Make PrimUnlifted ShorText instance safe

* Use a newtype to hide the unrestricted `ByteArray`
  underneath.

* Mark `Data.Primitive.Unlifted.Class` as `Trustworthy`. TODO:
  Discuss whether it's okay to do that without similarly changing
  the `PrimArray` instance.

Closes haskell-primitive#22

primitive-unlifted.cabal

@@ -24,6 +24,8 @@ tested-with: GHC == 8.10.1
 library
   exposed-modules:
     Data.Primitive.Unlifted.Class
+    Data.Primitive.Unlifted.Types
+    Data.Primitive.Unlifted.Types.Unsafe
     Data.Primitive.Unlifted.Array
     Data.Primitive.Unlifted.SmallArray
     Data.Primitive.Unlifted.SmallArray.ST

src/Data/Primitive/Unlifted/Class.hs

@@ -2,6 +2,7 @@
 {-# language UnboxedTuples #-}
 {-# language TypeFamilies #-}
 {-# language ScopedTypeVariables #-}
+{-# language Trustworthy #-}
 
 module Data.Primitive.Unlifted.Class
   ( PrimUnlifted(..)
@@ -27,6 +28,7 @@ import GHC.Exts (MutableByteArray#,ByteArray#
 import GHC.Exts (RuntimeRep(UnliftedRep))
 import GHC.Exts (MVar#,MutVar#,RealWorld)
 import GHC.Exts (TYPE)
+import Data.Primitive.Unlifted.Types.Unsafe (ShortText# (..))
 
 import qualified Data.Primitive.MVar as PM
 import qualified GHC.Exts as Exts
@@ -72,9 +74,9 @@ instance PrimUnlifted ShortByteString where
   fromUnlifted# x = SBS x
 
 instance PrimUnlifted ShortText where
-  type Unlifted ShortText = ByteArray#
-  toUnlifted# t = case toShortByteString t of { SBS x -> x }
-  fromUnlifted# x = fromShortByteStringUnsafe (SBS x)
+  type Unlifted ShortText = ShortText#
+  toUnlifted# t = case toShortByteString t of { SBS x -> ShortText# x }
+  fromUnlifted# (ShortText# x) = fromShortByteStringUnsafe (SBS x)
 
 instance PrimUnlifted (MutableByteArray s) where
   type Unlifted (MutableByteArray s) = MutableByteArray# s

src/Data/Primitive/Unlifted/Types.hs

@@ -0,0 +1,16 @@
+{-# language MagicHash #-}
+
+-- | Some types may impose invariants that are not natively
+-- enforced by their unlifted forms. This module exports
+-- newtypes around those unlifted forms that can be used to
+-- write safe @PrimUnlifted@ instances. At present, this is
+-- only done for the 'ShortText' type, but others may be added.
+--
+-- This module exports only abstract types. To access their
+-- constructors, import "Data.Primitive.Unlifted.Types.Unsafe".
+
+module Data.Primitive.Unlifted.Types
+  ( ShortText#
+  ) where
+
+import Data.Primitive.Unlifted.Types.Unsafe

src/Data/Primitive/Unlifted/Types/Unsafe.hs

@@ -0,0 +1,16 @@
+{-# language MagicHash #-}
+{-# language UnliftedNewtypes #-}
+
+-- | Some types may impose invariants that are not natively
+-- enforced by their unlifted forms. This module defines
+-- newtypes around those unlifted forms that can be used to
+-- write safe @PrimUnlifted@ instances. At present, this is
+-- only done for the 'ShortText' type, but others may be added.
+
+module Data.Primitive.Unlifted.Types.Unsafe
+  ( ShortText# (..)
+  ) where
+
+import GHC.Exts (ByteArray#)
+
+newtype ShortText# = ShortText# ByteArray#