lawspec 0.8.0 → 0.9.0

package/examples/specs/finite_data.lawspec

@@ -0,0 +1,37 @@
+unit example.finite_data
+
+type Choice is Yes | No end
+
+type Pair (a :: Type) (b :: Type) is
+  Pair first :: a second :: b
+end
+
+law `sum constructors remain distinct` is
+  definition is
+    `for all` (choice :: Choice) .
+      (match choice with
+        | Yes -> Yes
+        | No -> No
+      end) = choice
+  end
+  example `yes` is choice = Yes expect choice = Yes end
+end
+
+law `products preserve both fields` is
+  definition is
+    `for all` (pair :: Pair Bool Bool) .
+      (match pair with
+        | Pair first second -> Pair first second
+      end) = pair
+  end
+  example `different fields` is
+    pair = Pair true false
+    expect pair = Pair true false
+  end
+end
+
+law `nested optional products keep presence states` is
+  definition is
+    `for all` (value :: Maybe (Pair Choice (Nullable Bool))) . value = value
+  end
+end

package/examples/specs/list_contracts.lawspec

@@ -0,0 +1,136 @@
+unit example.list_contracts
+
+definition keep (xs :: List (value :: Int8 where value > 0))
+  :: List (value :: Int8 where value > 0)
+is xs end
+
+definition stronger (xs :: List (value :: Int8 where value > 10)) :: List Int8 is
+  keep (copypositive xs)
+end
+
+definition positive (value :: a) :: Bool requires Integer a is value > 0 end
+
+definition keephelper (xs :: List (value :: a where positive value))
+  :: List a requires Integer a
+is xs end
+
+definition reuse (xs :: List (value :: Int8 where positive value)) :: List Int8 is
+  keephelper xs
+end
+
+definition empty (value :: Int8) :: List (element :: Int8 where false) is [] end
+
+definition singleton (value :: Int8 where value > 0)
+  :: List (element :: Int8 where element > 0)
+is [value] end
+
+
+law `stronger domains satisfy the callee` is
+  definition is `for all` (xs :: List (value :: Int8 where value > 10)) .
+    stronger xs = xs
+  end
+  example `positive input` is xs = [11, 127] expect stronger xs = [11, 127] end
+end
+
+law `generic predicates keep their scope` is
+  definition is `for all` (xs :: List (value :: Int8 where value > 0)) .
+    reuse xs = xs
+  end
+  example `empty` is xs = [] expect reuse xs = [] end
+  example `nonempty` is xs = [1, 2] expect reuse xs = [1, 2] end
+end
+
+law `empty output satisfies an impossible element domain` is
+  definition is `for all` (value :: Int8) . empty value = [] end
+  example `zero` is value = 0 expect empty value = [] end
+end
+
+law `constructed output satisfies its contract` is
+  definition is `for all` (value :: Int8 where value > 0) . singleton value = [value] end
+  example `maximum` is value = 127 expect singleton value = [127] end
+end
+
+
+definition sumreciprocal (xs :: List (value :: Int8 where value != 0)) :: Rational is
+  match xs with
+  | Nil -> 0
+  | Cons first rest -> unwrapnonzero (wrapnonzero (nonzero first)) + sumreciprocal rest
+  end
+end
+
+definition sumrows (rows :: List (List (value :: Int8 where value != 0))) :: Rational is
+  match rows with
+  | Nil -> 0
+  | Cons first rest -> sumreciprocal first + sumrows rest
+  end
+end
+
+definition positivetail (xs :: List (value :: Int8 where value > 0))
+  :: List (value :: Int8 where value > 0)
+is
+  match xs with | Nil -> [] | Cons first rest -> rest end
+end
+
+definition positivefirst (xs :: List (value :: Int8 where value > 0))
+  :: (result :: Int8 where result > 0)
+is
+  match xs with | Nil -> 1 | Cons first rest -> first end
+end
+
+
+law `reciprocal sum uses each nonzero head` is
+  definition is `for all` (value :: Int8 where value != 0) .
+    sumreciprocal [value] = 1 / value
+  end
+  example `half` is value = 2 expect sumreciprocal [value] = rational(1, 2) end
+end
+
+law `nested membership keeps row contracts` is
+  definition is `for all` (value :: Int8 where value != 0) .
+    sumrows [[], [value]] = 1 / value
+  end
+  example `negative half` is value = -2 expect sumrows [[], [value]] = rational(-1, 2) end
+end
+
+law `tail preserves its positive elements` is
+  definition is `for all` (first :: Int8 where first > 0)
+    (second :: Int8 where second > 0) . positivetail [first, second] = [second]
+  end
+  example `two values` is first = 1 second = 2 expect positivetail [first, second] = [2] end
+end
+
+-- Recursive calls supply their verified result contract by structural induction.
+definition copypositive (xs :: List (value :: Int8 where value > 0))
+  :: List (value :: Int8 where value > 0)
+is
+  match xs with
+  | Nil -> []
+  | Cons first rest -> Cons first (copypositive rest)
+  end
+end
+
+definition nonzero (value :: Int8 where value != 0)
+  :: (result :: Int8 where result != 0)
+is value end
+
+definition wrapnonzero (value :: Int8 where value != 0)
+  :: Maybe (result :: Int8 where result != 0)
+is Just value end
+
+definition unwrapnonzero (value :: Maybe (element :: Int8 where element != 0))
+  :: Rational
+is
+  match value with
+  | Nothing -> 0
+  | Just element -> selectnonzero (Left element)
+  end
+end
+
+definition selectnonzero (value :: Either (element :: Int8 where element != 0) Bool)
+  :: Rational
+is
+  match value with
+  | Left element -> 1 / element
+  | Right ignored -> 0
+  end
+end

package/examples/specs/list_refinements.lawspec

@@ -0,0 +1,51 @@
+unit example.list_refinements
+
+definition above (floor :: Int8) (xs :: List Int8) :: Bool is
+  match xs with
+  | Nil -> true
+  | Cons first rest -> first > floor && above floor rest
+  end
+end
+
+definition positiveRows (rows :: List (List Int8)) :: Bool is
+  match rows with
+  | Nil -> true
+  | Cons first rest -> above 0 first && positiveRows rest
+  end
+end
+
+law `each element is positive` is
+  definition is `for all` (xs :: List (value :: Int8 where value > 0)) .
+    above 0 xs = true
+  end
+  example `empty` is xs = [] expect above 0 xs = true end
+  example `positive values` is xs = [1, 127] expect above 0 xs = true end
+end
+
+law `nested element domains` is
+  definition is `for all` (rows :: List (List (value :: Int8 where value > 0))) .
+    positiveRows rows = true
+  end
+  example `empty rows` is rows = [[], [1, 2]] expect positiveRows rows = true end
+end
+
+law `dependent elements` is
+  definition is `for all` (lawspecElement :: Int8)
+    (xs :: List (value :: Int8 where value > lawspecElement)) .
+    above lawspecElement xs = true
+  end
+  example `maximum prefix still permits empty` is
+    lawspecElement = 127 xs = [] expect above lawspecElement xs = true
+  end
+  example `nonempty continuation` is
+    lawspecElement = 0 xs = [1, 2] expect above lawspecElement xs = true
+  end
+end
+
+law `division stays behind its guard` is
+  definition is `for all`
+    (xs :: List (value :: Int8 where value != 0 && 1 / value > 0)) .
+    above 0 xs = true
+  end
+  example `positive denominator` is xs = [1] expect above 0 xs = true end
+end

package/examples/specs/matching.lawspec

@@ -0,0 +1,49 @@
+unit example.matching
+
+-- Rebuilding values checks both constructor identity and every payload field.
+law `list patterns preserve the head and tail` is
+  definition is
+    `for all` (xs :: List Int8) .
+      (match xs with
+        | Nil -> []
+        | Cons head tail -> Cons head tail
+      end) = xs
+  end
+end
+
+law `nested Maybe patterns preserve each absence state` is
+  definition is
+    `for all` (value :: Maybe (Maybe Bool)) .
+      (match value with
+        | Nothing -> Nothing
+        | Just inner -> Just (match inner with
+            | Nothing -> Nothing
+            | Just payload -> Just payload
+          end)
+      end) = value
+  end
+end
+
+law `Either patterns preserve their constructor` is
+  definition is
+    `for all` (value :: Either (List Int8) (Maybe Bool)) .
+      (match value with
+        | Left items -> Left items
+        | Right optional -> Right optional
+      end) = value
+  end
+end
+
+-- The annotation gives the empty-case literal the same primitive type as head.
+law `matching can provide a default value` is
+  definition is
+    `for all` (value :: Maybe Int8) .
+      ((match value with
+        | Nothing -> 0
+        | Just payload -> payload
+      end) :: Int8) = ((match value with
+        | Just payload -> payload
+        | Nothing -> 0
+      end) :: Int8)
+  end
+end

package/examples/specs/recursive_refinements.lawspec

@@ -0,0 +1,41 @@
+unit example.recursive_refinements
+
+-- Refining a type argument follows its stored occurrences through recursion.
+-- The fixed Int8 field remains independent of the refined argument.
+type Tree (a :: Type) is
+  Leaf value :: a fixed :: Int8
+  Fork left :: Tree a right :: Tree a
+end
+
+refinement Positive is (value :: Int8 where value > 0) end
+
+-- The payload guarantee is available when proving recursive definitions.
+definition positiveSum (tree :: Tree Positive) :: (total :: BigInt where total > 0) is
+  match tree with
+    | Leaf value fixed -> value + 0
+    | Fork left right -> positiveSum left + positiveSum right
+  end
+end
+
+law `positive leaves have a positive total` is
+  definition is
+    `for all` (tree :: Tree Positive) . positiveSum tree > 0
+  end
+  example `fixed fields may be negative` is
+    tree = Fork (Leaf 1 -128) (Fork (Leaf 2 0) (Leaf 3 -1))
+    expect positiveSum tree = 6
+  end
+end
+
+-- Dependent predicates retain the enclosing input, even below several forks.
+law `every stored argument exceeds the threshold` is
+  definition is
+    `for all` (threshold :: Int8 where threshold < 127)
+      (tree :: Tree (value :: Int8 where value > threshold)) . tree = tree
+  end
+  example `nested threshold` is
+    threshold = 4
+    tree = Fork (Leaf 5 -128) (Leaf 6 0)
+    expect tree = Fork (Leaf 5 -128) (Leaf 6 0)
+  end
+end

package/examples/specs/refined_definitions.lawspec

@@ -0,0 +1,44 @@
+unit example.refined_definitions
+
+refinement Nonzero (T :: Type) requires Integer T is
+  (value :: T where value != 0)
+end
+
+-- The compiler proves division is defined under the input contract.
+-- Native callers are checked before the body runs.
+definition reciprocal (x :: Nonzero a) :: Rational
+requires Integer a
+is
+  1 / x
+end
+
+-- Arithmetic promotes before this explicit, proved narrowing conversion.
+definition increment (x :: Int8 where x < 127)
+  :: (result :: Int8 where result > x)
+is
+  prelude.Int8 (x + 1)
+end
+
+-- Later argument refinements can depend on earlier arguments.
+definition inverseGap (x :: Int8) (y :: Int8 where y > x) :: Rational is
+  1 / (y - x)
+end
+
+law `exact reciprocal` is
+  definition is `for all` (x :: Nonzero Int8) . reciprocal x = 1 / x end
+  example `one half` is x = 2 expect reciprocal x = rational(1, 2) end
+end
+
+law `checked increment` is
+  definition is `for all` (x :: Int8 where x < 127) . increment x = x + 1 end
+  example `largest admitted input` is x = 126 expect increment x = 127 end
+end
+
+law `dependent gap` is
+  definition is `for all` (x :: Int8) (y :: Int8 where y > x) .
+    inverseGap x y = 1 / (y - x)
+  end
+  example `difference exceeds Int8` is
+    x = -128 y = 127 expect inverseGap x y = rational(1, 255)
+  end
+end

package/examples/specs/sum_refinements.lawspec

@@ -0,0 +1,49 @@
+unit example.sum_refinements
+
+law `positive Maybe payloads` is
+  definition is `for all` (x :: Maybe (value :: Int8 where value > 0)) .
+    (match x with | Nothing -> true | Just payload -> payload >= 1 end) = true
+  end
+  example `absent` is x = Nothing expect x = Nothing end
+  example `present` is x = Just 1 expect x = Just 1 end
+end
+
+law `selected Either payload` is
+  definition is `for all`
+    (x :: Either (value :: Int8 where value > 0) (value :: Int8 where value < 0)) .
+    (match x with | Left payload -> payload >= 1 | Right payload -> payload <= -1 end) = true
+  end
+  example `left` is x = Left 1 expect x = Left 1 end
+  example `right` is x = Right -1 expect x = Right -1 end
+end
+
+law `nested Maybe states` is
+  definition is `for all` (x :: Maybe (Maybe (value :: Bool where value))) .
+    (match x with | Nothing -> true | Just inner ->
+      match inner with | Nothing -> true | Just payload -> payload end
+    end) = true
+  end
+  example `outer absent` is x = Nothing expect x = Nothing end
+  example `inner absent` is x = Just Nothing expect x = Just Nothing end
+  example `present` is x = Just (Just true) expect x = Just (Just true) end
+end
+
+law `finite Either variants` is
+  definition is `for all`
+    (x :: Either (value :: Bool where value) (value :: Bool where !value)) .
+    (match x with | Left payload -> payload | Right payload -> !payload end) = true
+  end
+end
+
+law `dependent payload keeps outer binding` is
+  definition is `for all` (lawspecElement :: Int8)
+    (x :: Maybe (value :: Int8 where value > lawspecElement)) .
+    (match x with | Nothing -> true | Just payload -> payload - lawspecElement >= 1 end) = true
+  end
+  example `maximum prefix has absent continuation` is
+    lawspecElement = 127 x = Nothing expect x = Nothing
+  end
+  example `present continuation` is
+    lawspecElement = 0 x = Just 1 expect x = Just 1
+  end
+end

package/examples/specs/total_functions.lawspec

@@ -0,0 +1,101 @@
+unit example.total_functions
+
+-- These functions are implemented in the specification. LawSpec checks their
+-- bodies and emits reusable source; they do not need adapter implementations.
+definition increment (x :: a) :: BigInt
+requires Integer a
+is
+  x + 1
+end
+
+definition count (xs :: List a) :: BigInt is
+  match xs with
+    | Nil -> 0
+    | Cons head tail -> 1 + count tail
+  end
+end
+
+definition nonempty (xs :: List a) :: Bool is
+  match xs with
+    | Nil -> false
+    | Cons head tail -> true
+  end
+end
+
+law `nonempty lists have positive length` is
+  definition is
+    `for all` (xs :: List Int8 where nonempty xs) . count xs > 0
+  end
+  example `singleton` is xs = [0] expect count xs = 1 end
+end
+
+-- The exact guard proves that the promoted denominator cannot be zero.
+definition positiveReciprocal (x :: a) :: Bool
+requires Integer a
+is
+  x >= 0 && 1 / (x + 1) > 0
+end
+
+law `guarded exact arithmetic` is
+  definition is
+    `for all` (x :: Int8) . positiveReciprocal x = (x >= 0)
+  end
+  example `skip zero denominator` is
+    x = -1 expect positiveReciprocal x = false
+  end
+  example `promote before division` is
+    x = 127 expect positiveReciprocal x = true
+  end
+end
+
+definition guardedNarrow (x :: Int8) :: Bool is
+  x < 127 && prelude.Int8 (x + 1) > x
+end
+
+law `narrow only after proving the range` is
+  definition is
+    `for all` (x :: Int8) . guardedNarrow x = (x < 127)
+  end
+  example `largest valid conversion` is x = 126 expect guardedNarrow x = true end
+  example `overflow branch is skipped` is x = 127 expect guardedNarrow x = false end
+end
+
+definition same (xs :: List a) (ys :: List a) :: Bool
+requires Eq a
+is
+  xs == ys
+end
+
+-- The same checked template produces independent concrete instances.
+law `count also accepts text` is
+  definition is
+    `for all` (xs :: List Text) . count xs = prelude.length xs
+  end
+  example `two words` is xs = ["hello", "world"] expect count xs = 2 end
+end
+
+law `increment preserves the mathematical result` is
+  definition is
+    `for all` (x :: Int8) . increment x = x + 1
+  end
+  example `maximum input` is
+    x = 127 expect increment x = 128
+  end
+end
+
+law `recursive count agrees with length` is
+  definition is
+    `for all` (xs :: List Int8) . count xs = prelude.length xs
+  end
+  example `empty` is xs = [] expect count xs = 0 end
+  example `duplicates still count` is xs = [7, 7, 7] expect count xs = 3 end
+end
+
+law `list equality preserves duplicates and order` is
+  definition is
+    `for all` (xs :: List Int8) (ys :: List Int8) . same xs ys = (xs == ys)
+  end
+  example `different order` is
+    xs = [1, 2] ys = [2, 1] expect same xs ys = false
+  end
+end

package/examples-command.mjs

@@ -21,7 +21,12 @@ export async function generateExamples(options) {
   const compiler = await createCompiler();
   const artifacts = [];
   for (const target of selected) {
-    const result = await compiler.planGeneration({ sources, target, machineBits: options.machineBits ?? 64 });
+    const result = await compiler.planGeneration({
+      sources,
+      target,
+      machineBits: options.machineBits ?? 64,
+      minify: options.minify === true,
+    });
     if (result.diagnostics.length)
       throw Object.assign(new Error("Bundled examples failed to compile"), {
         diagnostics: result.diagnostics,

package/files.mjs

@@ -89,7 +89,16 @@ export async function planWrites(root, artifacts) {
     const file = await safePath(root, artifact.path);
     const old = await readOptional(file);
     if (artifact.ownership === "user") {
-      adapterHashes[artifact.path] = digest(artifact.content);
+      if (
+        artifact.adapterReference !== undefined &&
+        typeof artifact.adapterReference !== "string"
+      )
+        throw new Error(`Invalid adapter reference: ${artifact.path}`);
+      // Compare compiler-owned canonical scaffolds, never normalized user code.
+      // Older compilers and manifests used readable content as this reference.
+      adapterHashes[artifact.path] = digest(
+        artifact.adapterReference ?? artifact.content,
+      );
       if (
         old !== null &&
         previous.adapters?.[artifact.path] !== adapterHashes[artifact.path]