Built-ins, no imports required

Primitive types

String methods

List<T>

Mutable homogeneous list. Construct with [a, b, c] or by push. Index with xs[i] (unchecked) or get(i) (safe).

Ranges: a..b (exclusive) and a..=b (inclusive) produce a List<Int> and support the full List API. Float endpoints are excluded; a..b..c is a syntax error.

for i in 0..10            # 0, 1, ..., 9
    stdio.println("${i}")

let evens = (0..10).filter(fun (x: Int) -> Bool => x % 2 == 0)

Map<K, V>

Hash map. Construct via new_map() with a required type annotation.

Set<T>

Set of unique elements. Construct via new_set() with a type annotation.

Option<T>

Built-in sum type Some(T) | None.

Result<T, E>

Built-in sum type Ok(T) | Err(E). The ? operator propagates Err in functions that return Result.

JsonValue

Built-in sum type: JNull | JBool(Bool) | JNum(Float) | JStr(String) | JArr(List<JsonValue>) | JObj(Map<String, JsonValue>).

Conversions & panic

Capa has no implicit numeric coercion: Float + Int is a type error. Convert explicitly at the call site.

panic(message) terminates the program immediately: no unwinding, no catch. panic: <message> is written to stderr and the process exits non-zero. The contract is identical on every backend (Wasm and Component Model trap, translated to exit 1).

Python interoperability

Both functions cross the Capa/Python trust boundary and require Unsafe as the first argument. Crossing loses Capa's static guarantees: the Python value can do anything its type allows, with full ambient authority. --manifest marks such functions has_unsafe: true.

fun square_root(unsafe: Unsafe, x: Float) -> Float
    let math = py_import(unsafe, "math")
    return py_invoke(unsafe, math.sqrt, [x])

Capabilities

Stdio

print(s), println(s), eprintln(s) (stderr), read_line() -> Result<String, IoError>.

Fs

Env · Clock · Random

Net

A Net from main is unrestricted; restrict_to(host) returns a fresh Net whose authority is the intersection with {host} (monotonic). get(url) returns Err immediately if the host is outside the restriction set, before any system call.

fun main(net: Net, stdio: Stdio)
    let api = net.restrict_to("api.example.com")
    match fetch(api)
        Ok(body) -> stdio.println(body)
        Err(e)   -> stdio.eprintln("${e}")

Db

SQLite-backed database with path-prefix attenuation (mirrors Fs). query returns the rows as a JSON-encoded array of arrays of strings, so the wire shape is a single form; callers parse with parse_json and project columns explicitly.

Proc

Sandboxed subprocess execution with basename-prefix attenuation. exec takes the command and a JSON-encoded argv tail (for example ["status", "--short"]); stdout is returned as a String. allows checks the basename on a suffix boundary (restrict_to("git") admits git and git-lfs but not gitlab).

User-defined capabilities

Libraries declare their own capabilities with the capability keyword; any type that impls it becomes a valid implementor. A cap-bearing struct may hold built-in caps as fields. Only call / method-call right-hand sides produce fresh capability instances that can be bound; a plain alias let dup = mailer is rejected.

capability SendEmail
    fun send(self, to: String, subject: String, body: String) -> Result<Unit, IoError>

impl SendEmail for SmtpMailer
    fun send(self, ...) -> Result<Unit, IoError>
        return Ok(())

The IoError type

Opaque type for I/O errors, available as the error parameter in Result<T, IoError> and in pattern matching. Its string representation is human-readable; the internal contents are private.

match fs.read("x.txt")
    Ok(content) -> stdio.println(content)
    Err(e) -> stdio.eprintln("error: ${e}")