The Unsafe Gate

Direct memory access is fenced behind the unsafe keyword, keeping the risky surface of a codebase small and easy to audit.

Raw-memory operations — load/store, changetype, memory.copy/fill/repeat, and the v128 load/store family — are gated: using one outside an unsafe-marked function is a compile error naming the operation.

export unsafe function peek(p: usize): i32 {
    return load<i32>(p);      // fine here
}

export function bad(p: usize): i32 {
    return load<i32>(p);      // error: load is unsafe; mark the
}                              // enclosing function 'unsafe'

The keyword is a review marker, not a semantic change — the generated code is identical. It makes the raw-memory surface of a codebase greppable: our Box2D port carries its entire unsafe surface in 39 functions. Lib and runtime sources are exempt (they exist to wrap these ops), and --unsafe waives the gate for a whole build — the escape hatch for compiling existing upstream AssemblyScript code as-is.