
            , Css.background (Css.hex "3b82f6")  -- Color
            , Css.color (Css.hex "ffffff")
            , Css.cursor Css.Pointer
            ]
        ]

Length ADT (px, rem, em, pct, vh, vw, ch, fr, num, zero (), auto (), lengthRaw, calc, minmax), Color ADT (hex, rgb, rgba, hsl, hsla, transparent (), currentColor (), colorRaw), keyword enums (Display, Position, Cursor, FontWeight, FlexDirection, Align, Overflow, …). Open-ended compound properties (transition, transform, gridTemplateColumns, fontFamily, border, …) take a String. rule / media / keyframes / stylesheet / styles (inline) / property / rawProp.

Bare keyword constants (Css.zero, Css.auto, Css.none, Css.transparent) take () to sidestep zero-arity memoisation — write Css.margin (Css.zero ()). See Limitation 13.

Ui — typed no-CSS layout DSL

A typed layout DSL. Build a UI from typed primitives and typed attributes — Sky.Ui renders to inline-styled HTML on the server side and Sky.Live's wire ferries diffs to the browser. No CSS files, no template languages, no client framework.

import Std.Ui as Ui
import Std.Ui.Background as Background
import Std.Ui.Border as Border
import Std.Ui.Font as Font

view model =
    Ui.layout []
        (Ui.row
            [ Ui.spacing 12, Ui.padding 16
            , Background.color (Ui.rgb 255 102 0)
            , Font.color (Ui.rgb 255 255 255)
            , Border.rounded 4
            ]
            [ Ui.button [] { onPress = Just Decrement, label = Ui.text "−" }
            , Ui.el [ Font.size 24, Font.bold ] (Ui.text (String.fromInt model.count))
            , Ui.button [] { onPress = Just Increment, label = Ui.text "+" }
            ])

Layout primitives: el / row / column / wrappedRow / grid / paragraph / textColumn / text / none / button / input / form / link / image / html / layout (wrappedRow lets children wrap to a new line via flex-wrap: wrap; grid is CSS-Grid auto-fit — set min column width via Ui.gridColumns N, use this NOT wrappedRow when children contain <img> because flex-wrap collapses to 1-per-row in that case). Length: px Int / fill (bare) / fillPortion Int / content / shrink / minimum Int Length / maximum Int Length / vh Int / vw Int (vh / vw are viewport-relative — useful for Ui.height (Ui.vh 100) shells). Padding: padding / paddingXY / paddingEach / spacing. Alignment: centerX / centerY / alignLeft / alignRight / alignTop / alignBottom / pointer. Overflow: clip / clipX / clipY / scrollbars / scrollbarX / scrollbarY. Nearby (overlays): above / below / onLeft / onRight / inFront / behind. Attributes: width / height / style / class / htmlAttribute / name. Events: onClick / onSubmit / onInput (typed String→msg) / onChange / onFocus / onMouseOver / onMouseOut / onKeyDown / onFile / onImage. File hints: fileMaxSize / fileMaxWidth / fileMaxHeight. Colour: rgb / rgba / white / black / transparent.

Sub-modules:

• Std.Ui.Background — color / image url / linearGradient angle stops / gradient css
• Std.Ui.Border — color / width / widthEach {top, right, bottom, left} / rounded / solid / dashed / dotted / shadow {offsetX, offsetY, blur, spread, color} / glow blur color / innerShadow {…}
• Std.Ui.Font — color / family / size / weight / bold / semiBold / regular / light / extraBold / black / italic / underline / noDecoration / lineThrough / overline / letterSpacing em / wordSpacing em / alignLeft / alignRight / alignCenter / center / justify / sansSerif / serif / monospace
• Std.Ui.Region — heading n / mainContent / navigation / footer / aside / label text / announce / announceUrgently (the renderer dispatches <h1>..<h6> / <main> / <nav> / <footer> / <aside> from the Description, and emits aria-label / aria-live for the rest)
• Std.Ui.Input — typed form controls: button / text / multiline / email / username / search / currentPassword {show: Bool} / newPassword {show: Bool} / checkbox / radio {options, selected, …} / radioRow {…} / slider {min, max, step, value, …} + option value labelEl (RadioOption ctor) + labelAbove / labelBelow / labelLeft / labelRight / labelHidden / placeholder
• Std.Ui.Lazy — lazy / lazy2..lazy5. Real memoisation, not no-op wrappers. The Sky bodies (sky-stdlib/Std/Ui/Lazy.sky) are kernel-mapped (rust/crates/lower/src/kernel.rs:583-587) to a bounded LRU in runtime-go/rt/lazy.go, keyed on the function pointer plus an injective fingerprint of each argument. Four things to know before reaching for it:
  • A hit saves only your Element construction. The cache holds the Element ADT (Lazy.sky:25 returns Element msg), not rendered HTML — so a cache hit still pays renderElement, HtmlToVNode, assignSkyIDs, the four style walks and renderVNode. See docs/perf/skylive-interaction-cost.md → "Every pass over the tree".
  • The key costs a full reflective deep walk, on hits as well as misses. lazyKey (rt/lazy.go:148) calls identityKey (rt/identity_key.go) per argument, which reflectively walks the whole value (depth-bounded at 512). For a large argument the key can cost more than rebuilding the subtree.
  • The LRU is process-wide, behind one mutex, capped at 1024 entries (rt/lazy.go:44-49; override with SKY_UI_LAZY_CAP). It is shared across every session, so a busy multi-session app can evict one session's entries with another's.
  • The function is keyed by pointer address (%p, rt/lazy.go:150). A stable top-level binding — Lazy.lazy renderItem item — is the intended shape and hits. A locally-constructed closure gets a fresh address each render and will never hit.
• Std.Ui.Keyed — keyed (emits sky-key for diff identity)
• Std.Ui.Responsive — classifyDevice / adapt {phone, tablet, desktop}
• Std.Ui.Chart — typed chart primitives (v0.16.0). line / area / bar / sparkline / heatmap accept typed Series records ({label, color, points : List Point}) and render to inline-styled SVG. Pair with Ui.layoutWith to embed in dashboards (used by the bundled Sky Console + examples/26-ui-showcase). XSS-hardened: all axis ticks + tooltip labels HTML-escape through the same renderer as text content; no innerHTML, no data-sky-eval.
• Std.Ui.Animation — typed CSS keyframe animation DSL (v0.15.57). Build via defaultSpec "fadeIn" |> withDuration 500 |> withEasing easeOut |> withKeyframes [(0, [Transform.opacity 0.0]), (100, [Transform.opacity 1.0])] + Animation.attribute spec. Auto-wrapped in @media (prefers-reduced-motion: no-preference) by default; opt out via withRespectReducedMotion False only when motion is semantically required (loading spinner, progress indicator).
• Std.Ui.Transition — typed CSS transitions (v0.15.57). Transition.attribute [property "background-color", duration 200, easing easeOut] pairs with Background.hoverColor so the browser animates between base + :hover states. Also auto-wrapped in the reduced-motion guard. Use attributeUnsafe to opt out.
• Std.Ui.Transform — typed transform: property helpers used by Animation/Transition (translateX / translateY / translate / scale / scaleXY / rotate / skewX / skewY / opacity). All transform-shaped helpers join into ONE transform: shorthand per keyframe; opacity emits standalone.
• Std.Ui.Grid — explicit CSS-grid track lists (v0.15.57). Typed Track ADT (fr / px / auto / minContent / maxContent / minmax / repeat / repeatAutoFit / repeatAutoFill) + Grid.columns / Grid.rows / Grid.tracks. Use when Ui.gridColumns N (auto-fill) is too coarse — e.g. sidebar layouts ([fr 1, px 200, fr 1]), content-aware columns ([auto, fr 1]), responsive card grids ([repeatAutoFit (minmax (px 240) (fr 1))]).

Best-practice for forms with sensitive inputs (passwords, API keys): wrap inputs in Ui.form and dispatch on onSubmit DoSignIn with a typed record. Do NOT wire onInput on the password field — that would dispatch the secret on every keystroke into Model and through every session-store write. See Sky.Ui overview for the full pattern.

File / image upload: Ui.onImage auto-resizes to fileMaxWidth × fileMaxHeight (default 1200×1200) and re-encodes as JPEG @ 0.85 quality before sending; Ui.onFile ships the raw data URL. Both honour fileMaxSize for client-side caps. See Sky.Ui overview.

Full reference, surface-coverage table, known limitations: Sky.Ui overview.

RateLimit — request throttling

import Sky.Http.RateLimit as RateLimit

if RateLimit.allow "login" clientIp 5 1 then
    handleLogin req
else
    Task.succeed (Server.withStatus 429 (Server.text "too many attempts"))

allow : String -> String -> Int -> Int -> Bool — try to consume one token from a token-bucket keyed by (name, key). Arguments are name (limiter label), key (typically the client IP), capacity (bucket size), refillPerSec (refill rate). Returns True when the request is allowed, False when the bucket is empty. For declarative wiring use Middleware.withRateLimit.

Middleware — composable handler wrappers

Each helper returns a decorated Handler — compose by chaining with |> or by nesting via Server.use.

import Sky.Http.Middleware as Middleware

Server.use Middleware.withLogging
    (Server.use (Middleware.withRateLimit "api" 100 60)
        [ Server.get "/api/users" listUsers
        , ...
        ]
    )

CSRF protection + JSON/API clients

Every Server.listen server wraps its routes in CSRF protection by default (on for POST / PUT / DELETE / PATCH). A cookie-session browser form works automatically — the runtime issues a __sky_csrf cookie and Sky.Live's JS echoes it in an X-Sky-Csrf header (HTML forms get a hidden __sky_csrf field auto-injected).

A machine / API client that has no CSRF token gets a 403 with a JSON body naming the escape hatches. Three ways to call a mutating endpoint from a non-browser client:

• Send an Authorization header (Bearer / Basic). Such a request is auto-exempt: CSRF only guards ambient-cookie browser requests, and a browser never auto-attaches Authorization, so it can't be a CSRF vector. This is the recommended path for token-authenticated JSON APIs — no config needed.
• SKY_CSRF=off — disables CSRF for the whole server (pure-API services with their own auth).
• WithoutCsrf("/webhooks/stripe") — exempt a specific path (for third-party webhooks that can't carry a token).

Cookie-session POSTs (no Authorization header) stay fully protected in every case.

Product analytics — Std.Analytics

Typed product analytics: page views, actions, and e-commerce events with typed property values. The differentiator vs a stringly-typed SDK is that a prop's VALUE is Sky-typed — an Int is an Int, Money is lossless (never a float), and identity is a distinct Pii type the pipeline can redact by construction, never a stray String.

import Std.Analytics as Analytics

-- open payload builder: any code (your app OR a library) emits without
-- coupling to a central union
Analytics.track
    (Analytics.event "product_viewed"
        [ Analytics.string "sku" "SKU-42"
        , Analytics.money "price" price
        , Analytics.pii "email" (Analytics.piiEmail user.email)  -- redacted
        ])

-- or derive the payload from your OWN typed event union (no encoder):
Analytics.trackEvent (Purchased { orderId = id, total = cart })

Identity + consent. Consent defaults to Granted (v0.19.1) — enabling analytics captures fully and identify user.id traits attaches the user. This is the DX-friendly default; a privacy-conscious app shows a consent banner and downgrades with setConsent Anonymous (random anon id, no identity) or setConsent Denied (drops all capture). Consent + identity are session-scoped, so one Sky.Live user's identity never bleeds into another's.

Auto page-views (opt-in). Attach |> Live.withAnalytics { pageViews = True } to the Live.app config — every full page load is captured (consent-gated), with anonymised device + IP context. Add an identify resolver to attribute an already-authenticated session (including the first render, before any Msg runs) without a manual identify call — add the withAnalyticsIdentify builder:

|> Live.withAnalytics { pageViews = True }
|> Live.withAnalyticsIdentify (\model -> Maybe.map .id model.currentUser)  -- model -> Maybe String

The runtime resolves it against the model on each page-view and it is the session's identity authority — symmetric by design: Just id stamps the session user id, and Nothing / Just "" clears it, reverting the session to anonymous (the cleared state persists on the next render). So when a session signs out (model.session → Nothing → resolver returns Nothing), subsequent auto page-views are anonymous again rather than continuing to attribute to the signed-out user. It's the app's explicit opt-in for attributing the identity it already holds.

Sinks + store. configure [ StderrSink, FileSink "events.jsonl", Custom (\line -> Http.post collector line) ] fans every event to your destinations. A SQLite/Postgres store persists events — it reuses the console DB by default, or a [analytics] dbPath override in sky.toml. erase id (right-to-erasure) + totalEvents / uniqueUsers / eventCounts / recentEvents back an admin view; the Sky Console's Analytics tab renders totals, per-event counts, the recent stream (a page_view shows its props.path, e.g. page_view /shop/necklaces), and revenue grouped by currency. Full API + per-binding docs: sky doc Std.Analytics. Worked example: examples/52-blog-analytics.

Query on Store (v0.19.2). The read / query / aggregate / patch side of the analytics store is plain Std.Db.Store — only the consent-gated WRITE (track) stays in the runtime. Query the stored events with the same typed Store API as any other table:

• Analytics.eventsStore : Store AnalyticsEvent — a Store over the analytics_events table. AnalyticsEvent is the envelope record with typed columns id / ts / event / userId / anonymousId plus the open metadata bag props (event props JSON) and device context (JSON).
• Analytics.openStore : () -> Task Error Db — a connection to the analytics store (the console DB, or the [analytics] dbPath override), for use with eventsStore. Query the envelope columns directly; reach for Store.selectRaw
  • json_extract / ->> for the JSON props — same on SQLite and Postgres.
• The built-in aggregates totalEvents / uniqueUsers / eventCounts / recentEvents are now plain Std.Db.Store queries over eventsStore (Sky, not Go kernels). Breaking (v0.19.2): recentEvents now returns List AnalyticsEvent (typed rows — read .event / .ts / .userId) instead of List String (JSON-object strings). Rendering code reads fields off the record now — e.g. e.event ++ " · " ++ String.fromInt e.ts — rather than treating each item as a JSON string.

Low-level FFI proxies

These are thin wrappers around Go stdlib types — usually you'll reach for them only when interfacing with auto-generated FFI bindings.

Context

Go's context.Context: background, todo, withValue, withCancel.

Fmt

Go's fmt: sprint, sprintf, sprintln, errorf.

Ffi — escape hatches

call (any Go func, dynamic), callPure (mark as pure), callTask (lift to Task), has (does symbol exist?), isPure (introspection).

Reach for Ffi.* only when the auto-generated bindings can't model what you need. The built-in modules cover all common cases.

Diverging functions

System.exit : Int -> a — process termination, polymorphic return so it works as the last expression in any case branch:

case validateConfig config of
    Ok ()  -> startServer config
    Err msg ->
        let
            _ = Log.error msg
        in
            System.exit 1

Concurrency

import Sky.Core.Task as Task

-- Goroutine-backed parallel; first error short-circuits
allUsers =
    Task.parallel
        [ Db.getById db "users" 1
        , Db.getById db "users" 2
        , Db.getById db "users" 3
        ]

Task.parallel : List (Task err a) -> Task err (List a) — concurrent task execution; the first error short-circuits the batch.

Task.lazy : (() -> a) -> Task err a — defer a pure computation so it can be sequenced with other tasks.

The Prelude

Sky.Core.Prelude exposing (..) is implicitly imported everywhere. It re-exports:

Result (Ok / Err), Maybe (Just / Nothing), identity, not, always, fst, snd, clamp, modBy, errorToString.

You'll never need to write import Sky.Core.Prelude — it's already there.

See also

• Getting started
• Language syntax
• Sky.Live overview
• Sky.Auth overview
• Std.Db overview
• Go FFI interop
• Error system
• The dense AI-targeted reference lives in the project CLAUDE.md — same surface, no narrative.