[AS-SDK] Phase 5 — @view/@mutating/@payable intent transform

[manoahLinks]

Closes #10.

Adds the hybrid's ergonomic top layer: authors mark what an entry point does, next to the logic that does it, and an asc plugin holds those markers up against [functions.*] in otigen.toml.

@view      export function __get_impl(): u64 { … }
@mutating  export function __increment_impl(): u64 { … }
@payable   export function __deposit_impl(): void { … }

Where it lives

The issue called for a separate assemblyscript-transform/ package scoped @pyde-net/asc-transform. It ships instead inside @pyde-net/host, on the /transform subpath — one package per language directory, matching the go/ consolidation in #18. Two things fall out of that: the scaffold already depends on the SDK, so wiring it costs one asconfig.json line and no second install; and there is no publish-ordering dance between two packages that must move together.

{ "options": { "transform": ["@pyde-net/host/transform"] } }

The manifest stays authoritative

The plugin injects no schema, reads no [state] / [events], and feeds nothing back into the compile. It collects the markers, strips them from the AST, and either agrees with the manifest or fails the build:

FAILURE IntentMismatch: function intent in AssemblyScript disagrees with otigen.toml

  1. assembly/index.ts:106 — `increment`
       source      : @view — declares this entry never writes state
       otigen.toml : …/otigen.toml:46: attributes = ["entry"] — no "view", so the ABI marks it mutating
       fix         : drop @view, or add "view" to [functions.increment].attributes

Annotation is opt-in per function, so an unannotated contract — every contract written before this — is not checked at all.

Marker	Required in attributes	Attribute present, marker absent
@view	view	not an error — silence claims nothing
@mutating	no view	not an error
@payable	payable	error
@entry	entry	not an error

@payable is the one symmetric rule: on an annotated function, saying nothing about value reads as "this entry refuses value" — a safety claim the manifest may not be making.

Acceptance criteria

• An annotated contract builds via otigen build; the ABI is untouched because it never comes from the markers.
• @view on a fn the manifest marks mutating fails otigen build (exit 2) citing both sides — verified on a freshly-generated scaffold, not just in tests.
• Removing the transform from asconfig.json still yields a correct, deployable contract — asserted byte-for-byte: annotated-with-plugin and unannotated-without both produce 634b5a85… on examples/counter-as.
• Payable accept/reject on devnet. Not run here: those flags come from [functions.*] via otigen build, which this plugin cannot influence in either direction.

Two bugs worth reading

Both were found by building a real contract, not by the unit tests, and both fail silently — the worst failure mode a drift checker can have, because every mismatch sails through unchecked:

1. NodeKind is a const enum. tsc inlines one compiler's numeric ids at build time; FunctionDeclaration moved 55 → 56 between asc 0.27 and 0.28, so the walk matched nothing.
2. instanceof assumes a single assemblyscript install. It goes quietly false whenever the project resolves a different copy than the plugin does — exactly what a linked or unhoisted SDK produces, which is what this repo's own examples use.

The walk is now structural: no node kinds, no class identity. Regressions for both: a plain-object AST fixture that is not an assemblyscript instance and carries no kind ids, plus a CI step that re-runs the suite against the far end of the supported range.

Version policy

Supported: asc >= 0.27.30, < 0.29.0, checked against the compiler actually running the build. Outside it the plugin warns and stands down rather than reading an AST it cannot vouch for — an asc bump can cost the sugar, never the substrate.

Notes for review

• The manifest reader is dependency-free on purpose. It runs inside asc on the build path of every opted-in contract; a TOML dependency would put a third-party package inside the trust boundary of a check whose whole job is to tell the author the truth about their manifest. It throws — rather than guessing — on an attributes value it cannot parse, since silently ignoring one turns a real mismatch into a pass.
• assemblyscript/package.json gains "type": "module" and an exports map. asc resolves AS sources by file path and never consults exports, so @pyde-net/host/assembly/* is unaffected; the map exists for Node, which is what loads the plugin.
• 29 tests, green against both asc 0.27.37 (locked) and 0.28.20 (what scaffolds pin).

Follow-ups

• pyde-net/otigen#TBD wires this into the scaffold. It pins ^0.1.0-alpha.15, so this must publish first — npm is on alpha.14.
• pyde-net/otigen-templates holds the actual otigen init --lang as contract starter and needs the same wiring; it also carries stale /assembly host-fn imports that no longer compile against alpha.14, independent of this work.