v = append(v, x)) while keeping the
base frozen for every non-consuming mutation, move, reassign, or alias.Next: v0.6.8 → v0.7 consolidation — no new features. Freeze COW spec, property-based ownership testing, channel model-check, Unicode conformance suites, C runtime modularization, application benchmarks, CI automation, external review. See docs/CONSOLIDATION.md.
mldsa44_keygen, mldsa65_keygen, mldsa87_keygen for all three
NIST security levels, wrapping OpenSSL 3.5+'s native ML-DSA via the EVP API.mldsa_sign / mldsa_verify for post-quantum digital signatures.mldsa_public_key extraction and mldsa_algorithm_name inspection.mldsa_self_signed_cert for X.509 certificates with ML-DSA signatures
and mldsa_verify_cert for certificate chain verification.mako_tls_server_pqc / mako_tls_enable_pqc for TLS 1.3 with ML-DSA
signature schemes (MLDSA44/65/87).pqc_available() runtime probe.runtime/mako_pqc.h. 11 adversarial tests in mldsa_pqc_test.mko.error_trace(msg) and error_wrap_trace(err, context) builtins that
automatically embed source file:line in error strings via codegen injection.error_message, error_cause, error_chain for extracting and
formatting error context chains with source locations.\x01/\x02 delimiters invisible to normal string ops;
error_chain renders "context: message [file.mko:42 → caller.mko:10]".runtime/mako_errtrace.h. 5 tests in error_trace_test.mko.uuid_v1 (time + random node, RFC 4122).uuid_v6 (reordered time for natural sort order, RFC 9562).uuid_v8 (custom/experimental 122-bit data, RFC 9562).uuid_timestamp to extract 60-bit timestamps from v1/v6 UUIDs.uuid_v1v6v8_test.mko including sort-order and cross-version.uuid_cmp to return true three-way ordering instead of treating
every unequal UUID as greater.#[derive(json)] to support float, bool, and nested struct
fields (previously only string and int).json_f (float field), json_b (bool field) emitters.json_get_float, json_get_bool extractors.json_get_float/json_get_bool (strlen after
free on the pattern buffer).json_marshal_test.mko.let π = 3.14, let 变量 = 1).
Emoji and digit-leading names are still rejected per UAX #31.unicode_nfc, unicode_nfd,
unicode_nfkc, unicode_nfkd builtins and std/unicode wrappers
(nfc, nfd, nfkc, nfkd).unicode_is_letter, unicode_is_digit, unicode_is_space,
unicode_is_punct, unicode_is_symbol, unicode_is_control to use the
full Unicode 17 UCD tables when available, falling back to the legacy
regex-derived ranges.mako_unicode17.h not being included in the default (non-lean)
header set, which caused C test-backend builds to fail with undeclared
normalization functions.try_send and send_timeout call the matching typed runtime helpers instead
of passing MakoString or boxed values to the integer-channel API (#43).mako_chan_str_send_timeout and mako_chan_str_recv_timeout runtime
functions for string-channel timeout operations.TestTransactionWalCommitOnly through mako test --backend c.Fixed C-backend copy-on-write slice detachment to preserve existing capacity
when backing storage is shared, preventing exponential capacity growth and
rc_alloc OOMs when slices round-trip through returned aggregates and nested
struct fields (#42).
Fixed C-backend range loops to release owned body temporaries at the end of
every iteration, preventing unbounded memory growth and rc_alloc OOMs in
durable string, channel, map, and iterator workloads (#42).
malloc/free, while only slice backings use refcount headers. Removed the
out-of-bounds allocation-tag probe and rejected a partial string-RC migration.MAKO_RUNTIME overrides so compiler
and runtime headers always come from the same checkout under review.set -u.kick stubs by emitting a unique
translation-unit-local anti-folding marker for each generated stub.prove function contracts. Contract
clauses must type-check as bool; C output emits entry assertions for them.value |> f(args) parses as
f(value, args).live fn parsing/AST propagation for future hot-reload lowering. This
is accepted syntax, but runtime hot-swap semantics are not complete yet.Fixed std/grpc wrappers to match the checked builtin signatures for message
limit checks and unary request construction.
Fixed C backend forward declarations for generated struct/enum slice helpers so imported routes, nested struct slices, and map fields compile under clang, GCC, ASan, and UBSan.
makori version makoriX.Y.Z release
line.__int128 division helper imports on that target.llm_ask, llm_chat, llm_chat_stream, llm_embeddings, and
llm_https_post are no longer C-backend-only surfaces.MakoNativeString path as the rest
of the native builtin surface.examples/testing/deterministic_sim_test.mko; Windows CI now fails if that
fixture regresses again.--no-icf
flag while keeping per-kick anti-ICF markers in generated native stubs.makoriX.Y.Z
version line so makori doctor accepts fresh installs.makori fmt --check as a failing formatter gate for CI and editors.makori lint fail clearly when a target contains no .mko sources.makori doctor to validate native runtime support sources and parse
install manifests as structured JSON with version, binary, runtime, and stdlib
fields.Tightened the integer channel hot path by avoiding unnecessary global select notifications, modulo ring advancement, and repeated global peak-depth CAS after the local high-water mark is known.
Integer channels now avoid condition-variable syscalls when no peer is blocked and wake one peer per enqueue/dequeue; close still wakes all waiters.
Added adversarial channel wakeup regression coverage for uncontended traffic, blocked senders/receivers, multi-waiter progress, rendezvous, and close.
version from full
versionLine and include the installed binary path.share/mako/package-metadata.json to release archives so packaged
builds report the same product facts as installed builds.unix_listen,
unix_accept, unix_connect, and unix_unlink.checked-native stdlib package
in the 144-file matrix.scripts/stdlib-safety-audit.sh so releases fail if checked-native
packages lack package-local evidence or unsafe-boundary rows lack explicit
default-safe exclusions.examples/testing/stdlib_package_local_safety_test.mko as the
machine-checked package-local evidence fixture.benchmarks/performance-contract.json as the release source of truth
for workload-specific speed budgets.scripts/performance-contract.sh, which enforces the strict
faster-than-Rust workloads and parser hot-path budgets in one CI gate.rustc a hard failure for scripts/bench-gate.sh; the Rust
comparison can no longer silently skip.continue-on-error soft failure paths from the main CI workflow.continue-on-error usage and verifies quarantine plumbing.ci/windows-quarantine.txt, unknown failures fail CI, and recovered quarantines fail until removed.scripts/windows-quarantine-gate.sh --self-test so quarantine parsing is tested locally without a Windows runner.fn(int)->bool callback dispatch now reads the
Cranelift 8-bit bool return ABI, fixing the Ubuntu native
strings.fields_fn parity failure.--backend c.--emit-c, --target wasm32-wasip1,
--static-link, and --sanitize thread refusal, while keeping native
--sanitize address|leak on the direct backend.examples/testing suite from a
warning-only CI step to a hard gate.strings.fields_fn callback
splitting across ASCII and UTF-8 input.std/ tree so native/C gates
cannot accidentally run a new compiler against stale installed stdlib files.421 passed, 0 failed.strings.fields_fn could
return an empty result under the native backend.strings.fields_fn predicate results through a typed bool local so
native callback ABI differences cannot corrupt separator detection.fn(int)->bool condition calls so Linux ABI
high bits cannot make a false callback result read as true.base64_decode on C and native runtime paths so malformed input,
invalid characters, impossible padding, and partial groups fail closed instead
of skipping bad bytes and returning garbage.stdlib_codec_malformed_test.mko with package-local malformed-input
coverage for archive, image, binary codec, mail, XML, GraphQL, and gRPC
surfaces.scripts/stdlib-safety-audit.sh so the codec/parser safety
family requires the new package-local malformed-input fixture.stdlib_codec_malformed_test.mko passed on default and C backends.scripts/stdlib-safety-audit.sh so every checked-native and
unsafe-boundary stdlib matrix row must classify into exactly one enforced
safety contract family.codec-parser, crypto-secret, and handle-lifecycle.scripts/long-run-soak.sh to measure RSS stability after the warmup
sample, matching the documented years-up gate and avoiding cold-start baseline
noise.stdlib-safety-audit.sh passed with 144 std files covered, 102
checked-native rows, 38 safe rows, 4 unsafe-boundary rows, and 3 enforced
contract families.makori lint --security, which fails on known insecure helper calls
unless the exact line explicitly opts in with // mako: allow-insecure.gethostbyname address loads by using getaddrinfo.scripts/stdlib-safety-audit.sh and wired it into claims and
memory-safety gates so stdlib safety coverage cannot drift from the checked-in
package matrix.-O3 -flto distinct from MAKO_NO_LTO=1.std/**/*.mko file.makori test run graphics tests headless by default and fixed native
task-return lowering for string-backed Uuid values.claims-gate.sh passed, including full examples, cross artifacts, identity
lint, and strict speed gate.memory-safety-gate.sh passed: no GC path, ASan contract fixture, slice RSS
soak, and long-run ownership/RSS soak.0.20x, slice 0.38x, map 0.16x
Mako/Rust on the 2026-08-22 local run.str_slice(s, start, end) builtin — substring extraction, both backends.<, >, <=, >= via strcmp.str_compare(a, b) builtin — returns -1/0/1.crypto/rand (CSPRNG over random_bytes), crypto/hkdf
(RFC 5869 SHA-256 C), crypto/pbkdf2 (HMAC-SHA256 C), testing/quick
(seeded property checks; predicates return int 1/0 — native cannot
lower fn(...) -> bool callbacks), testing/fstest (in-memory MapFS;
empty names rejected), testing/slogtest, image (Point / half-open
Rectangle), regexp/syntax (literal/meta + quote),
net/http/httptrace (event log).context.with_value / value (string-pair chain; later
key shadows; packed key\\tval\\n so it persists across backends),
math/rand.shuffle / perm, time.load_location / in_named /
location_known (fixed-offset table, not IANA tzdb).stdlib_parity_wave3_test (C + native) — HKDF RFC 5869 A.1,
EST = −18000, perm is a permutation of 0..n-1, context shadow,
image half-open bounds, fstest overwrite/empty name.Closed the remaining application-stdlib gaps that can stay memory-safe.
Compress/hash hot paths are C (zlib/flate/LZW/SHA3/MD5). No unsafe,
weak, go/*, or debug/* binary parsers.
flate (raw DEFLATE), zlib (RFC 1950), lzw (9–12 bit),
bzip2 (optional libbz2).md5, sha3 (SHA3-256), subtle (constant-time eq),
ecdsa (ES256), rsa (RS256 verify + DigestInfo).math/big.Rat, hash/crc64, hash/maphash, expvar,
unique, iter, image/color, image/draw, net/textproto,
net/rpc (JSON-RPC 2.0), net/http/cookiejar, net/http/httputil,
testing/iotest, encoding/asn1 (DER integers), log/syslog (PRI lines).stdlib_parity_gap_test, stdlib_parity_adversarial_test (C + native).uint64 >> is arithmetic on
the sign bit, so a bit-by-bit CRC in Makori cannot match Go). Cookie jar
refuses single-label hosts (com no longer matches ex.com). JSON-RPC
escapes " / \ in method/message. rsa.can_sign() is 0 (verify only).
unique documents content-set, not pointer identity. ASN.1 uses []byte
so 0x80–0xFF are not UTF-8. LZW no longer inserts a prefix--1 entry for
the first byte.Mako-shaped equivalents of the Go standard library — snake_case, no
panic-on-OOB, Result instead of nil. Not a syntax clone.
cmp, math/bits, math/cmplx, math/big,
unicode/utf16, encoding/ascii85, encoding/pem,
mime/quotedprintable, hash/crc32, hash/adler32, hash/fnv,
text/tabwriter, text/scanner, io/fs, os/env, os/user,
net/netip, index/suffixarray.strings (cut/split_n/fields_fn/quote-adjacent
search), bytes ([]byte index/compare/clone), slices
(binary_search/compact/insert/delete), path/filepath (glob
matches, rel/abs/volume), io (Limit/Section/copy_n), os
(expand_env/lookup/uid/home), strconv (quote/unquote), time
(parse_duration), bufio.scan_lines, sync.once, net
host/port, maps.has_key/remove, sort.search_*.stdlib_parity_core_test, stdlib_parity_packs_test,
stdlib_parity_io_test, stdlib_parity_os_test,
stdlib_parity_net_test, stdlib_parity_time_sync_test.unsafe, go/* toolchain, debug/*
binary formats, weak (GC), compress/{flate,zlib,bzip2,lzw}
(need codecs), public-key crypto/{rsa,ecdsa} product surface.strings_copy or append), the caller's local became dangling
and was freed again at scope exit — causing SIGSEGV or heap corruption in
large programs. The caller now clones borrowed heap arguments before
passing, and the callee owns its parameters (matching C backend
pass-by-value semantics).bind/read/index now preserve correct type metadata in the C backend.cmap_concat2/concat3i
used a stack buffer that went out of scope — always malloc now (ASan verified).pthread_mutex (mu) instead of
non-existent rwmutex (ref_gate) — fixes Linux CI compile error.slices.fill mut param, os.exists bool return,
removed string ordering comparison in sort.base64url_encode/decode, jwt_sign_es256_header,
jwt_sign_custom, CMap composite-key helpers, nb_udp_bind_reuseport_addr,
tls_server_pool_* aliases.tls_srv_pool_accept/send/recv/fd/close API
returning int handles for server-side TLS connections. 1024-slot ABA-safe
table with inflight I/O tracking. Eliminates need for extern "C" bridge
code when multiplexing TLS connections (#33).cmap_has2/get2/del2, cmap_has3i/get3i/del3i,
cmap_set_int/get_int. Zero-allocation stack-buffer key construction for
high-throughput concurrent map lookups (#33).udp_bind_reuseport(port) and
udp_bind_reuseport_addr(ip, port) for multi-worker kernel-distributed
UDP ingress (#33).tls_reload_cert(srv, cert, key) for Let's Encrypt
rotation without restart (#33).mako update — self-update from GitHub releases without source checkout.mut struct param deep-clone for all owned types.w.routes[0].path = "x").fix: native backend SIGSEGV in struct clone/drop (#32). emit_struct_clone
and emit_struct_drop in both the Cranelift and LLVM backends were missing
match arms for StructSlice, PtrSlice (3 sub-variants), MapIPtr, and
MapSPtr field types. Owned aggregate fields inside structs fell through to
bitwise-copy (clone) or no-op (drop), causing shared pointers and
use-after-free when structs with []Struct or pointer-map fields were passed
by value. Also added missing FloatSlice/ByteSlice/BoolSlice arms to
the LLVM backend.
fix: C backend mut struct param deep-clone. Mutable struct parameters
shared interior pointers (strings, slices) with the caller. Reassigning an
owned field freed the caller's data. The codegen now deep-clones owned fields
at function entry for mut struct params.
feat: chained index+field assignment. w.routes[0].path = "x" now works.
The parser accepts Index nodes as field-assign bases; the C codegen emits a
bounds-checked _get_ptr accessor for in-place mutation of struct array
elements. The native IR path already handled this via StructFieldStore.
feat: indirect call arity raised to 8. Function-pointer and closure calls
previously capped at 3 arguments; fn_call4–fn_call8 runtime helpers and
IR dispatch now support up to 8.
feat: 20+ missing built-in functions registered in native IR.
str_trim_left, str_trim_right, format_pad, duration_us_as_ms,
duration_days, duration_to_seconds, file_append, syscall_chmod,
syscall_kill, syscall_symlink, syscall_setrlimit_nofile, btree_len,
btree_get_all, btree_range_str, store_del, and others — all with
corresponding native bridge wrappers where needed.
mako dap is now a real DAP adapter. It speaks the Debug Adapter
Protocol over stdio (Content-Length framing), builds the .mko program
named in the launch request's program field (debug flags -O0 -g, C
backend, output in $TMPDIR/mako_dbg_<stem>_<pid>), and proxies the
session to a spawned lldb-dap. Stack frames and breakpoints resolve to
.mko source via per-statement #line directives. A program that
already points at a binary is used as-is; a failed build returns a DAP
error. On disconnect the lldb-dap child and inferior are killed — no
orphans. lldb-dap discovery: $MAKO_LLDB_DAP, then xcrun -f lldb-dap
(macOS), then lldb-dap / lldb-dap-21..16 on PATH.mako debug [path] [-p member] [-- args]: builds with debug info
and launches an interactive lldb session with the Mako data formatters
preloaded. lldb discovery: $MAKO_LLDB, xcrun -f lldb, lldb on PATH.editors/lldb/mako_formatters.py): MakoString
prints as a quoted UTF-8 string; Mako*Array / MakoArr_* print as
[e0, e1, ...] (first 16 elements) with expandable synthetic children.
Auto-loaded by mako dap and mako debug (override with
$MAKO_LLDB_FORMATTERS); installed to
$PREFIX/share/mako/mako_formatters.py.mako-native debug type now spawns
mako dap itself via a DebugAdapterDescriptorFactory — no CodeLLDB or
Microsoft C/C++ extension, no preLaunchTask. The mako.debug.adapter
setting and adapter launch property are removed.#line directives and
generate the macOS dSYM (explicit dsymutil); function prologues no longer
steal user source lines in the line table.native (Cranelift) backend emits no DWARF line info. mako dap
and mako debug force the C backend automatically; manual lldb users must
build with makori build --backend c.mako dap
--request, --stdio, and --max-messages no longer exist; mako dap
takes no flags.scripts/test-dap.sh (scripted DAP session via
scripts/dap_drive.py against examples/testing/debug_probe.mko, skips
cleanly without lldb-dap, includes a build-failure negative case); unit
tests in src/dap.rs.null_moved_slots) instead of eagerly at every ownership transfer. The
eager null store (0.5.1, #30/#31) also killed bindings the language keeps
live — a chan placed in a tuple crashed any later use of the chan
(pthread_mutex_lock on a null handle), and plain let b = a string
aliases read back as empty.StrBuilder fields: struct clone shares the
builder pointer (shared handle, like chan), so a by-value method call such
as json.new_object().build() double-freed it. Matches the C backend —
the builder buffer is owned by explicit builder finish/free.examples/testing/struct_handle_fields_test.mko.MAKO_MAP_MAYBE_SHRINK rehashes to a smaller
table when tombstones outnumber live entries, keeping iteration O(len)
instead of O(cap) after delete-heavy workloads. Applied to all 15 C
runtime and 6 native runtime map delete functions.for k, v in range m loops and maps_keys/maps_values helpers,
eliminating sparse-table scans.map_iter_shrink_test.Six new test files exercising 14 previously untested safety gaps:
adversarial_try_owned_struct_test: ? on Result[OwnedStruct], ? in
loops, ? after match move, ? with live capturing closure.adversarial_defer_try_test: defer + ? early return, defer + break,
multiple defers LIFO order.adversarial_nested_cfgdrop_test: labeled break/continue with owned
values, ? inside nested match inside loop.adversarial_nested_string_arr_test: [][]string nested free under
append + reassign churn.adversarial_discard_bag_test: let _ = Result[OwnedStruct],
let _ = Option[[]string] deep payload cleanup.adversarial_own_alias_test: multi-arm conditional reassign, alias-mut
in loops.All tests pass under ASan with zero leaks, use-after-free, or double-free.
New std/dtls pack and dtls_* builtins (runtime/mako_dtls.h): DTLS 1.2
over a UDP socket — the WebRTC DTLS-SRTP building block Nalobi-style programs
need.
dtls.local_fingerprint / dtls.peer_fingerprint expose
SHA-256 cert digests (AA:BB:…) for SDP a=fingerprint.dtls.export_srtp_keys returns RFC 5764 keying material
(client_key|client_salt|server_key|server_salt) for the negotiated
profile; dtls.srtp_profile reports it; dtls.export_srtp_secret wraps the
bytes as a wipe-on-drop Secret.scripts/dtls-smoke.sh verifies a Makori echo server against
openssl s_client -dtls1_2; loopback test at
examples/testing/dtls_test.mko (C + native backends).Also fixed along the way:
_ in the name (src/dce.rs):
alias.method() reachability only registered the bare method name, which
never matched method_names when it contained an underscore — so calls like
dtls.ctx_new(...) or tls.server_new(...) compiled to literal 0. The
reachability walk now also pushes the mangled alias__method name, mirroring
the typechecker.print/print_int/print_bool flush stdout
(runtime/native_runtime.c): the Cranelift runtime buffered stdout when
redirected to a file, so log markers only appeared at process exit; now
matches the C runtime's unbuffered line semantics.The default compilation backend is now native (Cranelift). makori build,
makori run, and makori test produce native object code directly — no C
intermediate step.
The C backend remains available via --backend c and is used automatically
for modes the native backend does not support: sanitizers (thread, undefined),
cross-compilation, --emit-c, and --static. If you explicitly pass
--backend native with an unsupported mode, you get a hard error with
guidance.
Both backends pass 394/394 tests.
The default public registry (https://loreste.github.io/mako-packages) is
now built in — makori pkg get <name> works out of the box with no
configuration. Override with MAKO_REGISTRY_URL or [registry] url in
mako.toml.
version_satisfies now handles * (previously
rejected all versions when no version requirement was specified)scripts/publish-registry.sh for pushing packages
to the registry#line directives)Generated C output now includes #line directives that map back to the
original .mko source file. Debuggers (gdb, lldb) can step through Mako
source lines instead of generated C. Directives are emitted across all
codegen paths: function bodies, if/else, while, for (all variants),
defer, crew, arena, unsafe, select, closures, and block expressions.
Block::source_lines uses Box<[usize]> — zero
heap allocation for synthetic blocks, exact-fit for parsed blocks#line directivemakori pkg get <name> [version] fetches packages from an HTTPS registry,
verifies SHA-256 tarball integrity, and adds the dependency to mako.toml.
The resolver falls back to the remote registry automatically when local
and git sources miss.
MAKO_REGISTRY_URL or [registry] url in mako.toml<url>/<name>/index.json with versions, SHA-256 digests, and tarball URLsmakori pkg sign signs with ed25519 (MAKO_SIGN_KEY);
makori pkg verify checks against MAKO_VERIFY_KEY. Signatures are
verified automatically on remote fetch when the verify key is configured.0xFF, 0b1010, 0o77 with underscore separators (0xFF_FF, 0b1111_0000).
All three tiers from the security audit scope (docs/SECURITY_AUDIT_SCOPE.md):
0xDE on free, zero on alloc, double-free walk (capped at 64), freelist corruption detectionmako_http_conn_mu mutex on slot claim/release; all fields initialized under lock before live = true (fixes partial-init race where select() could poll fd 0)accept_ms timestamp (slowloris mitigation)_Thread_local globals eliminate data race on concurrent recv; cumulative fragment cap at MAKO_WS_MAX_PAYLOAD (16 MiB) prevents memory exhaustionw * h overflow guard before pixel allocationAudited and confirmed safe (no changes needed): SCTP/Diameter parsing (bounds-checked), HPACK decode (bounded), MAKO_CFLAGS (no shell, Command::arg).
transfer_own_on_return marks a returned local as moved so it is not freed
before return. Its Expr::Call arm is written for the bag constructors
(Ok/Err/Some) but matched every call shape, so any return f(local)
disarmed that local's drop. return len(a) yields an int64_t, which cannot
alias the backing array, yet the array was never freed: 1.6 MB leaked per call,
813 MB over 500 calls where it now holds at 8 MB.
The same shape appeared four more times, each fixed by cloning a borrow while leaving a live owner alone:
return str_to_upper(a) must still free a (236 MB → 6.7 MB over 2000 calls)fn wrap(s: string) -> Holder { return Holder{ s: s } } returned a struct
holding the caller's buffermako_some_str is o.ok_s = s)is_field_borrow_return covered Expr::Field but not Expr::Index, so
return a[0] handed back a borrow of a slice elementWith every escape path cloning, return user_fn(local) is finally safe to free.
A first attempt at the top-level guard used a blocklist and aborted five
C-backend fixtures with SIGTRAP; the shipped guard is a whitelist over scalar C
types, so anything that might carry ownership keeps transferring.
This also closed the whole append gap against C. A 10M-element append loop ran 6.5 ms against C's 3.2 ms purely because every call faulted in fresh pages; it now measures 3.20–3.57 ms against C's 3.16–3.39 ms.
The gate could not have caught any of it: its RSS check is a ratio across runs,
and every run leaked the same amount, so the ratio stayed flat at 800 MB. Adds
examples/bench/slice_drop_soak.mko and a gate step with an absolute peak-RSS
bound. run_backend now checks every fixture — the script has no set -e and a
bash function returns only its last command's status, so failures mid-list were
discarded.
pthread_mutex_t mapped to CRITICAL_SECTION and pthread_mutex_lock called
EnterCriticalSection, but entering a zeroed CRITICAL_SECTION is undefined and
faults. MAKO_MUTEX_INIT resolves to {0} on Windows, and fifteen runtime
mutexes are declared that way and never passed to pthread_mutex_init. Each
faulted on first lock, which was the entire SIGSEGV group in the Windows suite —
the owners line up one-to-one with the crashing fixtures. Mapped to SRWLOCK,
whose documented static initializer is {0}.
sha256_hex smeared a 64-bit FNV hash across 32 bytes and returned it formatted
as a digest; hmac_sha256_raw parsed that back into "MAC" bytes; hmac_sha1
returned ""; pbkdf2_sha256 had no fallback at all. An empty MAC compares
equal to an empty MAC, so a signature check built on any of these passed for
every input, on the platform where that is hardest to notice. Adds RFC 3174
SHA-1, FIPS 180-4 SHA-256, RFC 2104 HMAC and RFC 2898 PBKDF2, verified against
published vectors and cross-checked against CommonCrypto.
Windows went from 38 failing fixtures to 21. The remainder is unported platform surface — filesystem semantics, socket address behaviour, signals, the sampling profiler, AEAD/HKDF — so the full suite now reports with an annotation carrying the count rather than gating, while the core language tests still gate.
mako_await_timeout_ms polled in 2 ms steps and advanced its own counter by 2
per hop, assuming every nanosleep returned on schedule. Under contention it
does not, so the loop ran past the caller's timeout and the final check reported
the now-finished task as success: join_timeout(40) against 400 ms of work
returned Ok. Now measured against the monotonic clock, with the last hop
clamped so the wait cannot overshoot.
The literal-shape checks only matched Expr::String / Expr::Float /
Expr::Bool / Expr::Array, so [s] holding a string variable fell through
to the int-family path and emitted int64_t lit[] = { s }, which does not
compile. Dispatches on the emitted element type instead. The nested case moves
rather than copies, since mako_arr_*_of takes ownership of the element headers.
Completion offered a hand-written seed of thirteen builtins against a type
checker table of roughly 2500, so almost nothing the language provides was
discoverable and the seed drifted every time a builtin landed. Now read from
TypeChecker::builtin_signatures(), with each item carrying its rendered
signature. serverInfo advertised a hardcoded 0.5.0 while the crate was 0.4.16;
it now reports CARGO_PKG_VERSION.
Removed ~20,200 lines: 103 emit_builtin_call_* functions and 5
check_builtin_call_* functions that were an unreachable second copy of the live
emit and check paths, the two macros that fed them, const_len, and
MapValKind::StructKeyPtr. native_ir::lower only looked unused in a default
build — it is used by the LLVM backend and the native_ir unit tests — and is
now gated on any(feature = "llvm-backend", test).
Three steps ran with continue-on-error, so their failures never blocked a
merge. The native suite's comment blamed "missing backend services" for the
proxy and SQL failures; those were a free() on a handle owned by SQLite and a
SIGPIPE the native test harness never ignored, both fixed in 0.4.16. The
Windows default suite and its recursive-depth test were suppressed too, leaving
a platform that ships release artifacts unable to block anything.
Removing the suppressions immediately surfaced a real bug: the compiler thread reserved a release-sized 16 MB stack, and a debug build — which inlines nothing and carries full locals per frame — overflowed it on Windows, whose default thread stack is 1 MB against Linux's 8 MB. Debug now defaults to 64 MB.
MakoHttp2Conn is over 4 MB (stream_body alone is 64 × 64 KB) and
mako_http2_conn_new declared one as a stack local, overflowing the thread
stack. Found by Valgrind on Linux; macOS survived it by luck of stack layout.
str_builder leaked its struct and buffer on every call — 88 bytes plus
growth. mako_str_builder_free already existed; nothing emitted a call to it.
Measured over 500 iterations: 48000 bytes in 1500 allocations before, zero
after on the native backend, and 4000 on the C backend, the remainder being the
literal-argument leak still tracked as open.
Type::Builder separates handles this runtime owns from the Type::Opaque
catch-all, which cannot be dropped because it also holds handles owned by
foreign libraries — a SqlDB is the sqlite3* pointer itself. This is the
pattern the remaining opaque leaks need.
makori pkg imports lists every pull in a module, classified as relative,
stdlib, internal or external, and reports where the manifest disagrees. It
parses rather than matching text, so aliases and blank imports are handled by
the grammar.
makori pkg tidy reconciles [dependencies] with what the source imports.
Additions are automatic; removal is behind --prune, because the scan skips
files that fail to parse and a needed dependency can be invisible to it.
--check reports without writing, for CI.
Dependencies are keyed by the full import path, matching
resolve_module_import_path, not by the first path segment.
makori pkg publish now refuses a breaking API change under a version that
claims compatibility. mako api diff and publish both existed and nothing
connected them, so a module could ship a changed signature as a patch and
consumers resolving by SemVer range would take it. A break needs a major bump,
or a minor bump while major is 0. Additions are not breaking.
wss_client_connect_headers exposes the extra-header handshake that existed in
the runtime but was never wired to a builtin, so Makori code could not send
Origin, User-Agent or Cookie on an upgrade. The header block is validated
against request splitting.
Rebuilding libquiche from source produces an archive that exports BoringSSL's
SSL_* symbols, which collide with OpenSSL and segfault TLS setup. See
runtime/third_party/quiche/BUILD_NOTES.md. Quiche is optional; without the
archive, H3 falls back to header stubs.
A sweep of every runtime header, the native bridge, and the ownership classifier. Findings are grouped by what they cost, not by file.
Regression fixed — double-free on a success path. The previous release's
"free json_escape temps" change appended a second mako_str_free to five
mako_llm.h builders that already freed after snprintf, aborting on the
normal path of every llm_message / llm_chat_body / llm_embed_body call.
Confirmed under Valgrind and AddressSanitizer. examples/testing/llm_test.mko
and json_mako_test.mko are now in scripts/memory-safety-gate.sh — the gate
did not previously cover them, which is why the regression shipped green.
Bounds and overflow on untrusted input.
mako_proxy.h — chunked decoder guarded the hex accumulator before the
shift, so 16 F digits reached size == SIZE_MAX; the length check then
wrapped, the capacity check wrapped, and no buffer was allocated, reaching a
memcpy with SIZE_MAX. Reachable from both proxy directions. Both chunked
paths now use the non-wrapping size > len - i form.mako_quiche.h — h3_free_conn left a dead connection's ready-queue slots
marked live; 64 aborted requests permanently wedged the server, and slot
reuse could route a response to the wrong connection.mako_tls.h — free() on the shared empty singleton (a static address)
when SSL_get_finished produced no data, reachable via SCRAM channel bind.mako_sip.h — six decimal accumulators over unbounded wire digits were
signed-overflow UB, and the wrapped negative made message framing fail
open. All saturate now.mako_diameter.h — inbound-queue budget check underflowed for a wire length
larger than the limit.mako_httpengine.h — off-by-one admitted a read one byte past the request
buffer.mako_goext.h — zip reader trusted usize while bounds-checking csize
(heap over-read); mako_db.h — a >2 GiB URL made an int-cast length check
pass negative and overrun a stack buffer; mako_domain.h — framebuffer
w * h overflowed past its cap while pixel writes bounds-checked the
unclamped dimensions, and a b-tree split failure allowed a write past the key
array.mako_template.h — printf with a template-supplied format string (%n is
an arbitrary write); now restricted to a single %s.mako_model.h — signed overflow let a crafted model file pass its size cap.mako_std.h — graphql_schema_sdl returned a length covering uninitialized
heap bytes on truncation, and a non-NUL-terminated buffer for an empty
schema.Correctness.
map[Point]int returned wrong values for 22 of 40
keys. Now content-hash aware, with the cloned keys freed on delete.mako_fail stored the caller's message pointer without copying, leaving a
dangling read after longjmp.mako_str_eq passed NULL to memcmp, which is declared non-null even for
zero length.Per-call leaks. Reclaimed owned temporaries across the JSON, GraphQL,
OpenAPI, auth, YAML/TOML, SIP, HTTP/2, DB, and LLM builders — including
json_get_string, the highest-fan-in accessor in the runtime, and the
per-element leaks in yaml_get_list / yaml_keys / toml_keys that grew with
document size. Eleven native-bridge shims violated the compiler's
consumes_first contract by never freeing the argument the compiler had
already released: a 200k-iteration loop over the affected list builtins went
from 45.1 MB to 6.6 MB peak RSS.
Ownership classification. 797 string-returning builtins were classified
against their C implementations by walking every return path, rather than by
name convention. 122 were previously classified owned; 650 more were leaking
one buffer per call. The default is unchanged — an unclassified builtin is
still treated as borrowed, so the failure mode stays "may leak" and never
"double free". A live invalid-free was fixed in the same pass: print(...) of
a borrowed builtin such as http_path or tcp_read_fast emitted a
mako_str_free on a connection-table field or a static buffer.
Verified. On Linux, all 57 builtins that previously leaked one buffer per
call now measure 0 bytes/call under LeakSanitizer, with none regressed. The
double-free is gone, confirmed independently by a plain build, AddressSanitizer
and Valgrind. UndefinedBehaviorSanitizer is clean across 113 fixtures, and
there are no use-after-free, double-free or out-of-bounds errors anywhere in
the ASan sweep. Total leaked bytes across the fixture suite fell from 2,103,705
to 1,756,957; ws_api_test dropped 75% and diameter_conn_test went from
4,249 bytes to 48. The 391-fixture suite passes on both the C and native
backends. env_keys and read_dir both measure 0 bytes per call under
LeakSanitizer and Valgrind; read_dir was leaking 271 bytes per call in
shipped code, so this closes a pre-existing leak as well as the new one.
Sanitizers do not run on the native backend — --sanitize is rejected there —
so all sanitizer evidence above is C-backend only. The native backend was
exercised as a plain functional run, and no memory-safety claim for it should
rest on this audit.
Known open (tracked, not fixed here): string literals passed to builtin
call sites leak the mako_str_from_cstr temporary — 4–13 bytes per call
(str_trim 13, str_len 11, str_replace 10, sha256 8, json_object 4).
Pre-existing and unchanged by this release; bound arguments and user-defined
functions are unaffected. The fix needs a shared argument-emission path that
does not exist yet: builtin arms are spread across ~100 generated emitters with
no common place to reclaim an argument temporary. Emitting literals as borrowed
views instead would free static storage, and tagging them with an immortal bit
would require masking every length read in the runtime — the bug class that
produced a str_join abort. sip_test still accounts for 1.54 MB of
residual leak across 140k allocations; it barely moved here, so it is a
different class and remains untriaged. Channels have no destructor, and a
naive one is a use-after-free whenever a spawned task outlives the creating
scope — the documented leak is the safer trade until a refcount or a
shutdown-drained registry exists; buf_to_string is proven owned but left
borrowed (one buffer per call) rather than flipped in a release-blocking
change; plugin_call is genuinely two-valued depending on whether the plugin
exports free_string, so it stays borrowed; the aliasing string-array helpers
share buffers, so freeing both input and output would be a double free;
sctp_connectx passes a non-packed address array.
Native typed drops. The shared IR now distinguishes runtime-owned opaque
values from foreign handles. Interface boxes are reference-counted,
http_request_parse results are deep-cloned and dropped, and foreign database,
registry, and OS handles remain on their explicit close paths. Content-keyed
struct maps also clone values returned by reads and release stored keys and
values on overwrite, delete, copy, clear, and final drop. Interface boxes retain
the concrete type's compiler-generated recursive destructor, including slices,
maps, nested structs, and owned handles. The focused native fixture and the full
struct-key map suite pass under LeakSanitizer and AddressSanitizer.
These are the building blocks for any backend — not one application.
timer_heap_* / std/timer — deadline min-heap; kind/id are opaque app tags
(runtime/mako_timer.h).peer_table_* / std/peer — named peers + string-key routes + conn/state
handles; capacity / alive for scanning (runtime/mako_peer.h).tls_pool_* — pooled outbound TLS/mTLS with caller-supplied connect/I/O
timeouts (open_timeout, open_mtls, open_mtls_full, set_timeout).sctp_* / std/sctp — one-to-one SCTP: streams, PPID, heartbeats, RTO,
multihoming where the kernel allows. Linux real path; soft stubs elsewhere.<=0 does not invent
30s / 16 streams / 5 retrans.Tests: timer_heap_test, peer_table_test, tls_pool_test, sctp_api_test.
runtime/mako_diameter.h / std/diameter: RFC 6733 framing, AVP helpers, HbH
multiplex, optional diameter_mgr_*, TCP/SCTP pools, auto base CER/CEA/DWR.diameter_tcm_* is a thin Diameter facade that composes general
peer_table + timer_heap (plus Origin/Tw/DWR only). Prefer the general
primitives for multi-protocol services.diameter_limits_set for wire caps; absolute ceilings only for allocator DoS.{hbh,app,cmd}; conn generation (ABA).timer_heap, peer_table, tls_pool,
diameter_tcm — free+reuse rejects stale handles.json_object_str, json_si, json_ss,
json_i, graphql_request/_vars, LLM message builders, …) escaped their
arguments via mako_json_escape (which always allocates) into a temp used
only for snprintf, but never freed the temp — one buffer leaked per call on
JSON-serialization hot paths. Reclaimed the escape temps across ~20 flat
builders in mako_std.h / mako_llm.h. Verified: json_object_str etc. now
CLEAN under LeakSanitizer; json/adapters/graphql suites pass under
AddressSanitizer (no double-free). Loop-based / guarded-return builders (7
in mako_std.h) are left for a follow-up careful pass.+
(e.g. "row-" + int_to_string(n)) was copied by mako_str_concat but never
freed — one buffer leaked per concat. It is now reclaimed after the concat
when it is an unambiguously owned temporary (gated by expr_is_scope_drop_safe,
which excludes literal views / index / method borrows — no double-free).builtin_returns_owned_string(name) —
a conservative classifier keyed on operation families whose output is freshly
computed and can never be a borrowed view (_encode, _decode, _to_string,
_hash, _sign, _hex, _json, _sdl, format_*, base64_*, base32_*).
Their dropped results now free instead of leaking per call; any unclassified
builtin stays not-owned (may leak, never double-free). View-returners
(str_as_view, bytes_as_str, buf_to_string) and polymorphic string(x)
are excluded. Covers ~90+ builtins (was ~10); a new encode/format builtin is
handled by its family with no code change. Full suite green under ASan
(390/0). New examples/testing/owned_string_builtin_test.mko.examples/testing/concat_owned_operand_test.mko. A residual leak inside a
few builtin implementations (e.g. base64_encode) is a separate runtime-level
issue tracked apart from scope-drop ownership.Theme: Real GraphQL query executor; native backend List[T] for non-scalar
T; name the adaptive-optimization loop Anneal. Version bump 0.4.15 →
0.4.16.
graphql_schema_resolve API (both C and native backends, no ABI
change). Now supports: nested selection projection over object and array
results, field aliases, arguments with operation variable defaults,
__typename, __schema / __type introspection, named and inline fragments,
field validation, and spec-shaped {"data":…,"errors":[…]} output.graphql_schema_resolve results
and owned query-argument temporaries were never reclaimed. String-returning
builtins are now allowlisted in scope-drop cleanup; the resolve hot path is
leak-free per request (verified flat under LeakSanitizer over 500 calls).examples/testing/graphql_exec_test.mko (13 cases; ASan/UBSan clean).match-consumed; an unconditional free would double-free),
as are structs (freed field-by-field). New
examples/testing/owned_return_drop_test.mko. Verified: full suite green under
AddressSanitizer (no double-free/UAF), leak eliminated for []int / string
/ List[Struct] returns, generic-enum tests still pass.List[T]List[T] now lowers on the native backend for any element type (structs,
nested List[List[int]], strings, pointer arrays) by aliasing []T, instead
of erroring for non-scalar T. New examples/testing/native_list_generic_test.mko,
differentially valid vs the C backend.docs/ADAPTIVE_OPT.md.scripts/anneal-cycle.sh (product-named entry point over
scripts/adaptive-opt-cycle.sh; same args/env). Stable hot_site_* API and
/debug/hot_sites export unchanged.hot_site_test.mko: boundary ids, top reassignment, enable-mode
transitions, and concurrent atomic-counter tallies (single- and multi-site).Theme: NATS + Redis messaging adapters, GraphQL schema/resolvers, gRPC service registry, OpenAPI builders — backend API surface, no GC.
nats_new / sub / pub / try_next / len + wire frames
(pub_frame, sub_frame, connect_frame, ping_frame).
Package: std/messaging/nats.mko.redis_mq_* (LPUSH/RPOP/LLEN shapes) plus live
redis_conn_lpush / rpop / llen and host/port one-shots.
Package: std/messaging/redis.mko.graphql_schema_new / add_type / add_field / set_resolver /
resolve / sdl / has_type / has_resolver.std/graphql/schema.mko; HTTP helpers extended.grpc_service_new / add_method / handle /
methods (unary framed responses). Package: std/grpc.openapi_paths_merge / operation / response / info /
doc_full. Package: std/openapi.examples/testing/adapters_api_test.mkomakori test --json emits a versioned report with per-file results, captured
output, structured failures, repeat runs, and optional coverage data.makori check --json=v1 adds a stable diagnostics envelope while bare
--json retains the original array for existing integrations.Theme: Adaptive optimization — longer-running services get better via offline feedback, not in-process code rewrite. No GC.
hot_site_* builtins — opt-in relaxed atomic counters (256 sites).
Default off (hit is one load + branch). Export mako.hot_sites.v1 and
HTTP /debug/hot_sites via profile_http_route.scripts/adaptive-opt-cycle.sh (AOT + guidance + pgo-build.sh).examples/testing/hot_site_test.mko.Theme: Language-level queue[T] and Graphql (not only free functions).
queue[string] type with make(queue[string], n) and methods:
.publish / .push, .try_take / .take, .len, .purge, .free / .close.Graphql type via graphql_parse(body) and methods:
.query, .fields, .has / .has_field, .arg, .data, .error,
.is_query / .is_mutation.examples/testing/lang_queue_graphql_test.mko.Theme: Messaging queues + GraphQL HTTP — backend API surface seeds (no GC).
Theme: Messaging queues + GraphQL HTTP — backend API surface seeds (no GC).
mq_* / std/messaging)mq_new / mq_free / mq_declare / mq_publish /
mq_try_take / mq_len / mq_purge (mutex-safe, owned string payloads).std/messaging/messaging.mko.examples/testing/messaging_queue_test.mko.examples/messaging_worker.mko.graphql_query_from_body, graphql_variables_from_body,
graphql_fields (root field list).std/graphql (handle_http_body seed resolver).graphql_http_test.mko (+ existing graphql_seed_test.mko).examples/graphql_http_server.mko (POST /graphql).Theme: HTTP long-run soak + production allocator/PGO knobs (years-up LR-3/4/6).
Theme: HTTP long-run soak + production allocator/PGO knobs (years-up LR-3/4/6).
examples/bench/http_long_run_server.mko — accept budget + per-request map/string work.scripts/http-long-run-soak.sh — concurrent clients, server RSS under load, clean exit.MAKO_ALLOCATOR=mimalloc|jemalloc|system or path to a static .a.MAKO_LDFLAGS for extra link flags (fingerprinted; bypasses incremental).scripts/pgo-build.sh — instrument → train → llvm-profdata merge → rebuild.Theme: Years-up foundation — long-running services (no GC, stable p99/RSS).
examples/bench/long_run_soak.mko — compressed request cycles (map/slice/string).scripts/long-run-soak.sh — ownership live-delta + multi-sample RSS stability.Theme: LLVM CI job (macOS) + install/doctor smoke on primary hosts.
llvm-backend job on macos-latest: brew LLVM 21, cache static lld,
scripts/bootstrap-native-toolchain.sh, then scripts/llvm-backend-test.sh.MAKO_LLVM_SKIP_IF_UNAVAILABLE=1 (documented in the script + BUILD.md).
The macOS CI job fails hard when the toolchain is expected.examples/bench/native_map.mko and native_fib.mko.scripts/install-smoke.sh: version + makori doctor + init/run.Theme: Map + I/O native bench workloads, map hot-path speed, regression budget.
map[int]int: identity-key open addressing, 75% load / grow_at,
hand-C-matched header {keys*, vals*, state*, cap, lenp*} (separate len
allocation so insert stores do not alias table-pointer loads), non-recursive
rehash that actually doubles capacity.map_ii_set / map_ii_get with hand-C probe shape (empty →
insert, full+match → update; cold set_ptr only when the table is full).native_map uses 1e6 entries. On Apple arm64 (LLVM release):examples/bench/native_map.{mko,c,rs} and native_io.{mko,c,rs}.scripts/native-bench-baselines.json
(regression ≤ recorded × 1.15). Absolute bars: map ≤ 2.00×, io ≤ 2.00×.Theme: Modes truth table — fail closed on native/LLVM.
Depends on: 0.4.6 residual work in tree.
validate_direct_backend_modes for native/LLVM: hard-error on
--sanitize, --static-link, --target / wasm, --emit-c; llvm requires
--release and --features llvm-backend.--backend c (no silent hybrid).makori doctor prints the backend / modes matrix.--backend llvm.Theme: Post-v0.4.5 residual patch — smaller ship, not a mega-0.5.
Versioning: docs/VERSIONING.md — prefer patches (0.4.6,
0.4.7, …) over waiting for 0.5.0.
Next patches: 0.4.7 modes truth table · 0.4.8 map/I/O gates · then 0.5.0
CLI default flip.
mako_native_string_clone_ptr returns
the static header pointer; drop is a full no-op (no per-clone header malloc).[]string append: inline immortal/static check so literal append skips
the runtime clone call on the hot path; fast-path header kept in registers
(phi merge, no stack store/load).[]string index: immortal share for element loads (no runtime clone
for static payloads).[]string drop: inlined immortal check (no N external drop calls for
literal-filled slices).-ffunction-sections/-fdata-sections;
link with -dead_strip (macOS/lld) / --gc-sections (Linux); strip release
binaries by default (MAKO_NO_STRIP=1 to keep symbols). Bench binaries drop
from ~36× slim hand-C to ~1.01×.MAKO_BACKEND env for build / run / test when CLI is still default
c; MAKO_TEST_BACKEND still preferred for tests. Explicit --backend
always wins. No silent native→C hybrid. (Default CLI flip is 0.5.0, not this patch.)v0.4.6 is tagged and
fill-release-packaging.sh v0.4.6 is run.Theme: Native compiler product path. Integration branch: native-compiler.
After 0.4.5: patch train 0.4.6+ then minor 0.5.0 (default flip). Full
map: docs/ROADMAP.md · docs/VERSIONING.md.
--features llvm-backend + bundled lld.examples/testing native gate: 367/367 (0 failures).file_seek, file_read_exact, file_append3, fdatasync, fallocate.recv_timeout distinguishes closed vs timeout.for iterators; multi-stmt outer mut captures
(kick still ShareInt/Sync-only); const string index s[i]../scripts/native-bench-gate.sh with LLVM release when available (3 samples):
| Workload | vs Rust (median wall) | Notes |
|---|---|---|
native_fib |
~1.01× | Matches hand C / Rust |
native_parity |
~1.01× | Within gate |
native_slice |
~1.12× | Within 1.25× ship bar; RSS higher than hand C |
native_string_slice |
~1.35× at tag | Tightened post-tag residual pack (see Unreleased) |
| Compile latency (native vs C backend) | ~0.22× | Faster compiles |
| Binary size (some LLVM/native benches) | ~36× at tag | Fixed post-tag via dead_strip (~1.01×) |
scripts/package-release.sh --slim produces host tarball + .sha256.install-release.sh from file://dist → makori doctor ok.makori test examples/testing --backend native on Linux/macOS.cc is unavailable.print(f"..."), log_*(f"..."), http_respond(f"..."): f-string
bodies consumed directly from the stack buffer (no malloc/free).writev print: single syscall for data+newline on Unix.memcmp on hash mismatch during probing.= {0} aggregate init instead of memset.wrap_err, error_join, error_tag (separator strings).MAKO_LIKELY on FULL state).len(f"..."): compute length from stack buffer without materializing.s = append(s, v) self-append.mako0.4.0 (CARGO_PKG_VERSION). 362 Mako tests + 80 Rust tests, 0 failures.
mako_str_concat_own reuses buffer on chained opstrue && false → falselen("hello") → 5MAKO_LEAN_INCLUDES=1makori lint)let bindings (skip _ prefix)makori lint --shadow or MAKO_LINT_SHADOW=1--strip flag for smaller deploy binariesMAKO_NO_DCE=1 escape hatch to disable dead code eliminationOption and Result values free
resolved string, slice, map, struct, nested bag, and error payloads. Borrowed
bags from fields and indexes remain owned by their container.discarded_bag_drop_test, discarded_bag_borrow_test.mako0.3.0 (CARGO_PKG_VERSION). 360 Mako tests + 79 Rust tests, 0 failures.
All 11 CI jobs pass (ubuntu, macOS, Windows, ASan, UBSan, GCC, TSan,
cross-compile, bench gates, claims gate).
_XOPEN_SOURCE 700 for stack_t)detect_leaks=0 (focused on use-after-free / out-of-bounds)clock_gettime shim for Windows cross-compileout = b in if).let mut out = path emits out__own; free is
if (out__own) … so path-insensitive free never frees a still-aliased
caller/param buffer when a reassign arm is not taken.own_bind_scope when sequential arms reuse let blob; clear
arm freer flags on arm exit.match_own_free_test, double_free_guard_test,
early_return_path_free_test, own_branch_regress_test; leba main.mko build.PACKAGE.sha256 namecollect_program_inputs propagates verification errorsmako0.2.5 (CARGO_PKG_VERSION). 357 Mako tests + 75 Rust tests, 0 failures.
own_branch_regress_test fails on pre-fix compiler,
passes on fixed compiler (verified both directions)makori pkg seal for legacy package migration (TOFU)tar --no-same-owner, graceful read-only shell RC handling--owner=0 --group=0)mako0.2.4 (CARGO_PKG_VERSION).
Soundness and efficiency release after 0.2.3: memory-safe drops by construction, stack POD array lits, closed SAFE/RT residuals, build-time lockfile verification.
[][]T
free-on-reassign via *_release_replaced (no shared-inner UAF).string_view surface + str_as_view / str_to_owned (SAFE-005); owning
strings free on reassign/scope exit.? early-return frees live owns (SAFE-006).sched_set_workers pool +
mako_spawn_blocking; channel take-send ownership; census; select stress seed.cap==0 views); empty slices allocate nothing.mako_*_array_to_owned); cold free (MAKO_UNLIKELY).SSL_CTX_use_certificate_chain_file).[] lit; chained slice index assign.Tests: string_view_test, struct_own_drop_test, sched_pool_test,
capture_matrix_test, channel_ownership_test, nested_arr_drop_test,
try_drop_test, string_drop_test, stack_array_lit_test, own_drop_*,
pkg:: unit suite.
mako0.2.3 (CARGO_PKG_VERSION).
Security patch after 0.2.2: fail-closed JWT JSON/JWKS parsing, safer JWT sign/verify resource handling, dual-stack HTTP listen, and docs for the verified HTTPS contract.
true/false/null, objects, and
arrays with depth limiting; reject trailing junk after a complete object.jwt_verify_jwks returns 0).jwt_sign / jwt_verify — payload size cap, HMAC length checks, free
signature buffers on all exit paths.http_*, OIDC, and JWT SNI contracts.mako0.2.2 (CARGO_PKG_VERSION).
Security and packaging patch after 0.2.1: concurrent-safe multi-cert SNI, verified TLS hostnames, HTTPS/OIDC client helpers, JWT RS256/JWKS verify, and SHA-256 package lock integrity.
tls_server_sni_add rebuilds and swaps the full
certificate set under the server mutex so accept callbacks never see a
half-updated table.tls_server_sni_update / tls_server_sni_remove — strict replace and
remove of named SNI certificates (exact or *.example.com wildcards).X509_VERIFY_PARAM_set1_host from the SNI hostname.https_request / https_get / https_post — TLS HTTP client with optional
CA PEM path and timeout; https_last_status / https_last_header for the
last response.oidc_discovery / oidc_token — OpenID Connect discovery document and
token endpoint helpers over HTTPS.jwt_verify_rs256 / jwt_verify_jwks — strict base64url JWT signature
verification with PEM public keys or JWKS JSON.pkg install fails closed on mismatch (from 0.2.1 tip merges).See sections below for generics, stdlib-in-Mako, and match safety.
.mko sources are
hashed with deterministic SHA-256 digests over normalized relative paths.
pkg install now verifies every reused lock entry and fails closed on source
changes and missing, modified, or unreadable content. Malformed lockfiles,
unsafe serialized paths, and unreadable transitive manifests are rejected;
legacy v1 locks require an explicit pkg update.tls_server_sni_add preloads exact and
left-most wildcard certificate contexts. Exact names win, then the longest
wildcard suffix; malformed/duplicate hostnames and invalid key pairs fail
closed. Selection is synchronized for concurrent accept loops.clock_gettime/nanosleep declarations, and WASI uses
explicit portability fallbacks for unsupported POSIX process APIs.Stdlib surface gate — all 71 checked-in stdlib package files are
type-checked in the claims gate; fixed stale slog and boolean-print wrappers.
Multi-statement lambda bodies — lambdas can now contain let bindings,
assignments, if/else, while loops, and nested control flow. Previously
only single expressions were supported. Enables real callbacks in stdlib.
mut self on methods — on Type { fn m(mut self) { self.field = v } }
passes the receiver by pointer so mutations persist in the caller. Enables
real iterators and any method that modifies state.MyBox[int] and MyBox[string]) no longer collide
on shared variant names. Qualified lookup uses return type context to resolve
the correct instantiation in both type checker and codegen.Type::Named resolution.pattern if condition => body. Guard condition combined
with pattern into single if-condition. Some(n) if n > 10 => "large".Some(n) if n > 10 alone does not
cover all Some; missing unguarded arm was a compile-time hole that aborted
at runtime (non-exhaustive match).Some(struct) / nested struct match — track struct payload names for
builtin Some/Ok so match o { Some(Point { x, y }) => … } codegen unboxes
the heap payload correctly (was treating it as int64_t).Pool.release ignores duplicate idx.escape_str — also escapes \b \f and other C0 controls as \u00XX.hold values
produce compiler errors on use after move, partial moves, moves across
control flow branches (break/continue/if).std/io) — StringReader with read(mut self) advancing
position, ByteWriter with write(mut self) appending bytes, drain()
reads to completion. Written in Makori, not C wrappers.std/collections/stack.mko) — IntStack, StrStack,
IntQueue with push/pop/enqueue/dequeue using mut self. Returns
Option for empty cases. Queue auto-compacts on dequeue.std/context) — Context struct with background(),
with_timeout(ms), with_deadline(ms), with_cancel(), done(),
err(), remaining(). Deadline propagation and cancellation.std/encoding/json) — ObjectBuilder and ArrayBuilder
for constructing JSON incrementally. set_string/set_int/set_bool/
set_null/set_raw with proper escaping. Parser wrappers for extraction.std/net/http) — Request/Response types, Router with
add()/match_route() for method+path routing, text_response/
json_response/html_response constructors.std/database/sql) — Pool with acquire()/release()
slot management, begin_tx/commit_tx/rollback_tx transaction helpers.chan_len / chan_cap on any chan[T] — type-check accepts struct,
tuple, enum, and string channels (not only chan[int]). Runtime helpers
mako_chan_ptr_len / mako_chan_ptr_cap and mako_chan_str_len /
mako_chan_str_cap back the pointer and string rings.chan[tuple] codegen — TypeExpr::Tuple and generic chan[T] forms
register correctly in chan_ptr_elems so len/cap and ptr helpers stay
consistent with chan[Struct].mako0.1.9 (CARGO_PKG_VERSION).
Patch after 0.1.8: generic types, interface bounds, and seed iterator / mutable-closure infrastructure — the foundation for writing the stdlib in Makori.
struct Pair[T] { a: T, b: T }, multi-param
struct Triple[A, B] { … }. Monomorphized at compile time to one C struct
per concrete instantiation (Pair__int, Pair__string, …).enum MyBox[T] { Val(T), Nothing } with match on
monomorphized variants.fn make_pair[T](a: T, b: T) -> Pair[T].Box[Pair[int]] and multi-instantiation in one unit.fn f[T: Iface](…) — type parameters may name a structural interface
bound; call sites check method sets (on T { fn m… } satisfies Iface).examples/bad/generic_bound_fail.mko rejects types that lack
required methods.Type_next method returning Option[…] participate in
for … in codegen.self does not mutate the outer iterator; loops that
only return Some(self.current) without advancing will not terminate.
Prefer explicit mut patterns until mut-self iterators land.malloc + pointer in env).ROADMAP_IMPL.md is the
implementation plan for agents.generic_*_test, iterator_test, mutable_closure_test.mako0.1.8 (CARGO_PKG_VERSION).
Patch after 0.1.7: speed-first runtime and codegen wave — hashing, strings, channels/select, HTTP table scale, and compiler allocation cuts. Memory-safety and concurrency correctness retained (or tightened) on every change.
__uint128_t where
available, portable fallback elsewhere).f"...") uses a
256-byte stack buffer instead of two heap allocations (struct + buffer).
Short interpolated strings (routes, log lines, error messages) never touch
the allocator.1 + 2, flags & 0xff, size > 0) are folded at compile time.
No runtime code emitted for arithmetic on constants.x == "literal" and x != "literal" use
mako_str_view for the literal side (zero allocation, points directly into
read-only data). Extends to str_eq, str_has_prefix, str_has_suffix,
str_contains, match arm string patterns, and print("literal").
Previously every string literal in these contexts allocated via
malloc + memcpy.want_map lookup — demand-driven monomorph checks use a joined
key set instead of allocating String pairs on every call. Cuts thousands
of heap allocations during compilation of map-heavy programs.emit_line — hot emission paths write with format_args! into
the output buffer (no intermediate String per line).MAKO_HTTP_CONN_MAX raised from 32 toswitch dispatch
replaces sequential string comparison. Headers of non-matching length are
skipped without any comparison.select condvar wakeup — channel select waits on a shared condition
variable instead of 2 ms nanosleep polling. Send/close notify waiters for
near-zero wakeup latency (50 ms max wait slice covers race windows).cap lock-free — chan_cap() no longer takes the mutex to read
an immutable field. Removes unnecessary contention on high-throughput
channel workloads.malloc + memcpy (not realloc) to preserve sub-slice interior pointer
safety. realloc on a sub-slice's aliased pointer is undefined behavior.http_active_connections always returned 0 — the atomic active-count
added with the 1024-slot connection table was never incremented/decremented
on accept/close. Live transitions now go through mako_http_conn_set_live,
which keeps the counter in sync. Graceful-shutdown drain paths can rely on
a correct count again.TestBinaryFormatSeeds to match
spec-compliant compact encoding (positive fixint, uint8, int8) instead of
expecting always-64-bit format.P0 — first-class handles + bloom rebuild
- Domain handles (Bloom, PageMan, Predict, MultiMap, …) map to real C
pointers (params / returns / struct fields), not int64_t.
- bloom_clear resets bits without free/new.
P1 — range · multi-value · string keys
- Range buffer grows (TLS 128 → heap up to 65 536); range_cap.
- Iterator: range_rewind / range_next / range_key / range_val.
- MultiMap multi-value ordered map (multimap_put / get_all / range).
- String keys: bloom_add_str / bloom_maybe_str, btree_put_str /
get_str / range_str, str_hash64.
P2 — durable sidecars
- btree_save v2: magic MBT2 + FNV checksum (legacy v1 load still works).
- pman_write_page / pman_read_page (full 4 KiB bulk).
P3 — ergonomics
- str_slice_ci_index / str_slice_ci_starts, builder_write_slice.
- file_append2 / file_append3 (writev multi-record flush).
- Domain registry: domain_reg_put_* / get_* / del (int slots for handles).
P4 — extras
- sst_build8 / sst_build_n (N≤8 pairs without C arrays).
- Profile JSON schema remains mako.profile_samples.v1 (stable).
Tests: TestDomainHandleFieldsAndFns, TestDomainStoragePolishP0toP4.
mako0.1.7 (CARGO_PKG_VERSION).
Patch after 0.1.6: binary codecs (CBOR/MessagePack/Avro), list combinators, GraphQL/protobuf packages, named timezone offsets.
std/encoding/avro).std/graphql).std/encoding/protobuf).time_offset_named UTC/EST/PST/JST/…) + time_format_offset.avro_graphql_tz_test.[]int (binary + hex helpers).cbor_type.std/encoding/msgpack, std/encoding/cbor; collections wrappers.cbor_msgpack_test.mako0.1.6 (CARGO_PKG_VERSION).
Patch after 0.1.5: YAML/TOML encoding packages, plugin product, rich collections, full time + syscall, unicode/utf8 depth.
[section] get, int/bool/float, encode pairs/sections.std/encoding/yaml, std/encoding/toml.yaml_toml_test.plugin_info_json,
std/plugin package; plugin_product_test compiles a real plugin with cc.std/collections.time_date / year…weekday), RFC3339 parse/format,
local format, duration helpers, trunc/add/sub; std/time + time_full_test.std/syscall + syscall_full_test.rune_error / rune_self / max_rune / utf_max).unicode_is_* categories, case (to_lower/to_upper/
to_title/simple_fold), unicode_is(prop, r) (same tables as \p{…}).std/unicode, expanded std/unicode/utf8.unicode_full_test.List[T] / List<T> aliases []T with correct codegen for element types.slices_reverse_strs / slices_unique_strs /
strings_index / strings_copy.std/collections.collections_list_test.std/plugin (open/call/close + meta + hot-reload wrappers).plugin_package_test (+ residual plugin seeds).mako0.1.5 (CARGO_PKG_VERSION).
Patch after 0.1.4: package-per-directory, unbuffered rendezvous channels,
Go-style implicit interfaces, actor int payloads, const-fn depth (match /
while / for / break·continue / strings / string const fn), error chain peel,
and fallthrough.
const fn f(s: string) -> string and mixed int/string params.len_greet)."" / 0 for params by type.TestConstFnString in const_fn_test.const S = "…" string constants; + / str_concat at const time.str_len / len and == / != / str_eq fold to ints.mako_str_from_cstr("…").TestConstString in const_fn_test.break / continue fold in const while / for / C-style for.continue still runs the post clause (Go/C semantics).TestConstFnBreakContinue in const_fn_test.for i in n / for i in range n (count 0..n-1).for init; cond; post (let/assign init + post).TestConstFnFor in const_fn_test.match on ints: literals, a \| b, _, binding patterns.while with let/assign (capped at 100k iterations).TestConstFnMatch · TestConstFnWhile in const_fn_test.receive Inc(delta) / receive Set(v: int) — one int payload per message.actor_pack /
actor_msg_tag / actor_msg_payload).Counter_Inc() → pack(tag, 0); Accum_Add(10) → pack(tag, 10).TestActorIntPayload · TestActorPackHelpers in actor_test.on T { fn m… } or free fn T_m(self T, …) implement
interface I when signatures match — no on T : I required.Concrete_method (alongside I_method /
I_Concrete_method).iface_implicit_test.mko..mko files in a package dir merge as
one unit (same pack name enforced). Path deps and pull qualify after the
full merge so cross-file calls rewrite correctly.main.mko / lib.mko / *_test.mko
(and dirs with mako.toml) pull sibling units; flat demo dumps stay single-file.chan_new(0) / chan_open[T](0) true rendezvous —
send waits until recv takes; try_send only succeeds with a waiting receiver.
chan_cap reports 0. Int / string / pointer channels.pkg_per_dir_test · chan_rendezvous_test · example examples/pkg_per_dir.error_unwrap / error_root / error_as_tag /
error_has_tag (Go errors.Is / unwrap / tag style on wrap chains).std/errors: unwrap / root / as_tag / has_tag aliases.fallthrough: Go dual keyword; last statement of a switch case merges
the next arm body (fallthrough_test).error_chain_test.mko · fallthrough_test.mko.mako0.1.4 (CARGO_PKG_VERSION).
Patch release after 0.1.3: language zero-copy string regions, storage polish,
observability/debugger seeds, packaging dry-runs, comptime if fold, and
product-path seeds (DAP stdio, profile-serve, live plugin reload).
mako dap --stdio Content-Length loop; more commands (scopes/variables/step/breakpoints).mako profile-serve --port N --max-requests K continuous HTTP seed.hot_reload_plugin_watch / poll / call / close / swaps.gfx_window_fill / set_pixel / get_pixel / pixels..github/workflows/product-seeds.yml packaging + cross-compile dry-run.== < <= > >=), &&/||/!, statement if/else,
and if-expressions fold at compile time (const_fn_test).hot_reload_note_swap / swap_count / stamp / status_json.predict_* client prediction service seed (input + reconcile).dap_handle_request / dap_request_seq — one-shot DAP request dispatch.mako dap --request '…' (or stdin) prints a seed response.profile_http_route("/debug/pprof/text|json") ·
profile_pprof_http_body (app owns the TCP listener).scripts/cross-target-seed.sh lists FreeBSD/RISC-V triples;
.github/workflows/cross-target-seed.yml dry-run.dap_initialize_response / dap_stopped_event / dap_threads_response /
dap_request_command (adapter helpers; lldb remains DWARF path).profile_samples_pprof_text · per-sample tid ·
profile_sample_thread_count.packaging/windows/mako.wxs · package-msi-seed.sh ·
package-notarize-seed.sh · publish-homebrew-tap-seed.sh ·
publish-winget-seed.sh · .github/workflows/package-seed.yml.gfx_poll / gfx_backend_name · gpu_metal_ok / cuda_ok /
vulkan_ok stubs · snap_diff / snap_apply_delta · netcode_*.plugin_open / plugin_call / plugin_close ·
ffi_abi_name · hot_reload_unwatch / hot_reload_watch_count.residual_seeds_test.mko (+ extended domain/profile tests).profile_sample_clear / once / start / stop / count / lenprofile_sample_cpu_us / profile_sample_wall_ns / profile_samples_jsonSIGPROF + setitimer(ITIMER_PROF) when availableexamples/testing/profile_sample_test.mkodebug_line_bp_*), frame stack
(debug_push/pop_frame / debug_frames_json), async parent ids on tasks,
optional SIGTRAP (debug_trap_enable), combined debug_snapshot_json.trace_export_otlp_pb (minimal protobuf wire) · otlp_http_export /
otlp_export_traces_json|pb · http_request_ct (Content-Type).install.ps1 writes mako.install.v1; matrix DOCTOR_STRICT=1 option.Name_spawn_cap(n) · Interfaces: on Concrete : Iface { … }
desugars to Iface_Concrete_method.fn_drop_debug_test, observability_depth_test, actor_test,
iface_on_iface_test.bloom_new / add / maybe / len / free — int64 keys,
fixed bitset, no false negatives.btree_range / sst_range (inclusive lo..hi) fill a
TLS buffer; read with range_len / range_key_at / range_val_at (cap 128).pman_open / alloc / set / get / sync / pages /
reads / writes / close — 4 KiB file-backed pages (superblock + user pages).TestBloomFilter, TestBtreeAndSstRange, TestDiskPageManager.str_slice_eq / str_slice_ci_eq / str_slice_contains /
str_slice_index / str_at_eq / str_byte_at — operate on s[off:off+len]
without allocating a substring.s[i:j] only to compare or search.examples/testing/str_slice_zc_test.mko.sip_header_view / sip_body_view / sip_method_view + sip_view_len /
offset / eq / ci_eq / contains / copy (TLS last-view; no malloc on view).sip_header_eq / sip_header_ci_eq / sip_header_contains /
sip_method_eq — no TLS, no alloc.sip_header_n).TestSipZeroCopyViews, TestSipZeroCopyHotLoop (20k compares).;maddr in via_fix_source (only strip received/rport) — RFC 3261 §18.2.2.sdp_replace_connection_addr upgrades IP4↔IP6 with the new address.$/? inside single-quoted string literals.sip_test (maddr+fix_source, v4→v6 rewrite).sdp_media_formats, sdp_media_connection/_addr (inheritance),
sdp_media_attr, sdp_media_direction (default sendrecv).sdp_origin_addr, sdp_timing, sdp_connection_is_ip6.sdp_replace_connection_addr, sdp_replace_media_port,
sdp_set_media_direction.sdp_build_audio (IP6), sdp_build_av, sdp_attr_candidate.TestSdpProxyRewrite.sip_via_value_rport — bare ;rport for symmetric response routing.sip_via_fix_source / sip_msg_fix_top_via — if rport present,
set received=src and rport=src_port; else if sent-by ≠ source, set received only.sip_via_response_host (maddr > received > sent-by),
sip_via_response_port (rport value > sent-by port > 5060/5061),
sip_via_response_addr, sip_msg_response_*.sip_via_has_rport / sip_via_rport / sip_via_received / sip_via_maddr /
sip_via_transport.TestSipRfc3581ViaRewrite, TestSipRfc3261ReceivedOnly, TestSipRfc3581UacAndMsg,
TestSipViaMaddrAndDefaultPort, IPv6 response addr.std/sip expanded: full proxy surface re-exports (insert_via, strip_via,
via_value_nat, digest_response_ha1, framing, auth challenges, …).sip_* builtins.z9hG4bK magic cookie; uppercase transport; IPv6 [addr]:port
sent-by; via_host/via_port parse brackets.via_add_received strips prior ;rport/;received then rewrites
(no duplicate bare ;rport); via_value_nat orders ;received then ;rport.<sip:…;transport=…;lr>; IPv6 host brackets; lowercase transport.Content-Encoding ↔ e.TestSipRfc3581ViaRewrite, TestSipViaIpv6.sql_exec_str4 uses mako_sql_placeholder_arity (max $N / ?
count). Empty "" is a real bind value — no more stripping trailing empties
(fixes Postgres “supplies 1 parameters, requires 2”).sql_query_str2 / str3 / str4: multi-arg string queries (same arity rules).MAKO_SIP_LIT); framing
without extra header-buffer copies; compact header aliases; stress test.sip_insert_via / sip_strip_via / sip_via_value_nat /
sip_via_add_received / sip_via_host / sip_via_port / sip_record_route /
sip_prepend_header.sip_digest_response_ha1, sip_www_authenticate,
sip_proxy_authenticate.sip_first_message_len, sip_ensure_to_tag,
sip_reply_with_to_tag.sql_str4_empty_bind_test, sql_query_str_multi_test, sip_test,
sip_digest_ha1_test.levels[3] L1–L3 SSTs; lsm_compact_down promotes/merges L1→L2→L3;
lsm_sst_levels / lsm_level_len(level).pbtree_new / put / get / len / pages / free — nodes stored
in MakoPage slots (split/grow).TestLsmMultiLevel, TestPageBTree.lsm_compact(l, path) merges L0 run (+ prior L1 SST) into a new
sorted SST, truncates the run; lsm_compactions / lsm_flushes counters.store_recover_wal(s, w) replays P,k,v / D,k WAL records.file_mtime_ns, hot_reload_watch, hot_reload_changed (mtime slots).domain_tracks_test (TestLsmCompact, TestStoreRecoverWal, TestHotReloadWatch).mako0.1.3 (CARGO_PKG_VERSION).
Runtime trust, observability, language ergonomics (closures, f-strings), storage/domain seeds (no SIPREC/WebRTC), packaging polish, and docs.
btree_save / btree_load — persist ordered KV snapshot to disk.sst_build4 / sst_get / sst_len / sst_free (sorted run + binary search).pcache_new / pcache_get / hits·misses (16-slot LRU).mvcc_gc(min_ts) / mvcc_live.simd_dot_i64_4 / simd_sum_i64_4.storage_depth_test.btree_new / put / get / len / free (fanout 8).lsm_new / put / get / flush / attach_run.mvcc_*.rollback_push / get / restore_slot0.gfx_window_*, gfx_shader_compile, gfx_asset_size,
audio_mix, physics_step_*.kv_cache_*, gemm2x2, f32_to_f16_bits.debug_set_loc / debug_file / debug_line / debug_frame_json.package-msi-notes.md, package-macos-notarize-notes.md.mako_domain.h. Tests: domain_tracks_test.hindex_new / put / get / del / len / free.store_* with begin/commit/rollback + optional WAL.snap_encode* / snap_predict / snap_reconcile.store_index_test.MakoFn + env) · string/struct/ShareInt captures · kick Send.fn_drop on scope exit; kick moves capture env.+ # - 0, hex/oct/bin, float e/f/g).mako0.1.2 (CARGO_PKG_VERSION).
map[K]V types from the program AST, then emits only those
(key, val) pairs — not the full N² named-key × bag grid.MakoMapK_* /
opt_* / arr_* helpers) so large packs stay roughly O(used maps).[]T bag-array deps still resolve
correctly when those shapes are actually used.map[K](Option[T], U) / (U, Option[T]) / (Result[T,E], U) and
same-leaf bag pairs; Option[chan[T]] × scalar; (chan[T], Option[int]);
named-struct bag × int.MakoTup_* (e.g. None → opt_int retagged to map’s bag leaf).None / Ok("…")
refine under map assignment.map_tuple_bag_test.map[K][]Option[Option[T]] / []Option[Result[T,E]] /
[]Result[Option[T],E] / []Result[Result[T,E],E] (scalar, struct,
channel leaves) — tags arr_opt_opt_* / arr_opt_res_* / arr_res_opt_* /
arr_res_res_*.map[K]Option[[]Option[T]] / Result[[]Option[T],E] /
Option[[]Result[T,E]] / Result[[]Result[T,E],E] — tags
opt_arr_opt_* / res_arr_opt_* / opt_arr_res_* / res_arr_res_*.Some/Ok for channel and struct
payloads.map_nested_bag_slice_test.map[K]Option[Result[T,E]] / Option[Result[chan[T],E]] /
Option[Result[Option[T],E]] — tags opt_res_* / opt_res_opt_*.map[K]Option[Option[Option[T]]] (triple Option, incl. channels) —
opt_opt_opt_*.map[K]Result[Option[Option[T]],E] / Result[Result[T,E],E]
(incl. channels) — res_opt_opt_* / res_res_*.map_option_result_nested_test.Option[Option[…]] map values + struct-chan 3-tuplesmap[K]Option[Option[T]] / Option[Option[chan[T]]] and
map[K]Result[Option[chan[T]],E] — tags opt_opt_* / res_opt_*.peek_expr_c_ty treats Some/None/Ok/Err as bag C types so
nested Option metadata is not clobbered (bare Option[Option[int]] match).map[K](chan[Point], int, int) (and mid/last).map_nested_option_chan_test.map[K](chan[T], U, V) and channel in the other two slots —
(U, chan[T], V), (U, V, chan[T]) over core channel kinds × scalar pairs.
Unpack let c, a, b = t propagates channel metadata.map_tuple_chan3_test.[][]chan[T] and (chan[T], scalar) map valuesmap[K][][]chan[T] — nested channel-slice values (arr_arr_chan_*).map[K](chan[T], U) / (U, chan[T]) / (chan, chan) — 2-tuples with
channel handles (int/bool/float/string/struct × scalars). Tuple lits refine
float/struct channel mono tags from local metadata; unpack propagates
send/recv kinds.map_chan_nested_slice_tuple_test.[]Option[chan] / Option[[]chan])map[K][]Option[chan[T]] / map[K][]Result[chan[T],E] — bag-element
slices of channels (arr_opt_chan_* / arr_res_chan_*).map[K]Option[[]chan[T]] / map[K]Result[[]chan[T],E] — optional /
fallible channel-slice values (opt_arr_chan_* / res_arr_chan_*).map_option_chan_nested_test.Option[chan[T]] / map[K]Option[chan] / Result[chan]Option[chan[T]], Result[chan[T],E], and as map values
(map[string]Option[chan[int]], map[int]Result[chan[string],string], named
keys, float/struct channels). Some/Ok store channel handles via mako_some_ptr
/ mako_ok_ptr; match unboxes with send/recv metadata.opt_chan_* / res_chan_*. Tests: map_option_chan_test.map[K][]chan[T]map[string][]chan[int],
map[int][]chan[string], map[string][]chan[Point], named keys.
Tags arr_chan_*; also enables standalone make([]chan[T], n) / append
/ array lits of channel handles. Float/struct channel metadata propagates
on slice index.map_slice_chan_test.map[K]map[K2]map[K3]V — three-level nested maps (scalar mid/leaf cores;
named keys allowed on the outer map). Shallow maps_* (pointer identity on
mid maps). Depth 4+ still rejected.map_depth3_test.session_cancel mutex — lazy-init instead of PTHREAD_MUTEX_INITIALIZER
so Windows CRITICAL_SECTION shims compile (was failing every Windows test).parse_map_k_slice_val — if _map_ is the leftmost separator, defer to
nested-map parse (map[Point]map[string][]int no longer misread as slice).[]byte / []int64 / []int32 /
[]int8 when the element type is expected (annotated lets / casts).map[K]chan[T] channel valuesmap[string]chan[int],
map[int]chan[string], map[bool]chan[float], map[string]chan[Point],
named struct/enum keys. Tags chan_int / chan_string / chan_float /
chan_bool / chan_Struct; values are channel pointers (missing key → nil).
Full get/set/maps_*/range/comma-ok; float and struct-channel metadata
propagates on lookup so .send/.recv still type-correct.chan_float / chan_ptr_elems per function so float/struct
channel metadata does not leak across functions that reuse local names.map_chan_test.crypto.scram_verify_proof — uses const_eq when comparing the recovered
StoredKey (was language ==). Docs: STDLIB / SECURITY / BUILTINS / book ch07 /
llms-full.txt aligned to the real crypto.scram_* core API (no fictional
scram_client_first / SASL framing helpers).(Struct|Enum, scalar) / reverse / (T,T) map values; tags use C mono
names (MakoEnum_Color) so they match Expr::Tuple emission.map[K](int,int,int,int) (and string/float/bool);
no full 4^4 monomorph grid.map_tuple_struct_test.map[K]Option[map[…]] / map[K]Result[map[…],E]map[string]Option[map[string]int],
map[int]Result[map[string]int,string], struct-valued inner maps, named
outer keys. Tags opt_map_* / res_map_*; Some/Ok store map pointers;
match unbox registers map C types. Fixed named-key parse so opt_map_…
is not misread as a nested-map value.map_option_of_map_test.map[K](T, U[, V]) tuple valuesMakoMapS_tup_int_int*, etc. for
scalar 2- and 3-tuples over int/string/float/bool keys × same bases. Named
keys supported. Values stored by value; get/set/maps_*/comma-ok.
Unpack: let t = m[k]; let a, b = t (let a, b = m[k] is comma-ok, not
tuple unpack — same as Go).map_tuple_test.map[K]Option[[]T] / map[K]Result[[]T,E]map[string]Option[[]int],
map[int]Result[[]string,string], named keys/payloads. Tags opt_arr_* /
res_arr_*; Some/Ok heap-box slice headers (existing path). Match on m[k]
registers slice kinds. Fixed named-key parse so opt_arr_int is not split on
inner _arr_. Zero-cost monomorphs; bag eq is pointer identity for boxed
slices (same as Option[map]).map_option_of_slice_test.map[K][]Option[T] / map[K][]Result[T,E]MakoMapS_arr_opt_int*,
etc. Full get/set/maps_*/range; match on m[k][i]. Zero-cost: reuses
MakoArr_opt_* / MakoArr_res_* already used by []Option / bag-map
maps_values. Equality uses mako_eq_option_int / mako_eq_result_int.map_option_slice_test.seal_at_rest / open_at_rest (AES-128-GCM,
nonce||ct||tag) and seal_file_at_rest / open_file_at_rest.limits_new(mem, time_ms, max_conns) with try/release
mem & conn slots, limits_check_time, inspect helpers.session_cancel_token / session_cancel /
session_cancelled / session_cancel_clear (process-local registry; share
token over the wire).tls_server_new_mtls(cert, key, client_ca),
tls_client_new_mtls(ca, client_cert, client_key), tls_unique(conn).scram_gs2_header, scram_cbind_b64,
scram_client_final_without_proof (classic c=biws + PLUS-style headers).security_residuals_test. Docs: SECURITY.md.[]Option[T] / []Result[T,E]make([]Option[int], 0, n), append, index get/set,
range, and annotated literals [Some(1), None]. Same for Result[T,E] and
string/float/bool/Struct payloads. Reuses monomorphized MakoArr_opt_* /
MakoArr_res_* (also used by maps_values on bag maps). Match on xs[i]
registers Some/Ok kinds; append/index-assign push expected types for bare
None / Err.option_result_slice_test.Option[map] / Result[map], []map, maps_*, test index).map[K]Option[T] / map[K]Result[T,E]map[string]Option[int], map[int]Result[string,string],
map[Point]Option[int], etc. Values are stored by value (MakoOptionInt /
MakoResultInt monomorphs MakoMapS_opt_int*, MakoMapI_res_string*, …).
Full surface: get/set/len/has/delete, comma-ok, range, maps_*.
Missing key → zero bag (None / Err("")). Match on m[k] registers
Some/Ok payload kinds for nested arms.m[k] = None / Some(x) / Ok(x) / Err(e)
push the map value type as current_expected so bare None is not
Option[int] when the map holds Option[string].map_option_result_test.Option[map[K]V] and annotated None/Somelet o: Option[map[…]] = None — annotation is pushed as current_expected
before checking the init, so bare None no longer defaults to Option[int].Some(map) / Ok(map) codegen — any MakoMap* uses mako_some_ptr /
mako_ok_ptr. Match unbox tracks concrete map C types (MakoMapFI*,
MakoMapBI*, monomorphized maps, …) not only SI/II/SS. Inferred
Some(m) / Ok(m) derive kind + C type from the argument.option_map_test (float/bool keys, SI/II/SS, Result map).[]map[K]V and map[K][]map[K2]V — slices of map pointers (MakoArr_map_string_int,
…) with make/append/index/range; maps whose values are those slices. Deduped
nested-arr emission. Tests: slice_map_test.mako_eq_* / mako_hash_* for structs — fields that are slices
(MakoIntArray, MakoArr_*, …) or map/channel pointers no longer use
== or (int64_t) casts (invalid C). Eq/hash use buffer identity
(.data + .len) or pointer identity. Unblocks real engine packs
(e.g. a Table with []int + map[int]int) after pull.Option / Result / enum struct fields — same helpers no longer
emit aggregate == or int casts. Runtime mako_eq_option_int /
mako_hash_option_int / mako_eq_result_int / mako_hash_result_int
(and float-result variants) plus mako_eq_MakoEnum_* for enum fields.
Unblocks lang_residuals_test (WrapOpt with Option[int]) and
map[WrapOpt] / map[WrapRes] keys.struct_slice_fields_test, lang_residuals_test.eng.Table
(parsed as the import-mangled name eng__Table). Same surface as
eng.table_new() calls.eng.Point { x: 1, y: 2 },
positional eng.Point { 1, 2 }, and match p { eng.Point { x, y } => … }.eng.Red, eng.Green(n),
eng.Color.Red, eng.Color.Green(n) (pack alias must not be a value binding).map[int]Point / map[string]Point (and pack types
e.g. map[int]eng.Table): get/set, len/has/delete, comma-ok, range.
Codegen monomorphizes like []Struct (MakoMapI_* / MakoMapS_*).map[Point]int / map[Point]string / map[Point]float
(and pack keys e.g. map[eng.Table]int): monomorphized MakoMapK_T_i|s|f*,
field-wise mako_eq_T / mako_hash_T.map[Struct]Struct — monomorphized MakoMapK_Key_vVal* (second pass after
all []T helpers); pack types work as key and/or value.map[K]bool + []bool — set-style maps (MakoMapIB* / SB* / FB* /
MakoMapK_T_b*) and bool slices (MakoBoolArray): make, append, index, slice,
range, maps_*.map[bool]V — bool keys for int/string/float/bool/Struct values
(MakoMapBI* / BS* / BF* / BB* / MakoMapB_T*).[]Enum — map[K]Enum, map[Enum]V, map[Enum]Enum,
map[Struct]Enum, map[Enum]Struct, and []Enum with make/append/index.
Enum keys use mako_hash_MakoEnum_* / field-wise eq; unit variants fully
zero payload slots.[][]T — monomorphized outer arrays of slice headers
(MakoArr_arr_int / arr_string / … / arr_Struct): literals, make,
append, index, range, sub-slice.map[K][]T — maps with slice values (MakoMapI_arr_int*, …) for scalar
keys × int/string/float/bool/byte/Struct/Enum slices; full get/set/maps_*.map[Struct|Enum][]T — named keys with slice values (MakoMapK_Point_arr_int*,
…): same surface as scalar-key slice maps (get/set/len/has/delete, comma-ok,
range, maps_*). Values may be []int|[]string|[]float|[]bool|[]byte|[]Struct|[]Enum.map[K]map[K2]V — depth-2 only (inner value must not be a map).
Outer keys: int|string|float|bool|Struct|Enum; inner maps any previously supported
leaf map. Values are map pointers (missing → nil); maps_clone / maps_equal are
shallow (pointer identity). Tests: map_nested_test.map[K][][]T — maps with nested-slice values (MakoMapS_arr_arr_int*, …)
for scalar and named keys × [][]int|[][]string|[][]float|[][]bool|[][]Struct|[][]Enum.
Full get/set/range/maps_*. Tests: map_nested_slice_test.map[K]map[K2][]T / [][]T — nested maps whose values are slice maps
(e.g. map[string]map[string][]int, map[Point]map[string][]int,
map[string]map[int][][]int). Leaf specs include slice-value monomorphs;
parse disambiguates …_map_…_arr_… from plain slice values.
Tests: map_map_slice_test.len on nil SI/II/SS maps — mako_map_{si,ii,ss}_len treat NULL as 0 (matches
other map kinds and nested-map zero values).make(chan[T], n) — same element set as chan_open[T](n): int family,
string, float, bool, named structs (incl. pack types).maps_* overloads — maps_keys / values / clear / clone / equal /
copy work for SI/II/SS, float-value maps, struct-value maps, and
struct-key maps.map[int]float / map[string]float — full get/set/len/has/delete,
comma-ok, range, maps_* (MakoMapIF* / MakoMapSF*).map[float]int, map[float]string, map[float]float
(MakoMapFI* / FS* / FF*). +0/-0 unify; all NaNs share one key.map[float]Struct — monomorphized MakoMapF_T* (incl. pack types).maps_equal on struct maps (string
fields compare by content, not pointer identity).== / != on structs and enums — uses generated mako_eq_Type /
mako_eq_MakoEnum_* (field-wise; string content; enum tag + payload).let a, b = f() and tuple match no longer
force non-primitive tuple elements to int64_t. Element C types are taken
from the registered MakoTup_* field list, so local structs and pack-
prefixed structs (eng__Table) unpack correctly.pack_types_test, tuple_struct_test, map_struct_test,
map_struct_key_test, map_float_test (float values + float keys),
chan_make_struct_test, struct_eq_test; lib examples/pack_types_lib.mko.maps_* +
chan_open, ERGONOMICS (maps/slices short path), LANGUAGE, STATUS,
GO_SYNTAX_CHECKLIST, book ch03/ch15, llms.txt / llms-full.txt.Patch release for production edge stability and CI green. makori version reports
mako0.1.1 (CARGO_PKG_VERSION).
mako_tls_h2_reply_200 / 404 (and client DATA)
split bodies into ≤16384-byte DATA frames (SETTINGS_MAX_FRAME_SIZE default).
A single ~19 KiB homepage frame caused browsers to report
net::ERR_HTTP2_FRAME_SIZE_ERROR on https://mako-lang.com/.http2_data_frame auto-split — same rule for raw builders and gRPC helpers;
END_STREAM only on the last frame. http2_response* shares that path.TestHttp2DataFrameSplit, TestHttp2ResponseLargeBodySplit.freed. Broader use of
mako_str_free in HTTP/2, SIP, WS, reflect, slog, net, cache, proxy forward
headers/body, maps_clear_si, and zip close (avoids free(): invalid pointer
/ SIGABRT on macOS).free(arr.data) for int/float/byte arrays (not the string singleton).mako_tcp_shutdown uses Winsock SD_*; mako_log.h
uses platform CRITICAL_SECTION shims + lazy mutex init (no raw pthread.h).game_udp_bind — bind 0.0.0.0 (IPv4 any); "*" dual-stack IPv6 broke
IPv4-only game UDP tests.SIGPIPE so proxy races do not abort under TSan.http_request type — register builtin so client API typechecks.std/fmt — lowercase int / bool / float / hex / dec aliases.:443 → site
:8090 (HTTP/1.1 ALPN until multi-stream H2 is solid on the edge).respond_json uses interned application/json; charset=utf-8 (no malloc
for the type string). Request fill still zero-copy views into conn.raw.chan_str_send_take / chan_str_try_send_take — move ownership of a string
into a chan[string] without cloning; default ch.send(s) still clones (safe).
Try-send always consumes the temporary (frees on full/closed).tcp_fd_copy — Linux splice uses 256 KiB chunks + F_SETPIPE_SZ;
Apple/FreeBSD sendfile for regular file→socket before userspace pump (macOS
declares sendfile when _POSIX_C_SOURCE would hide it).http_parse free safety — replace raw free of default empty fields with
mako_str_free so the empty-string singleton is not freed.map_take_http_test.mko, chan_string_test.mko, proxy_edge_test.mkomap_si_set_take / map_ss_set_take — move string keys (and ss values) into
maps without cloning; default m[k]=v still clones (safe).raw[] buffer after a single request copy; header locate via
find_header_view (no intermediate header buffer).examples/testing/map_take_http_test.mkomakori build --release no longer forces
MAKO_BOUNDS_ALWAYS (was silently taxing every index). Opt in with
--bounds always or [profile.release] bounds_checks = "on"."" / zero-len clone avoids malloc; mako_str_free
skips the singleton (safe for map key/value free).MAKO_LIKELY on map set/get and slice append.uuid_v4, uuid_v5(ns, name) (SHA-1), uuid_v7 (unix-ms ordered)uuid_ns_dns / url / oid / x500uuid_bytes / uuid_from_bytes (hard-fail length)uuid_version, uuid_variant, uuid_cmp, uuid_checkulid_new / ulid_string / ulid_parse / ulid_timestamp_ms (same 16-byte POD)Uuid is Copy (NLL re-read, crew kick heap-boxed pack)std/uuid · tests: examples/testing/uuid_test.mko (9 tests)./scripts/bench-gate.sh PASS (fib/slice/map ≤2× baseline threshold)? · race stack · tracing GC · UCD/PCRE depthOk(Some(v)) codegen? — Option? in Result[T,string] → Err("None"); Result? in Option → None on Errgc_root / gc_unroot / gc_link / gc_mark / gc_root_count; mark-from-roots collect\P{…}, \X, \h/\H, \R, \N; Alnum/Word/Space/… propertiesload_test_package + test codegen honor nearest mako.toml (gc = true)lang_residuals_test.mko, examples/testing/gc_app/gc_trace_test.mkokick accepts Option/Result/tuple of sendables, deep-POD structs,
and enums with sendable fields; Option/Result heap-boxed across spawnjoin → hard errortrue == true); multi-label break testsPoint { x, y }#[stable], #[deprecated("msg")] (call sites hard-error)gc_alloc / gc_collect / gc_live with [package] gc = true
(forbidden when systems = true)reflect_value_ofjpeg_encode_gray_baseline / jpeg_is_baseline_huff\p{Lu} / \p{Ll} / \p{Lo} / \p{ASCII} / \p{Any} / \p{Assigned}lang_residuals_test.mko, nll_multi_label_test.mko, api_stable_test.mko,
bad: deprecated_call, race_mut_after_kickformat_int_dec / hex / hex_upper / hex_prefix / hex_pad,
format_int_bin / oct / format_int_base(n, 2..36) / format_padparse_int_hex / bin / oct / base / auto (0x 0b 0o)fmt_sprintf_d("%#08x", n), fmt_sprintf_dd("%d %b", a, b)std/strconv, std/fmt · tests in fmt_print_test.mkofmt and printfmt_sprintf…4, verbs %s %v %d %q %x %X %%, plus
fmt_sprintf_d / fmt_sprintf_fstd/fmt, std/print · tests: fmt_print_test.mko · demo: fmt_demo.mkotext/template / html/template)tmpl_new / tmpl_data_* / tmpl_execute / tmpl_html_execute{{.key}}, {{if}}/{{else}}/{{end}}, {{range}}, {{with}},
{{define}} / {{template}}, comments, len/upper/lower/html/printftmpl_html / tmpl_html_execute)std/text/template, std/html/templateexamples/testing/template_test.mko · demo: examples/template_demo.mkotemplate_execute / html_template_* still workmail_msg_*: From/To/Cc/Bcc, subject, text+HTML
multipart/alternative, attachments (base64), custom headers, Date/Message-IDsmtp_new → connect → EHLO → STARTTLS → AUTH PLAIN →
MAIL/RCPT/DATA (dot-stuffing) → QUIT; smtp_last_reply / last_codesmtp_send_msg(host, port, user, pass, msg, use_tls)smtp_mock_start / serve_once / last_message for e2e
programming without an external MTAstd/net/mail, std/net/smtp · demos mail_program.mko, send_mail.mkoexamples/testing/mail_smtp_test.mko (includes full send e2e)gpu_mha_f32 — multi-head attention over [seq, H·D] Q/K/Vmodel_load_gguf dequantizes Q4_0 and Q8_0 → f32tok_load_bpe / tok_load_merges / tok_encode_bpeai_depth_test.mko (MHA, quant fixture, BPE)model_load_gguf loads F32/F16 tensors (quantized types skipped)gpu_gelu_f32, gpu_silu_f32, gpu_layernorm_f32,
gpu_transpose_f32, gpu_attention_f32 (scaled dot-product, 1 head)tok_new / tok_load_json / tok_load_lines /
longest-match tok_encode / tok_decodeexamples/testing/ai_depth_test.mko · fixtures tiny.gguf,
tiny_vocab.json| Path | Surface |
|---|---|
| Hosted APIs | llm_* (unchanged) |
| Local weights | model_* + gpu_* |
model_new / model_set_f32 / tensor introspect — named f32 tensors on a devicemodel_load_safetensors — Hugging Face safetensors (F32 + F16→f32)model_save / model_load — native .makomodel for models you authormodel_linear_f32 — dense + bias; hf=1 for PyTorch [out, in] weightsmodel_weights_test.mko · fixture tiny_linear.safetensors ·
examples/model_mlp.mkoNorth star: compose inference/training ops in Makori on multi-vendor GPUs.
gpu_matmul_f32, gpu_relu_f32,
gpu_bias_add_f32, gpu_saxpy_f32, gpu_softmax_rows_f32, gpu_sum_f32
plus elementwise add/mul/scale/fillmatmul → bias_add → relu (covered in tests)examples/testing/gpu_seed_test.mkoPortable compute for NVIDIA, AMD, Intel (OpenCL ICDs) and macOS (Apple OpenCL → GPU), with host CPU fallback when no driver:
-DMAKO_HAS_OPENCL + -framework OpenCL (macOS) or
-lOpenCL (Linux/Windows when headers/ICD found); opt out MAKO_NO_OPENCL=1gpu_device_open prefers GPU; gpu_device_name / vendor /
is_gpu / backend; gpu_opencl_ok; gpu_set_prefer_host for CIadd/mul/scale/fill)examples/testing/gpu_seed_test.mkoInitial host-only seed (superseded by OpenCL multi-vendor above).
ws_last_close_code after close framews_client_connect (Happy Eyeballs TCP + upgrade),
ws_client_recv, ws_client_send_{text,binary,ping,close}ws_accept / ws_recv / ws_send_* / ws_echo / ws_echo_oncews_last_opcode, ws_last_fin, ws_last_status (0/-1/-2/-3/-4)examples/testing/ws_api_test.mko (handshake helpers + loopback e2e)tcp_listen / tcp_listen_addr — IPv4, IPv6, dual-stack (*/"" → :: +
IPV6_V6ONLY=0 when supported; fallback IPv4)tcp_connect / tcp_connect_timeout — getaddrinfo(AF_UNSPEC), AAAA/A
interleave, Happy Eyeballs racing (default 250ms stagger via
tcp_set_he_delay_ms)sockaddr_storage; IPv6 shown as [addr]:portudp_bind("*") remains
IPv4 for compatibilitytcp_connect_nb — first resolved v4/v6 address (nonblocking)examples/testing/net_ipv6_he_test.mkollm_chat_stream — true HTTPS SSE read loop; accumulates deltas; returns
synthetic chat JSON for llm_contentllm_chat_retry — exponential backoff on 429 / 5xx / connect / rate_limitllm_is_error / llm_error_message / llm_should_retry / llm_last_statusllm_embed_body, llm_embeddings, llm_embed,
llm_embedding_dim, llm_embedding_json (OpenAI-compatible /embeddings)llm_body_force_stream — ensure "stream":true on bodiesexamples/testing/llm_test.mko (12 cases, offline)runtime/mako_log.h)Production logging surface:
ts=… level=… msg=… k=v) or JSON lines (slog_set_json(1))slog_set_level / slog_get_level (debug→error)slog_set_service, active trace= when setslog_with / with2 / with3 / with_int; JSON string escapeslog_set_output(path) append file or "" for stderr; slog_flushslog_redact / slog_with_redactedlog_* aliases route through the same backend (filter + format)examples/testing/strong_log_test.mko · pack: std/log/slogPlatform surface so you build secure systems in Makori (not a soft PKI product):
tls_client_new / tls_client_new_insecure,
tls_connect / tls_connect_start (SNI + VERIFY_PEER), same TlsConn I/O as
server; tls_conn_version, tls_peer_cnsecret_len, secret_eq_str (constant-time)hkdf_sha256(ikm, salt, info, out_len) RFC 5869 extract+expandexamples/testing/security_crypto_test.mko (HKDF A.1 vector, secrets, client surface)Mako ships primitives so you can implement transaction engines, dialogs, SIPS, SRTP, proxies, and UAs in Makori — not a prebuilt softswitch/WebRTC stack.
runtime/mako_sip.h, std/sip)crew + mono_ns codeexamples/testing/sip_test.mko · demo: examples/sip_ua.mkoaes_ctr(key, iv, data) — AES-128/256-CTR (classic SRTP AES-CM keystream)hmac_sha1 / hmac_sha1_raw — SRTP auth tag source (truncate in Makori)10bc49bc…) + HMAC-SHA1 RFC 2202sql_query_rows*)sql_query_rows(db, sql, []int) / sql_query_rows_str(db, sql, p1) —
open a result handle (SQLite streams; Postgres materializes).sql_rows_next (1/0/-1), sql_rows_int / sql_rows_str (col),
sql_rows_cols, sql_rows_ok, sql_rows_close.sql_query_col_int / sql_query_col_str (capped, max 10000).examples/testing/sql_rows_test.mkosql_*)sql_exec_str4 / sql_query_str work on SQLite (were Postgres-only; docs
claimed both). Placeholders ? or $1..$4; trailing "" = unused slots.sql_last_insert_id(db) — SQLite last_insert_rowid; Postgres lastval.sql_rows_affected(db) — rows changed by last mutating statement.sql_query_int returns the first-column integer (not just 0/-1).examples/testing/sql_programming_test.mkoruntime/mako_llm.h, std/llm)First-class OpenAI-compatible LLM client focused on market gaps:
llm_message, llm_messages_append, llm_chat_body,
llm_system_user, llm_body_with_toolsllm_content, finish reason, usage tokens, tool call
name/args/countllm_sse_data, llm_sse_delta, llm_stream_appendllm_json_extract (markdown fences + balanced JSON)llm_https_post / llm_chat / llm_ask (HTTPS + Bearer;
default xAI api.x.ai, env XAI_API_KEY)crew/fan for parallel tool executionexamples/testing/llm_test.mko · demo: examples/llm_chat.mkomono_ns / mono_us / mono_ms — monotonic (CLOCK_MONOTONIC_RAW when available)wall_ns / wall_us / wall_ms — wall/REALTIME (logs, calendar)now_ns = mono ns; now_ms = wall ms (documented domains)elapsed_ns / elapsed_us / elapsed_mono_ms — mono elapsed (no NTP jump)deadline_ns / deadline_ms / deadline_remaining_ns / deadline_expiredsleep_ns / sleep_us, sleep_until_ns (hybrid), spin_until_ns (busy-wait)mono_res_ns / mono_overhead_ns — resolution and sample overheadexamples/testing/time_latency_test.mkotcp_peer_addr / tcp_local_addr — "ip:port" via getpeername/getsocknametcp_write_all / tcp_read_n — full write and exact-length readtcp_shutdown / tcp_linger / sock_error — half-close, SO_LINGER, SO_ERRORudp_bind_addr — bind to a specific hostudp_recv records sender — udp_last_sender_host / _port / _senderudp_recv_from alias for explicit APIexamples/testing/net_lowlevel_test.mkoatomic_write_file — temp + fsync + rename (crash-safe config/log updates)mkdir_all / rmdir / remove_all — parents, empty dir, recursive tree deleterename / copy_file — same-FS move and byte copyis_file / path_size / file_mtime / chmod — path metadatatemp_dir / temp_file — system temp path helperssymlink / readlink / realpath — links and absolute resolve/ . ..file_open always O_CLOEXEC; flag bit 32 = exclusive createexamples/testing/fs_storage_test.mkohttp2_conn_*)WINDOW_UPDATE raises send; auto WU restores recv onlyhttp2_stream_body_overflowhttp2_response*; header table size
sets HPACK dyn byte budget; initial window delta on open send windowshttp2_conn_pump auto SETTINGS ACK, PING ACK, WINDOW_UPDATE at 16 KiBhttp2_response_ct, http2_conn_goaway, SETTINGS accessorstls_serve_h2_routes remains a demo/smoke helper; production servers use
tls_server_new + http2_conn_* (examples/h2_dynamic_server.mko)examples/testing/http2_prod_test.mkoh3_response; POST/PUT/PATCH wait for FINexamples/h3_server.mko · smoke: ./scripts/h3-server-smoke.shenv.sh + shell RC hookspackage-release.sh ships the full target/release/mako binary in the tarball? unwrap for []int / []string / []float and map payloadstry_slice_in_void; TSan wave38examples/testing/wave39_queue_test.mko? unwrap for struct, nested Option, nested Result payloads?, bool Result ?; let-binding kind propagation after ?try_struct_use_after_err (Result ? outside Result fn)examples/testing/wave38_queue_test.mko? codegen: Option early-return None; string/float Ok/Some unwrap? only in Option-returning fns; Result ? only in Resultoption_try_in_result, result_try_in_optionexamples/testing/wave37_queue_test.mkoResult[Result[bool]] + string Option[Option[string]] nestsjpeg_app7_length; jpeg_has_soi; jpeg_app7_len_matches_payloadexamples/testing/wave36_queue_test.mkoResult[Result[float]], Option[Option[float]] Ok/None/Errjpeg_roundtrip_ok; jpeg_app8_length / jpeg_app9_lengthexamples/testing/wave35_queue_test.mkoResult[Result[string]] Ok/inner Err/outer Err edgesjpeg_has_app8/app9; jpeg_is_mako_dct / jpeg_is_mako_huffexamples/testing/wave34_queue_test.mkoResult[Option[Result[Option[bool]]]] Ok/None/Err edgesjpeg_is_mako_raw; jpeg_jfif_app0_length; jpeg_app7_payload_lenexamples/testing/wave33_queue_test.mkoOption[Result[Option[string]]] Ok/None/Err edgesjpeg_has_eoi; jpeg_sof0_matches_app7; jpeg_is_mako_completeexamples/testing/wave32_queue_test.mkoOption[Result[Option[Result[Option[T]]]]] Ok/None/Errjpeg_sof0_quant_table; JFIF thumb W/H; jpeg_is_mako_jfif (gray+APP7)examples/testing/wave31_queue_test.mkoResult[Option[Result[Option[Result[T]]]]] Ok/Err/None edgesjpeg_sof0_component_id; jpeg_has_app7 (MAKOJPG)examples/testing/wave30_queue_test.mkoOption[Result[Option[Result[T]]]] Ok/None/Err edgesjpeg_jfif_major / jpeg_jfif_minor; jpeg_sof0_sampling (Hi/Vi)examples/testing/wave29_queue_test.mkoOk(Some(Ok(None))), mid Err); Option[[]int] Nonejpeg_is_baseline_gray (JFIF+SOF0 grayscale shell probe)select_nll_testexamples/testing/wave28_queue_test.mkoOk(None), Ok(Some(None)), map Option None)Option[Result] Some(Err); jpeg_sof0_componentsexamples/testing/wave27_queue_test.mkojpeg_sof0_precision; match-continue outer NLL; reflect []int field rejectjob_join_typed_testexamples/testing/wave26_queue_test.mkoNone takes Option[T] from function return / expected typeeither Ok/Err string+floatjpeg_sof0_width / jpeg_sof0_height from SOF0 markercrew_fan_testexamples/testing/wave25_queue_test.mkoResult[Option[Result[Option[Result[T]]]]] string/int matchkick_option_non_send; Balinese/Javanese/Sundanese scriptskick_share_testexamples/testing/wave24_queue_test.mkoOption[Result[Option[T]]], Result[Option[Result[Option[T]]]]kick_result_non_send; Telugu/Oriya/Lao scripts; TSan wave22 + kick_syncexamples/testing/wave23_queue_test.mkoOk(Some(Ok(x))))Option[Result[T]] and Result[Option[Result[T]]] codegen + matchwave21_queue_testexamples/testing/wave22_queue_test.mkoOk(Ok(x)) typechecks against inner Result expected typeResult[Result[T, E], E2] Ok box/unbox + match; wrap_ok(Ok(...)) mono\p{Canadian} / Deseret / Phoenician seedswave20_queue_test, chan_float_testexamples/testing/wave21_queue_test.mkoResult[Option³[T]])Type::mono_tag for Option/Result; Some(...) mono tag alignmentwave19_queue_test, chan_struct_testexamples/testing/wave20_queue_test.mkoOption containers ([]int, maps) and Option[Option[T]] nestingResult[Option[Option[T]], E] Ok + match unbox chainjpeg_has_sof0 marker scan for JFIF/SOF0 shell\p{Thaana} / \p{Tagalog} / \p{Bopomofo} seedswave18_queue_test, chan_string_testexamples/testing/wave19_queue_test.mkoOption[T] Some: string/float/ptr payloads (not only int)Result[Option[T], E] Ok (boxed option + match unbox)\p{Syriac} / \p{Coptic} / \p{Runic} seedswave17_queue_testexamples/testing/wave18_queue_test.mkoResult[T] mono tags aligned for arrays/maps (arr_* / map_*)\p{Myanmar} / \p{Khmer} / \p{Tibetan} seedswave16_queue_test, share_atomic_testexamples/testing/wave17_queue_test.mkoResult[T, E] Ok: match/let resolve monomorphized ok kind\p{Bengali} / \p{Sinhala} seedswave15_queue_testexamples/testing/wave16_queue_test.mkoResult[[]Struct, E] Ok (boxed MakoArr_*)continue outer records NLL moves on the outer loop frame\p{Georgian} / \p{Cherokee} seedswave14_queue_testexamples/testing/wave15_queue_test.mkoResult[[]string, E] and Result[[]float, E] Ok (boxed arrays)hold_loop_match_partial, _product_exit)\p{Tamil} / \p{Armenian} / \p{Ethiopic} seedsfan_string_test, kick_string_testexamples/testing/wave14_queue_test.mkoResult[map[int]int, E] and Result[map[string]string, E] Okreflect_value_of flattens nested POD structs\p{Thai} / \p{Devanagari} seedskick_sync_test, wave11_queue_testexamples/testing/wave13_queue_test.mkoResult[map[string]int, E] Ok via mako_ok_ptr (map pointer)kick_non_pod), nested reflect (reflect_non_pod)hold_if_else_partial_product)\p{Hiragana} / \p{Katakana} / \p{Hangul} seedsexamples/testing/wave12_queue_test.mkojoin_timeout for Job[Result[T, string]] (no nested Result)reflect_value_of snapshots all POD fields (not only two ints)Result[[]int, E] Ok via heap-boxed arrayexamples/testing/wave11_queue_test.mkojob.join_timeout(ms) always returns Result[R, string] (Err("timeout"))reflect_value_of(struct) for POD 2-field snapshotsfor NLL loop-carried fixpointMAKO_SMTP_TLS_VERIFY=1 enables peer cert checkproxy_edge_testexamples/testing/wave10_queue_test.mkomako_chan_ptr_selectn); arm must not recv againResult[Struct, E] Ok via heap mako_ok_ptrjoin_timeout for Result → Err("timeout"); string → emptyreflect_value_from_2_int; regex Mark/Nl/No seedsexamples/testing/wave9_queue_test.mkojoin_timeout (poll task done; return 0 if still running)chan_str_select2, chan_select_value_str)Result[float, E] Ok; enum Err packs i0–i2 and s0–s1reflect_value_from_2; regex \p{Z} / \p{Sc} / scriptsexamples/testing/wave8_queue_test.mkojob.join for string and Result returns (heap-box across kick)Result[string, E] Ok via ok_s / mako_ok_strchan_open[float], fan on []Struct, TCP pool mutexlog_* / slog emit active trace= idbench-gate and TSan concurrency smoke jobswould_overflow_sub — fully wired (types + codegen + docs + tests); was runtime-only.recover_to_next_decl no longer consumes the next item's start
keyword; unit test proves following good fns stay in the AST.BuildOpts — test path fills overflow / bounds_always (cargo test compiles).fold_const_c wrapper (fold path is fold_const_c_env only).src/overflow.rs + runtime/mako_overflow.h + codegen trap pathsrc/recovery.rs + multi-error emit via diagsrc/shutdown.rs + runtime/mako_shutdown.hruntime/mako_rt.h — MAKO_BOUNDS_CHECK / MAKO_BOUNDS_ALWAYSsrc/errors.rs — Result[T, Enum] helpers for codegensrc/leak.rs + runtime/mako_leak.hResult[int, Enum] — Err(MyError::…) packs enum tag/payload; match Err(e)
reconstructs the enum for nested match.const fn — parse + fold at typecheck/codegen; const X = f(…) works.crew.drain(ms) / crew_drain — cancel+join with timeout budget.evloop_shutdown — free event loop.result_enum_test.mko, const_fn_test.mko, crew_drain_test.mko.runtime/mako_overflow.h; checked_add / checked_sub /
checked_mul, would_overflow_*. CLI --overflow trap|wrap|ignore (build/run).
Trap mode emits mako_add_i64 etc. for + - * on ints.parse_with_errors + recover_to_next_decl;
makori check reports all top-level parse errors (examples/bad/multi_error.mko).signal_on_term, register_listener / close_listeners,
server_shutdown_begin, server_drain, shutdown_requested,
install_graceful_shutdown (runtime/mako_shutdown.h).leak_scope_enter / leak_scope_exit / leak_check on top of
alloc tracking (runtime/mako_leak.h).trace_id / trace_set / trace_begin / trace_end /
trace_log (runtime/mako_trace.h).makori dev — watch source mtime and rebuild+rerun (hot-reload seed).--bounds always on build/run keeps bounds checks under release.Tests: examples/testing/overflow_shutdown_test.mko.
tcp_pool_open / acquire / release / close
keeps backend fds per host:port, validates before reuse, closes on error.http_forward_full — returns HttpForwardResult with status, body,
body length, and total bytes; supports Content-Length, chunked, and close.http_proxy_raw — raw request → backend → raw response → client pump.http_parse — C hot-path request parser (HttpParsed: method/path/host/
headers/body/chunked) without Mako str_split allocations.http_decode_chunked + integrated in forward/proxy.tcp_connect_nb / connect_check / connect_wait.tcp_fd_copy / tcp_splice (Linux splice) / tcp_proxy_pump.tcp_listen_reuseport, tcp_set_recv_buf/send_buf,
tcp_accept4 (NONBLOCK|CLOEXEC).tls_accept_start / tls_handshake_step /
tls_want_read/write / tls_read_nb/write_nb for worker-friendly handshakes.http2_next_ready_stream / stream_take / stream_body), concurrent bodies.h3_server_new / bind / poll / accept_stream /
stream_read/write (UDP event integration; crypto depth via quiche).examples/testing/proxy_pool_test.mko.examples/testing/proxy_edge_test.mko. Docs: BUILTINS Reverse-proxy notes,
STDLIB pool section, book ch08 reverse proxy / mux / async TLS / H3.http_forward(host, port, method, path, body) forwards a
request to an upstream HTTP/1.1 backend and returns the response body. With
the HTTP/2 server this is a complete reverse proxy
(examples/h2_reverse_proxy.mko), verified curl --http2 → proxy → backend.tcp_listen_addr(host, port) binds a specific
address (loopback-only, a chosen NIC, or "*" for all). Verified on Linux.tcp_set_timeout(fd, ms) (recv/send timeouts),
tcp_keepalive(fd, idle, interval, count) (dead-peer detection),
tcp_listen_backlog(host, port, backlog) (bound the accept queue).tls_server_new / tls_accept / tls_read /
tls_write / tls_conn_alpn (ALPN h2), plus tls_server_new_tls13 to
require TLS 1.3. Verified on Linux: a 1.2 client is rejected with a
protocol_version alert, a 1.3 client negotiates TLS_AES_256_GCM_SHA384.crypto.bcrypt(password, cost) / bcrypt_check / bcrypt_ok
($2b$ via libxcrypt on Linux; Argon2id remains the recommendation for new
systems). Verified on Linux against a round-trip with distinct salts.crypto.scram_* toolkit (salted password, client/server
keys, stored key, signatures, client proof, server-side proof verification)
plus raw primitives sha256_raw, hmac_sha256_raw, xor_bytes. Verified
byte-for-byte against the RFC 7677 test vector.mako_net.h before mako_http.h) so
mako_bind_ipv4_addr is declared before use.game_udp_bind now calls the address helper with a wildcard host.if as an expression — let x = if c { a } else { b }; each branch yields
its trailing expression, else required, both branches must agree on typevar a, b = 1, 2 and a, b = b, a
(swap/rotate); the right-hand side is evaluated before any target is writtencrypto.password_hash / password_verify (Argon2id,
OWASP parameters, PHC string format) backed by OpenSSL's trusted implementationCMap, Mutex, RWMutex, and
AtomicInt may now be passed into a kicked task; the same object is shared
(matching the documented CMap behaviour). Structs / arrays / arenas stay
non-sendable. The kick error hint now lists them.crypto.pbkdf2 / pbkdf2_sha256(password, salt,
iterations, dklen), verified against published test vectors. Completes the
SCRAM-SHA-256 primitive set (with hmac_sha256, sha256, random_bytes,
const_eq).http2_conn_new / http2_conn_use /
http2_conn_free. A server or proxy can juggle several HTTP/2 connections on
one thread; each keeps independent stream/settings/flow-control state. Leaving
the handles unused keeps the original single-connection behaviour.http2_conn_recv rejected the
client's odd-numbered streams in server mode (inverted stream-id parity), so no
request ever assembled. A received HEADERS now correctly opens a client
(odd-id) stream, so header_block + HPACK decode recover :method / :path —
the basis for an H2 accept loop / reverse proxy.http2_response(stream, status, body) — builds a full response (HEADERS
with :status + content-length, then DATA with END_STREAM) in one call,
completing the read-request → write-response cycle for an H2 server.curl --http2, routing by :path.
Example: examples/h2_dynamic_server.mko.http_forward(host, port, method, path, body)
forwards a request to an upstream HTTP backend and returns its response body.
Composed with the H2 server, examples/h2_reverse_proxy.mko is a complete
reverse proxy verified end-to-end: curl --http2 → Mako proxy → backend →
relayed response.tls_server_new(cert, key), tls_accept(fd),
tls_read / tls_write, tls_conn_alpn, tls_conn_close. Own the accept
loop and upgrade an accepted TCP fd to TLS — including STARTTLS-style upgrades
on the same socket (verified against Postgres-style SSLRequest negotiation).
ALPN negotiates h2 / http/1.1 for proxy use.signal_watch("HUP"), signal_fired("HUP"),
signal_ignore("PIPE") for HUP/TERM/INT/USR1/USR2/QUIT/PIPE/CHLD. Distinct
per-signal flags (reload vs shutdown), and handlers interrupt blocking calls so
an accept loop can react.watch_new / watch_add(path) / watch_poll(timeout)
/ watch_close over kqueue (macOS/BSD) and inotify (Linux). watch_poll
returns the path that changed. Pairs with SIGHUP for config reloads.game_udp_sender_addr (the host:port of
the last sender) and game_udp_send_to (send to an arbitrary address). Enables
forwarding traffic upstream and routing replies back to the original sender.GameUDP handle in a struct (struct
arrays hold handles); array literals accept a trailing comma.examples/nb_echo_server.mko, a complete
one-thread reactor over evloop_* + nb_* (accept many clients, service the
ready ones). Verified with concurrent clients — the template for a protocol
server such as pgwire.FAIL
with no detail. Assertion failures already print their own message.runtime/*.h)
invalidates stale .o objects even when the generated C is byte-identical.
Previously a runtime change could be masked by a cached object until the cache
was cleared by hand.[P{1}, P{2}] now compiles as a struct arrayidentifiers that shadow C/POSIX library names (read, write, time, …) now
emit valid, linkable C
Tests: if_expr_test, parallel_assign_test, password_hash_test
if init; cond { … } — init clause scoped to the if/elseswitch / case / default — value, expression-less, and init forms;
arbitrary case expressions, single tag evaluation, optional defaultfor (four forms) — three-clause for i := 0; i < n; i++, condition-only
for cond {}, infinite for {}, plus range for i, v in range xs+= -= *= /= %= and ++ / -- on
identifiers, struct fields, and index targetsPoint{1, 2} and zero-value Point{};
composite-literal-in-condition ambiguity resolvedgo f() — schedules a call onto the innermost crew (errors outside one)returnlet switch = 1, params named int, …)
now emit valid C — codegen mangles reserved words consistentlypack / pull / switch / go are contextual keywords — usable as namesbreak / continue only bind a label on the same source linemakori fmt no longer doubles export on structs
Tests: if_init_test, switch_test, for_forms_test, compound_assign_test,
struct_positional_test, go_stmt_test, parallel_assign_test
chan_open[Point] — MakoChanPtr heap-box send / unbox recverror_tag("NotFound", "user") — enum-like string error tagschan_struct_test, error_tag_test"encoding/json", "net/http", "path/filepath", …module = "izi-iva" → "izi-iva/pkg/acd"; vendor/<path>/; [dependencies] keyed by import pathredisv9 "github.com/…" (and "path" as name)import ( / pull ( groupsbody, path, …)encoding/json, errors, net/http importable; seed packs for crypto/tls, os/signal, syscall, netexamples/import_paths/ · test: import_paths_test.mkoprint, string ==, match routes, opt-in power)examples/testing/ergonomics_test.mkoexamples/mako_style.mkopack name · pull "path" · pull "path" as name · pull ( … )package / import (all previous forms still parse)pkg.fn(...) (internal pkg__fn)pack clause (≠ main), else path basenamemakori fmt emits pack / pull / "path" as namefmt.int safe)docs/IDENTITY.md flair table · ~90%fn, let, struct, on Type, hold/share/arena, crew/kick, export, matchfunc, :=, var, bare a int, receivers) remain compat sugar onlydocs/IDENTITY.md (~86% identity strength)docs/GO_SYNTAX_CHECKLIST.md (optional; not preferred)examples/mako_style.mko · makori fmt emits Mako-native spellingson Type methods, tuples, typed chan_open[T]docs/COMPAT.mdSTATUS north-star / MVP: 100% (homebrew-core publish remains an external blocker).
docs/book/ (15 chapters + SUMMARY.md + optional mdBook book.toml)docs/book/examples/book_{hello,ops,errors,imports}.mko\p{...} now decodes UTF-8 and recognizes common categories/scripts (L, N, Nd, Latin, Greek, Cyrillic, and several major letter/digit ranges).(?=...) and (?!...).goext_wave9_test.mkomakori pkg install, lock, and update now support --offline..mako/deps, and .mako/registry / $MAKO_REGISTRY, then fails fast instead of fetching.offline_git_requires_cached_dep\1–\9 · \p{L}/\p{N} (ASCII) · [:lower:]/[:upper:]/[:punct:]str_cut / str_countbuild/run/check/test help; version listed before lsp; after_helpgoext_wave8_test.mkomako-native launch configs and a
Mako: Debug Active File command..mko file first, then delegates the native
binary to CodeLLDB (lldb) or Microsoft C/C++ (cppdbg).mako.debug.adapter; packaged editor scaffold
includes the matching build task and docs.makori pkg audit now reads mako.lock and checks local mako-cve.toml
advisory ranges plus mako-license.toml allow/deny license policy.mako doc now writes API markdown plus examples.md runnable commands and a
search-index.json symbol index.makori check, makori run, and makori test commands for
files that contain runnable mains or test functions.doc_generates_runnable_examples_and_search_indexmakori test --coverage now prints package source/test file coverage and
category counts.Fuzz*, Property*, Snapshot*, Mock*, and
Fixture* zero-arg functions alongside Test* / test_*.tooling_quality_test.mkomako profile [path] [-p NAME] [--release] [--json] -- [args...].mako.profile.v1 schema.docs/ tree, including the book,
howtos, performance notes, roadmap, status, and internal planning docs, plus
top-level README and changelog.#[derive(json)] now generates compile-time serializers for arbitrary
supported scalar field counts instead of falling back to placeholder JSON
after the first narrow shapes.*_to_json and *_<field>_from_json helpers use direct JSON
builtins and do not require runtime reflection lookup for marshaling.derive_json_codegen_test.mkomongo_connect_url, mongo_find_one_request,
cassandra_connect_url, cassandra_select, clickhouse_connect_url,
clickhouse_select, elastic_connect_url, elastic_search_request.multistore_compat_test.mkoredis_conn_* command helpers.mysql_redis_polish_test.mkosql_check_typed(schema, sql, params, result) for
static table, column, placeholder, nullability, and result-shape checks.sql_typed_check_test.mkosql_migration_applied / sql_migrate.mako_schema_migrations, transaction boundaries, and
parameterized version tracking through the existing unified SQL facade.sql_migration_test.mkosql_begin / sql_commit / sql_rollback.sql_prepare / sql_stmt_query_int / sql_stmt_exec / sql_stmt_close.sqlite3_stmt handles when linked; Postgres uses named
libpq prepared statements when connected.sql_tx_stmt_test.mkosql_pool_open_sqlite / sql_pool_open_postgres / sql_pool_query_int /
sql_pool_exec / sql_pool_close plus pool status/metric helpers.SqlDB handles now keep a reusable connection when libsqlite is linked,
so pool slots are real backend handles instead of DSN-only facades.sql_pool_test.mko\xHH / \n / (?:…); GIF LZW dictionary decode; JPEG Huffman-block APP9[]string; smtp AUTH PLAIN + STARTTLS probegoext_wave7_test.mkomakori version — Donemakori version → makori version mako0.1.0 darwin/arm64 (Cargo.toml + os/arch)mako --version / -V aligned; makori version -v optional commit (MAKO_GIT_HASH / git)import ( "a" \n "b" ) · brace import { "a"; "b" } · alias "path" · "path" as xmakori fmt emits import ( … ) for 2+ importsimport_group_test.mko · import_brace_test.mkorange/with; gob struct bag; GIF LZW decode\Q/\Ggoext_wave6_test.mko{n,m} \b \A \z; html/template if/multi-keymap[string]string; encoding/binary LE; net/smtp format + soft dialgoext_wave5_test.mko== != < > <= >= (= remains assignment only)&& || ! (+ and/or/not); short-circuit codegen for &&/||& | ^ &^ << >>; unary ^ (complement); !!x = two !operators_go_test.mko[:digit:]/escapes in classes · regex_valid / regex_quote_metagoext_wave4_test.mkoruntime/mako_goext.h: archive/zip (store), image/png, maps helpers, reflect (minimal),
testing/httptest, AES-GCM + ChaCha20-Poly1305 (OpenSSL), mime/multipart, recursive
filepath_walk / filepath_walk_n, regexp find_all / replace / replace_allruntime/mako_rt.h: RE2-ish \d \D \w \W \s \S escapesstd/: archive/zip, image/png, maps, reflect, testing/httptest, mime/multipart + crypto/regexp updatesexamples/testing/goext_wave3_test.mkoruntime/mako_goext.h: flag, exec, url, csv/xml, gzip (+ zlib auto-link), tar, mime,
context deadlines, bytes.Buffer, rand, template, html, base32, sha1/sha512, DNS/IP,
signal, atomic, utf8, filepath_walk, slices, embed_filestd/ wrappers for new packages; zlib via find_zlib / -DMAKO_HAS_ZLIBexamples/testing/goext_wave_test.mkorwmutex_new / rlock / runlock / lock / unlock
(runtime/mako_stdlib.h) · examples/testing/rwmutex_test.mkoimport "strings" (and path, fmt, sync, bufio, math, os,
time, crypto, log, strconv, collections, errors, regexp,
encoding/{json,hex,base64}, database/sql, net/http): resolve under
std/, auto-alias to package basename; MAKO_STD override
(src/tooling.rs) · examples/testing/std_import_test.mkobuf_reader_new / from_string / read_line / read / buf_writer_*
(runtime/mako_stdlib.h) · examples/testing/bufio_test.mkoHttpRequest: http_request_parse / from_conn / accessors
(runtime/mako_http.h) · http_request_type_test.mko · examples/http_lib/request_type.mkodatabase/sql: sql_open_sqlite / sql_open_postgres / sql_query_int /
sql_exec / sql_ok / sql_close (runtime/mako_db.h) · sql_unify_test.mkosql_begin / commit / rollback /
sql_prepare / sql_stmt_* (runtime/mako_db.h) · sql_tx_stmt_test.mkosql_migration_applied / sql_migrate
(runtime/mako_db.h) · sql_migration_test.mkosql_check_typed for table/column/param/nullability/
result shape (runtime/mako_db.h) · sql_typed_check_test.mkoruntime/mako_db.h) ·
mysql_redis_polish_test.mkoruntime/mako_db.h) ·
multistore_compat_test.mkosrc/desugar.rs) ·
derive_json_codegen_test.mkosql_pool_open_* / query_int / exec / metrics / close
(runtime/mako_db.h) · sql_pool_test.mkowait_group_new / add / done / waitruntime/mako_stdlib.h: strings (split/join/trim/replace/…), strconv/fmt,
path/fs/os (path_clean, getcwd, read_dir, …), math, collections, time
RFC3339, hex_encode, random_bytes, mutex, log_debug/log_kvsrc/types/mod.rs + src/codegen/mod.rs; -lm on Unixexamples/testing/stdlib_strings_test.mko, stdlib_path_math_test.mkoexamples/stdlib/demo.mkomakori test --race / --sanitize plumbed through cmd_test → clangsecret_from_str / secret_drop + mako_secure_zero (zero-on-drop)unsafe { } + unsafe_index — explicit rare bounds opt-outhttp_header_ok, reply Content-Type)sqlite_query_*_params, pg_exec_params)const_eq / crypto_eq constant-time comparecancel_join — tasks cannot outlive cancel policy[package] systems = true — GC never weakens ownershipsecurity_test, cancel_policy_test, db_params_testhttp_get / http_post / http_request / timeouts / http_last_status / http_last_headerexamples/http_lib/ + scripts/http-lib-smoke.shdocs/howto/ (getting started, HTTP, errors, packages, concurrency, memory, WASI, testing, release)-O3now_ns / black_box; three-way ns benches (scripts/bench-vs-go-rust.sh)len; fast-path appendarena_cstr / arena_text_n (no malloc→arena double copy)-DNDEBUG elides bounds checks (debug still aborts) — PERFORMANCE.md.mako/cache/ keyed by source hash + compiler version + flags; per-unit .o + link-j / MAKO_JOBS; --no-incremental escape-O3 -flto -DNDEBUG; optional MAKO_STRIPexamples/bench/ + scripts/bench-vs-go.shhttp_respond_json, append_fileexamples/api_backend/, systems_log/, db_engine/ + testsmakori init --backend; GUIDE: Building APIs / Systems / DB enginesmakori pkg install / update / lock / publish — SemVer resolve, mako.lock, local registrysrc/pkg.rs; example examples/pkg_manager/errorf / error_is / error_string + existing error / wrap_err / ?dbg / dbg_str; abort hints → docs/DEBUG.md; assert_eq got/want wording-glabel: while / label: for + break label / continue labelsrc/types/nll.rs: const-bool edge prune, diverge helpers, loop re-entry detectionbreak false positives)if false / while false examples; hold_const_true_after bad case^ / ~ / exact) for path deps; local registry .mako/registry/<name>/<ver>/makori pkg list resolves registry-only deps; example examples/pkg_registry/tls_serve_h2_routes; gRPC unary+stream live smoke scriptmako --version from Cargo.toml; polished --helpmakori init [path] [--name] → mako.toml + main.mkomakori pkg list — path + git deps; git shows [fetched] / MISSING — run pkg fetchmakori pkg fetch — clone git deps into .mako/deps/ (needs git + network; not default CI)makori init [path] --workspace → root [workspace] members + lib/ + app/ (path dep); default init unchanged-pexamples/pkg_path_dep/doc / deploy docker described as stubsFormula/mako.rbdocs/RELEASE.mdmakori test examples/testing (no live network deps).mko → C → native; crew / actors / arenas / Resultmakori test; tooling: fmt / lint / bench / doc / lsp / pkgmakori build --target wasm32-wasi uses wasi-sdk clang
(wasm32-wasip1), -DMAKO_WASI minimal runtime; examples/wasi_hello.mko,
wasi_args_env.mko, wasi_fs.mko; scripts/wasi-verify.shmakori build, makori run, and makori test accept repeatable
--native-source <FILE> arguments for explicitly compiling and linking
regular .c files. Paths are validated, passed without a shell, included in
incremental and direct native link paths, and rejected for WebAssembly.