create-dubhe 0.0.8 → 0.0.10

package/template/101/movement-template/contracts/counter/build/counter/sources/dependencies/MoveStdlib/fixed_point32.move

@@ -0,0 +1,295 @@
+/// Defines a fixed-point numeric type with a 32-bit integer part and
+/// a 32-bit fractional part.
+
+module std::fixed_point32 {
+
+    /// Define a fixed-point numeric type with 32 fractional bits.
+    /// This is just a u64 integer but it is wrapped in a struct to
+    /// make a unique type. This is a binary representation, so decimal
+    /// values may not be exactly representable, but it provides more
+    /// than 9 decimal digits of precision both before and after the
+    /// decimal point (18 digits total). For comparison, double precision
+    /// floating-point has less than 16 decimal digits of precision, so
+    /// be careful about using floating-point to convert these values to
+    /// decimal.
+    struct FixedPoint32 has copy, drop, store { value: u64 }
+
+    const MAX_U64: u128 = 18446744073709551615;
+
+    /// The denominator provided was zero
+    const EDENOMINATOR: u64 = 0x10001;
+    /// The quotient value would be too large to be held in a `u64`
+    const EDIVISION: u64 = 0x20002;
+    /// The multiplied value would be too large to be held in a `u64`
+    const EMULTIPLICATION: u64 = 0x20003;
+    /// A division by zero was encountered
+    const EDIVISION_BY_ZERO: u64 = 0x10004;
+    /// The computed ratio when converting to a `FixedPoint32` would be unrepresentable
+    const ERATIO_OUT_OF_RANGE: u64 = 0x20005;
+
+    /// Multiply a u64 integer by a fixed-point number, truncating any
+    /// fractional part of the product. This will abort if the product
+    /// overflows.
+    public fun multiply_u64(val: u64, multiplier: FixedPoint32): u64 {
+        // The product of two 64 bit values has 128 bits, so perform the
+        // multiplication with u128 types and keep the full 128 bit product
+        // to avoid losing accuracy.
+        let unscaled_product = (val as u128) * (multiplier.value as u128);
+        // The unscaled product has 32 fractional bits (from the multiplier)
+        // so rescale it by shifting away the low bits.
+        let product = unscaled_product >> 32;
+        // Check whether the value is too large.
+        assert!(product <= MAX_U64, EMULTIPLICATION);
+        (product as u64)
+    }
+    spec multiply_u64 {
+        pragma opaque;
+        include MultiplyAbortsIf;
+        ensures result == spec_multiply_u64(val, multiplier);
+    }
+    spec schema MultiplyAbortsIf {
+        val: num;
+        multiplier: FixedPoint32;
+        aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;
+    }
+    spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {
+        (val * multiplier.value) >> 32
+    }
+
+    /// Divide a u64 integer by a fixed-point number, truncating any
+    /// fractional part of the quotient. This will abort if the divisor
+    /// is zero or if the quotient overflows.
+    public fun divide_u64(val: u64, divisor: FixedPoint32): u64 {
+        // Check for division by zero.
+        assert!(divisor.value != 0, EDIVISION_BY_ZERO);
+        // First convert to 128 bits and then shift left to
+        // add 32 fractional zero bits to the dividend.
+        let scaled_value = (val as u128) << 32;
+        let quotient = scaled_value / (divisor.value as u128);
+        // Check whether the value is too large.
+        assert!(quotient <= MAX_U64, EDIVISION);
+        // the value may be too large, which will cause the cast to fail
+        // with an arithmetic error.
+        (quotient as u64)
+    }
+    spec divide_u64 {
+        pragma opaque;
+        include DivideAbortsIf;
+        ensures result == spec_divide_u64(val, divisor);
+    }
+    spec schema DivideAbortsIf {
+        val: num;
+        divisor: FixedPoint32;
+        aborts_if divisor.value == 0 with EDIVISION_BY_ZERO;
+        aborts_if spec_divide_u64(val, divisor) > MAX_U64 with EDIVISION;
+    }
+    spec fun spec_divide_u64(val: num, divisor: FixedPoint32): num {
+        (val << 32) / divisor.value
+    }
+
+    /// Create a fixed-point value from a rational number specified by its
+    /// numerator and denominator. Calling this function should be preferred
+    /// for using `Self::create_from_raw_value` which is also available.
+    /// This will abort if the denominator is zero. It will also
+    /// abort if the numerator is nonzero and the ratio is not in the range
+    /// 2^-32 .. 2^32-1. When specifying decimal fractions, be careful about
+    /// rounding errors: if you round to display N digits after the decimal
+    /// point, you can use a denominator of 10^N to avoid numbers where the
+    /// very small imprecision in the binary representation could change the
+    /// rounding, e.g., 0.0125 will round down to 0.012 instead of up to 0.013.
+    public fun create_from_rational(numerator: u64, denominator: u64): FixedPoint32 {
+        // If the denominator is zero, this will abort.
+        // Scale the numerator to have 64 fractional bits and the denominator
+        // to have 32 fractional bits, so that the quotient will have 32
+        // fractional bits.
+        let scaled_numerator = (numerator as u128) << 64;
+        let scaled_denominator = (denominator as u128) << 32;
+        assert!(scaled_denominator != 0, EDENOMINATOR);
+        let quotient = scaled_numerator / scaled_denominator;
+        assert!(quotient != 0 || numerator == 0, ERATIO_OUT_OF_RANGE);
+        // Return the quotient as a fixed-point number. We first need to check whether the cast
+        // can succeed.
+        assert!(quotient <= MAX_U64, ERATIO_OUT_OF_RANGE);
+        FixedPoint32 { value: (quotient as u64) }
+    }
+    spec create_from_rational {
+        pragma opaque;
+        include CreateFromRationalAbortsIf;
+        ensures result == spec_create_from_rational(numerator, denominator);
+    }
+    spec schema CreateFromRationalAbortsIf {
+        numerator: u64;
+        denominator: u64;
+        let scaled_numerator = (numerator as u128)<< 64;
+        let scaled_denominator = (denominator as u128) << 32;
+        let quotient = scaled_numerator / scaled_denominator;
+        aborts_if scaled_denominator == 0 with EDENOMINATOR;
+        aborts_if quotient == 0 && scaled_numerator != 0 with ERATIO_OUT_OF_RANGE;
+        aborts_if quotient > MAX_U64 with ERATIO_OUT_OF_RANGE;
+    }
+    spec fun spec_create_from_rational(numerator: num, denominator: num): FixedPoint32 {
+        FixedPoint32{value: (numerator << 64) / (denominator << 32)}
+    }
+
+    /// Create a fixedpoint value from a raw value.
+    public fun create_from_raw_value(value: u64): FixedPoint32 {
+        FixedPoint32 { value }
+    }
+    spec create_from_raw_value {
+        pragma opaque;
+        aborts_if false;
+        ensures result.value == value;
+    }
+
+    /// Accessor for the raw u64 value. Other less common operations, such as
+    /// adding or subtracting FixedPoint32 values, can be done using the raw
+    /// values directly.
+    public fun get_raw_value(self: FixedPoint32): u64 {
+        self.value
+    }
+
+    /// Returns true if the ratio is zero.
+    public fun is_zero(self: FixedPoint32): bool {
+        self.value == 0
+    }
+
+    /// Returns the smaller of the two FixedPoint32 numbers.
+    public fun min(num1: FixedPoint32, num2: FixedPoint32): FixedPoint32 {
+        if (num1.value < num2.value) {
+            num1
+        } else {
+            num2
+        }
+    }
+    spec min {
+        pragma opaque;
+        aborts_if false;
+        ensures result == spec_min(num1, num2);
+    }
+    spec fun spec_min(num1: FixedPoint32, num2: FixedPoint32): FixedPoint32 {
+        if (num1.value < num2.value) {
+            num1
+        } else {
+            num2
+        }
+    }
+
+    /// Returns the larger of the two FixedPoint32 numbers.
+    public fun max(num1: FixedPoint32, num2: FixedPoint32): FixedPoint32 {
+        if (num1.value > num2.value) {
+            num1
+        } else {
+            num2
+        }
+    }
+    spec max {
+        pragma opaque;
+        aborts_if false;
+        ensures result == spec_max(num1, num2);
+    }
+    spec fun spec_max(num1: FixedPoint32, num2: FixedPoint32): FixedPoint32 {
+        if (num1.value > num2.value) {
+            num1
+        } else {
+            num2
+        }
+    }
+
+    /// Create a fixedpoint value from a u64 value.
+    public fun create_from_u64(val: u64): FixedPoint32 {
+        let value = (val as u128) << 32;
+        assert!(value <= MAX_U64, ERATIO_OUT_OF_RANGE);
+        FixedPoint32 {value: (value as u64)}
+    }
+    spec create_from_u64 {
+        pragma opaque;
+        include CreateFromU64AbortsIf;
+        ensures result == spec_create_from_u64(val);
+    }
+    spec schema CreateFromU64AbortsIf {
+        val: num;
+        let scaled_value = (val as u128) << 32;
+        aborts_if scaled_value > MAX_U64;
+    }
+    spec fun spec_create_from_u64(val: num): FixedPoint32 {
+        FixedPoint32 {value: val << 32}
+    }
+
+    /// Returns the largest integer less than or equal to a given number.
+    public fun floor(self: FixedPoint32): u64 {
+        self.value >> 32
+    }
+    spec floor {
+        pragma opaque;
+        aborts_if false;
+        ensures result == spec_floor(self);
+    }
+    spec fun spec_floor(self: FixedPoint32): u64 {
+        let fractional = self.value % (1 << 32);
+        if (fractional == 0) {
+            self.value >> 32
+        } else {
+            (self.value - fractional) >> 32
+        }
+    }
+
+    /// Rounds up the given FixedPoint32 to the next largest integer.
+    public fun ceil(self: FixedPoint32): u64 {
+        let floored_num = floor(self) << 32;
+        if (self.value == floored_num) {
+            return floored_num >> 32
+        };
+        let val = ((floored_num as u128) + (1 << 32));
+        (val >> 32 as u64)
+    }
+    spec ceil {
+        pragma verify_duration_estimate = 120;
+        pragma opaque;
+        aborts_if false;
+        ensures result == spec_ceil(self);
+    }
+    spec fun spec_ceil(self: FixedPoint32): u64 {
+        let fractional = self.value % (1 << 32);
+        let one = 1 << 32;
+        if (fractional == 0) {
+            self.value >> 32
+        } else {
+            (self.value - fractional + one) >> 32
+        }
+    }
+
+    /// Returns the value of a FixedPoint32 to the nearest integer.
+    public fun round(self: FixedPoint32): u64 {
+        let floored_num = floor(self) << 32;
+        let boundary = floored_num + ((1 << 32) / 2);
+        if (self.value < boundary) {
+            floored_num >> 32
+        } else {
+            ceil(self)
+        }
+    }
+    spec round {
+        pragma verify_duration_estimate = 120;
+        pragma opaque;
+        aborts_if false;
+        ensures result == spec_round(self);
+    }
+    spec fun spec_round(self: FixedPoint32): u64 {
+        let fractional = self.value % (1 << 32);
+        let boundary = (1 << 32) / 2;
+        let one = 1 << 32;
+        if (fractional < boundary) {
+            (self.value - fractional) >> 32
+        } else {
+            (self.value - fractional + one) >> 32
+        }
+    }
+
+    // **************** SPECIFICATIONS ****************
+
+    spec module {} // switch documentation context to module level
+
+    spec module {
+        pragma aborts_if_is_strict;
+    }
+}

package/template/101/movement-template/contracts/counter/build/counter/sources/dependencies/MoveStdlib/hash.move

@@ -0,0 +1,8 @@
+/// Module which defines SHA hashes for byte vectors.
+///
+/// The functions in this module are natively declared both in the Move runtime
+/// as in the Move prover's prelude.
+module std::hash {
+    native public fun sha2_256(data: vector<u8>): vector<u8>;
+    native public fun sha3_256(data: vector<u8>): vector<u8>;
+}

package/template/101/movement-template/contracts/counter/build/counter/sources/dependencies/MoveStdlib/mem.move

@@ -0,0 +1,34 @@
+/// Module with methods for safe memory manipulation.
+module std::mem {
+    // TODO - functions here are `public(friend)` here for one release,
+    // and to be changed to `public` one release later.
+    #[test_only]
+    friend std::mem_tests;
+
+    /// Swap contents of two passed mutable references.
+    ///
+    /// Move prevents from having two mutable references to the same value,
+    /// so `left` and `right` references are always distinct.
+    public(friend) native fun swap<T>(left: &mut T, right: &mut T);
+
+    /// Replace the value reference points to with the given new value,
+    /// and return the value it had before.
+    public(friend) fun replace<T>(ref: &mut T, new: T): T {
+        swap(ref, &mut new);
+        new
+    }
+
+   spec swap<T>(left: &mut T, right: &mut T) {
+        pragma opaque;
+        aborts_if false;
+        ensures right == old(left);
+        ensures left == old(right);
+    }
+
+    spec replace<T>(ref: &mut T, new: T): T {
+        pragma opaque;
+        aborts_if false;
+        ensures result == old(ref);
+        ensures ref == new;
+    }
+}

package/template/101/movement-template/contracts/counter/build/counter/sources/dependencies/MoveStdlib/option.move

@@ -0,0 +1,356 @@
+/// This module defines the Option type and its methods to represent and handle an optional value.
+module std::option {
+    use std::vector;
+
+    /// Abstraction of a value that may or may not be present. Implemented with a vector of size
+    /// zero or one because Move bytecode does not have ADTs.
+    struct Option<Element> has copy, drop, store {
+        vec: vector<Element>
+    }
+    spec Option {
+        /// The size of vector is always less than equal to 1
+        /// because it's 0 for "none" or 1 for "some".
+        invariant len(vec) <= 1;
+    }
+
+    /// The `Option` is in an invalid state for the operation attempted.
+    /// The `Option` is `Some` while it should be `None`.
+    const EOPTION_IS_SET: u64 = 0x40000;
+    /// The `Option` is in an invalid state for the operation attempted.
+    /// The `Option` is `None` while it should be `Some`.
+    const EOPTION_NOT_SET: u64 = 0x40001;
+    /// Cannot construct an option from a vector with 2 or more elements.
+    const EOPTION_VEC_TOO_LONG: u64 = 0x40002;
+
+    /// Return an empty `Option`
+    public fun none<Element>(): Option<Element> {
+        Option { vec: vector::empty() }
+    }
+    spec none {
+        pragma opaque;
+        aborts_if false;
+        ensures result == spec_none<Element>();
+    }
+    spec fun spec_none<Element>(): Option<Element> {
+        Option{ vec: vec() }
+    }
+
+    /// Return an `Option` containing `e`
+    public fun some<Element>(e: Element): Option<Element> {
+        Option { vec: vector::singleton(e) }
+    }
+    spec some {
+        pragma opaque;
+        aborts_if false;
+        ensures result == spec_some(e);
+    }
+    spec fun spec_some<Element>(e: Element): Option<Element> {
+        Option{ vec: vec(e) }
+    }
+
+    public fun from_vec<Element>(vec: vector<Element>): Option<Element> {
+        assert!(vector::length(&vec) <= 1, EOPTION_VEC_TOO_LONG);
+        Option { vec }
+    }
+
+    spec from_vec {
+        aborts_if vector::length(vec) > 1;
+    }
+
+    /// Return true if `self` does not hold a value
+    public fun is_none<Element>(self: &Option<Element>): bool {
+        vector::is_empty(&self.vec)
+    }
+    spec is_none {
+        pragma opaque;
+        aborts_if false;
+        ensures result == spec_is_none(self);
+    }
+    spec fun spec_is_none<Element>(self: Option<Element>): bool {
+        vector::is_empty(self.vec)
+    }
+
+    /// Return true if `self` holds a value
+    public fun is_some<Element>(self: &Option<Element>): bool {
+        !vector::is_empty(&self.vec)
+    }
+    spec is_some {
+        pragma opaque;
+        aborts_if false;
+        ensures result == spec_is_some(self);
+    }
+    spec fun spec_is_some<Element>(self: Option<Element>): bool {
+        !vector::is_empty(self.vec)
+    }
+
+    /// Return true if the value in `self` is equal to `e_ref`
+    /// Always returns `false` if `self` does not hold a value
+    public fun contains<Element>(self: &Option<Element>, e_ref: &Element): bool {
+        vector::contains(&self.vec, e_ref)
+    }
+    spec contains {
+        pragma opaque;
+        aborts_if false;
+        ensures result == spec_contains(self, e_ref);
+    }
+    spec fun spec_contains<Element>(self: Option<Element>, e: Element): bool {
+        is_some(self) && borrow(self) == e
+    }
+
+    /// Return an immutable reference to the value inside `self`
+    /// Aborts if `self` does not hold a value
+    public fun borrow<Element>(self: &Option<Element>): &Element {
+        assert!(is_some(self), EOPTION_NOT_SET);
+        vector::borrow(&self.vec, 0)
+    }
+    spec borrow {
+        pragma opaque;
+        include AbortsIfNone<Element>;
+        ensures result == spec_borrow(self);
+    }
+    spec fun spec_borrow<Element>(self: Option<Element>): Element {
+        self.vec[0]
+    }
+
+    /// Return a reference to the value inside `self` if it holds one
+    /// Return `default_ref` if `self` does not hold a value
+    public fun borrow_with_default<Element>(self: &Option<Element>, default_ref: &Element): &Element {
+        let vec_ref = &self.vec;
+        if (vector::is_empty(vec_ref)) default_ref
+        else vector::borrow(vec_ref, 0)
+    }
+    spec borrow_with_default {
+        pragma opaque;
+        aborts_if false;
+        ensures result == (if (spec_is_some(self)) spec_borrow(self) else default_ref);
+    }
+
+    /// Return the value inside `self` if it holds one
+    /// Return `default` if `self` does not hold a value
+    public fun get_with_default<Element: copy + drop>(
+        self: &Option<Element>,
+        default: Element,
+    ): Element {
+        let vec_ref = &self.vec;
+        if (vector::is_empty(vec_ref)) default
+        else *vector::borrow(vec_ref, 0)
+    }
+    spec get_with_default {
+        pragma opaque;
+        aborts_if false;
+        ensures result == (if (spec_is_some(self)) spec_borrow(self) else default);
+    }
+
+    /// Convert the none option `self` to a some option by adding `e`.
+    /// Aborts if `self` already holds a value
+    public fun fill<Element>(self: &mut Option<Element>, e: Element) {
+        let vec_ref = &mut self.vec;
+        if (vector::is_empty(vec_ref)) vector::push_back(vec_ref, e)
+        else abort EOPTION_IS_SET
+    }
+    spec fill {
+        pragma opaque;
+        aborts_if spec_is_some(self) with EOPTION_IS_SET;
+        ensures spec_is_some(self);
+        ensures spec_borrow(self) == e;
+    }
+
+    /// Convert a `some` option to a `none` by removing and returning the value stored inside `self`
+    /// Aborts if `self` does not hold a value
+    public fun extract<Element>(self: &mut Option<Element>): Element {
+        assert!(is_some(self), EOPTION_NOT_SET);
+        vector::pop_back(&mut self.vec)
+    }
+    spec extract {
+        pragma opaque;
+        include AbortsIfNone<Element>;
+        ensures result == spec_borrow(old(self));
+        ensures spec_is_none(self);
+    }
+
+    /// Return a mutable reference to the value inside `self`
+    /// Aborts if `self` does not hold a value
+    public fun borrow_mut<Element>(self: &mut Option<Element>): &mut Element {
+        assert!(is_some(self), EOPTION_NOT_SET);
+        vector::borrow_mut(&mut self.vec, 0)
+    }
+    spec borrow_mut {
+        include AbortsIfNone<Element>;
+        ensures result == spec_borrow(self);
+        ensures self == old(self);
+    }
+
+    /// Swap the old value inside `self` with `e` and return the old value
+    /// Aborts if `self` does not hold a value
+    public fun swap<Element>(self: &mut Option<Element>, e: Element): Element {
+        assert!(is_some(self), EOPTION_NOT_SET);
+        let vec_ref = &mut self.vec;
+        let old_value = vector::pop_back(vec_ref);
+        vector::push_back(vec_ref, e);
+        old_value
+    }
+    spec swap {
+        pragma opaque;
+        include AbortsIfNone<Element>;
+        ensures result == spec_borrow(old(self));
+        ensures spec_is_some(self);
+        ensures spec_borrow(self) == e;
+    }
+
+    /// Swap the old value inside `self` with `e` and return the old value;
+    /// or if there is no old value, fill it with `e`.
+    /// Different from swap(), swap_or_fill() allows for `self` not holding a value.
+    public fun swap_or_fill<Element>(self: &mut Option<Element>, e: Element): Option<Element> {
+        let vec_ref = &mut self.vec;
+        let old_value = if (vector::is_empty(vec_ref)) none()
+            else some(vector::pop_back(vec_ref));
+        vector::push_back(vec_ref, e);
+        old_value
+    }
+    spec swap_or_fill {
+        pragma opaque;
+        aborts_if false;
+        ensures result == old(self);
+        ensures spec_borrow(self) == e;
+    }
+
+    /// Destroys `self.` If `self` holds a value, return it. Returns `default` otherwise
+    public fun destroy_with_default<Element: drop>(self: Option<Element>, default: Element): Element {
+        let Option { vec } = self;
+        if (vector::is_empty(&mut vec)) default
+        else vector::pop_back(&mut vec)
+    }
+    spec destroy_with_default {
+        pragma opaque;
+        aborts_if false;
+        ensures result == (if (spec_is_some(self)) spec_borrow(self) else default);
+    }
+
+    /// Unpack `self` and return its contents
+    /// Aborts if `self` does not hold a value
+    public fun destroy_some<Element>(self: Option<Element>): Element {
+        assert!(is_some(&self), EOPTION_NOT_SET);
+        let Option { vec } = self;
+        let elem = vector::pop_back(&mut vec);
+        vector::destroy_empty(vec);
+        elem
+    }
+    spec destroy_some {
+        pragma opaque;
+        include AbortsIfNone<Element>;
+        ensures result == spec_borrow(self);
+    }
+
+    /// Unpack `self`
+    /// Aborts if `self` holds a value
+    public fun destroy_none<Element>(self: Option<Element>) {
+        assert!(is_none(&self), EOPTION_IS_SET);
+        let Option { vec } = self;
+        vector::destroy_empty(vec)
+    }
+    spec destroy_none {
+        pragma opaque;
+        aborts_if spec_is_some(self) with EOPTION_IS_SET;
+    }
+
+    /// Convert `self` into a vector of length 1 if it is `Some`,
+    /// and an empty vector otherwise
+    public fun to_vec<Element>(self: Option<Element>): vector<Element> {
+        let Option { vec } = self;
+        vec
+    }
+    spec to_vec {
+        pragma opaque;
+        aborts_if false;
+        ensures result == self.vec;
+    }
+    /// Apply the function to the optional element, consuming it. Does nothing if no value present.
+    public inline fun for_each<Element>(self: Option<Element>, f: |Element|) {
+        if (is_some(&self)) {
+            f(destroy_some(self))
+        } else {
+            destroy_none(self)
+        }
+    }
+
+    /// Apply the function to the optional element reference. Does nothing if no value present.
+    public inline fun for_each_ref<Element>(self: &Option<Element>, f: |&Element|) {
+        if (is_some(self)) {
+            f(borrow(self))
+        }
+    }
+
+    /// Apply the function to the optional element reference. Does nothing if no value present.
+    public inline fun for_each_mut<Element>(self: &mut Option<Element>, f: |&mut Element|) {
+        if (is_some(self)) {
+            f(borrow_mut(self))
+        }
+    }
+
+    /// Folds the function over the optional element.
+    public inline fun fold<Accumulator, Element>(
+        self: Option<Element>,
+        init: Accumulator,
+        f: |Accumulator,Element|Accumulator
+    ): Accumulator {
+        if (is_some(&self)) {
+            f(init, destroy_some(self))
+        } else {
+            destroy_none(self);
+            init
+        }
+    }
+
+    /// Maps the content of an option.
+    public inline fun map<Element, OtherElement>(self: Option<Element>, f: |Element|OtherElement): Option<OtherElement> {
+        if (is_some(&self)) {
+            some(f(destroy_some(self)))
+        } else {
+            destroy_none(self);
+            none()
+        }
+    }
+
+    /// Maps the content of an option without destroying the original option.
+    public inline fun map_ref<Element, OtherElement>(
+        self: &Option<Element>, f: |&Element|OtherElement): Option<OtherElement> {
+        if (is_some(self)) {
+            some(f(borrow(self)))
+        } else {
+            none()
+        }
+    }
+
+    /// Filters the content of an option
+    public inline fun filter<Element:drop>(self: Option<Element>, f: |&Element|bool): Option<Element> {
+        if (is_some(&self) && f(borrow(&self))) {
+            self
+        } else {
+            none()
+        }
+    }
+
+    /// Returns true if the option contains an element which satisfies predicate.
+    public inline fun any<Element>(self: &Option<Element>, p: |&Element|bool): bool {
+        is_some(self) && p(borrow(self))
+    }
+
+    /// Utility function to destroy an option that is not droppable.
+    public inline fun destroy<Element>(self: Option<Element>, d: |Element|) {
+        let vec = to_vec(self);
+        vector::destroy(vec, |e| d(e));
+    }
+
+    spec module {} // switch documentation context back to module level
+
+    spec module {
+        pragma aborts_if_is_strict;
+    }
+
+    /// # Helper Schema
+
+    spec schema AbortsIfNone<Element> {
+        self: Option<Element>;
+        aborts_if spec_is_none(self) with EOPTION_NOT_SET;
+    }
+}