@shd101wyy/yo 0.1.28 → 0.1.30

package/std/string/string.yo

@@ -1,4 +1,5 @@
 //! Immutable UTF-8 string type with comprehensive operations.
+pragma(Pragma.AllowUnsafe);
 { ArrayList } :: import("../collections/array_list.yo");
 { rune } :: import("./rune.yo");
 { memcpy, memcmp, strlen } :: import("../libc/string.yo");
@@ -65,7 +66,12 @@ impl(
   * Note: We manually search for the null terminator by iterating
   */
   from_cstr : (fn(cstr : *(u8)) -> Result(Self, StringError))({
-    len := strlen((*(char))(cstr));
+    // SAFETY: caller's contract — `cstr` must point at a null-terminated byte
+    // sequence (the standard C string invariant). `strlen` walks forward until
+    // it hits the null byte and returns the count not including it. If the
+    // caller passes a non-null-terminated buffer, the read walks past the end;
+    // this is the same trust boundary as `<string.h>`'s `strlen`.
+    len := unsafe(strlen((*(char))(cstr)));
     if(len == usize(0), {
       return(.Ok(Self(_bytes :.None)));
     });
@@ -321,7 +327,7 @@ impl(
     return(Self(_bytes :.Some(new_bytes)));
   }),
   /// Append another `String` to this string in-place (mutates `self`).
-  push_string : (fn(self : *(Self), other : Self) -> unit)({
+  push_string : (fn(ref(self) : Self, other : Self) -> unit)({
     (olen : usize) = match(other._bytes,.Some(b) => b.len(),.None => usize(0));
     if(olen > usize(0), {
       match(
@@ -330,11 +336,11 @@ impl(
           ob.ptr(),
           .Some(p) => {
             match(
-              self.*._bytes,
+              self._bytes,
               .None => {
                 (new_al : ArrayList(u8)) = ArrayList(u8).with_capacity(olen);
                 new_al.extend_from_ptr(p, olen);
-                self.*._bytes =.Some(new_al);
+                self._bytes =.Some(new_al);
               },
               .Some(al) => {
                 al.extend_from_ptr(p, olen);
@@ -348,15 +354,15 @@ impl(
     });
   }),
   /// Append a `str` slice to this string in-place (mutates `self`).
-  push_str : (fn(self : *(Self), s : str) -> unit)({
+  push_str : (fn(ref(self) : Self, s : str) -> unit)({
     (slen : usize) = s.len();
     if(slen > usize(0), {
       match(
-        self.*._bytes,
+        self._bytes,
         .None => {
           (new_al : ArrayList(u8)) = ArrayList(u8).with_capacity(slen);
           new_al.extend_from_ptr(s.ptr(), slen);
-          self.*._bytes =.Some(new_al);
+          self._bytes =.Some(new_al);
         },
         .Some(al) => {
           al.extend_from_ptr(s.ptr(), slen);
@@ -366,13 +372,13 @@ impl(
   }),
   /// Append a single byte to this string in-place (mutates `self`).
   /// The caller must ensure the byte maintains valid UTF-8.
-  push_byte : (fn(self : *(Self), b : u8) -> unit)({
+  push_byte : (fn(ref(self) : Self, b : u8) -> unit)({
     match(
-      self.*._bytes,
+      self._bytes,
       .None => {
         (new_al : ArrayList(u8)) = ArrayList(u8).with_capacity(usize(8));
         new_al.push(b);
-        self.*._bytes =.Some(new_al);
+        self._bytes =.Some(new_al);
       },
       .Some(al) => {
         al.push(b);
@@ -381,11 +387,11 @@ impl(
   }),
   /// Reserve capacity for at least `additional` more bytes.
   /// If the string is empty, creates a new buffer with the given capacity.
-  reserve : (fn(self : *(Self), additional : usize) -> unit)({
+  reserve : (fn(ref(self) : Self, additional : usize) -> unit)({
     match(
-      self.*._bytes,
+      self._bytes,
       .None => {
-        self.*._bytes =.Some(ArrayList(u8).with_capacity(additional));
+        self._bytes =.Some(ArrayList(u8).with_capacity(additional));
       },
       .Some(al) => {
         (current_len : usize) = al.len();
@@ -394,29 +400,16 @@ impl(
     );
   }),
   /// Clear the string content but keep the allocated buffer for reuse.
-  clear : (fn(self : *(Self)) -> unit)(
+  clear : (fn(ref(self) : Self) -> unit)(
     match(
-      self.*._bytes,
+      self._bytes,
       .Some(al) => al.clear(),
       .None => ()
     )
   ),
-  /// Create a deep copy of this string with its own buffer.
-  clone : (fn(self : Self) -> Self)(
-    match(
-      self._bytes,
-      .None => Self(_bytes :.None),
-      .Some(al) => {
-        (new_al : ArrayList(u8)) = ArrayList(u8).with_capacity(al.len());
-        match(
-          al.ptr(),
-          .Some(p) => new_al.extend_from_ptr(p, al.len()),
-          .None => ()
-        );
-        Self(_bytes :.Some(new_al))
-      }
-    )
-  ),
+  // (Inherent `clone` removed; the Clone trait impl below provides
+  // the same semantics via ref(self) : Self after the Phase D
+  // migration. Calling `s.clone()` resolves to the trait method.)
   /// Get the number of bytes in the string (not Unicode characters).
   /// Use `len()` for Unicode character count.
   bytes_len : (fn(self : Self) -> usize)(
@@ -1399,8 +1392,13 @@ impl(
                     .Some(self_ptr) =>
                       match(
                         other_al.ptr(),
+                        // SAFETY: self_len equals other_len (checked
+                        // above) and both equal each ArrayList's
+                        // .len() (the inner Option's ptr is Some only
+                        // when len > 0); memcmp reads exactly that many
+                        // bytes from each Rc-managed buffer.
                         .Some(other_ptr) =>
-                          (memcmp((*(void))(self_ptr), (*(void))(other_ptr), self_len) == int(0)),
+                          (unsafe(memcmp((*(void))(self_ptr), (*(void))(other_ptr), self_len)) == int(0)),
                         .None => false
                       ),
                     .None => false
@@ -1420,10 +1418,10 @@ impl(
 impl(
   String,
   Hash(
-    (hash) : (fn(self : *(Self)) -> u64)({
+    (hash) : (fn(ref(self) : Self) -> u64)({
       h := u64(14695981039346656037);
       match(
-        self.*._bytes,
+        self._bytes,
         .None => (),
         .Some(al) => {
           i := usize(0);
@@ -1457,7 +1455,7 @@ impl(
   StringChars,
   Iterator(
     Item : rune,
-    next : (fn(self : *(Self)) -> Option(rune))(
+    next : (fn(ref(self) : Self) -> Option(rune))(
       match(
         self._string._bytes,
         .None =>.None,
@@ -1499,7 +1497,7 @@ impl(
   StringBytes,
   Iterator(
     Item : u8,
-    next : (fn(self : *(Self)) -> Option(u8))(
+    next : (fn(ref(self) : Self) -> Option(u8))(
       match(
         self._string._bytes,
         .None =>.None,
@@ -1515,6 +1513,31 @@ impl(
     )
   )
 );
+/// Byte-position iterator for `String` — yields `usize` byte indices.
+/// Used by `String.iter()`; the for-macro pairs each yielded position
+/// with `String.project(pos)` (Indexable from Phase C) to bind the
+/// body's `ref`-name to a byte in `self._bytes.Some`. See
+/// plans/ITERATOR_REDESIGN.md.
+_StringPosIter :: struct(
+  _index : usize,
+  _len : usize
+);
+impl(
+  _StringPosIter,
+  Iterator(
+    Item : usize,
+    next : (fn(ref(self) : Self) -> Option(usize))(
+      cond(
+        (self._index >= self._len) =>.None,
+        true => {
+          out := self._index;
+          self._index = (self._index + usize(1));
+          .Some(out)
+        }
+      )
+    )
+  )
+);
 impl(
   String,
   /**
@@ -1529,6 +1552,17 @@ impl(
   bytes : (fn(self : Self) -> StringBytes)(
     StringBytes(_string : self, _index : usize(0))
   ),
+  /// Byte-position iterator for `for(s, ref(b) => body)`. Yields
+  /// `usize` byte indices; the for-macro pairs each with
+  /// `s.project(pos)` (Indexable) so the body sees `ref(u8)` bound
+  /// to each byte. Iteration is byte-level, not rune-level — for
+  /// codepoint iteration use `chars()` explicitly.
+  iter : (fn(ref(self) : Self) -> _StringPosIter)(
+    _StringPosIter(
+      _index : usize(0),
+      _len : match(self._bytes,.Some(b) => b.len(),.None => usize(0))
+    )
+  ),
   /**
   * Consume the string and return a rune iterator (default iteration)
   */
@@ -1550,7 +1584,7 @@ impl(
   StringLines,
   Iterator(
     Item : String,
-    next : (fn(self : *(Self)) -> Option(String))(
+    next : (fn(ref(self) : Self) -> Option(String))(
       match(
         self._string._bytes,
         .None =>.None,
@@ -2114,20 +2148,41 @@ impl(
   String,
   Index(usize)(
     Output : u8,
-    index : (fn(self : *(Self), idx : usize) -> *(Self.Output))(
+    index : (fn(ref(self) : Self, idx : usize) -> *(Self.Output))(
       match(
-        self.*._bytes,
+        self._bytes,
         .Some(bytes) => &(bytes(idx)),
         .None => panic("String: index on empty string")
       )
     )
   )
 );
+/// String Indexable impl — projection-style byte access yielding
+/// `ref(u8)`. Body uses `unsafe(...)` because `&(bytes(pos))` produces
+/// a raw `*(u8)` borrow into `self._bytes.Some.bytes` storage; the
+/// `unsafe` wrap is the trusted escape from the flowability rule
+/// (privileged code only). See plans/ITERATOR_REDESIGN.md.
+impl(
+  String,
+  Indexable(usize)(
+    Element : u8,
+    project : (fn(ref(self) : Self, pos : usize) -> ref(u8))(
+      match(
+        self._bytes,
+        // SAFETY: `pos < self.len()` is the precondition; the `_bytes` is the
+        // String's own owned ArrayList whose `data[pos]` lives as long as the
+        // ref-bound `self`. `bytes(pos)` is auto-bounds-checked by ArrayList.project.
+        .Some(bytes) => unsafe(&(bytes(pos))),
+        .None => panic("String: project on empty string")
+      )
+    )
+  )
+);
 /// Clone implementation — produces an independent byte-level copy.
 impl(
   String,
   Clone(
-    clone : (fn(self : *(Self)) -> Self)(
+    clone : (fn(ref(self) : Self) -> Self)(
       match(
         self._bytes,
         .None => Self(_bytes :.None),

package/std/string/string_builder.yo

@@ -40,19 +40,19 @@ impl(
   /**
   * Returns the current number of bytes in the buffer.
   */
-  len : (fn(self : *(Self)) -> usize)(
+  len : (fn(self : Self) -> usize)(
     self._buf.len()
   ),
   /**
   * Returns true if the buffer is empty.
   */
-  is_empty : (fn(self : *(Self)) -> bool)(
+  is_empty : (fn(self : Self) -> bool)(
     self._buf.len() == usize(0)
   ),
   /**
   * Append a `str` (raw byte slice) to the buffer.
   */
-  write_str : (fn(self : *(Self), s : str) -> unit)({
+  write_str : (fn(self : Self, s : str) -> unit)({
     byte_len := s.len();
     if(byte_len > usize(0), {
       self._buf.extend_from_ptr(s.ptr(), byte_len);
@@ -61,7 +61,7 @@ impl(
   /**
   * Append a `String` to the buffer.
   */
-  write_string : (fn(self : *(Self), s : String) -> unit)(
+  write_string : (fn(self : Self, s : String) -> unit)(
     match(
       s._bytes,
       .None => (),
@@ -84,7 +84,7 @@ impl(
   /**
   * Append a single byte to the buffer.
   */
-  write_byte : (fn(self : *(Self), b : u8) -> unit)({
+  write_byte : (fn(self : Self, b : u8) -> unit)({
     self._buf.push(b);
   }),
   /**
@@ -97,7 +97,7 @@ impl(
   * sb.write_rune(rune(0x41));     // 'A'
   * ```
   */
-  write_rune : (fn(self : *(Self), r : rune) -> unit)({
+  write_rune : (fn(self : Self, r : rune) -> unit)({
     cp := r.char;
     cond(
       (cp < u32(0x80)) => {
@@ -123,7 +123,7 @@ impl(
   /**
   * Append a `String` followed by a newline byte (`\n`).
   */
-  write_line : (fn(self : *(Self), s : String) -> unit)({
+  write_line : (fn(self : Self, s : String) -> unit)({
     self.write_string(s);
     self._buf.push(u8(10));
   }),
@@ -131,7 +131,7 @@ impl(
   * Consume the builder and return the accumulated `String`.
   * The builder is left empty after this call.
   */
-  to_string : (fn(self : *(Self)) -> String)({
+  to_string : (fn(self : Self) -> String)({
     n := self._buf.len();
     cond(
       (n == usize(0)) => String(_bytes :.None),
@@ -156,7 +156,7 @@ impl(
   /**
   * Clear the buffer without freeing memory.
   */
-  clear : (fn(self : *(Self)) -> unit)({
+  clear : (fn(self : Self) -> unit)({
     self._buf = ArrayList(u8).new();
   })
 );

package/std/string/unicode.yo

@@ -8,6 +8,7 @@
 //! lower := unicode_to_lowercase(`HELLO WÖRLD`);  // "hello wörld"
 //! upper := unicode_to_uppercase(`hello wörld`);  // "HELLO WÖRLD"
 //! ```
+pragma(Pragma.AllowUnsafe);
 open(import("../string"));
 { ArrayList } :: import("../collections/array_list");
 // Declare towlower/towupper directly with i32 to avoid wint_t cast issues.
@@ -26,70 +27,70 @@ _DecodeResult :: struct(
 );
 // Decode a single UTF-8 codepoint from bytes at position i.
 _decode_utf8 :: (fn(bytes : ArrayList(u8), i : usize) -> _DecodeResult)({
-  (b0 : i32) = i32(bytes.get(i).unwrap());
+  (b0 : i32) = i32(bytes(i));
   cond(
     // 1-byte ASCII
     ((b0 & i32(0x80)) == i32(0)) =>
       _DecodeResult(codepoint : b0, bytes_consumed : usize(1)),
     // 2-byte
     ((b0 & i32(0xE0)) == i32(0xC0)) => {
-      (b1 : i32) = i32(bytes.get(i + usize(1)).unwrap());
+      (b1 : i32) = i32(bytes(i + usize(1)));
       (cp : i32) = (((b0 & i32(0x1F)) << i32(6)) | (b1 & i32(0x3F)));
       _DecodeResult(codepoint : cp, bytes_consumed : usize(2))
     },
     // 3-byte
     ((b0 & i32(0xF0)) == i32(0xE0)) => {
-      (b1 : i32) = i32(bytes.get(i + usize(1)).unwrap());
-      (b2 : i32) = i32(bytes.get(i + usize(2)).unwrap());
+      (b1 : i32) = i32(bytes(i + usize(1)));
+      (b2 : i32) = i32(bytes(i + usize(2)));
       (cp : i32) = ((((b0 & i32(0x0F)) << i32(12)) | ((b1 & i32(0x3F)) << i32(6))) | (b2 & i32(0x3F)));
       _DecodeResult(codepoint : cp, bytes_consumed : usize(3))
     },
     // 4-byte
     true => {
-      (b1 : i32) = i32(bytes.get(i + usize(1)).unwrap());
-      (b2 : i32) = i32(bytes.get(i + usize(2)).unwrap());
-      (b3 : i32) = i32(bytes.get(i + usize(3)).unwrap());
+      (b1 : i32) = i32(bytes(i + usize(1)));
+      (b2 : i32) = i32(bytes(i + usize(2)));
+      (b3 : i32) = i32(bytes(i + usize(3)));
       (cp : i32) = (((((b0 & i32(0x07)) << i32(18)) | ((b1 & i32(0x3F)) << i32(12))) | ((b2 & i32(0x3F)) << i32(6))) | (b3 & i32(0x3F)));
       _DecodeResult(codepoint : cp, bytes_consumed : usize(4))
     }
   )
 });
 // Encode a Unicode codepoint as UTF-8 bytes into an ArrayList.
-_encode_utf8 :: (fn(cp : i32, out : *(ArrayList(u8))) -> unit)({
+_encode_utf8 :: (fn(cp : i32, out : ArrayList(u8)) -> unit)({
   cond(
     (cp < i32(0x80)) => {
-      out.*.push(u8(cp));
+      out.push(u8(cp));
     },
     (cp < i32(0x800)) => {
-      out.*.push(u8(i32(0xC0) | (cp >> i32(6))));
-      out.*.push(u8(i32(0x80) | (cp & i32(0x3F))));
+      out.push(u8(i32(0xC0) | (cp >> i32(6))));
+      out.push(u8(i32(0x80) | (cp & i32(0x3F))));
     },
     (cp < i32(0x10000)) => {
-      out.*.push(u8(i32(0xE0) | (cp >> i32(12))));
-      out.*.push(u8(i32(0x80) | ((cp >> i32(6)) & i32(0x3F))));
-      out.*.push(u8(i32(0x80) | (cp & i32(0x3F))));
+      out.push(u8(i32(0xE0) | (cp >> i32(12))));
+      out.push(u8(i32(0x80) | ((cp >> i32(6)) & i32(0x3F))));
+      out.push(u8(i32(0x80) | (cp & i32(0x3F))));
     },
     true => {
-      out.*.push(u8(i32(0xF0) | (cp >> i32(18))));
-      out.*.push(u8(i32(0x80) | ((cp >> i32(12)) & i32(0x3F))));
-      out.*.push(u8(i32(0x80) | ((cp >> i32(6)) & i32(0x3F))));
-      out.*.push(u8(i32(0x80) | (cp & i32(0x3F))));
+      out.push(u8(i32(0xF0) | (cp >> i32(18))));
+      out.push(u8(i32(0x80) | ((cp >> i32(12)) & i32(0x3F))));
+      out.push(u8(i32(0x80) | ((cp >> i32(6)) & i32(0x3F))));
+      out.push(u8(i32(0x80) | (cp & i32(0x3F))));
     }
   );
 });
 // Special case folding: codepoints that expand to multiple codepoints
 // when lowercased. These are Unicode case folding entries of type 'F' (full).
-_special_to_lower :: (fn(cp : i32, out : *(ArrayList(u8))) -> bool)(
+_special_to_lower :: (fn(cp : i32, out : ArrayList(u8)) -> bool)(
   cond(
     // ẞ (U+1E9E LATIN CAPITAL LETTER SHARP S) → ss
     (cp == i32(0x1E9E)) => {
-      out.*.push(u8(0x73)); // s
-      out.*.push(u8(0x73)); // s
+      out.push(u8(0x73)); // s
+      out.push(u8(0x73)); // s
       true
     },
     // İ (U+0130 LATIN CAPITAL LETTER I WITH DOT ABOVE) → i + combining dot above
     (cp == i32(0x0130)) => {
-      out.*.push(u8(0x69)); // i
+      out.push(u8(0x69)); // i
       // U+0307 COMBINING DOT ABOVE
       _encode_utf8(i32(0x0307), out);
       true
@@ -99,56 +100,56 @@ _special_to_lower :: (fn(cp : i32, out : *(ArrayList(u8))) -> bool)(
 );
 // Special case folding: codepoints that expand to multiple codepoints
 // when uppercased.
-_special_to_upper :: (fn(cp : i32, out : *(ArrayList(u8))) -> bool)(
+_special_to_upper :: (fn(cp : i32, out : ArrayList(u8)) -> bool)(
   cond(
     // ß (U+00DF LATIN SMALL LETTER SHARP S) → SS
     (cp == i32(0x00DF)) => {
-      out.*.push(u8(0x53)); // S
-      out.*.push(u8(0x53)); // S
+      out.push(u8(0x53)); // S
+      out.push(u8(0x53)); // S
       true
     },
     // ff (U+FB00 LATIN SMALL LIGATURE FF) → FF
     (cp == i32(0xFB00)) => {
-      out.*.push(u8(0x46)); // F
-      out.*.push(u8(0x46)); // F
+      out.push(u8(0x46)); // F
+      out.push(u8(0x46)); // F
       true
     },
     // fi (U+FB01 LATIN SMALL LIGATURE FI) → FI
     (cp == i32(0xFB01)) => {
-      out.*.push(u8(0x46)); // F
-      out.*.push(u8(0x49)); // I
+      out.push(u8(0x46)); // F
+      out.push(u8(0x49)); // I
       true
     },
     // fl (U+FB02 LATIN SMALL LIGATURE FL) → FL
     (cp == i32(0xFB02)) => {
-      out.*.push(u8(0x46)); // F
-      out.*.push(u8(0x4C)); // L
+      out.push(u8(0x46)); // F
+      out.push(u8(0x4C)); // L
       true
     },
     // ffi (U+FB03 LATIN SMALL LIGATURE FFI) → FFI
     (cp == i32(0xFB03)) => {
-      out.*.push(u8(0x46)); // F
-      out.*.push(u8(0x46)); // F
-      out.*.push(u8(0x49)); // I
+      out.push(u8(0x46)); // F
+      out.push(u8(0x46)); // F
+      out.push(u8(0x49)); // I
       true
     },
     // ffl (U+FB04 LATIN SMALL LIGATURE FFL) → FFL
     (cp == i32(0xFB04)) => {
-      out.*.push(u8(0x46)); // F
-      out.*.push(u8(0x46)); // F
-      out.*.push(u8(0x4C)); // L
+      out.push(u8(0x46)); // F
+      out.push(u8(0x46)); // F
+      out.push(u8(0x4C)); // L
       true
     },
     // ſt (U+FB05 LATIN SMALL LIGATURE LONG S T) → ST
     (cp == i32(0xFB05)) => {
-      out.*.push(u8(0x53)); // S
-      out.*.push(u8(0x54)); // T
+      out.push(u8(0x53)); // S
+      out.push(u8(0x54)); // T
       true
     },
     // st (U+FB06 LATIN SMALL LIGATURE ST) → ST
     (cp == i32(0xFB06)) => {
-      out.*.push(u8(0x53)); // S
-      out.*.push(u8(0x54)); // T
+      out.push(u8(0x53)); // S
+      out.push(u8(0x54)); // T
       true
     },
     true => false
@@ -162,7 +163,7 @@ unicode_to_lowercase :: (fn(input : String) -> String)({
   (out : ArrayList(u8)) = ArrayList(u8).with_capacity(bytes.len());
   (i : usize) = usize(0);
   while(i < bytes.len(), {
-    (b0 : i32) = i32(bytes.get(i).unwrap());
+    (b0 : i32) = i32(bytes(i));
     // Fast path for ASCII
     if((b0 & i32(0x80)) == i32(0), {
       if((b0 >= i32(0x41)) && (b0 <= i32(0x5A)), {
@@ -177,10 +178,10 @@ unicode_to_lowercase :: (fn(input : String) -> String)({
       (cp : i32) = result.codepoint;
       (len : usize) = result.bytes_consumed;
       // Try special case folding first
-      if(!(_special_to_lower(cp, &(out))), {
+      if(!(_special_to_lower(cp, out)), {
         // Use C towlower for standard Unicode lowercase
-        (lower : i32) = i32(towlower(cp));
-        _encode_utf8(lower, &(out));
+        (lower : i32) = i32(unsafe(towlower(cp)));
+        _encode_utf8(lower, out);
       });
       i = (i + len);
     });
@@ -195,7 +196,7 @@ unicode_to_uppercase :: (fn(input : String) -> String)({
   (out : ArrayList(u8)) = ArrayList(u8).with_capacity(bytes.len());
   (i : usize) = usize(0);
   while(i < bytes.len(), {
-    (b0 : i32) = i32(bytes.get(i).unwrap());
+    (b0 : i32) = i32(bytes(i));
     // Fast path for ASCII
     if((b0 & i32(0x80)) == i32(0), {
       if((b0 >= i32(0x61)) && (b0 <= i32(0x7A)), {
@@ -210,10 +211,10 @@ unicode_to_uppercase :: (fn(input : String) -> String)({
       (cp : i32) = result.codepoint;
       (len : usize) = result.bytes_consumed;
       // Try special case folding first
-      if(!(_special_to_upper(cp, &(out))), {
+      if(!(_special_to_upper(cp, out)), {
         // Use C towupper for standard Unicode uppercase
-        (upper : i32) = i32(towupper(cp));
-        _encode_utf8(upper, &(out));
+        (upper : i32) = i32(unsafe(towupper(cp)));
+        _encode_utf8(upper, out);
       });
       i = (i + len);
     });

package/std/sync/channel.yo

@@ -1,5 +1,5 @@
 //! Bounded multi-producer multi-consumer (MPMC) channel.
-//! Uses blocking send/recv via condition variables — does not require IO.
+//! Uses blocking send/recv via condition variables — does not require Io.
 //!
 //! Channel uses `atomic object` with atomic reference counting, so it can be
 //! safely shared across threads without `Arc` wrapping.
@@ -18,6 +18,7 @@
 //! assert((val.unwrap() == i32(42)), "received value");
 //! t.join();
 //! ```
+pragma(Pragma.AllowUnsafe);
 { GlobalAllocator } :: import("../allocator");
 { malloc, free } :: GlobalAllocator;
 { Mutex } :: import("./mutex");

package/std/sync/cond.yo

@@ -1,4 +1,5 @@
 //! Condition variable for thread synchronization.
+pragma(Pragma.AllowUnsafe);
 { __YO_THREAD_SYNC_TYPE, mutex_t, Mutex } :: import("./mutex");
 extern(
   "Yo",
@@ -20,16 +21,16 @@ impl(
   new : (fn() -> Self)({
     return(Self(__yo_cond_create()));
   }),
-  wait : (fn(self : *(Self), mutex : *(mutex_t)) -> unit)({
+  wait : (fn(ref(self) : Self, ref(mutex) : mutex_t) -> unit)({
     return(__yo_cond_wait(&(self.cv), &(mutex.mutex)));
   }),
-  signal : (fn(self : *(Self)) -> unit)({
+  signal : (fn(ref(self) : Self) -> unit)({
     return(__yo_cond_signal(&(self.cv)));
   }),
-  broadcast : (fn(self : *(Self)) -> unit)({
+  broadcast : (fn(ref(self) : Self) -> unit)({
     return(__yo_cond_broadcast(&(self.cv)));
   }),
-  destroy : (fn(self : *(Self)) -> unit)({
+  destroy : (fn(ref(self) : Self) -> unit)({
     return(__yo_cond_destroy(&(self.cv)));
   })
 );

package/std/sync/mutex.yo

@@ -1,4 +1,5 @@
 //! Mutual exclusion lock primitives.
+pragma(Pragma.AllowUnsafe);
 extern(
   "Yo",
   __YO_THREAD_SYNC_TYPE : Type,
@@ -18,13 +19,13 @@ impl(
   new : (fn() -> Self)({
     return(Self(__yo_mutex_create()));
   }),
-  lock : (fn(self : *(Self)) -> unit)({
+  lock : (fn(ref(self) : Self) -> unit)({
     return(__yo_mutex_lock(&(self.mutex)));
   }),
-  unlock : (fn(self : *(Self)) -> unit)({
+  unlock : (fn(ref(self) : Self) -> unit)({
     return(__yo_mutex_unlock(&(self.mutex)));
   }),
-  destroy : (fn(self : *(Self)) -> unit)({
+  destroy : (fn(ref(self) : Self) -> unit)({
     return(__yo_mutex_destroy(&(self.mutex)));
   })
 );

package/std/sys/advise.yo

@@ -2,6 +2,7 @@
 //!
 //! Advisory wrappers for file and memory access pattern hints.
 //! Returns 0 on success, -errno / negative platform error on failure.
+pragma(Pragma.AllowUnsafe);
 { __yo_sync_fadvise, __yo_sync_madvise } :: import("./externs.yo");
 POSIX_FADV_NORMAL :: i32(0);
 POSIX_FADV_RANDOM :: i32(1);