@aster-cloud/aster-lang-ts 0.0.1

package/dist/scripts/update-eff-violation-expected.js

@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+/**
+ * 临时脚本：更新 eff_violation_* 测试的 expected 输出文件
+ */
+import fs from 'node:fs';
+import { canonicalize, lex, parse } from '../src/index.js';
+process.env.ASTER_CAP_EFFECTS_ENFORCE = '1';
+const tests = [
+    'eff_violation_chain',
+    'eff_violation_cpu_calls_io',
+    'eff_violation_empty_caps',
+    'eff_violation_files_calls_secrets',
+    'eff_violation_http_calls_sql',
+    'eff_violation_missing_http',
+    'eff_violation_missing_sql',
+    'eff_violation_missing_time',
+    'eff_violation_mixed_caps',
+    'eff_violation_multiple_errors',
+    'eff_violation_nested_a',
+    'eff_violation_nested_b',
+    'eff_violation_pure_calls_cpu',
+    'eff_violation_secrets_calls_ai',
+    'eff_violation_sql_calls_files',
+    'eff_violation_transitive',
+    'eff_violation_files_only',
+    'eff_violation_secrets_calls_http',
+];
+async function updateExpectedFiles() {
+    const { lowerModule } = await import('../src/lower_to_core.js');
+    const { typecheckModule } = await import('../src/typecheck.js');
+    for (const test of tests) {
+        const inputFile = `test/cnl/programs/effects/${test}.aster`;
+        const outputFile = `test/cnl/programs/effects/expected_${test}.diag.txt`;
+        console.log(`更新 ${test}...`);
+        try {
+            const src = fs.readFileSync(inputFile, 'utf8');
+            const can = canonicalize(src);
+            const toks = lex(can);
+            const ast = parse(toks);
+            const core = lowerModule(ast);
+            const diags = typecheckModule(core);
+            const actualLines = Array.from(new Set(diags.map(d => `${d.severity.toUpperCase()}: ${d.message}`)));
+            const output = actualLines.join('\n') + (actualLines.length ? '\n' : '');
+            fs.writeFileSync(outputFile, output, 'utf-8');
+            console.log(`  ✓ 已更新 ${outputFile}`);
+        }
+        catch (error) {
+            console.error(`  ✗ 失败: ${error}`);
+        }
+    }
+    console.log('\n全部完成！');
+}
+updateExpectedFiles().catch(e => {
+    console.error('脚本失败:', e.message);
+    process.exit(1);
+});
+//# sourceMappingURL=update-eff-violation-expected.js.map

package/dist/scripts/update-eff-violation-expected.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-eff-violation-expected.js","sourceRoot":"","sources":["../../scripts/update-eff-violation-expected.ts"],"names":[],"mappings":";AACA;;GAEG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAE3D,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,GAAG,CAAC;AAE5C,MAAM,KAAK,GAAG;IACZ,qBAAqB;IACrB,4BAA4B;IAC5B,0BAA0B;IAC1B,mCAAmC;IACnC,8BAA8B;IAC9B,4BAA4B;IAC5B,2BAA2B;IAC3B,4BAA4B;IAC5B,0BAA0B;IAC1B,+BAA+B;IAC/B,wBAAwB;IACxB,wBAAwB;IACxB,8BAA8B;IAC9B,gCAAgC;IAChC,+BAA+B;IAC/B,0BAA0B;IAC1B,0BAA0B;IAC1B,kCAAkC;CACnC,CAAC;AAEF,KAAK,UAAU,mBAAmB;IAChC,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAChE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAEhE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,6BAA6B,IAAI,QAAQ,CAAC;QAC5D,MAAM,UAAU,GAAG,sCAAsC,IAAI,WAAW,CAAC;QAEzE,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACtB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YACxB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAC5B,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CACrE,CAAC;YACF,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACzE,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,WAAW,UAAU,EAAE,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACzB,CAAC;AAED,mBAAmB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;IAC9B,OAAO,CAAC,KAAK,CAAC,OAAO,EAAG,CAAW,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/scripts/update-golden-ast.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=update-golden-ast.d.ts.map

package/dist/scripts/update-golden-ast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-golden-ast.d.ts","sourceRoot":"","sources":["../../scripts/update-golden-ast.ts"],"names":[],"mappings":""}

package/dist/scripts/update-golden-ast.js

@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { canonicalize, lex, parse } from '../src/index.js';
+function prune(obj) {
+    if (Array.isArray(obj))
+        return obj.map(prune);
+    if (typeof obj !== 'object' || obj === null)
+        return obj;
+    const result = {};
+    for (const [k, v] of Object.entries(obj)) {
+        if (k === 'span' || k === 'nameSpan')
+            continue;
+        result[k] = prune(v);
+    }
+    return result;
+}
+function updateOneAst(inputPath, expectPath) {
+    try {
+        const src = fs.readFileSync(inputPath, 'utf8');
+        const can = canonicalize(src);
+        const toks = lex(can);
+        const ast = parse(toks);
+        const actual = prune(ast);
+        // Write the actual output to the expected file
+        fs.writeFileSync(expectPath, JSON.stringify(actual, null, 2) + '\n', 'utf8');
+        console.log(`UPDATED: ${expectPath}`);
+    }
+    catch (e) {
+        const err = e;
+        console.error(`ERROR: ${inputPath}: ${err.message ?? String(e)}`);
+        process.exitCode = 1;
+    }
+}
+function main() {
+    const testDir = 'test/cnl/programs';
+    const files = fs.readdirSync(testDir, { recursive: true, withFileTypes: true });
+    let updatedCount = 0;
+    for (const entry of files) {
+        if (!entry.isFile())
+            continue;
+        if (!entry.name.endsWith('.aster'))
+            continue;
+        // @ts-ignore - parentPath exists in Node 20+
+        const asterPath = path.join(entry.parentPath ?? entry.path, entry.name);
+        const expectedPath = asterPath.replace(/\.aster$/, '') + '.ast.json';
+        const expectedPathWithPrefix = path.join(path.dirname(asterPath), 'expected_' + path.basename(asterPath).replace(/\.aster$/, '.ast.json'));
+        // Check if expected file exists (with or without prefix)
+        if (fs.existsSync(expectedPath)) {
+            updateOneAst(asterPath, expectedPath);
+            updatedCount++;
+        }
+        else if (fs.existsSync(expectedPathWithPrefix)) {
+            updateOneAst(asterPath, expectedPathWithPrefix);
+            updatedCount++;
+        }
+    }
+    console.log(`\nUpdated ${updatedCount} golden AST files`);
+}
+main();
+//# sourceMappingURL=update-golden-ast.js.map

package/dist/scripts/update-golden-ast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-golden-ast.js","sourceRoot":"","sources":["../../scripts/update-golden-ast.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAE3D,SAAS,KAAK,CAAC,GAAY;IACzB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC;IACxD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,UAAU;YAAE,SAAS;QAC/C,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB,EAAE,UAAkB;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QAE1B,+CAA+C;QAC/C,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,YAAY,UAAU,EAAE,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,CAAyB,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,UAAU,SAAS,KAAK,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,IAAI;IACX,MAAM,OAAO,GAAG,mBAAmB,CAAC;IACpC,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAEhF,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAS;QAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAS;QAE7C,6CAA6C;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,WAAW,CAAC;QACrE,MAAM,sBAAsB,GAAG,IAAI,CAAC,IAAI,CACtC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EACvB,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CACxE,CAAC;QAEF,yDAAyD;QACzD,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YACtC,YAAY,EAAE,CAAC;QACjB,CAAC;aAAM,IAAI,EAAE,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;YACjD,YAAY,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;YAChD,YAAY,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,aAAa,YAAY,mBAAmB,CAAC,CAAC;AAC5D,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/scripts/validate_error_codes.d.ts

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+/**
+ * 错误码验证脚本
+ *
+ * 检查 shared/error_codes.json 的规范性：
+ * - Code 唯一性
+ * - Category 枚举值有效性
+ * - Message 格式正确性
+ * - Help 文本存在性
+ */
+export {};
+//# sourceMappingURL=validate_error_codes.d.ts.map

package/dist/scripts/validate_error_codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate_error_codes.d.ts","sourceRoot":"","sources":["../../scripts/validate_error_codes.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG"}

package/dist/scripts/validate_error_codes.js

@@ -0,0 +1,114 @@
+#!/usr/bin/env node
+/**
+ * 错误码验证脚本
+ *
+ * 检查 shared/error_codes.json 的规范性：
+ * - Code 唯一性
+ * - Category 枚举值有效性
+ * - Message 格式正确性
+ * - Help 文本存在性
+ */
+import fs from 'node:fs';
+import process from 'node:process';
+const VALID_CATEGORIES = new Set([
+    'type',
+    'effect',
+    'capability',
+    'async',
+    'scope',
+    'pii',
+    'syntax',
+    'semantic',
+]);
+const VALID_SEVERITIES = new Set(['error', 'warning', 'info']);
+function validateErrorCodes(filePath) {
+    const errors = [];
+    // 读取文件
+    let errorCodes;
+    try {
+        const content = fs.readFileSync(filePath, 'utf8');
+        errorCodes = JSON.parse(content);
+    }
+    catch (error) {
+        errors.push(`无法读取或解析 ${filePath}: ${error.message}`);
+        return { valid: false, errors };
+    }
+    const seenCodes = new Map();
+    const entries = Object.entries(errorCodes);
+    for (const [key, entry] of entries) {
+        const prefix = `[${key}]`;
+        // 检查必需字段
+        if (!entry.code) {
+            errors.push(`${prefix} 缺少 code 字段`);
+            continue;
+        }
+        if (!entry.category) {
+            errors.push(`${prefix} 缺少 category 字段`);
+        }
+        if (!entry.severity) {
+            errors.push(`${prefix} 缺少 severity 字段`);
+        }
+        if (!entry.message) {
+            errors.push(`${prefix} 缺少 message 字段`);
+        }
+        if (!entry.help) {
+            errors.push(`${prefix} 缺少 help 字段`);
+        }
+        // 检查 code 唯一性
+        if (seenCodes.has(entry.code)) {
+            errors.push(`${prefix} code "${entry.code}" 重复，已在 "${seenCodes.get(entry.code)}" 中使用`);
+        }
+        else {
+            seenCodes.set(entry.code, key);
+        }
+        // 检查 code 格式 (E001-E999 或 W001-W999)
+        if (!/^[EW]\d{3,4}$/.test(entry.code)) {
+            errors.push(`${prefix} code "${entry.code}" 格式无效，应为 E001-E999 或 W001-W999`);
+        }
+        // 检查 category 有效性
+        if (!VALID_CATEGORIES.has(entry.category)) {
+            errors.push(`${prefix} category "${entry.category}" 无效，有效值: ${Array.from(VALID_CATEGORIES).join(', ')}`);
+        }
+        // 检查 severity 有效性
+        if (!VALID_SEVERITIES.has(entry.severity)) {
+            errors.push(`${prefix} severity "${entry.severity}" 无效，有效值: ${Array.from(VALID_SEVERITIES).join(', ')}`);
+        }
+        // 检查 message 包含占位符的语法
+        const placeholderMatches = entry.message.match(/\{[^}]+\}/g) || [];
+        for (const placeholder of placeholderMatches) {
+            const name = placeholder.slice(1, -1);
+            // 检查占位符名称是否有效（不包含空格或特殊字符）
+            if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name)) {
+                errors.push(`${prefix} message 中的占位符 "${placeholder}" 格式无效，应使用 {variableName} 格式`);
+            }
+        }
+        // 检查 help 文本不为空
+        if (entry.help.trim().length === 0) {
+            errors.push(`${prefix} help 文本为空`);
+        }
+    }
+    return {
+        valid: errors.length === 0,
+        errors,
+    };
+}
+function main() {
+    const filePath = process.argv[2] || 'shared/error_codes.json';
+    console.log(`验证错误码文件: ${filePath}\n`);
+    const result = validateErrorCodes(filePath);
+    if (result.valid) {
+        console.log('✅ 所有错误码验证通过！');
+        console.log(`   共 ${Object.keys(JSON.parse(fs.readFileSync(filePath, 'utf8'))).length} 个错误码`);
+        process.exit(0);
+    }
+    else {
+        console.log('❌ 发现以下问题：\n');
+        for (const error of result.errors) {
+            console.log(`   ${error}`);
+        }
+        console.log(`\n共 ${result.errors.length} 个问题`);
+        process.exit(1);
+    }
+}
+main();
+//# sourceMappingURL=validate_error_codes.js.map

package/dist/scripts/validate_error_codes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate_error_codes.js","sourceRoot":"","sources":["../../scripts/validate_error_codes.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,OAAO,MAAM,cAAc,CAAC;AAYnC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM;IACN,QAAQ;IACR,YAAY;IACZ,OAAO;IACP,OAAO;IACP,KAAK;IACL,QAAQ;IACR,UAAU;CACX,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAE/D,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,OAAO;IACP,IAAI,UAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClD,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAe,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,WAAW,QAAQ,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAE3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,GAAG,GAAG,CAAC;QAE1B,SAAS;QACT,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,aAAa,CAAC,CAAC;YACpC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,iBAAiB,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,iBAAiB,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,gBAAgB,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,aAAa,CAAC,CAAC;QACtC,CAAC;QAED,cAAc;QACd,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CACT,GAAG,MAAM,UAAU,KAAK,CAAC,IAAI,YAAY,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAC1E,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;QAED,qCAAqC;QACrC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CACT,GAAG,MAAM,UAAU,KAAK,CAAC,IAAI,iCAAiC,CAC/D,CAAC;QACJ,CAAC;QAED,kBAAkB;QAClB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CACT,GAAG,MAAM,cAAc,KAAK,CAAC,QAAQ,aAAa,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5F,CAAC;QACJ,CAAC;QAED,kBAAkB;QAClB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CACT,GAAG,MAAM,cAAc,KAAK,CAAC,QAAQ,aAAa,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5F,CAAC;QACJ,CAAC;QAED,sBAAsB;QACtB,MAAM,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACnE,KAAK,MAAM,WAAW,IAAI,kBAAkB,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACtC,0BAA0B;YAC1B,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,MAAM,CAAC,IAAI,CACT,GAAG,MAAM,mBAAmB,WAAW,8BAA8B,CACtE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,gBAAgB;QAChB,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,YAAY,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,IAAI;IACX,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,yBAAyB,CAAC;IAE9D,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,IAAI,CAAC,CAAC;IAEtC,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAE5C,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,QAAQ,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC;QAC9F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC;QAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/scripts/verify-capabilities.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=verify-capabilities.d.ts.map

package/dist/scripts/verify-capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-capabilities.d.ts","sourceRoot":"","sources":["../../scripts/verify-capabilities.ts"],"names":[],"mappings":""}

package/dist/scripts/verify-capabilities.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import { canonicalize } from '../src/frontend/canonicalizer.js';
+import { lex } from '../src/frontend/lexer.js';
+import { parse } from '../src/parser.js';
+import { lowerModule } from '../src/lower_to_core.js';
+import { typecheckModuleWithCapabilities } from '../src/typecheck.js';
+function main() {
+    const src = fs.readFileSync('test/cnl/programs/business/policy/capdemo.aster', 'utf8');
+    const manifest = JSON.parse(fs.readFileSync('test/cnl/programs/integration/capabilities/capabilities.json', 'utf8'));
+    const ast = parse(lex(canonicalize(src)));
+    const core = lowerModule(ast);
+    const diags = typecheckModuleWithCapabilities(core, manifest);
+    // Expect exactly one error: badIO should be allowed (module matches), but its body is invalid nullstrict-wise; we only assert capability errors count is zero
+    const capErrors = diags.filter(d => d.severity === 'error' && d.message.includes('capability manifest')).length;
+    if (capErrors !== 0) {
+        console.error('Capability verification failed:', diags);
+        process.exit(1);
+    }
+    console.log('Capability verification passed (no manifest violations)');
+}
+main();
+//# sourceMappingURL=verify-capabilities.js.map

package/dist/scripts/verify-capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-capabilities.js","sourceRoot":"","sources":["../../scripts/verify-capabilities.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAC;AAEtE,SAAS,IAAI;IACX,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,iDAAiD,EAAE,MAAM,CAAC,CAAC;IACvF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,8DAA8D,EAAE,MAAM,CAAC,CAAC,CAAC;IACrH,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC9D,8JAA8J;IAC9J,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC;IAChH,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;AACzE,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/scripts/verify-classes.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=verify-classes.d.ts.map

package/dist/scripts/verify-classes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-classes.d.ts","sourceRoot":"","sources":["../../scripts/verify-classes.ts"],"names":[],"mappings":""}

package/dist/scripts/verify-classes.js

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+import cp from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+function sh(cmd) {
+    cp.execSync(cmd, { stdio: 'inherit' });
+}
+function findRuntimeJar() {
+    const dir = 'aster-runtime/build/libs';
+    if (!fs.existsSync(dir))
+        return '';
+    const jars = fs.readdirSync(dir).filter(f => f.endsWith('.jar'));
+    return jars.length > 0 ? path.join(dir, jars[0]) : '';
+}
+function main() {
+    // Ensure runtime jar exists
+    sh('./gradlew :aster-runtime:jar');
+    const rt = findRuntimeJar();
+    if (!rt) {
+        console.error('aster-runtime jar not found');
+        process.exit(2);
+    }
+    const classesDir = path.resolve('build/jvm-classes');
+    if (!fs.existsSync(classesDir)) {
+        console.error('classes not found at ' + classesDir);
+        process.exit(2);
+    }
+    const cp = `${rt}:${classesDir}`;
+    sh(`java -Xverify:all -cp '${cp}' aster.runtime.VerifyClasses '${classesDir}'`);
+}
+main();
+//# sourceMappingURL=verify-classes.js.map

package/dist/scripts/verify-classes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-classes.js","sourceRoot":"","sources":["../../scripts/verify-classes.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,oBAAoB,CAAC;AACpC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,SAAS,EAAE,CAAC,GAAW;IACrB,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,GAAG,GAAG,0BAA0B,CAAC;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,IAAI;IACX,4BAA4B;IAC5B,EAAE,CAAC,8BAA8B,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACrD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,uBAAuB,GAAG,UAAU,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,EAAE,IAAI,UAAU,EAAE,CAAC;IACjC,EAAE,CAAC,0BAA0B,EAAE,kCAAkC,UAAU,GAAG,CAAC,CAAC;AAClF,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/scripts/verify-examples.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=verify-examples.d.ts.map

package/dist/scripts/verify-examples.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-examples.d.ts","sourceRoot":"","sources":["../../scripts/verify-examples.ts"],"names":[],"mappings":""}

package/dist/scripts/verify-examples.js

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+import cp from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+function sh(cmd, env) {
+    cp.execSync(cmd, {
+        stdio: 'inherit',
+        env: { ...process.env, ASTER_ROOT: process.cwd(), ...env },
+    });
+}
+const examples = [
+    {
+        name: 'login-jvm',
+        sources: [
+            'test/cnl/programs/examples/login.aster',
+            'test/cnl/programs/business/policy/policy_engine.aster',
+            'test/cnl/programs/business/policy/policy_demo.aster',
+        ],
+    },
+    {
+        name: 'text-jvm',
+        sources: ['test/cnl/programs/collections/text_ops.aster'],
+    },
+    {
+        name: 'list-jvm',
+        sources: ['test/cnl/programs/collections/list_ops.aster'],
+    },
+    {
+        name: 'map-jvm',
+        sources: ['test/cnl/programs/collections/map_ops.aster'],
+    },
+];
+function main() {
+    // Pre-generate JARs for each example
+    // This avoids Gradle calling npm (which may fail in CI due to PATH issues)
+    console.log('Pre-generating JARs for examples...');
+    for (const example of examples) {
+        const outDir = `examples/${example.name}/build/aster-out`;
+        fs.mkdirSync(outDir, { recursive: true });
+        console.log(`\n=== ${example.name} ===`);
+        // Compile aster sources for this example
+        for (const source of example.sources) {
+            if (!fs.existsSync(source)) {
+                console.log(`  ⚠ Source not found: ${source}`);
+                continue;
+            }
+            try {
+                sh(`node dist/scripts/emit-classfiles.js ${source}`);
+                console.log(`  ✓ Compiled ${path.basename(source)}`);
+            }
+            catch (e) {
+                console.error(`  ✗ Failed to compile ${source}: ${e.message}`);
+            }
+        }
+        // Build JAR for this example
+        try {
+            sh('npm run jar:jvm', { ASTER_OUT_DIR: outDir });
+            console.log(`  ✓ Built ${outDir}/aster.jar`);
+        }
+        catch (e) {
+            console.error(`  ✗ Failed to build JAR: ${e.message}`);
+            process.exit(1);
+        }
+    }
+    // Compile+run JVM examples against package map
+    // Use --no-configuration-cache to avoid stale cache issues in CI
+    console.log('\nBuilding examples with Gradle...');
+    const targets = examples.map((e) => `:examples:${e.name}:build`);
+    try {
+        sh(`./gradlew ${targets.join(' ')} --no-configuration-cache`);
+    }
+    catch (e) {
+        console.error('Examples build failed:', e.message);
+        process.exit(1);
+    }
+    console.log('\nExamples compile against package map: OK');
+}
+main();
+//# sourceMappingURL=verify-examples.js.map

package/dist/scripts/verify-examples.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-examples.js","sourceRoot":"","sources":["../../scripts/verify-examples.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,oBAAoB,CAAC;AACpC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,SAAS,EAAE,CAAC,GAAW,EAAE,GAA4B;IACnD,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE;QACf,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE;KAC3D,CAAC,CAAC;AACL,CAAC;AAQD,MAAM,QAAQ,GAAoB;IAChC;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE;YACP,wCAAwC;YACxC,uDAAuD;YACvD,qDAAqD;SACtD;KACF;IACD;QACE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,CAAC,8CAA8C,CAAC;KAC1D;IACD;QACE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,CAAC,8CAA8C,CAAC;KAC1D;IACD;QACE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,CAAC,6CAA6C,CAAC;KACzD;CACF,CAAC;AAEF,SAAS,IAAI;IACX,qCAAqC;IACrC,2EAA2E;IAC3E,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;IAEnD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,YAAY,OAAO,CAAC,IAAI,kBAAkB,CAAC;QAC1D,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1C,OAAO,CAAC,GAAG,CAAC,SAAS,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC;QAEzC,yCAAyC;QACzC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAC;gBAC/C,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,EAAE,CAAC,wCAAwC,MAAM,EAAE,CAAC,CAAC;gBACrD,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,yBAAyB,MAAM,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,IAAI,CAAC;YACH,EAAE,CAAC,iBAAiB,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,YAAY,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,4BAA6B,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,iEAAiE;IACjE,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAG,CAAW,CAAC,OAAO,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;AAC5D,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/scripts/verify-fuzz.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=verify-fuzz.d.ts.map

package/dist/scripts/verify-fuzz.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-fuzz.d.ts","sourceRoot":"","sources":["../../scripts/verify-fuzz.ts"],"names":[],"mappings":""}

package/dist/scripts/verify-fuzz.js

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import cp from 'node:child_process';
+function sh(cmd) { cp.execSync(cmd, { stdio: 'inherit' }); }
+function randInt(n) { return Math.floor(Math.random() * n); }
+function randExpr(i) {
+    const k = randInt(3);
+    if (k === 0)
+        return { kind: 'Int', value: randInt(1000) };
+    if (k === 1)
+        return { kind: 'Bool', value: randInt(2) === 0 };
+    // 50% chance of static interop call to exercise INVOKESTATIC lowering
+    if (randInt(2) === 0) {
+        const which = randInt(2);
+        if (which === 0) {
+            // pick overload fuzz
+            const choice = randInt(4);
+            let arg;
+            if (choice === 0)
+                arg = { kind: 'Int', value: randInt(100) };
+            else if (choice === 1)
+                arg = { kind: 'Bool', value: randInt(2) === 0 };
+            else if (choice === 2)
+                arg = { kind: 'String', value: 's' + i };
+            else
+                arg = { kind: 'Null' };
+            return { kind: 'Call', target: { kind: 'Name', name: 'aster.runtime.Interop.pick' }, args: [arg] };
+        }
+        else {
+            // sum overload fuzz with mixed numeric kinds
+            const aKinds = [
+                { kind: 'Int', value: randInt(50) },
+                { kind: 'Long', value: String(randInt(50)) },
+                { kind: 'Double', value: Math.floor(Math.random() * 50) + 0.5 },
+            ];
+            const a = aKinds[randInt(aKinds.length)];
+            const b = aKinds[randInt(aKinds.length)];
+            return { kind: 'Call', target: { kind: 'Name', name: 'aster.runtime.Interop.sum' }, args: [a, b] };
+        }
+    }
+    return { kind: 'String', value: 's' + i };
+}
+function genCoreJSON(i) {
+    // Randomly generate either a Return literal or an If with two Returns
+    const shape = randInt(2);
+    if (shape === 0) {
+        const e = randExpr(i);
+        const retName = e.kind === 'String' ? 'Text' : e.kind;
+        return {
+            kind: 'Module', name: 'fuzz.mod' + i, decls: [
+                { kind: 'Func', name: 'f' + i, params: [], ret: { kind: 'TypeName', name: retName }, effects: [],
+                    body: { kind: 'Block', statements: [{ kind: 'Return', expr: e }] } }
+            ]
+        };
+    }
+    else {
+        const cond = { kind: 'Bool', value: randInt(2) === 0 };
+        const thenExpr = randExpr(i);
+        const elseExpr = randExpr(i + 1000);
+        // Harmonize return type to Text if either branch is String
+        const retName = (thenExpr.kind === 'String' || elseExpr.kind === 'String') ? 'Text' : (thenExpr.kind === 'Bool' || elseExpr.kind === 'Bool') ? 'Bool' : 'Int';
+        return {
+            kind: 'Module', name: 'fuzz.mod' + i, decls: [
+                { kind: 'Func', name: 'f' + i, params: [], ret: { kind: 'TypeName', name: retName }, effects: [],
+                    body: { kind: 'Block', statements: [
+                            { kind: 'If', cond, thenBlock: { kind: 'Block', statements: [{ kind: 'Return', expr: thenExpr }] }, elseBlock: { kind: 'Block', statements: [{ kind: 'Return', expr: elseExpr }] } }
+                        ] } }
+            ]
+        };
+    }
+}
+function main() {
+    const outDir = path.resolve('build/asm-fuzz');
+    fs.mkdirSync(outDir, { recursive: true });
+    const N = 100;
+    for (let i = 0; i < N; i++) {
+        const mod = genCoreJSON(i);
+        const p = path.join(outDir, `fuzz_${i}.json`);
+        fs.writeFileSync(p, JSON.stringify(mod));
+        sh(`node dist/scripts/emit-classfiles-core.js '${p}'`);
+    }
+    // Verify classes under -Xverify:all
+    sh('node dist/scripts/verify-classes.js');
+    console.log('Fuzz verify passed');
+}
+main();
+//# sourceMappingURL=verify-fuzz.js.map

package/dist/scripts/verify-fuzz.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-fuzz.js","sourceRoot":"","sources":["../../scripts/verify-fuzz.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAEpC,SAAS,EAAE,CAAC,GAAW,IAAU,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;AAE1E,SAAS,OAAO,CAAC,CAAS,IAAY,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7E,SAAS,QAAQ,CAAC,CAAS;IACzB,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;IAC1D,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9D,sEAAsE;IACtE,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAChB,qBAAqB;YACrB,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,GAAQ,CAAC;YACb,IAAI,MAAM,KAAK,CAAC;gBAAE,GAAG,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;iBACxD,IAAI,MAAM,KAAK,CAAC;gBAAE,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;iBAClE,IAAI,MAAM,KAAK,CAAC;gBAAE,GAAG,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC;;gBAC3D,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QACrG,CAAC;aAAM,CAAC;YACN,6CAA6C;YAC7C,MAAM,MAAM,GAAG;gBACb,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE;gBACnC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE;gBAC5C,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,GAAG,EAAE;aAChE,CAAC;YACF,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACzC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACzC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACrG,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,sEAAsE;IACtE,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtD,OAAO;YACL,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,GAAG,CAAC,EAAE,KAAK,EAAE;gBAC3C,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE;oBAC9F,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;aACvE;SACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,GAAC,IAAI,CAAC,CAAC;QAClC,2DAA2D;QAC3D,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QAC9J,OAAO;YACL,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,GAAG,CAAC,EAAE,KAAK,EAAE;gBAC3C,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE;oBAC9F,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE;4BACjC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE;yBACrL,EAAE,EAAE;aACR;SACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,IAAI;IACX,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC9C,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,GAAG,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9C,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,EAAE,CAAC,8CAA8C,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,oCAAoC;IACpC,EAAE,CAAC,qCAAqC,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;AACpC,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/scripts/verify-jar-checksum.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=verify-jar-checksum.d.ts.map

package/dist/scripts/verify-jar-checksum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-jar-checksum.d.ts","sourceRoot":"","sources":["../../scripts/verify-jar-checksum.ts"],"names":[],"mappings":""}

package/dist/scripts/verify-jar-checksum.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+/**
+ * 验证 aster.jar 的 checksum 一致性
+ *
+ * 用途：
+ * 1. 在 Gradle verify 阶段验证生成的 JAR 文件未被篡改
+ * 2. 确保 TypeScript → Java 产物的跨工具链一致性
+ *
+ * 使用方式：
+ * - npm run verify:jar:checksum
+ * - node dist/scripts/verify-jar-checksum.js
+ */
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+function computeChecksum(filePath) {
+    const data = fs.readFileSync(filePath);
+    return crypto.createHash('sha256').update(data).digest('hex');
+}
+function main() {
+    const outBase = process.env.ASTER_OUT_DIR?.trim() || 'build/aster-out';
+    const jarPath = path.join(outBase, 'aster.jar');
+    const checksumPath = path.join(outBase, 'aster.jar.sha256');
+    // 检查文件存在性
+    if (!fs.existsSync(jarPath)) {
+        console.error(`JAR 文件不存在: ${jarPath}`);
+        console.error('请先运行 npm run jar:jvm 生成 JAR');
+        process.exit(1);
+    }
+    if (!fs.existsSync(checksumPath)) {
+        console.error(`Checksum 文件不存在: ${checksumPath}`);
+        console.error('请先运行 npm run jar:jvm 生成 checksum');
+        process.exit(1);
+    }
+    // 读取保存的 checksum
+    const savedContent = fs.readFileSync(checksumPath, 'utf-8').trim();
+    const savedHash = savedContent.split(/\s+/)[0];
+    if (!savedHash || savedHash.length !== 64) {
+        console.error(`Checksum 文件格式无效: ${checksumPath}`);
+        console.error(`内容: ${savedContent}`);
+        process.exit(1);
+    }
+    // 计算当前 JAR 的 checksum
+    const currentHash = computeChecksum(jarPath);
+    // 比较
+    if (currentHash === savedHash) {
+        console.log('✓ Checksum 验证通过');
+        console.log(`  文件: ${jarPath}`);
+        console.log(`  SHA-256: ${currentHash}`);
+        process.exit(0);
+    }
+    else {
+        console.error('✗ Checksum 验证失败');
+        console.error(`  文件: ${jarPath}`);
+        console.error(`  期望: ${savedHash}`);
+        console.error(`  实际: ${currentHash}`);
+        console.error('');
+        console.error('JAR 文件可能在生成后被修改，请重新运行 npm run jar:jvm');
+        process.exit(1);
+    }
+}
+main();
+//# sourceMappingURL=verify-jar-checksum.js.map