@aptos-labs/ts-sdk 1.29.0-zeta.1 → 1.29.0-zeta.2

package/src/internal/move/jwks/build/jwk/sources/dependencies/AptosStdlib/type_info.move

@@ -0,0 +1,351 @@
+module aptos_std::type_info {
+    use std::bcs;
+    use std::features;
+    use std::string::{Self, String};
+
+    //
+    // Error codes
+    //
+
+    const E_NATIVE_FUN_NOT_AVAILABLE: u64 = 1;
+
+    //
+    // Structs
+    //
+
+    struct TypeInfo has copy, drop, store {
+        account_address: address,
+        module_name: vector<u8>,
+        struct_name: vector<u8>,
+    }
+
+    //
+    // Public functions
+    //
+
+    public fun account_address(self: &TypeInfo): address {
+        self.account_address
+    }
+
+    public fun module_name(self: &TypeInfo): vector<u8> {
+        self.module_name
+    }
+
+    public fun struct_name(self: &TypeInfo): vector<u8> {
+        self.struct_name
+    }
+
+    /// Returns the current chain ID, mirroring what `aptos_framework::chain_id::get()` would return, except in `#[test]`
+    /// functions, where this will always return `4u8` as the chain ID, whereas `aptos_framework::chain_id::get()` will
+    /// return whichever ID was passed to `aptos_framework::chain_id::initialize_for_test()`.
+    public fun chain_id(): u8 {
+        if (!features::aptos_stdlib_chain_id_enabled()) {
+            abort(std::error::invalid_state(E_NATIVE_FUN_NOT_AVAILABLE))
+        };
+
+        chain_id_internal()
+    }
+
+    /// Return the `TypeInfo` struct containing  for the type `T`.
+    public native fun type_of<T>(): TypeInfo;
+
+    /// Return the human readable string for the type, including the address, module name, and any type arguments.
+    /// Example: 0x1::coin::CoinStore<0x1::aptos_coin::AptosCoin>
+    /// Or: 0x1::table::Table<0x1::string::String, 0x1::string::String>
+    public native fun type_name<T>(): String;
+
+    native fun chain_id_internal(): u8;
+
+    /// Return the BCS size, in bytes, of value at `val_ref`.
+    ///
+    /// See the [BCS spec](https://github.com/diem/bcs)
+    ///
+    /// See `test_size_of_val()` for an analysis of common types and
+    /// nesting patterns, as well as `test_size_of_val_vectors()` for an
+    /// analysis of vector size dynamism.
+    public fun size_of_val<T>(val_ref: &T): u64 {
+        bcs::serialized_size(val_ref)
+    }
+
+    #[test_only]
+    use aptos_std::table::Table;
+
+    #[test_only]
+    use std::vector;
+
+    #[test]
+    fun test_type_of() {
+        let type_info = type_of<TypeInfo>();
+        assert!(account_address(&type_info) == @aptos_std, 0);
+        assert!(module_name(&type_info) == b"type_info", 1);
+        assert!(struct_name(&type_info) == b"TypeInfo", 2);
+    }
+
+    #[test]
+    fun test_type_of_with_type_arg() {
+        let type_info = type_of<Table<String, String>>();
+        assert!(account_address(&type_info) == @aptos_std, 0);
+        assert!(module_name(&type_info) == b"table", 1);
+        assert!(struct_name(&type_info) == b"Table<0x1::string::String, 0x1::string::String>", 2);
+    }
+
+    #[test(fx = @std)]
+    fun test_chain_id(fx: signer) {
+        // We need to enable the feature in order for the native call to be allowed.
+        features::change_feature_flags_for_testing(&fx, vector[features::get_aptos_stdlib_chain_id_feature()], vector[]);
+
+        // The testing environment chain ID is 4u8.
+        assert!(chain_id() == 4u8, 1);
+    }
+
+    #[test]
+    fun test_type_name() {
+
+
+        assert!(type_name<bool>() == string::utf8(b"bool"), 0);
+        assert!(type_name<u8>() == string::utf8(b"u8"), 1);
+        assert!(type_name<u64>() == string::utf8(b"u64"), 2);
+        assert!(type_name<u128>() == string::utf8(b"u128"), 3);
+        assert!(type_name<address>() == string::utf8(b"address"), 4);
+        assert!(type_name<signer>() == string::utf8(b"signer"), 5);
+
+        // vector
+        assert!(type_name<vector<u8>>() == string::utf8(b"vector<u8>"), 6);
+        assert!(type_name<vector<vector<u8>>>() == string::utf8(b"vector<vector<u8>>"), 7);
+        assert!(type_name<vector<vector<TypeInfo>>>() == string::utf8(b"vector<vector<0x1::type_info::TypeInfo>>"), 8);
+
+
+        // struct
+        assert!(type_name<TypeInfo>() == string::utf8(b"0x1::type_info::TypeInfo"), 9);
+        assert!(type_name<
+            Table<
+                TypeInfo,
+                Table<u8, vector<TypeInfo>>
+            >
+        >() == string::utf8(b"0x1::table::Table<0x1::type_info::TypeInfo, 0x1::table::Table<u8, vector<0x1::type_info::TypeInfo>>>"), 10);
+    }
+
+    #[verify_only]
+    fun verify_type_of() {
+        let type_info = type_of<TypeInfo>();
+        let account_address = account_address(&type_info);
+        let module_name = module_name(&type_info);
+        let struct_name = struct_name(&type_info);
+        spec {
+            assert account_address == @aptos_std;
+            assert module_name == b"type_info";
+            assert struct_name == b"TypeInfo";
+        };
+    }
+
+    #[verify_only]
+    fun verify_type_of_generic<T>() {
+        let type_info = type_of<T>();
+        let account_address = account_address(&type_info);
+        let module_name = module_name(&type_info);
+        let struct_name = struct_name(&type_info);
+        spec {
+            assert account_address == type_of<T>().account_address;
+            assert module_name == type_of<T>().module_name;
+            assert struct_name == type_of<T>().struct_name;
+        };
+    }
+    spec verify_type_of_generic {
+        aborts_if !spec_is_struct<T>();
+    }
+
+    #[test_only]
+    struct CustomType has drop {}
+
+    #[test_only]
+    struct SimpleStruct has copy, drop {
+        field: u8
+    }
+
+    #[test_only]
+    struct ComplexStruct<T> has copy, drop {
+        field_1: bool,
+        field_2: u8,
+        field_3: u64,
+        field_4: u128,
+        field_5: SimpleStruct,
+        field_6: T
+    }
+
+    #[test_only]
+    struct TwoBools has drop {
+        bool_1: bool,
+        bool_2: bool
+    }
+
+    #[test_only]
+    use std::option;
+
+    #[test(account = @0x0)]
+    /// Ensure valid returns across native types and nesting schemas.
+    fun test_size_of_val(
+        account: &signer
+    ) {
+        assert!(size_of_val(&false) == 1, 0); // Bool takes 1 byte.
+        assert!(size_of_val<u8>(&0) == 1, 0); // u8 takes 1 byte.
+        assert!(size_of_val<u64>(&0) == 8, 0); // u64 takes 8 bytes.
+        assert!(size_of_val<u128>(&0) == 16, 0); // u128 takes 16 bytes.
+        // Address is a u256.
+        assert!(size_of_val(&@0x0) == 32, 0);
+        assert!(size_of_val(account) == 32, 0); // Signer is an address.
+        // Assert custom type without fields has size 1.
+        assert!(size_of_val(&CustomType{}) == 1, 0);
+        // Declare a simple struct with a 1-byte field.
+        let simple_struct = SimpleStruct{field: 0};
+        // Assert size is indicated as 1 byte.
+        assert!(size_of_val(&simple_struct) == 1, 0);
+        let complex_struct = ComplexStruct<u128>{
+            field_1: false,
+            field_2: 0,
+            field_3: 0,
+            field_4: 0,
+            field_5: simple_struct,
+            field_6: 0
+        }; // Declare a complex struct with another nested inside.
+        // Assert size is bytewise sum of components.
+        assert!(size_of_val(&complex_struct) == (1 + 1 + 8 + 16 + 1 + 16), 0);
+        // Declare a struct with two boolean values.
+        let two_bools = TwoBools{bool_1: false, bool_2: false};
+        // Assert size is two bytes.
+        assert!(size_of_val(&two_bools) == 2, 0);
+        // Declare an empty vector of element type u64.
+        let empty_vector_u64 = vector::empty<u64>();
+        // Declare an empty vector of element type u128.
+        let empty_vector_u128 = vector::empty<u128>();
+        // Assert size is 1 byte regardless of underlying element type.
+        assert!(size_of_val(&empty_vector_u64) == 1, 0);
+        // Assert size is 1 byte regardless of underlying element type.
+        assert!(size_of_val(&empty_vector_u128) == 1, 0);
+        // Declare a bool in a vector.
+        let bool_vector = vector::singleton(false);
+        // Push back another bool.
+        vector::push_back(&mut bool_vector, false);
+        // Assert size is 3 bytes (1 per element, 1 for base vector).
+        assert!(size_of_val(&bool_vector) == 3, 0);
+        // Get a some option, which is implemented as a vector.
+        let u64_option = option::some(0);
+        // Assert size is 9 bytes (8 per element, 1 for base vector).
+        assert!(size_of_val(&u64_option) == 9, 0);
+        option::extract(&mut u64_option); // Remove the value inside.
+        // Assert size reduces to 1 byte.
+        assert!(size_of_val(&u64_option) == 1, 0);
+    }
+
+    #[test]
+    /// Verify returns for base vector size at different lengths, with
+    /// different underlying fixed-size elements.
+    ///
+    /// For a vector of length n containing fixed-size elements, the
+    /// size of the vector is b + n * s bytes, where s is the size of an
+    /// element in bytes, and b is a "base size" in bytes that varies
+    /// with n.
+    ///
+    /// The base size is an artifact of vector BCS encoding, namely,
+    /// with b leading bytes that declare how many elements are in the
+    /// vector. Each such leading byte has a reserved control bit (e.g.
+    /// is this the last leading byte?), such that 7 bits per leading
+    /// byte remain for the actual element count. Hence for a single
+    /// leading byte, the maximum element count that can be described is
+    /// (2 ^ 7) - 1, and for b leading bytes, the maximum element count
+    /// that can be described is (2 ^ 7) ^ b - 1:
+    ///
+    /// * b = 1,                         n < 128
+    /// * b = 2,                  128 <= n < 16384
+    /// * b = 3,                16384 <= n < 2097152
+    /// * ...
+    /// *           (2 ^ 7) ^ (b - 1) <= n < (2 ^ 7) ^ b
+    /// * ...
+    /// * b = 9,    72057594037927936 <= n < 9223372036854775808
+    /// * b = 10, 9223372036854775808 <= n < 18446744073709551616
+    ///
+    /// Note that the upper bound on n for b = 10 is 2 ^ 64, rather than
+    /// (2 ^ 7) ^ 10 - 1, because the former, lower figure is the
+    /// maximum number of elements that can be stored in a vector in the
+    /// first place, e.g. U64_MAX.
+    ///
+    /// In practice b > 2 is unlikely to be encountered.
+    fun test_size_of_val_vectors() {
+        // Declare vector base sizes.
+        let (base_size_1, base_size_2, base_size_3) = (1, 2, 3);
+        // A base size of 1 applies for 127 or less elements.
+        let n_elems_cutoff_1 = 127; // (2 ^ 7) ^ 1 - 1.
+        // A base size of 2 applies for 128 < n <= 16384 elements.
+        let n_elems_cutoff_2 = 16383; // (2 ^ 7) ^ 2 - 1.
+        let vector_u64 = vector::empty<u64>(); // Declare empty vector.
+        let null_element = 0; // Declare a null element.
+        // Get element size.
+        let element_size = size_of_val(&null_element);
+        // Vector size is 1 byte when length is 0.
+        assert!(size_of_val(&vector_u64) == base_size_1, 0);
+        let i = 0; // Declare loop counter.
+        while (i < n_elems_cutoff_1) { // Iterate until first cutoff:
+            // Add an element.
+            vector::push_back(&mut vector_u64, null_element);
+            i = i + 1; // Increment counter.
+        };
+        // Vector base size is still 1 byte.
+        assert!(size_of_val(&vector_u64) - element_size * i == base_size_1, 0);
+        // Add another element, exceeding the cutoff.
+        vector::push_back(&mut vector_u64, null_element);
+        i = i + 1; // Increment counter.
+        // Vector base size is now 2 bytes.
+        assert!(size_of_val(&vector_u64) - element_size * i == base_size_2, 0);
+        while (i < n_elems_cutoff_2) { // Iterate until second cutoff:
+            // Add an element.
+            vector::push_back(&mut vector_u64, null_element);
+            i = i + 1; // Increment counter.
+        };
+        // Vector base size is still 2 bytes.
+        assert!(size_of_val(&vector_u64) - element_size * i == base_size_2, 0);
+        // Add another element, exceeding the cutoff.
+        vector::push_back(&mut vector_u64, null_element);
+        i = i + 1; // Increment counter.
+        // Vector base size is now 3 bytes.
+        assert!(size_of_val(&vector_u64) - element_size * i == base_size_3, 0);
+        // Repeat for custom struct.
+        let vector_complex = vector::empty<ComplexStruct<address>>();
+        // Declare a null element.
+        let null_element = ComplexStruct{
+            field_1: false,
+            field_2: 0,
+            field_3: 0,
+            field_4: 0,
+            field_5: SimpleStruct{field: 0},
+            field_6: @0x0
+        };
+        element_size = size_of_val(&null_element); // Get element size.
+        // Vector size is 1 byte when length is 0.
+        assert!(size_of_val(&vector_complex) == base_size_1, 0);
+        i = 0; // Re-initialize loop counter.
+        while (i < n_elems_cutoff_1) { // Iterate until first cutoff:
+            // Add an element.
+            vector::push_back(&mut vector_complex, copy null_element);
+            i = i + 1; // Increment counter.
+        };
+        assert!( // Vector base size is still 1 byte.
+            size_of_val(&vector_complex) - element_size * i == base_size_1, 0);
+        // Add another element, exceeding the cutoff.
+        vector::push_back(&mut vector_complex, null_element);
+        i = i + 1; // Increment counter.
+        assert!( // Vector base size is now 2 bytes.
+            size_of_val(&vector_complex) - element_size * i == base_size_2, 0);
+        while (i < n_elems_cutoff_2) { // Iterate until second cutoff:
+            // Add an element.
+            vector::push_back(&mut vector_complex, copy null_element);
+            i = i + 1; // Increment counter.
+        };
+        assert!( // Vector base size is still 2 bytes.
+            size_of_val(&vector_complex) - element_size * i == base_size_2, 0);
+        // Add another element, exceeding the cutoff.
+        vector::push_back(&mut vector_complex, null_element);
+        i = i + 1; // Increment counter.
+        assert!( // Vector base size is now 3 bytes.
+            size_of_val(&vector_complex) - element_size * i == base_size_3, 0);
+    }
+
+}

package/src/internal/move/jwks/build/jwk/sources/dependencies/MoveStdlib/acl.move

@@ -0,0 +1,46 @@
+/// Access control list (acl) module. An acl is a list of account addresses who
+/// have the access permission to a certain object.
+/// This module uses a `vector` to represent the list, but can be refactored to
+/// use a "set" instead when it's available in the language in the future.
+
+module std::acl {
+    use std::vector;
+    use std::error;
+
+    /// The ACL already contains the address.
+    const ECONTAIN: u64 = 0;
+    /// The ACL does not contain the address.
+    const ENOT_CONTAIN: u64 = 1;
+
+    struct ACL has store, drop, copy {
+        list: vector<address>
+    }
+
+    /// Return an empty ACL.
+    public fun empty(): ACL {
+        ACL{ list: vector::empty<address>() }
+    }
+
+    /// Add the address to the ACL.
+    public fun add(self: &mut ACL, addr: address) {
+        assert!(!vector::contains(&mut self.list, &addr), error::invalid_argument(ECONTAIN));
+        vector::push_back(&mut self.list, addr);
+    }
+
+    /// Remove the address from the ACL.
+    public fun remove(self: &mut ACL, addr: address) {
+        let (found, index) = vector::index_of(&mut self.list, &addr);
+        assert!(found, error::invalid_argument(ENOT_CONTAIN));
+        vector::remove(&mut self.list, index);
+    }
+
+    /// Return true iff the ACL contains the address.
+    public fun contains(self: &ACL, addr: address): bool {
+        vector::contains(&self.list, &addr)
+    }
+
+    /// assert! that the ACL has the address.
+    public fun assert_contains(self: &ACL, addr: address) {
+        assert!(contains(self, addr), error::invalid_argument(ENOT_CONTAIN));
+    }
+}

package/src/internal/move/jwks/build/jwk/sources/dependencies/MoveStdlib/bcs.move

@@ -0,0 +1,27 @@
+/// Utility for converting a Move value to its binary representation in BCS (Binary Canonical
+/// Serialization). BCS is the binary encoding for Move resources and other non-module values
+/// published on-chain. See https://github.com/aptos-labs/bcs#binary-canonical-serialization-bcs for more
+/// details on BCS.
+module std::bcs {
+    /// Returns the binary representation of `v` in BCS (Binary Canonical Serialization) format.
+    /// Aborts with `0x1c5` error code if serialization fails.
+    native public fun to_bytes<MoveValue>(v: &MoveValue): vector<u8>;
+
+    /// Returns the size of the binary representation of `v` in BCS (Binary Canonical Serialization) format.
+    /// Aborts with `0x1c5` error code if there is a failure when calculating serialized size.
+    native public fun serialized_size<MoveValue>(v: &MoveValue): u64;
+
+    // ==============================
+    // Module Specification
+    spec module {} // switch to module documentation context
+
+    spec module {
+        /// Native function which is defined in the prover's prelude.
+        native fun serialize<MoveValue>(v: &MoveValue): vector<u8>;
+    }
+
+    spec serialized_size<MoveValue>(v: &MoveValue): u64 {
+        pragma opaque;
+        ensures result == len(serialize(v));
+    }
+}

package/src/internal/move/jwks/build/jwk/sources/dependencies/MoveStdlib/bit_vector.move

@@ -0,0 +1,239 @@
+module std::bit_vector {
+    use std::vector;
+
+    /// The provided index is out of bounds
+    const EINDEX: u64 = 0x20000;
+    /// An invalid length of bitvector was given
+    const ELENGTH: u64 = 0x20001;
+
+    const WORD_SIZE: u64 = 1;
+    /// The maximum allowed bitvector size
+    const MAX_SIZE: u64 = 1024;
+
+    spec BitVector {
+        invariant length == len(bit_field);
+    }
+
+    struct BitVector has copy, drop, store {
+        length: u64,
+        bit_field: vector<bool>,
+    }
+
+    public fun new(length: u64): BitVector {
+        assert!(length > 0, ELENGTH);
+        assert!(length < MAX_SIZE, ELENGTH);
+        let counter = 0;
+        let bit_field = vector::empty();
+        while ({spec {
+            invariant counter <= length;
+            invariant len(bit_field) == counter;
+        };
+            (counter < length)}) {
+            vector::push_back(&mut bit_field, false);
+            counter = counter + 1;
+        };
+        spec {
+            assert counter == length;
+            assert len(bit_field) == length;
+        };
+
+        BitVector {
+            length,
+            bit_field,
+        }
+    }
+    spec new {
+        include NewAbortsIf;
+        ensures result.length == length;
+        ensures len(result.bit_field) == length;
+    }
+    spec schema NewAbortsIf {
+        length: u64;
+        aborts_if length <= 0 with ELENGTH;
+        aborts_if length >= MAX_SIZE with ELENGTH;
+    }
+
+    /// Set the bit at `bit_index` in the `self` regardless of its previous state.
+    public fun set(self: &mut BitVector, bit_index: u64) {
+        assert!(bit_index < vector::length(&self.bit_field), EINDEX);
+        let x = vector::borrow_mut(&mut self.bit_field, bit_index);
+        *x = true;
+    }
+    spec set {
+        include SetAbortsIf;
+        ensures self.bit_field[bit_index];
+    }
+    spec schema SetAbortsIf {
+        self: BitVector;
+        bit_index: u64;
+        aborts_if bit_index >= length(self) with EINDEX;
+    }
+
+    /// Unset the bit at `bit_index` in the `self` regardless of its previous state.
+    public fun unset(self: &mut BitVector, bit_index: u64) {
+        assert!(bit_index < vector::length(&self.bit_field), EINDEX);
+        let x = vector::borrow_mut(&mut self.bit_field, bit_index);
+        *x = false;
+    }
+    spec unset {
+        include UnsetAbortsIf;
+        ensures !self.bit_field[bit_index];
+    }
+    spec schema UnsetAbortsIf {
+        self: BitVector;
+        bit_index: u64;
+        aborts_if bit_index >= length(self) with EINDEX;
+    }
+
+    /// Shift the `self` left by `amount`. If `amount` is greater than the
+    /// bitvector's length the bitvector will be zeroed out.
+    public fun shift_left(self: &mut BitVector, amount: u64) {
+        if (amount >= self.length) {
+            vector::for_each_mut(&mut self.bit_field, |elem| {
+                *elem = false;
+            });
+        } else {
+            let i = amount;
+
+            while (i < self.length) {
+                if (is_index_set(self, i)) set(self, i - amount)
+                else unset(self, i - amount);
+                i = i + 1;
+            };
+
+            i = self.length - amount;
+
+            while (i < self.length) {
+                unset(self, i);
+                i = i + 1;
+            };
+        }
+    }
+    spec shift_left {
+        // TODO: set to false because data invariant cannot be proved with inline function. Will remove it once inline is supported
+        pragma verify = false;
+    }
+
+    /// Return the value of the bit at `bit_index` in the `self`. `true`
+    /// represents "1" and `false` represents a 0
+    public fun is_index_set(self: &BitVector, bit_index: u64): bool {
+        assert!(bit_index < vector::length(&self.bit_field), EINDEX);
+        *vector::borrow(&self.bit_field, bit_index)
+    }
+    spec is_index_set {
+        include IsIndexSetAbortsIf;
+        ensures result == self.bit_field[bit_index];
+    }
+    spec schema IsIndexSetAbortsIf {
+        self: BitVector;
+        bit_index: u64;
+        aborts_if bit_index >= length(self) with EINDEX;
+    }
+    spec fun spec_is_index_set(self: BitVector, bit_index: u64): bool {
+        if (bit_index >= length(self)) {
+            false
+        } else {
+            self.bit_field[bit_index]
+        }
+    }
+
+    /// Return the length (number of usable bits) of this bitvector
+    public fun length(self: &BitVector): u64 {
+        vector::length(&self.bit_field)
+    }
+
+    /// Returns the length of the longest sequence of set bits starting at (and
+    /// including) `start_index` in the `bitvector`. If there is no such
+    /// sequence, then `0` is returned.
+    public fun longest_set_sequence_starting_at(self: &BitVector, start_index: u64): u64 {
+        assert!(start_index < self.length, EINDEX);
+        let index = start_index;
+
+        // Find the greatest index in the vector such that all indices less than it are set.
+        while ({
+            spec {
+                invariant index >= start_index;
+                invariant index == start_index || is_index_set(self, index - 1);
+                invariant index == start_index || index - 1 < vector::length(self.bit_field);
+                invariant forall j in start_index..index: is_index_set(self, j);
+                invariant forall j in start_index..index: j < vector::length(self.bit_field);
+            };
+            index < self.length
+        }) {
+            if (!is_index_set(self, index)) break;
+            index = index + 1;
+        };
+
+        index - start_index
+    }
+
+    spec longest_set_sequence_starting_at(self: &BitVector, start_index: u64): u64 {
+        aborts_if start_index >= self.length;
+        ensures forall i in start_index..result: is_index_set(self, i);
+    }
+
+    #[test_only]
+    public fun word_size(): u64 {
+        WORD_SIZE
+    }
+
+    #[verify_only]
+    public fun shift_left_for_verification_only(self: &mut BitVector, amount: u64) {
+        if (amount >= self.length) {
+            let len = vector::length(&self.bit_field);
+            let i = 0;
+            while ({
+                spec {
+                    invariant len == self.length;
+                    invariant forall k in 0..i: !self.bit_field[k];
+                    invariant forall k in i..self.length: self.bit_field[k] == old(self).bit_field[k];
+                };
+                i < len
+            }) {
+                let elem = vector::borrow_mut(&mut self.bit_field, i);
+                *elem = false;
+                i = i + 1;
+            };
+        } else {
+            let i = amount;
+
+            while ({
+                spec {
+                    invariant i >= amount;
+                    invariant self.length == old(self).length;
+                    invariant forall j in amount..i: old(self).bit_field[j] == self.bit_field[j - amount];
+                    invariant forall j in (i-amount)..self.length : old(self).bit_field[j] == self.bit_field[j];
+                    invariant forall k in 0..i-amount: self.bit_field[k] == old(self).bit_field[k + amount];
+                };
+                i < self.length
+            }) {
+                if (is_index_set(self, i)) set(self, i - amount)
+                else unset(self, i - amount);
+                i = i + 1;
+            };
+
+
+            i = self.length - amount;
+
+            while ({
+                spec {
+                    invariant forall j in self.length - amount..i: !self.bit_field[j];
+                    invariant forall k in 0..self.length - amount: self.bit_field[k] == old(self).bit_field[k + amount];
+                    invariant i >= self.length - amount;
+                };
+                i < self.length
+            }) {
+                unset(self, i);
+                i = i + 1;
+            }
+        }
+    }
+    spec shift_left_for_verification_only {
+        aborts_if false;
+        ensures amount >= self.length ==> (forall k in 0..self.length: !self.bit_field[k]);
+        ensures amount < self.length ==>
+            (forall i in self.length - amount..self.length: !self.bit_field[i]);
+        ensures amount < self.length ==>
+            (forall i in 0..self.length - amount: self.bit_field[i] == old(self).bit_field[i + amount]);
+    }
+}