nomen-lang 0.8.0 → 0.9.0

package/core/System/Text/JsonTree.nm

@@ -1,156 +1,184 @@
-// JsonTree: a flat pool of JSON tree nodes backed by a Buffer<JsonNode> slab.
-// Each node is a value struct stored at index N in the buffer; grow_T/store_T/
-// load_T handle the slab arithmetic. The caller creates a JsonTree once and
-// calls reset() per document to reuse the slab without reallocation.
+// JsonTree: a flat pool of JSON tree nodes backed by a StableList<JsonNode>.
+// Each node is a value struct appended to the list; node indices are list
+// indices, and list slots never move. The caller creates a JsonTree once and
+// calls reset() per document. The pool owns its node texts end to end —
+// set_text/take_text's interior field write frees the displaced text and the
+// list's own destroy reclaims every node — so there is no manual text
+// lifecycle. (The pre-StableList version kept a raw Buffer slab with a
+// hand-encoded element layout and a strdup/free dance; see the stable grow-only
+// arrays".)
 //
-// set_text is the one exception to the load/store pattern: it calls strdup
-// directly into the slab via raw code, because routing the strdup'd pointer
-// through an Nomen local would subject it to auto-free at scope exit, leaving
-// the slab's text pointer dangling.
+// Accessors read and write through the slot alias (`ref JsonNode n =
+// self.nodes.at(idx)`), the checked interior-mutation form: the alias binds
+// the slot itself, so field writes land in the list and reads copy nothing.
 
 // A node in a parsed JSON tree, stored by value in the pool.
 //   kind: 0=null, 1=true, 2=number, 3=string, 4=array, 5=object, 6=false
 //   child/next/val are node indices, -1 = none.
+//
+// `text` is nullable and seeds as `null` (the in-band zero pair): the auto
+// constructor stores no pointer for it, so a fresh node costs NO allocation
+// — every parsed node used to pay a strdup-of-"" seed plus the free when
+// take_text displaced it (or at destroy for kinds that never carry text).
+// set_text/take_text install the owned value; until then the field holds
+// null and every read (get_text/get_text_view) answers the empty string.
 mv struct JsonNode {
 	var kind = 0
-	var text = ""
+	var string? text = null
 	var int child = -1
 	var int next = -1
 	var int val = -1
 }
 
 /**
- * A flat, buffer-backed pool of JSON tree nodes — the parsed representation `Json.parse` produces
+ * A flat, pool-backed set of JSON tree nodes — the parsed representation `Json.parse` produces
  **/
 pub mv struct JsonTree {
-	var nodes = Buffer<JsonNode>()
-	var count = 0
+	var nodes = StableList<JsonNode>()
 
+	// Append a fresh node and return its index.
 	func alloc_node = (ref self, out int) {
-		var int idx = self.count
-		self.nodes.grow(idx + 1)
-		self.count = idx + 1
-		var default = JsonNode()
-		self.nodes.store(idx, default)
-		// store_T deep-copies the mv `text` field (strdup of the shared
-		// empty-string literal) into the slot. JsonTree manages node texts
-		// manually (set_text strdup's into the slab; free_text/release frees
-		// them; NULL means "no text"), so the slot must start NULL — free the
-		// strdup'd default and NULL it, or reset() would leak it. The slab
-		// slot layout: 56-byte JsonNode elements — 7 words — with the text
-		// pair at words 2 and 3 of each element.
-		unsafe {
-			var ptr uint64 slots = self.nodes.data as ptr uint64
-			var int t = idx * 7 + 2
-			var uint64 old = slots[t]
-			if old != 0 {
-				free(old)
-			}
-			slots[t] = 0
-			slots[t + 1] = 0
-		}
-		return idx
-	}
-
-	// Free a node's strdup'd text pointer (set_text writes a heap pointer via
-	// raw strdup; this mirrors it). idx is x1, following set_text's layout.
-	func free_text = (ref self, int idx) {
-		unsafe {
-			var ptr uint64 slots = self.nodes.data as ptr uint64
-			var int t = idx * 7 + 2
-			var uint64 p = slots[t]
-			if p != 0 {
-				free(p)
-				slots[t] = 0
-				slots[t + 1] = 0
-			}
-		}
+		self.nodes.push(JsonNode())
+		return self.nodes.length - 1
 	}
 
-	// Free every strdup'd text pointer before reusing the slab, otherwise
-	// re-parsing a document leaks the previous document's string/number texts.
+	// Drop the current document: the fresh StableList displaces the old one,
+	// whose destroy frees every node (texts included) and its slabs. The
+	// next parse starts from a clean pool.
 	func reset = (ref self) {
-		var i = 0
-		while i < self.count; i += 1 {
-			self.free_text(i)
-		}
-		self.count = 0
+		self.nodes = StableList<JsonNode>()
 	}
 
-	// Runs when the tree instance is destroyed (before its `nodes` buffer field
-	// is freed): release the current document's strdup'd node texts, which live
-	// raw in the slab and are otherwise invisible to the auto-destroy pass.
-	func #destroy = () {
-		var i = 0
-		while i < self.count; i += 1 {
-			self.free_text(i)
+	// Install node `idx`'s text, TAKING ownership of the argument (the D3
+	// mv convention): `set_text(n, mv s)` transfers the caller's buffer
+	// into the pool with no copy anywhere — the field store moves the pair
+	// raw and the caller's variable is invalidated. (Pass `.copy()` for the
+	// keep-the-original spelling: `set_text(n, s.copy())`.) The pool owns
+	// its node texts end to end, so the transferred buffer is freed exactly
+	// once, by the list's destroy or the next text store. For strings
+	// produced by a StringBuilder, `take_text` installs the builder's
+	// buffer with no copy at all.
+	func set_text = (ref self, int idx, mv string text) {
+		if idx < 0 || idx >= self.nodes.length {
+			panic("index out of range")
 		}
-		self.count = 0
+		ref JsonNode n = self.nodes.at(idx)
+		n.text = mv text
 	}
 
-	// strdup directly into the slab — see file header for why this can't
-	// go through load_T/store_T. (Under the fat-string ABI the C body is
-	// emitted behind the _raw_ adapter, so `text` arrives as a thin char*;
-	// aarch64 receives the pair x2 = ptr, x3 = len.)
-	func set_text = (ref self, int idx, string text) {
-		unsafe {
-			var int len = text.length
-			var uint64 buf = malloc(len + 1)
-			memcpy(buf, (text as ptr char) as uint64, len)
-			memset(buf + len, 0, 1)
-			var ptr uint64 slots = self.nodes.data as ptr uint64
-			var int t = idx * 7 + 2
-			slots[t] = buf
-			slots[t + 1] = len
+	// Install node `idx`'s text by TAKING the builder's buffer — the parse
+	// path's zero-copy store. `to_string` is a take (the builder hands its
+	// heap buffer over and resets), and a fresh-call RHS stores into the
+	// field directly, so per parsed string/key the only allocation in the
+	// whole node lifecycle is the builder's own buffer — the node's null
+	// seed costs nothing and there is no copy malloc, no seed free, no
+	// temp free. (A `mv string` parameter cannot do this: the string-arg
+	// ownership convention makes mv string arguments caller-owned
+	// borrows, forcing the callee-side copy this method exists to skip.)
+	func take_text = (ref self, int idx, ref StringBuilder sb) {
+		if idx < 0 || idx >= self.nodes.length {
+			panic("index out of range")
 		}
+		ref JsonNode n = self.nodes.at(idx)
+		n.text = sb.to_string()
 	}
 
 	func set_kind = (ref self, int idx, int val) {
-		var JsonNode n = self.nodes.load(idx)
+		if idx < 0 || idx >= self.nodes.length {
+			panic("index out of range")
+		}
+		ref JsonNode n = self.nodes.at(idx)
 		n.kind = val
-		self.nodes.store(idx, n)
 	}
 
 	func set_child = (ref self, int idx, int val) {
-		var JsonNode n = self.nodes.load(idx)
+		if idx < 0 || idx >= self.nodes.length {
+			panic("index out of range")
+		}
+		ref JsonNode n = self.nodes.at(idx)
 		n.child = val
-		self.nodes.store(idx, n)
 	}
 
 	func set_next = (ref self, int idx, int val) {
-		var JsonNode n = self.nodes.load(idx)
+		if idx < 0 || idx >= self.nodes.length {
+			panic("index out of range")
+		}
+		ref JsonNode n = self.nodes.at(idx)
 		n.next = val
-		self.nodes.store(idx, n)
 	}
 
 	func set_val = (ref self, int idx, int val) {
-		var JsonNode n = self.nodes.load(idx)
+		if idx < 0 || idx >= self.nodes.length {
+			panic("index out of range")
+		}
+		ref JsonNode n = self.nodes.at(idx)
 		n.val = val
-		self.nodes.store(idx, n)
 	}
 
 	func get_kind = (self, int idx, out int) {
-		var JsonNode n = self.nodes.load(idx)
+		if idx < 0 || idx >= self.nodes.length {
+			panic("index out of range")
+		}
+		ref JsonNode n = self.nodes.at(idx)
 		return n.kind
 	}
 
 	func get_text = (self, int idx, out string) {
-		var JsonNode n = self.nodes.load(idx)
+		if idx < 0 || idx >= self.nodes.length {
+			panic("index out of range")
+		}
+		ref JsonNode n = self.nodes.at(idx)
+		// The aarch64 `??` yields the left pair AS-IS (no dup), so the
+		// coalesce spelling would return a borrow of the node's text — the
+		// caller's free would take the pool's buffer. Spell the owned copy:
+		// a null text answers a fresh "" and a non-null one takes
+		// `.copy()` (the return contract — the caller owns the result —
+		// is the `.copy()` shape the method always had).
+		if n.text == null {
+			return ""
+		}
 		return n.text.copy()
 	}
 
+	// A non-mv (ptr, len) view over node `idx`'s text — the zero-copy read.
+	// The borrow roots at `self` and re-roots at the call-site receiver
+	// (the `slice` convention), so it is invalidated by `reset()`/re-parse
+	// like any pool borrow. Callers that immediately append, hash, or
+	// inspect the text take this instead of paying `get_text`'s per-read
+	// copy allocation. A node that never had text installed views the
+	// empty string (a rodata-rooted empty borrow).
+	func get_text_view = (self, int idx, out view string) {
+		if idx < 0 || idx >= self.nodes.length {
+			panic("index out of range")
+		}
+		ref JsonNode n = self.nodes.at(idx)
+		if n.text == null {
+			return "".slice(0, 0)
+		}
+		return n.text.slice(0, n.text.length)
+	}
+
 	func get_child = (self, int idx, out int) {
-		var JsonNode n = self.nodes.load(idx)
+		if idx < 0 || idx >= self.nodes.length {
+			panic("index out of range")
+		}
+		ref JsonNode n = self.nodes.at(idx)
 		return n.child
 	}
 
 	func get_next = (self, int idx, out int) {
-		var JsonNode n = self.nodes.load(idx)
+		if idx < 0 || idx >= self.nodes.length {
+			panic("index out of range")
+		}
+		ref JsonNode n = self.nodes.at(idx)
 		return n.next
 	}
 
 	func get_val = (self, int idx, out int) {
-		var JsonNode n = self.nodes.load(idx)
+		if idx < 0 || idx >= self.nodes.length {
+			panic("index out of range")
+		}
+		ref JsonNode n = self.nodes.at(idx)
 		return n.val
 	}
 }

package/core/System/Text/Regex.nm

@@ -33,10 +33,9 @@ pub struct Regex {
 	}
 
 	// Return the first substring of input matching pattern, or "" if none.
-	// `mv out string`: the built match (or the copied empty literal) is
-	// handed to the caller as an owned value.
+	// `mv out string`: the matched span (or the empty literal) is handed to
+	// the caller as an owned value.
 	pub func match = (string pattern, string input, mv out string) {
-		var match_result = ""
 		var int pat_len = pattern.length
 		var int len = input.length
 		var string charset = first_byte_set(pattern, pat_len)
@@ -52,14 +51,14 @@ pub struct Regex {
 			var caps = List<int>()
 			var int end = match_here(pattern, 0, pat_len, input, i, len, ref caps)
 			if end >= 0 {
-				var int j = i
-				while j < end; j += 1 {
-					match_result = match_result + "\{input.at(j)}"
-				}
-				break
+				// One owned substring copy. The old accumulator
+				// (`match_result = match_result + "\{input.at(j)}"` per
+				// matched byte) paid an interpolation malloc PLUS a
+				// whole-accumulator re-copy per byte — O(n²) in the span.
+				return input.substring(i, end)
 			}
 		}
-		return match_result
+		return ""
 	}
 
 	// Try to match pattern anywhere in input. On a match, append the whole
@@ -173,25 +172,27 @@ pub struct Regex {
 	}
 
 	// Replace all non-overlapping occurrences of pattern in input with replacement.
+	// Literal bytes between matches are copied in bulk runs (one
+	// `append_string_view` per run) — the old loop appended per byte.
 	pub func replace_all = (
 		string pattern,
 		string input,
 		string replacement,
 		out string
-	) { var sb = StringBuilder()
+	) {
+		var sb = StringBuilder()
 		var int pat_len = pattern.length
 		var int len = input.length
 		var string charset = first_byte_set(pattern, pat_len)
 		var int clen = charset.length
 		var pos = 0
+		var run_start = 0
 		while pos < len {
 			if clen > 0 {
-				var int next = find_next_byte(input, pos, len, charset)
-				// Copy the bytes we're skipping over.
-				while pos < next {
-					sb.append_char(input.at(pos))
-					pos += 1
-				}
+				// Prefilter: jump to the next candidate byte. The skipped
+				// run stays pending — it is copied in bulk at the next
+				// match, or by the tail copy below.
+				pos = find_next_byte(input, pos, len, charset)
 				if pos >= len {
 					break
 				}
@@ -199,18 +200,22 @@ pub struct Regex {
 			var caps = List<int>()
 			var int end = match_here(pattern, 0, pat_len, input, pos, len, ref caps)
 			if end >= 0 {
+				sb.append_string_view(input.slice(run_start, pos))
 				sb.append_string(replacement)
 				if end == pos {
-					sb.append_char(input.at(pos))
+					// Empty match: the byte at pos is not consumed — it
+					// starts the next literal run.
+					run_start = pos
 					pos += 1
 				} else {
 					pos = end
+					run_start = pos
 				}
 			} else {
-				sb.append_char(input.at(pos))
 				pos += 1
 			}
 		}
+		sb.append_string_view(input.slice(run_start, len))
 		return sb.to_string()
 	}
 

package/core/System/Text/Utf8.nm

@@ -126,11 +126,11 @@ pub struct Utf8 {
 				sb.append_char(((0x80 | (code & 0x3F)) as char))
 			}
 		} else {
-				sb.append_char(((0xF0 | (code >> 18)) as char))
-				sb.append_char(((0x80 | ((code >> 12) & 0x3F)) as char))
-				sb.append_char(((0x80 | ((code >> 6) & 0x3F)) as char))
-				sb.append_char(((0x80 | (code & 0x3F)) as char))
-			}
+			sb.append_char(((0xF0 | (code >> 18)) as char))
+			sb.append_char(((0x80 | ((code >> 12) & 0x3F)) as char))
+			sb.append_char(((0x80 | ((code >> 6) & 0x3F)) as char))
+			sb.append_char(((0x80 | (code & 0x3F)) as char))
+		}
 		return sb.to_string()
 	}
 

package/core/System/float.nm

@@ -5,37 +5,51 @@ pub struct float: Stringable {
 	pub func to_string = (self, mv out string) {
 		```
 		#arch: c
-		int length = snprintf(NULL, 0, "%f", self);
-		char* str = malloc(length + 1);
-		snprintf(str, length + 1, "%f", self);
-		// Fat-string ABI: snprintf already counted the bytes.
+		// Single snprintf into a stack scratch (360 bytes covers "%f" of the
+		// largest double: 309 integer digits + '.' + 6 decimals + sign), then
+		// one malloc + memcpy — no sizing pass, no second format.
+		char tmp[360];
+		int length = snprintf(tmp, sizeof(tmp), "%f", self);
+		char* str = (char*)malloc((size_t)length + 1);
+		memcpy(str, tmp, (size_t)length);
+		str[length] = 0;
 		return (nomen_string){ str, length };
 		```
 		```
 		#arch: aarch64
-		sub sp, sp, #128
-		str x0, [sp, #0]
-		str x1, [sp, #8]
-		str x2, [sp, #16]
-		str x3, [sp, #24]
-		str d0, [sp, #64]
-		mov x0, xzr
-		mov x1, xzr
+		// x19 = self (the double). Render into a 360-byte scratch at
+		// [sp+16]; [sp+0] is snprintf's variadic stack slot (Darwin passes
+		// variadic args on the stack), reused after the call for the
+		// length; [sp+8] holds buf.
+		sub sp, sp, #400
+		add x0, sp, #16
+		mov x1, #360
 		adr x2, .Lfmt_float_f
 		fmov d0, x19
+		str d0, [sp, #0]           // variadic double slot
 		bl _snprintf
+		str x0, [sp, #0]           // length
 		add x0, x0, #1
-		str x0, [sp, #64]
 		bl _malloc
-		str x0, [sp, #72]
-		ldr x0, [sp, #72]
-		ldr x1, [sp, #64]
-		adr x2, .Lfmt_float_f
-		fmov d0, x19
-		bl _snprintf
-		mov x1, x0
-		ldr x0, [sp, #72]
-		add sp, sp, #128
+		str x0, [sp, #8]           // buf
+		ldr x1, [sp, #0]
+		add x2, sp, #16            // src
+		mov x3, x1
+		.Lft_cl:
+		cbz x3, .Lft_done
+		ldrb w4, [x2]
+		strb w4, [x0]
+		add x2, x2, #1
+		add x0, x0, #1
+		sub x3, x3, #1
+		b .Lft_cl
+		.Lft_done:
+		ldr x0, [sp, #8]
+		add x2, x0, x1
+		strb wzr, [x2]             // buf[length] = 0
+		ldr x0, [sp, #8]
+		ldr x1, [sp, #0]
+		add sp, sp, #400
 		b .Lend_float_to_string
 		.Lfmt_float_f: .asciz "%f"
 		.p2align 2

package/core/System/int.nm

@@ -2,6 +2,17 @@
  * A signed integer — the default integer type
  **/
 pub struct int: Stringable, Hashable, Equatable {
+
+	// The divisor contract (SPEC, Division and Modulo by Zero): scalar
+	// arithmetic lowers natively, so these declarations are the contract
+	// signatures the checker enforces at every `/` and `%` site.
+	func #op_div = (self, int divisor: divisor != 0, out int) {
+		return self / divisor
+	}
+
+	func #op_mod = (self, int divisor: divisor != 0, out int) {
+		return self % divisor
+	}
 	pub func hash = (self, out uint) {
 		return self as uint
 	}
@@ -9,39 +20,80 @@ pub struct int: Stringable, Hashable, Equatable {
 	pub func to_string = (self, mv out string) {
 		```
 		#arch: c
-		int length = snprintf(NULL, 0, "%ld", self);
-		char* str = malloc(length + 1);
-		snprintf(str, length + 1, "%ld", self);
-		// Fat-string ABI: snprintf already counted the bytes.
-		return (nomen_string){ str, length };
+		// Single pass: render the digits into a stack scratch (24 bytes
+		// covers INT64_MIN's sign + 19 digits + slack), then one malloc and
+		// one memcpy. The old body paid two snprintf passes over the value.
+		long v = self;
+		char tmp[24];
+		int pos = 24;
+		// Magnitude via the two's-complement negate (correct for INT64_MIN,
+		// whose positive counterpart is not representable).
+		unsigned long long u = v < 0 ? (unsigned long long)(-(v + 1)) + 1ULL : (unsigned long long)v;
+		do {
+			tmp[--pos] = (char)('0' + (int)(u % 10));
+			u /= 10;
+		} while (u != 0);
+		if (v < 0) tmp[--pos] = '-';
+		long len = 24 - pos;
+		char* str = (char*)malloc((size_t)len + 1);
+		memcpy(str, tmp + pos, (size_t)len);
+		str[len] = 0;
+		return (nomen_string){ str, len };
 		```
 		```
 		#arch: aarch64
-		sub sp, sp, #128
-		str x0, [sp, #0]
-		str x1, [sp, #8]
-		str x2, [sp, #16]
-		str x3, [sp, #24]
-		mov x0, xzr
-		mov x1, xzr
-		adr x2, .Lfmt_int_ld
-		mov x3, x19
-		bl _snprintf
-		add x0, x0, #1
-		str x0, [sp, #64]
+		// x19 = self (the value). Render digits into a 24-byte scratch, then
+		// malloc(len + 1) + copy. [sp]=len, [sp+8]=buf, [sp+16]=pos across
+		// the malloc call.
+		sub sp, sp, #48
+		mov x9, x19
+		mov x10, x9
+		cmp x9, #0
+		b.ge .Lit_pos
+		neg x10, x10               // magnitude (wraps correctly for INT64_MIN)
+		.Lit_pos:
+		add x11, sp, #48
+		mov x12, x11
+		.Lit_digit:
+		mov x13, #10
+		udiv x14, x10, x13
+		msub x15, x14, x13, x10
+		add x15, x15, #48
+		sub x12, x12, #1
+		strb w15, [x12]
+		mov x10, x14
+		cbnz x10, .Lit_digit
+		cmp x9, #0
+		b.ge .Lit_store
+		sub x12, x12, #1
+		mov w15, #45               // '-'
+		strb w15, [x12]
+		.Lit_store:
+		sub x1, x11, x12           // len
+		str x12, [sp, #16]         // pos
+		str x1, [sp, #0]           // len
+		add x0, x1, #1
 		bl _malloc
-		str x0, [sp, #72]
-		ldr x0, [sp, #72]
-		ldr x1, [sp, #64]
-		adr x2, .Lfmt_int_ld
-		mov x3, x19
-		bl _snprintf
-		mov x1, x0
-		ldr x0, [sp, #72]
-		add sp, sp, #128
+		str x0, [sp, #8]           // buf
+		ldr x1, [sp, #0]
+		ldr x12, [sp, #16]
+		mov x3, x1
+		.Lit_cl:
+		cbz x3, .Lit_done
+		ldrb w4, [x12]
+		strb w4, [x0]
+		add x12, x12, #1
+		add x0, x0, #1
+		sub x3, x3, #1
+		b .Lit_cl
+		.Lit_done:
+		ldr x0, [sp, #8]
+		add x2, x0, x1
+		strb wzr, [x2]             // buf[len] = 0
+		ldr x0, [sp, #8]
+		ldr x1, [sp, #0]
+		add sp, sp, #48
 		b .Lend_int_to_string
-		.Lfmt_int_ld: .asciz "%ld"
-		.p2align 2
 		.Lend_int_to_string:
 		```
 	}

package/core/System/int16.nm

@@ -2,6 +2,17 @@
  * A 16-bit signed integer
  **/
 pub struct int16: Stringable, Hashable, Equatable {
+
+	// The divisor contract (SPEC, Division and Modulo by Zero): scalar
+	// arithmetic lowers natively, so these declarations are the contract
+	// signatures the checker enforces at every `/` and `%` site.
+	func #op_div = (self, int16 divisor: divisor != 0, out int16) {
+		return self / divisor
+	}
+
+	func #op_mod = (self, int16 divisor: divisor != 0, out int16) {
+		return self % divisor
+	}
 	pub func hash = (self, out uint) {
 		return self as uint
 	}

package/core/System/int32.nm

@@ -2,6 +2,17 @@
  * A 32-bit signed integer
  **/
 pub struct int32: Stringable, Hashable, Equatable {
+
+	// The divisor contract (SPEC, Division and Modulo by Zero): scalar
+	// arithmetic lowers natively, so these declarations are the contract
+	// signatures the checker enforces at every `/` and `%` site.
+	func #op_div = (self, int32 divisor: divisor != 0, out int32) {
+		return self / divisor
+	}
+
+	func #op_mod = (self, int32 divisor: divisor != 0, out int32) {
+		return self % divisor
+	}
 	pub func hash = (self, out uint) {
 		return self as uint
 	}

package/core/System/int64.nm

@@ -2,6 +2,17 @@
  * A 64-bit signed integer
  **/
 pub struct int64: Stringable, Hashable, Equatable {
+
+	// The divisor contract (SPEC, Division and Modulo by Zero): scalar
+	// arithmetic lowers natively, so these declarations are the contract
+	// signatures the checker enforces at every `/` and `%` site.
+	func #op_div = (self, int64 divisor: divisor != 0, out int64) {
+		return self / divisor
+	}
+
+	func #op_mod = (self, int64 divisor: divisor != 0, out int64) {
+		return self % divisor
+	}
 	pub func hash = (self, out uint) {
 		return self as uint
 	}