@typecad/cuttlefish 1.0.0-alpha.6 → 1.0.0-alpha.8

package/dist/ir/transformers/expressions.js

@@ -16,6 +16,17 @@ export function expressionStatementToIR(statement, fileName, sourceText, diagnos
         if (callStmt && callStmt.kind === "call") {
             return { ...callStmt, isAwaited: true };
         }
+        // Awaited network HAL ops (WiFi.connect / WiFi.untilConnected / Http.send
+        // / ...) resolve to hal-op statements, which would otherwise lower to the
+        // BLOCKING shim call even inside an async state machine. Rewrite them to
+        // an awaited __WIFI_WAIT__/__HTTP_WAIT__ marker call carrying the original
+        // op; the async state-machine generator turns it into a start + poll state
+        // pair, and the statement renderer falls back to the blocking form when
+        // the marker is rendered outside a state machine (top-level await, awaits
+        // nested in unsupported positions).
+        const netMarker = awaitedNetMarker(callStmt);
+        if (netMarker)
+            return netMarker;
         return callStmt;
     }
     // ── Register bit-field write ────────────────────────────────────────
@@ -404,3 +415,54 @@ export function expressionStatementToIR(statement, fileName, sourceText, diagnos
     }
     return undefined;
 }
+/** HAL ops with a start/poll split available in the async state machine
+ *  (see async-state-machine.ts netWaitInfo — keep the two in sync).
+ *  timing.delay is included because `delay()` from @typecad/hal resolves to a
+ *  hal-op, dropping the isAwaited flag the state machine keys on. */
+const AWAITABLE_HAL_OPS = new Set([
+    "timing.delay",
+    "wifi.connect",
+    "wifi.wait_connected",
+    "wifi.wait_disconnected",
+    "wifi.scan",
+    "http.send",
+    "ble.until_connected",
+    // Worker offload: `await worker.submit(...)` rewrites to submit + poll
+    // worker.done — mirrors `await http.send(...)`. The start op is worker.submit
+    // (emitted by the previous state segment); the poll predicate is worker.done.
+    "worker.submit",
+]);
+/**
+ * Rewrite an awaited hal-op statement (or a block whose LAST statement is
+ * one — chained HAL calls resolve to blocks of hal-ops) into an awaited
+ * `__WIFI_WAIT__` / `__HTTP_WAIT__` / `__HAL_WAIT__` marker call carrying the
+ * original op as a hal-expr argument. Returns undefined when the statement is
+ * not an awaitable HAL op.
+ */
+function awaitedNetMarker(stmt) {
+    if (!stmt)
+        return undefined;
+    if (stmt.kind === "hal-op" && AWAITABLE_HAL_OPS.has(stmt.operation.operation)) {
+        const opName = stmt.operation.operation;
+        const callee = opName.startsWith("http.") ? "__HTTP_WAIT__"
+            : opName.startsWith("wifi.") ? "__WIFI_WAIT__"
+                : opName.startsWith("ble.") ? "__BLE_WAIT__"
+                    : "__HAL_WAIT__";
+        return {
+            kind: "call",
+            sourceSpan: stmt.sourceSpan,
+            leadingComments: stmt.leadingComments,
+            trailingComments: stmt.trailingComments,
+            callee,
+            args: [{ kind: "hal-expr", operation: stmt.operation }],
+            isAwaited: true,
+        };
+    }
+    if (stmt.kind === "block" && stmt.body.length > 0) {
+        const last = awaitedNetMarker(stmt.body[stmt.body.length - 1]);
+        if (last) {
+            return { ...stmt, body: [...stmt.body.slice(0, -1), last] };
+        }
+    }
+    return undefined;
+}

package/dist/ir/transformers/hal-call-resolver.js

@@ -270,5 +270,26 @@ export function tryResolveHALExpression(call, sourceText, diagnostics, pointerVa
             }
         }
     }
+    // Namespace method fallbacks (Pulse, Shift, Random) in expression context.
+    // Value-returning namespace methods (e.g. Random.upTo/between/int) lower to
+    // HAL ops; surface the last op as a hal-expr so the strategy lowers it to the
+    // platform PRNG (Arduino random(), ESP-IDF esp_random()). Without this, an
+    // inline `if (Random.upTo(5) > 2)` would fall through to a 0 placeholder.
+    if (ts.isIdentifier(receiver)) {
+        const ns = receiver.text;
+        const nsResult = resolveNamespaceMethodCall(ns, method, argIRs);
+        if (nsResult) {
+            if (nsResult.halOps.length > 0) {
+                const lastOp = nsResult.halOps[nsResult.halOps.length - 1];
+                return {
+                    ir: { kind: "hal-expr", operation: lastOp },
+                    sideEffects: nsResult.emitLines,
+                };
+            }
+            if (nsResult.returnValue && nsResult.returnValue !== "__hal_op_return__") {
+                return { ir: { kind: "raw", value: nsResult.returnValue }, sideEffects: nsResult.emitLines };
+            }
+        }
+    }
     return null;
 }

package/dist/ir/transformers/hal-emit-helpers.js

@@ -27,7 +27,7 @@ export function collectChainedHALEmits(expr, sourceText, diagnostics, pointerVar
             }
         }
         // Continue recursion to collect deeper chain levels
-        if (ts.isCallExpression(innerReceiver) && ts.isPropertyAccessExpression(innerReceiver)) {
+        if (ts.isCallExpression(innerReceiver) && ts.isPropertyAccessExpression(innerReceiver.expression)) {
             collectChainedHALEmits(innerReceiver, sourceText, diagnostics, pointerVars, emitLines, halOps);
         }
     }

package/dist/ir/transformers/namespace-methods.js

@@ -81,29 +81,34 @@ export function resolveNamespaceMethodCall(ns, method, argIRs) {
         }
     }
     if (ns === "Random") {
+        // Random.* lowers to the random.* HAL op family, which frameworks lower to
+        // their platform PRNG (Arduino random()/randomSeed(), ESP-IDF esp_random()).
+        // Previously these emitted bare `random()`/`randomSeed()` calls, which only
+        // resolve to symbols on Arduino-core frameworks — on ESP-IDF they were
+        // undefined and failed at C++ link time.
         if (method === "seed") {
-            return { emitLines: [`randomSeed(${argText(0)});`], halOps: [] };
+            return { emitLines: [], halOps: [{ operation: "random.seed", seed: argText(0) }] };
         }
         if (method === "number") {
             const min = argText(0);
             const max = argText(1);
-            return {
-                emitLines: [],
-                halOps: [],
-                returnValue: max ? `random(${min}, ${max})` : `random(${min})`,
-            };
+            if (max) {
+                return { emitLines: [], halOps: [{ operation: "random.range", min, max }], returnValue: "__hal_op_return__" };
+            }
+            // Single-arg form: Random.number(max) → [0, max-1]
+            return { emitLines: [], halOps: [{ operation: "random.range", min: "0", max: min }], returnValue: "__hal_op_return__" };
         }
-        // Current class API: Random.upTo(max) → random(max)
+        // Random.upTo(max) → [0, max-1]
         if (method === "upTo") {
-            return { emitLines: [], halOps: [], returnValue: `random(${argText(0)})` };
+            return { emitLines: [], halOps: [{ operation: "random.range", min: "0", max: argText(0) }], returnValue: "__hal_op_return__" };
         }
-        // Random.between(min, max) → random(min, max)
+        // Random.between(min, max) → [min, max-1]
         if (method === "between") {
-            return { emitLines: [], halOps: [], returnValue: `random(${argText(0)}, ${argText(1)})` };
+            return { emitLines: [], halOps: [{ operation: "random.range", min: argText(0), max: argText(1) }], returnValue: "__hal_op_return__" };
         }
-        // Random.int() → random(2147483647)
+        // Random.int() → non-negative 31-bit integer
         if (method === "int") {
-            return { emitLines: [], halOps: [], returnValue: `random(2147483647)` };
+            return { emitLines: [], halOps: [{ operation: "random.int" }], returnValue: "__hal_op_return__" };
         }
     }
     return null;

package/dist/ir/transformers/ui-reactive.js

@@ -30,9 +30,9 @@ function propEnum(property) {
 export function emitBindingEntry(spec) {
     // Text bindings wire to textFn (void fill-style); color bindings wire to fn.
     if (spec.property === "text") {
-        return `  { .node=${spec.nodeIndex}, .prop=${propEnum(spec.property)}, .fn=nullptr, .textFn=${spec.fnName} },`;
+        return `  { .node=${spec.nodeIndex}, .prop=${propEnum(spec.property)}, .fn=nullptr, .textFn=${spec.fnName}, .lastValue=0, .initialized=0 },`;
     }
-    return `  { .node=${spec.nodeIndex}, .prop=${propEnum(spec.property)}, .fn=${spec.fnName}, .textFn=nullptr },`;
+    return `  { .node=${spec.nodeIndex}, .prop=${propEnum(spec.property)}, .fn=${spec.fnName}, .textFn=nullptr, .lastValue=0, .initialized=0 },`;
 }
 /** Emit a full binding table from a list of specs. */
 export function emitBindingTable(specs) {

package/dist/ir/transformers/variables.js

@@ -7,9 +7,11 @@ import { getCurrentIrTypeScope, setScopeLocalType } from "../symbol-types.js";
 import { renderExprAsText } from "../render-expr.js";
 import { expressionToIR } from "../expression-to-ir.js";
 import { buildInlineForLoop } from "./array-methods.js";
-import { isKnownHALClass, getCtorIncludes, registerFloatVariable, resolveHALReceiver, isHALSingleton, } from "../hal-resolver.js";
+import { isKnownHALClass, getCtorIncludes, getHALCtorFieldMap, registerFloatVariable, resolveHALReceiver, isHALSingleton, } from "../hal-resolver.js";
+import { httpFactoryVerb, httpUrlArgText } from "../hal/hal-parser.js";
 import { resolveHALCallForVarInit } from "./hal-call-resolver.js";
 import { recordSignal } from "./ui-call-resolver.js";
+import { hasSafetyHook, requireSafetyHook } from "../../safety-hook.js";
 function replaceHalReadBufferPlaceholder(op, varName) {
     if (op.operation === "i2c.read_buffer" && op.buffer === "__HAL_READ_BUF__") {
         return { ...op, buffer: varName };
@@ -374,6 +376,56 @@ export function variableStatementToIR(statement, fileName, sourceText, diagnosti
                 localVariableTypes.set(varName, cppType);
                 continue;
             }
+            // ── safe.<method>(...) — @typecad/safety call as initializer.
+            // Handles expression-position safe.* calls like `const r = safe.read(pin)`.
+            // The statement-position form (safe.pinMode(...)) is handled in the
+            // call-statement transformer. Both produce hal-op IR nodes that
+            // routeHALOp() later dispatches to the safety hook.
+            if (hasSafetyHook() &&
+                ts.isCallExpression(declaration.initializer) &&
+                ts.isPropertyAccessExpression(declaration.initializer.expression) &&
+                ts.isIdentifier(declaration.initializer.expression.expression) &&
+                declaration.initializer.expression.expression.text === "safe") {
+                const method = declaration.initializer.expression.name.text;
+                const argValues = declaration.initializer.arguments.map((a) => {
+                    if (ts.isNumericLiteral(a))
+                        return Number(a.text);
+                    if (ts.isStringLiteral(a))
+                        return a.text;
+                    if (a.kind === ts.SyntaxKind.TrueKeyword)
+                        return true;
+                    if (a.kind === ts.SyntaxKind.FalseKeyword)
+                        return false;
+                    if (ts.isIdentifier(a)) {
+                        const name = a.text;
+                        if (name === "INPUT")
+                            return 0;
+                        if (name === "OUTPUT")
+                            return 1;
+                        if (name === "INPUT_PULLUP")
+                            return 2;
+                        return name;
+                    }
+                    return undefined;
+                });
+                const op = requireSafetyHook().resolveSemanticCall?.(`safe.${method}`, argValues);
+                if (op) {
+                    // Emit a var_decl initialized by a hal-expr carrying the safety op.
+                    // routeHALOp() resolves it to the C++ expression at emit time.
+                    const initExpr = { kind: "hal-expr", operation: op };
+                    lowered.push({
+                        kind: "var_decl",
+                        name: varName,
+                        storage,
+                        cppType: "auto",
+                        initializer: initExpr,
+                        sourceSpan: makeSourceSpan(declaration, fileName, sourceText),
+                    });
+                    // auto-deduced to SafeReadResult on the C++ side.
+                    localVariableTypes.set(varName, "auto");
+                    continue;
+                }
+            }
             if (ts.isNewExpression(declaration.initializer) && ts.isIdentifier(declaration.initializer.expression)) {
                 const className = declaration.initializer.expression.text;
                 const ctorArgs = declaration.initializer.arguments;
@@ -408,9 +460,26 @@ export function variableStatementToIR(statement, fileName, sourceText, diagnosti
                             }
                         }
                     }
+                    // new HttpRequest(method, url) — positional ctor fields. The URL is
+                    // stored as C++ expression text (quoted literal or identifier).
+                    if (className === "HttpRequest" && ctorArgs && ctorArgs.length >= 2) {
+                        const methodArg = ctorArgs[0];
+                        if (ts.isStringLiteral(methodArg))
+                            fieldValues.set("_method", methodArg.text.toUpperCase());
+                        const urlText = httpUrlArgText(ctorArgs[1]);
+                        if (urlText)
+                            fieldValues.set("_url", urlText);
+                    }
                     if (ctorArgs) {
+                        // Resolve a Pin-identifier ctor arg to its _pin number, for any HAL
+                        // class whose first constructor field is _pin (Pin itself, plus
+                        // pin-bearing wrappers like RmtChannel). Mirrors the Pin branch
+                        // above but keyed off the class's registered ctor field map so new
+                        // pin-keyed classes work without a per-class branch here.
+                        const ctorFieldMap = getHALCtorFieldMap(className);
+                        const firstFieldIsPin = ctorFieldMap && Array.from(ctorFieldMap.keys())[0] === "_pin";
                         for (const arg of ctorArgs) {
-                            if (ts.isIdentifier(arg) && className === "Pin") {
+                            if (ts.isIdentifier(arg) && (className === "Pin" || firstFieldIsPin)) {
                                 const existing = halInstances.get(arg.text);
                                 if (existing && existing.fieldValues.has("_pin")) {
                                     fieldValues.set("_pin", existing.fieldValues.get("_pin"));
@@ -516,6 +585,19 @@ export function variableStatementToIR(statement, fileName, sourceText, diagnosti
                                 }
                             }
                         }
+                        // For Http factory calls (const req = Http.get(url)), record the
+                        // HTTP verb + URL so req.send() can resolve this._method/this._url.
+                        if (result.returnClassName === "HttpRequest") {
+                            const verb = httpFactoryVerb(init.expression.name.text);
+                            if (verb)
+                                fieldValues.set("_method", verb);
+                            const urlArg = init.arguments?.[0];
+                            if (urlArg) {
+                                const urlText = httpUrlArgText(urlArg);
+                                if (urlText)
+                                    fieldValues.set("_url", urlText);
+                            }
+                        }
                         halInstances.set(varName, {
                             className: result.returnClassName,
                             fieldValues,
@@ -573,7 +655,14 @@ export function variableStatementToIR(statement, fileName, sourceText, diagnosti
                             // fill ops). Everything else is a scalar/value return captured
                             // after the side-effect ops.
                             const isTypedArray = result.returnValue.startsWith("__TYPED_ARRAY__:");
-                            if (!isTypedArray) {
+                            // A factory returning a compile-time HAL instance (e.g.
+                            // `const req = Http.get(url)` → returnValue `new HttpRequest(...)`)
+                            // is fully tracked via halInstances — every later method call on
+                            // the variable resolves at compile time. Emitting the raw
+                            // `new HttpRequest(...)` would reference a class that doesn't
+                            // exist in the C++ output.
+                            const isHalInstanceReturn = !!result.returnClassName && /^new\s/.test(result.returnValue.trim());
+                            if (!isTypedArray && !isHalInstanceReturn) {
                                 lowered.push({
                                     kind: "var_decl",
                                     sourceSpan: makeSourceSpan(declaration, fileName, sourceText),

package/dist/ir/type-resolution.js

@@ -48,6 +48,14 @@ const BOARD_CONSTANT_TYPE_NAMES = new Set([
 const OWNERSHIP_WRAPPER_TYPE_NAMES = new Set([
     "Owned", "Shared", "Mutable",
 ]);
+/** Safety wrapper types: like ownership wrappers (phantom TS types that carry
+ *  a type parameter), but instead of stripping the wrapper, the C++ keeps it
+ *  as a template instantiation: SafeVariable<number> → SafeVariable<int32_t>.
+ *  The C++ template definition is provided by the safety polyfill. */
+const SAFE_WRAPPER_TYPE_NAMES = new Set([
+    "SafeVariable",
+    "SafeInt",
+]);
 export function resolveAliasedTypeNode(node, typeAliases, visited = new Set()) {
     if (!node || !typeAliases) {
         return node;
@@ -147,6 +155,16 @@ export function typeNodeToCppType(node, typeAliases, typeParametersInScope) {
             const innerTypeNode = node.typeArguments?.[0];
             return typeNodeToCppType(innerTypeNode, typeAliases, typeParametersInScope);
         }
+        // SafeVariable<T> is a safety wrapper: unlike ownership wrappers (which
+        // strip the wrapper name entirely), SafeVariable keeps the wrapper name
+        // in the C++ type because the polyfill provides a template definition.
+        // SafeVariable<number> → SafeVariable<int> (the template is emitted by
+        // the safety polyfill's helperStructs).
+        if (SAFE_WRAPPER_TYPE_NAMES.has(wrapperName)) {
+            const innerTypeNode = node.typeArguments?.[0];
+            const innerCppType = typeNodeToCppType(innerTypeNode, typeAliases, typeParametersInScope);
+            return `${wrapperName}<${innerCppType}>`;
+        }
     }
     const resolvedNode = resolveAliasedTypeNode(node, typeAliases) ?? node;
     // If the resolved node is an object literal type (e.g. type X = { a: number }),

package/dist/ir/ui-element-auto-wire.js

@@ -81,7 +81,7 @@ function autoWireNode(treeName, node, nodeIndex) {
                 nodeIndex,
                 property: "text",
                 fnName: `__ui_bindtext_${nodeIndex}`,
-                cppBody: `snprintf(buf, size, "%s", ${sig});`,
+                cppBody: `snprintf(buf, static_cast<size_t>(size), "%s", ${sig});`,
             });
             // Write: keyboard commit → signal.set(text).
             recordInputBinding({
@@ -156,13 +156,15 @@ function autoWireNode(treeName, node, nodeIndex) {
             fnName: `__ui_${node.id}_autoclick`,
             callbackBody: `__ui_nodes[${nodeIndex}].value = (__ui_nodes[${nodeIndex}].value + 1) % ${count};`,
         });
-        // Auto-bind text to show the current option via snprintf if/else chain
+        // Auto-bind text to show the current option via snprintf if/else chain.
+        // Cast size to size_t to satisfy -Wformat (snprintf's n param is size_t;
+        // the textFn signature uses uint8_t).
         const branches = options.map((opt, i) => {
             if (i === 0)
-                return `if (__ui_nodes[${nodeIndex}].value == 0) { snprintf(buf, size, "%s", "${opt}"); }`;
-            return `else if (__ui_nodes[${nodeIndex}].value == ${i}) { snprintf(buf, size, "%s", "${opt}"); }`;
+                return `if (__ui_nodes[${nodeIndex}].value == 0) { snprintf(buf, static_cast<size_t>(size), "%s", "${opt}"); }`;
+            return `else if (__ui_nodes[${nodeIndex}].value == ${i}) { snprintf(buf, static_cast<size_t>(size), "%s", "${opt}"); }`;
         }).join(" ");
-        const elseBranch = `else { snprintf(buf, size, "%s", "${options[0] || ""}"); }`;
+        const elseBranch = `else { snprintf(buf, static_cast<size_t>(size), "%s", "${options[0] || ""}"); }`;
         recordBinding({
             nodeIndex,
             property: "text",

package/dist/ir/utils/map-statements.d.ts

@@ -0,0 +1,4 @@
+import type { ProgramIR, StatementIR } from "../../api/shared/index.js";
+/** Map each statement in the program to zero or more statements. The result
+ *  is a new ProgramIR; the input is not modified. */
+export declare function mapProgramStatements(program: ProgramIR, fn: (stmt: StatementIR) => StatementIR[]): ProgramIR;

package/dist/ir/utils/map-statements.js

@@ -0,0 +1,79 @@
+// ---------------------------------------------------------------------------
+// mapProgramStatements — produce a NEW ProgramIR with statements mapped by fn.
+//
+// The existing walkers in walk-ir.ts are read-only; filterProgramIR
+// (ir/filter.ts) produces a new IR but only filters, never injects. This
+// helper extends the "produce-new-IR" idiom to "map each statement to N
+// statements," which is what the safety pinMode-intercept pass needs to
+// inject companion ops.
+//
+// Non-mutating: every statement container is rebuilt; the input program is
+// untouched. The shape mirrors walkProgramIR's enumeration of containers
+// (walk-ir.ts:107-134): topLevelStatements, functions, classes
+// (constructor/methods/getters/setters), namespaces (recursively).
+//
+// KNOWN LIMITATION (Part A scope): does NOT recurse into nested statement
+// bodies (if/for/while/switch/cases). Statements at the top level of a
+// function body, class method, namespace function, or the file's top level
+// ARE mapped. pinMode calls inside `if (...) { pinMode(...); }` are not. The
+// safety package's design (docs/superpowers/specs/2026-07-27-safety-package-
+// part-a-design.md) explicitly bounds Part A to this. A future iteration can
+// thread mapping into nested bodies by recursing into thenBranch/elseBranch/
+// body/initializer/increment/cases — see walkNestedStatements (walk-ir.ts:3).
+// ---------------------------------------------------------------------------
+/** Map each statement in the program to zero or more statements. The result
+ *  is a new ProgramIR; the input is not modified. */
+export function mapProgramStatements(program, fn) {
+    const mapList = (stmts) => {
+        const out = [];
+        for (const s of stmts) {
+            const mapped = fn(s);
+            for (const m of mapped)
+                out.push(m);
+        }
+        return out;
+    };
+    const newFunctions = program.functions.map((f) => ({
+        ...f,
+        statements: mapList(f.statements),
+    }));
+    const newClasses = program.classes.map((cls) => ({
+        ...cls,
+        constructor: cls.constructor
+            ? { ...cls.constructor, statements: mapList(cls.constructor.statements) }
+            : cls.constructor,
+        methods: cls.methods.map((m) => ({ ...m, statements: mapList(m.statements) })),
+        getters: cls.getters.map((g) => ({ ...g, statements: mapList(g.statements) })),
+        setters: cls.setters.map((s) => ({ ...s, statements: mapList(s.statements) })),
+    }));
+    const newNamespaces = program.namespaces.map((ns) => mapNamespace(ns, fn));
+    return {
+        ...program,
+        topLevelStatements: mapList(program.topLevelStatements),
+        functions: newFunctions,
+        classes: newClasses,
+        namespaces: newNamespaces,
+    };
+}
+function mapNamespace(ns, fn) {
+    const mapList = (stmts) => {
+        const out = [];
+        for (const s of stmts)
+            out.push(...fn(s));
+        return out;
+    };
+    return {
+        ...ns,
+        functions: ns.functions.map((f) => ({ ...f, statements: mapList(f.statements) })),
+        classes: ns.classes.map((cls) => ({
+            ...cls,
+            constructor: cls.constructor
+                ? { ...cls.constructor, statements: mapList(cls.constructor.statements) }
+                : cls.constructor,
+            methods: cls.methods.map((m) => ({ ...m, statements: mapList(m.statements) })),
+            getters: cls.getters.map((g) => ({ ...g, statements: mapList(g.statements) })),
+            setters: cls.setters.map((s) => ({ ...s, statements: mapList(s.statements) })),
+        })),
+        children: ns.children ? ns.children.map((c) => mapNamespace(c, fn)) : ns.children,
+    };
+}

package/dist/ir/validation-orchestrator.js

@@ -1,6 +1,7 @@
 import { resolveStrategy } from "../platform/registry.js";
 import { hasLoadedFramework, getLoadedFramework } from "../framework-registry.js";
 import { analyzeInterruptSafety, inferVolatileForIsrSharedVars, detectReentrancyRisk } from "./interrupt-analysis.js";
+import { analyzeWorkerIsolation } from "./worker-analysis.js";
 import { validateADCRange } from "./adc-range-validation.js";
 import { createEmptyPeripheralUsage } from "./peripheral-usage.js";
 import { validatePeripherals } from "./peripheral-validation.js";
@@ -18,6 +19,7 @@ import { validateBlockingDelayInLoop } from "./timing-validation.js";
 import { validateUnitSuspicion } from "./unit-suspicion-validation.js";
 import { validateOwnership } from "./ownership-analysis.js";
 import { validatePinCapabilities } from "./pin-capability-validation.js";
+import { validateNetworkUsage } from "./network-validation.js";
 export function runProgramValidations(program, strategy) {
     const resolvedStrategy = strategy ?? (hasLoadedFramework() ? getLoadedFramework().strategy : resolveStrategy('generic'));
     const diagnostics = [];
@@ -30,9 +32,13 @@ export function runProgramValidations(program, strategy) {
     diagnostics.push(...validatePWMTimerSharing(peripheralUsage, program.boardConstants, program.fileName));
     diagnostics.push(...validateTimer0PWMTimingConflict(peripheralUsage, program.boardConstants, program.fileName));
     diagnostics.push(...validatePulldownSupport(peripheralUsage, program.boardConstants, program.fileName));
-    diagnostics.push(...analyzeInterruptSafety(program, peripheralUsage));
+    diagnostics.push(...analyzeInterruptSafety(program, peripheralUsage, resolvedStrategy.isrUnsafeOperations?.()));
     inferVolatileForIsrSharedVars(program, diagnostics);
     detectReentrancyRisk(program, diagnostics);
+    // Worker isolation: bus access in workers is a hard error; worker-shared
+    // globals get volatile promotion (info) or a data-race warning. Only fires
+    // when worker.submit ops are present, so non-worker programs are unaffected.
+    analyzeWorkerIsolation(program, diagnostics);
     diagnostics.push(...validateADCRange(program, program.boardConstants));
     diagnostics.push(...validateUnitSuspicion(program));
     diagnostics.push(...validatePinModeConfig(program));
@@ -40,6 +46,7 @@ export function runProgramValidations(program, strategy) {
     diagnostics.push(...validateOwnership(program));
     diagnostics.push(...validateTryCatch(program, program.boardConstants, resolvedStrategy));
     diagnostics.push(...validateMemoryBudget(program, program.boardConstants));
-    diagnostics.push(...validateBlockingDelayInLoop(program));
+    diagnostics.push(...validateBlockingDelayInLoop(program, resolvedStrategy));
+    diagnostics.push(...validateNetworkUsage(program));
     return diagnostics;
 }

package/dist/ir/worker-analysis.d.ts

@@ -0,0 +1,10 @@
+import type { ProgramIR } from '../api/index.js';
+import type { Diagnostic } from '../types.js';
+/**
+ * Analyze worker isolation: (a) promote volatile for worker-shared globals,
+ * (b) flag shared-mutable globals, (c) hard-error on bus access in workers.
+ *
+ * Mutates the IR for (a) (sets isVolatile=true on qualifying var_decls) and
+ * pushes diagnostics for all three tiers. Returns the diagnostics it added.
+ */
+export declare function analyzeWorkerIsolation(program: ProgramIR, diagnostics: Diagnostic[]): Diagnostic[];