lemmascript 0.1.0 → 0.3.0

package/README.md

@@ -1,18 +1,24 @@
 # LemmaScript (Tech Preview)
 
-A verification toolchain for TypeScript. Write ordinary TypeScript with `//@ ` specification annotations. The toolchain generates verified code from your TypeScript — either Lean 4 (with Velvet/Loom) or Dafny.
+A verification toolchain for TypeScript. Write ordinary TypeScript with `//@ ` specification annotations. The toolchain generates verifiable code from your TypeScript — either in Dafny or Lean 4 (with Velvet/Loom).
 
-See [SPEC.md](SPEC.md) for the full specification, [DESIGN.md](DESIGN.md) for the Lean backend design, and [DESIGN_DAFNY.md](DESIGN_DAFNY.md) for the Dafny backend design.
+See [SPEC.md](SPEC.md) and [DESIGN.md](DESIGN.md).
 
 This is a **Tech Preview**: the core idea is there, but support, semantics, and ergonomics are still evolving.
 
-## Case Studies
+## Examples and Case Studies
 
-Each case study is verified in both Lean 4 and Dafny from the same annotated TypeScript source.
+Each example and case study is verified in Lean 4 and/or Dafny from the same annotated TypeScript source.
 
+See the internal [examples](examples).
+
+See the external case studies:
 - **[colorwheel-lemmascript](https://github.com/midspiral/colorwheel-lemmascript/)** — verified color palette generator with mood + harmony constraints. 31 Lean proofs + 18 behavioral properties, 115 Dafny lemmas (invariant preservation, commutativity, NoOp completeness).
 - **[clear-split-lemmascript](https://github.com/midspiral/clear-split-lemmascript/)** — greenfield verified expense splitting web app. Conservation theorem, invariant preservation, delta laws — all proven in both Lean (no sorry) and Dafny (56 lemmas).
 - **[node-casbin-lemmascript](https://github.com/midspiral/node-casbin-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [node-casbin](https://github.com/casbin/node-casbin). 5 functions verified, 217 existing tests pass. End-to-end correctness and order independence for all 4 effect modes in both Lean and Dafny (39 lemmas).
+- **[hono-lemmascript](https://github.com/midspiral/hono-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [hono](https://github.com/honojs/hono)'s security middleware. Two CVEs verified: IP restriction bypass ([CVE-2026-39409](https://github.com/honojs/hono/security/advisories/GHSA-3mpf-rcc7-5347)) and cookie name bypass ([CVE-2026-39410](https://github.com/honojs/hono/security/advisories/GHSA-r5rp-j6wh-rvv4)) — 51 Dafny lemmas. [Cookie verification done **in-place**](https://github.com/midspiral/hono-lemmascript/blob/lemmascript/src/utils/cookie.ts#L79). Dafny only.
+- **[charmchat](https://github.com/CHARM-BDF/charmchat/tree/lemma)** — brownfield verification of an AI agent orchestration backend. `isEmptyResult` (string emptiness predicate, 8 postconditions, <1s) and `topologicalSort` (Kahn's algorithm — memory safety, output bounds, completeness via acyclicity ranking witness, termination; 5 helper lemmas, 28 loop invariants). Dafny only.
+- **[xyflow-lemmascript](https://github.com/midspiral/xyflow-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [xyflow](https://github.com/xyflow/xyflow)'s core edge and geometry utilities. 9 functions verified: `addEdge` (dedup — never loses edges, adds at most one), `reconnectEdge` (replace — bounded length), `connectionExists`, `getEdgeCenter` (midpoint correctness), `clamp` (bounds), `rectToBox`/`boxToRect` (field arithmetic), `getBoundsOfBoxes` (enclosure), `getOverlappingArea` (non-negative), `areSetsEqual` (subset + same size). 14 Dafny proof obligations. Dafny only.
 
 ## Setup
 
@@ -40,13 +46,6 @@ git clone https://github.com/namin/velvet.git -b lemma ../velvet
 
 ## Usage
 
-### Lean backend (default)
-
-```sh
-npx lsc gen src/myModule.ts
-lake build
-```
-
 ### Dafny backend
 
 ```sh
@@ -57,6 +56,13 @@ npx lsc regen --backend=dafny src/myModule.ts
 
 The Dafny backend generates two files per TS source: `foo.dfy.gen` (always regeneratable) and `foo.dfy` (source of truth, with LLM/user proof additions). The diff between them must be additions-only.
 
+### Lean backend
+
+```sh
+npx lsc gen src/myModule.ts
+lake build
+```
+
 ## What's Supported
 
 ### Annotations
@@ -71,33 +77,21 @@ The Dafny backend generates two files per TS source: `foo.dfy.gen` (always regen
 
 ## File Structure
 
-### Lean backend
+### Dafny backend
 
 | File | Generated? | Purpose |
 |------|-----------|---------|
 | `foo.ts` | — | TypeScript source with `//@ ` annotations |
-| `foo.types.lean` | Yes | Lean types, `namespace Pure` defs |
-| `foo.spec.lean` | No | Ghost definitions, helper lemmas |
-| `foo.def.lean` | Yes | Velvet method definitions |
-| `foo.proof.lean` | No | `prove_correct` with proof tactics |
+| `foo.dfy.gen` | Yes | Generated Dafny (merge base, always regeneratable) |
+| `foo.dfy` | Yes (initial) | Annotated Dafny (gen + proof additions) |
 
-### Dafny backend
+### Lean backend
 
 | File | Generated? | Purpose |
 |------|-----------|---------|
 | `foo.ts` | — | TypeScript source with `//@ ` annotations |
-| `foo.dfy.gen` | Yes | Generated Dafny (merge base, always regeneratable) |
-| `foo.dfy` | Yes (initial) | Annotated Dafny (gen + proof additions) |
+| `foo.types.lean` | Yes | Lean types, `namespace Pure` defs |
+| `foo.spec.lean` | No | Ghost definitions, helper lemmas |
+| `foo.def.lean` | Yes | Velvet method definitions |
+| `foo.proof.lean` | No | `prove_correct` with proof tactics |
 
-## Examples
-
-| Example | Pattern |
-|---------|---------|
-| `binarySearch` | Array search, break, Int arithmetic |
-| `linearSearch` | Loop with break, Nat index |
-| `arraySum` | Accumulator, recursive ghost function |
-| `transition` | State machine, enum ADT, inter-method call |
-| `packet` | Discriminated union with data, if-chain → match |
-| `isSorted` | Loop with break, existential in invariant |
-| `maxElement` | If-without-else in loop |
-| `arrayContains` | For-of loop, boolean flag |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lemmascript",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "A verification toolchain for TypeScript — generates Lean 4 or Dafny from annotated TS",
   "type": "module",
   "bin": {

package/tools/dist/dafny-commands.js

@@ -1,7 +1,7 @@
 /**
  * Dafny backend commands: gen, check, regen.
  */
-import { existsSync, readFileSync, writeFileSync, copyFileSync } from "fs";
+import { existsSync, readFileSync, writeFileSync, copyFileSync, unlinkSync } from "fs";
 import { execSync } from "child_process";
 import path from "path";
 function writeGen(genPath, text) {
@@ -31,74 +31,68 @@ export function dafnyCheckDiff(genPath, dfyPath) {
     catch { /* diff not available */ }
     return true;
 }
-export function dafnyVerify(dfyPath, dir) {
+export function dafnyVerify(dfyPath, dir, timeLimit) {
     console.log("Running dafny verify...");
     try {
         const content = readFileSync(dfyPath, "utf-8");
-        const stdLibFlag = content.includes("import Std.") ? " --standard-libraries" : "";
-        execSync(`dafny verify${stdLibFlag} "${dfyPath}"`, { cwd: dir, stdio: "inherit" });
+        const stdLibFlag = content.includes("Std.") ? " --standard-libraries" : "";
+        const timeLimitFlag = timeLimit ? ` --verification-time-limit ${timeLimit}` : "";
+        execSync(`dafny verify${stdLibFlag}${timeLimitFlag} "${dfyPath}"`, { cwd: dir, stdio: "inherit" });
         return true;
     }
     catch {
         return false;
     }
 }
-export function dafnySavePatch(genPath, dfyPath, patchPath) {
-    try {
-        const patch = execSync(`diff -u "${genPath}" "${dfyPath}" || true`, { encoding: "utf-8" });
-        writeFileSync(patchPath, patch);
-        console.log(`Saved: ${patchPath}`);
-    }
-    catch { /* diff not available */ }
-}
-function dafnyApplyPatch(genPath, dfyPath, patchPath) {
-    if (!existsSync(patchPath))
-        return false;
-    const patch = readFileSync(patchPath, "utf-8").trim();
-    if (!patch)
-        return false;
-    copyFileSync(genPath, dfyPath);
-    try {
-        execSync(`patch --no-backup-if-mismatch -p0 "${dfyPath}" < "${patchPath}"`, { stdio: "pipe" });
-        console.log(`Applied: ${patchPath}`);
-        return true;
-    }
-    catch {
-        copyFileSync(genPath, dfyPath);
-        return false;
-    }
-}
-export function dafnyRegen(genPath, dfyPath, patchPath, text, dir) {
-    // 1. No .dfy yet — create both, verify, done
+export function dafnyRegen(genPath, dfyPath, basePath, text, dir) {
+    // 1. Read old gen before overwriting (needed for base seeding)
+    const oldGen = existsSync(genPath) ? readFileSync(genPath, "utf-8") : "";
+    // 2. Always write new gen so user can inspect latest output
+    writeGen(genPath, text);
+    // 3. No .dfy yet — create dfy, verify, done
     if (!existsSync(dfyPath)) {
-        dafnyGen(genPath, dfyPath, text);
+        writeFileSync(dfyPath, text);
+        console.log(`Created: ${path.basename(dfyPath)}`);
         if (!dafnyVerify(dfyPath, dir)) {
             console.error(`FAILED: ${path.basename(dfyPath)} verification failed on first run.`);
             process.exit(1);
         }
         return;
     }
-    // 2. Capture patch from current gen → dfy BEFORE overwriting gen
-    let hasPatch = false;
-    if (existsSync(genPath)) {
-        dafnySavePatch(genPath, dfyPath, patchPath);
-        hasPatch = readFileSync(patchPath, "utf-8").trim().length > 0;
+    // 4. Determine anchor: base file if it exists (dirty state), otherwise old gen
+    const anchor = existsSync(basePath) ? readFileSync(basePath, "utf-8") : oldGen;
+    // 5. If gen changed, three-way merge
+    if (text !== anchor) {
+        const savedDfy = readFileSync(dfyPath, "utf-8");
+        if (!existsSync(basePath))
+            writeFileSync(basePath, anchor);
+        const mergedPath = dfyPath + ".merged";
+        console.log("Gen changed. Three-way merging...");
+        try {
+            execSync(`git merge-file "${dfyPath}" "${basePath}" "${genPath}"`, { stdio: "pipe" });
+            console.log(`Merged: ${path.basename(dfyPath)}`);
+        }
+        catch (e) {
+            if (e.status > 0) {
+                copyFileSync(dfyPath, mergedPath);
+                writeFileSync(dfyPath, savedDfy);
+                console.error(`CONFLICT: ${path.basename(dfyPath)} — merge had conflicts, dfy restored. See ${path.basename(mergedPath)}`);
+                process.exit(1);
+            }
+            throw e;
+        }
     }
-    // 3. Write new gen
-    writeGen(genPath, text);
-    // 4. Try verifying existing dfy as-is
-    if (dafnyVerify(dfyPath, dir))
-        return;
-    // 5. Failed — try applying captured patch to new gen
-    if (hasPatch) {
-        console.log("Verification failed. Trying to apply patch...");
-        if (dafnyApplyPatch(genPath, dfyPath, patchPath) && dafnyVerify(dfyPath, dir))
-            return;
+    // 6. Check gen invariant (unconditional)
+    if (!dafnyCheckDiff(genPath, dfyPath)) {
+        console.error(`FAILED: ${path.basename(dfyPath)} has modifications to generated lines.`);
+        process.exit(1);
+    }
+    // 7. Verify
+    if (!dafnyVerify(dfyPath, dir)) {
+        console.error(`FAILED: ${path.basename(dfyPath)} verification failed.`);
+        process.exit(1);
     }
-    // 6. Needs LLM re-adaptation
-    console.error(`FAILED: ${path.basename(dfyPath)} needs manual re-adaptation.`);
-    console.error(`  ${genPath} has the new generated code.`);
-    if (hasPatch)
-        console.error(`  ${patchPath} has the captured patch.`);
-    process.exit(1);
+    // 8. Success — delete base (gen is now the anchor)
+    if (existsSync(basePath))
+        unlinkSync(basePath);
 }