lemmascript 0.2.0 → 0.3.0

package/README.md

@@ -16,8 +16,9 @@ See the external case studies:
 - **[colorwheel-lemmascript](https://github.com/midspiral/colorwheel-lemmascript/)** — verified color palette generator with mood + harmony constraints. 31 Lean proofs + 18 behavioral properties, 115 Dafny lemmas (invariant preservation, commutativity, NoOp completeness).
 - **[clear-split-lemmascript](https://github.com/midspiral/clear-split-lemmascript/)** — greenfield verified expense splitting web app. Conservation theorem, invariant preservation, delta laws — all proven in both Lean (no sorry) and Dafny (56 lemmas).
 - **[node-casbin-lemmascript](https://github.com/midspiral/node-casbin-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [node-casbin](https://github.com/casbin/node-casbin). 5 functions verified, 217 existing tests pass. End-to-end correctness and order independence for all 4 effect modes in both Lean and Dafny (39 lemmas).
-- **[hono-lemmascript](https://github.com/midspiral/hono-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [hono](https://github.com/honojs/hono)'s security middleware. Two CVEs verified: IP restriction bypass ([CVE-2026-39409](https://github.com/honojs/hono/security/advisories/GHSA-3mpf-rcc7-5347)) and cookie name bypass ([CVE-2026-39410](https://github.com/honojs/hono/security/advisories/GHSA-r5rp-j6wh-rvv4)) — 51 Dafny lemmas. Cookie verification done in-place. Dafny only.
-- **[charmchat](https://github.com/CHARM-BDF/charmchat/tree/lemma)** — in-progress verification of some sub-components, in Dafny.
+- **[hono-lemmascript](https://github.com/midspiral/hono-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [hono](https://github.com/honojs/hono)'s security middleware. Two CVEs verified: IP restriction bypass ([CVE-2026-39409](https://github.com/honojs/hono/security/advisories/GHSA-3mpf-rcc7-5347)) and cookie name bypass ([CVE-2026-39410](https://github.com/honojs/hono/security/advisories/GHSA-r5rp-j6wh-rvv4)) — 51 Dafny lemmas. [Cookie verification done **in-place**](https://github.com/midspiral/hono-lemmascript/blob/lemmascript/src/utils/cookie.ts#L79). Dafny only.
+- **[charmchat](https://github.com/CHARM-BDF/charmchat/tree/lemma)** — brownfield verification of an AI agent orchestration backend. `isEmptyResult` (string emptiness predicate, 8 postconditions, <1s) and `topologicalSort` (Kahn's algorithm — memory safety, output bounds, completeness via acyclicity ranking witness, termination; 5 helper lemmas, 28 loop invariants). Dafny only.
+- **[xyflow-lemmascript](https://github.com/midspiral/xyflow-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [xyflow](https://github.com/xyflow/xyflow)'s core edge and geometry utilities. 9 functions verified: `addEdge` (dedup — never loses edges, adds at most one), `reconnectEdge` (replace — bounded length), `connectionExists`, `getEdgeCenter` (midpoint correctness), `clamp` (bounds), `rectToBox`/`boxToRect` (field arithmetic), `getBoundsOfBoxes` (enclosure), `getOverlappingArea` (non-negative), `areSetsEqual` (subset + same size). 14 Dafny proof obligations. Dafny only.
 
 ## Setup
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lemmascript",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "A verification toolchain for TypeScript — generates Lean 4 or Dafny from annotated TS",
   "type": "module",
   "bin": {

package/tools/dist/dafny-commands.js

@@ -35,7 +35,7 @@ export function dafnyVerify(dfyPath, dir, timeLimit) {
     console.log("Running dafny verify...");
     try {
         const content = readFileSync(dfyPath, "utf-8");
-        const stdLibFlag = content.includes("import Std.") ? " --standard-libraries" : "";
+        const stdLibFlag = content.includes("Std.") ? " --standard-libraries" : "";
         const timeLimitFlag = timeLimit ? ` --verification-time-limit ${timeLimit}` : "";
         execSync(`dafny verify${stdLibFlag}${timeLimitFlag} "${dfyPath}"`, { cwd: dir, stdio: "inherit" });
         return true;

package/tools/dist/dafny-emit.js

@@ -51,12 +51,13 @@ function paramList(params) {
 const OP_MAP = {
     "=": "==", "≠": "!=", "≥": ">=", "≤": "<=",
     "∧": "&&", "∨": "||", "¬": "!",
+    "arrayConcat": "+",
 };
 function mapOp(op) { return OP_MAP[op] ?? op; }
 // ── Expression emission ─────────────────────────────────────
 function emitExpr(e) {
     switch (e.kind) {
-        case "var": return escapeName(e.name);
+        case "var": return e.name === "undefined" ? "None" : escapeName(e.name);
         case "num": return `${e.value}`;
         case "bool": return e.value ? "true" : "false";
         case "str": return `"${e.value.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n')}"`;
@@ -79,20 +80,18 @@ function emitExpr(e) {
                     return `(${args[0]} in ${obj})`;
                 if (e.method === "push")
                     return `(${obj} + [${args[0]}])`;
-                if (e.method === "slice")
+                if (e.method === "concat")
+                    return `(${obj} + [${args[0]}])`;
+                if (e.method === "slice" && args.length === 1)
                     return `${obj}[${args[0]}..]`;
-                if (e.method === "map") {
-                    needsStdCollections = true;
-                    return `Seq.Map(${args[0]}, ${obj})`;
-                }
-                if (e.method === "filter") {
-                    needsStdCollections = true;
-                    return `Seq.Filter(${args[0]}, ${obj})`;
-                }
-                if (e.method === "every") {
-                    needsStdCollections = true;
-                    return `Seq.All(${obj}, ${args[0]})`;
-                }
+                if (e.method === "slice" && args.length === 2)
+                    return `${obj}[${args[0]}..${args[1]}]`;
+                if (e.method === "map")
+                    return `Std.Collections.Seq.Map(${args[0]}, ${obj})`;
+                if (e.method === "filter")
+                    return `Std.Collections.Seq.Filter(${args[0]}, ${obj})`;
+                if (e.method === "every")
+                    return `Std.Collections.Seq.All(${obj}, ${args[0]})`;
                 if (e.method === "some" && e.args[0].kind === "lambda" &&
                     e.args[0].body.length === 1 && e.args[0].body[0].kind === "return") {
                     const lam = e.args[0];
@@ -143,6 +142,8 @@ function emitExpr(e) {
                     return `${obj}[${args[0]} := ${args[1]}]`;
                 if (e.method === "has")
                     return `(${args[0]} in ${obj})`;
+                if (e.method === "delete")
+                    return `(map k | k in ${obj} && k != ${args[0]} :: ${obj}[k])`;
             }
             // Set methods
             if (ty === "set") {
@@ -232,13 +233,24 @@ function emitExpr(e) {
             }
             if (e.fn === "BigInt" || e.fn === "Number")
                 return args[0]; // identity: both map to int
+            // Set literal: {a, b, c}
+            if (e.fn === "SetLiteral")
+                return `{${args.join(", ")}}`;
             if (e.fn === "JSFloorDiv")
                 needsJSFloorDiv = true;
             if (e.fn === "CeilReal")
                 needsCeilReal = true;
             if (e.fn === "FloorReal")
                 needsFloorReal = true;
-            return `${e.fn}(${args.join(", ")})`;
+            if (e.fn === "NatToString")
+                needsNatToString = true;
+            if (e.fn === "MathAbs")
+                needsMathAbs = true;
+            if (e.fn === "MathMin")
+                needsMathMin = true;
+            if (e.fn === "MathMax")
+                needsMathMax = true;
+            return `${escapeName(e.fn)}(${args.join(", ")})`;
         }
         case "field": {
             const obj = emitExpr(e.obj);
@@ -260,10 +272,40 @@ function emitExpr(e) {
                 const updates = e.fields.map(f => `${escapeName(f.name)} := ${emitExpr(f.value)}`);
                 return `${emitExpr(e.spread)}.(${updates.join(", ")})`;
             }
-            const ctorName = e.fields.length > 0 ? _recordCtors.get(e.fields[0].name) : undefined;
-            const vals = e.fields.map(f => emitExpr(f.value));
-            if (ctorName)
+            // Match constructor by field names — prefer exact match over first-field heuristic
+            let ctorName;
+            if (e.fields.length > 0) {
+                const fieldNames = new Set(e.fields.map(f => f.name));
+                for (const [name, fields] of _structureDecls) {
+                    if (fields.length >= e.fields.length && fields.every(f => fieldNames.has(f.name) || f.type.kind === "optional")) {
+                        ctorName = name;
+                        break;
+                    }
+                }
+                if (!ctorName)
+                    ctorName = _recordCtors.get(e.fields[0].name);
+            }
+            if (ctorName) {
+                const structFields = _structureDecls.get(ctorName);
+                if (structFields && e.fields.length < structFields.length) {
+                    // Pad missing fields: match by name, fill None for optional
+                    const provided = new Map(e.fields.map(f => [f.name, f]));
+                    const vals = structFields.map(sf => {
+                        const f = provided.get(sf.name);
+                        if (f)
+                            return emitExpr(f.value);
+                        if (sf.type.kind === "optional") {
+                            needsOptionType = true;
+                            return "None";
+                        }
+                        return `/* missing: ${sf.name} */`;
+                    });
+                    return `${ctorName}(${vals.join(", ")})`;
+                }
+                const vals = e.fields.map(f => emitExpr(f.value));
                 return `${ctorName}(${vals.join(", ")})`;
+            }
+            const vals = e.fields.map(f => emitExpr(f.value));
             return `(${vals.join(", ")})`;
         }
         case "if":
@@ -331,7 +373,13 @@ function emitStmt(s, indent) {
     const pad = "  ".repeat(indent);
     switch (s.kind) {
         case "let":
-            if (s.value.kind === "havoc")
+            // Record literal assigned to map type → emit as map[k := v, ...]
+            if (s.type.kind === "map" && s.value.kind === "record" && !s.value.spread) {
+                const entries = s.value.fields.map(f => `${emitExpr({ kind: "str", value: f.name })} := ${emitExpr(f.value)}`);
+                return `${pad}var ${escapeName(s.name)}: ${tyToDafny(resolveTy(s.type))} := map[${entries.join(", ")}];`;
+            }
+            if (s.value.kind === "havoc" || s.value.kind === "emptyMap" || s.value.kind === "emptySet" ||
+                (s.value.kind === "arrayLiteral" && s.value.elems.length === 0))
                 return `${pad}var ${escapeName(s.name)}: ${tyToDafny(s.type)} := ${emitExpr(s.value)};`;
             return `${pad}var ${escapeName(s.name)} := ${emitExpr(s.value)};`;
         case "assign":
@@ -408,18 +456,23 @@ function emitStmt(s, indent) {
 function emitDecl(d) {
     switch (d.kind) {
         case "inductive": {
+            const tp = d.typeParams?.length ? `<${d.typeParams.join(", ")}>` : "";
             const ctors = d.constructors.map(c => {
                 if (c.fields.length === 0)
                     return escapeName(c.name);
                 return `${escapeName(c.name)}(${paramList(c.fields)})`;
             });
-            return `datatype ${d.name} = ${ctors.join(" | ")}`;
+            return `datatype ${d.name}${tp} = ${ctors.join(" | ")}`;
         }
         case "structure": {
             return `datatype ${d.name} = ${d.name}(${paramList(d.fields)})`;
         }
+        case "type-alias": {
+            return `type ${d.name} = ${tyToDafny(d.target)}`;
+        }
         case "def": {
-            const lines = [`function ${d.name}(${paramList(d.params)}): ${tyToDafny(d.returnType)}`];
+            const tp = d.typeParams.length > 0 ? `<${d.typeParams.join(", ")}>` : "";
+            const lines = [`function ${d.name}${tp}(${paramList(d.params)}): ${tyToDafny(d.returnType)}`];
             for (const r of d.requires)
                 lines.push(`  requires ${emitExpr(r)}`);
             lines.push(`{`);
@@ -428,7 +481,7 @@ function emitDecl(d) {
             // Companion lemma for ensures (proof target for LLM)
             if (d.ensures.length > 0) {
                 lines.push("");
-                lines.push(`lemma ${d.name}_ensures(${paramList(d.params)})`);
+                lines.push(`lemma ${d.name}_ensures${tp}(${paramList(d.params)})`);
                 for (const r of d.requires)
                     lines.push(`  requires ${emitExpr(r)}`);
                 for (const e of d.ensures)
@@ -439,7 +492,8 @@ function emitDecl(d) {
             return lines.join("\n");
         }
         case "method": {
-            const lines = [`method ${d.name}(${paramList(d.params)}) returns (res: ${tyToDafny(d.returnType)})`];
+            const tp = d.typeParams.length > 0 ? `<${d.typeParams.join(", ")}>` : "";
+            const lines = [`method ${d.name}${tp}(${paramList(d.params)}) returns (res: ${tyToDafny(d.returnType)})`];
             for (const r of d.requires)
                 lines.push(`  requires ${emitExpr(r)}`);
             for (const e of d.ensures)
@@ -487,11 +541,14 @@ let needsStringToUpper = false;
 let needsJSFloorDiv = false;
 let needsCeilReal = false;
 let needsFloorReal = false;
-let needsStdCollections = false;
 let needsOptionType = false;
 let needsSetToSeq = false;
 let needsBitAnd = false;
 let needsPow2 = false;
+let needsNatToString = false;
+let needsMathAbs = false;
+let needsMathMin = false;
+let needsMathMax = false;
 const POW2 = `function Pow2(n: int): int
   requires n >= 0
   decreases n
@@ -579,25 +636,64 @@ const STRING_TO_UPPER = `function StringToUpper(s: string): string
     var upper := if 'a' <= c <= 'z' then (c - 'a' + 'A') as char else c;
     [upper] + StringToUpper(s[1..])
 }`;
+const MATH_MIN = `function MathMin(a: int, b: int): int { if a <= b then a else b }`;
+const MATH_MAX = `function MathMax(a: int, b: int): int { if a >= b then a else b }`;
+const NAT_TO_STRING = `function NatToString(n: nat): string
+  decreases n
+{
+  var digit := ('0' as int + n % 10) as char;
+  if n < 10 then [digit]
+  else NatToString(n / 10) + [digit]
+}`;
+const MATH_ABS = `function MathAbs(x: int): nat { if x >= 0 then x else -x }`;
 // ── Constructor and record helpers ───────────────────────────
 let _recordCtors = new Map();
+let _structureDecls = new Map();
+let _declaredTypes = new Set();
 function buildRecordCtorMap(decls) {
     _recordCtors = new Map();
-    for (const d of decls) {
-        if (d.kind === "structure" && d.fields.length > 0)
-            _recordCtors.set(d.fields[0].name, d.name);
+    _structureDecls = new Map();
+    _declaredTypes = new Set();
+    function collectDecl(d) {
+        if (d.kind === "structure") {
+            _declaredTypes.add(d.name);
+            _structureDecls.set(d.name, d.fields);
+            if (d.fields.length > 0)
+                _recordCtors.set(d.fields[0].name, d.name);
+        }
+        if (d.kind === "inductive")
+            _declaredTypes.add(d.name);
+        if (d.kind === "type-alias")
+            _declaredTypes.add(d.name);
+        if (d.kind === "def")
+            _declaredTypes.add(d.name);
         if (d.kind === "namespace")
-            for (const inner of d.decls) {
-                if (inner.kind === "structure" && inner.fields.length > 0)
-                    _recordCtors.set(inner.fields[0].name, inner.name);
-            }
+            for (const inner of d.decls)
+                collectDecl(inner);
     }
+    for (const d of decls)
+        collectDecl(d);
+}
+/** Resolve a Ty to a Dafny-safe type, falling back to string for undeclared user types. */
+function resolveTy(ty) {
+    if (ty.kind === "user" && !_declaredTypes.has(ty.name))
+        return { kind: "string" };
+    if (ty.kind === "optional")
+        return { kind: "optional", inner: resolveTy(ty.inner) };
+    if (ty.kind === "array")
+        return { kind: "array", elem: resolveTy(ty.elem) };
+    if (ty.kind === "map")
+        return { kind: "map", key: resolveTy(ty.key), value: resolveTy(ty.value) };
+    if (ty.kind === "set")
+        return { kind: "set", elem: resolveTy(ty.elem) };
+    return ty;
 }
 function qualifyCtor(name, type) {
     const rawName = name.replace(/^\./, "");
+    const mapped = CTOR_MAP[rawName] ?? escapeName(rawName);
     if (type)
-        return `${type}.${escapeName(rawName)}`;
-    return escapeName(rawName);
+        return `${type}.${mapped}`;
+    return mapped;
 }
 /** Translate a Lean match pattern to Dafny syntax.
  *  ".ctorName field1 field2" → "ctorName(field1, field2)"
@@ -630,11 +726,14 @@ export function emitDafnyFile(file, tsFileName) {
     needsJSFloorDiv = false;
     needsCeilReal = false;
     needsFloorReal = false;
-    needsStdCollections = false;
     needsOptionType = false;
     needsSetToSeq = false;
     needsBitAnd = false;
     needsPow2 = false;
+    needsNatToString = false;
+    needsMathAbs = false;
+    needsMathMin = false;
+    needsMathMax = false;
     // Collect pure def names so we can skip their method wrappers
     const pureDefs = new Set();
     for (const d of file.decls) {
@@ -671,8 +770,6 @@ export function emitDafnyFile(file, tsFileName) {
     const lines = [];
     if (tsFileName)
         lines.push(`// Generated by lsc from ${tsFileName}`);
-    if (needsStdCollections)
-        lines.push("import Std.Collections.Seq");
     if (needsOptionType) {
         lines.push("");
         lines.push("datatype Option<T> = None | Some(value: T)");
@@ -733,6 +830,22 @@ export function emitDafnyFile(file, tsFileName) {
         lines.push("");
         lines.push(STRING_TO_UPPER);
     }
+    if (needsNatToString) {
+        lines.push("");
+        lines.push(NAT_TO_STRING);
+    }
+    if (needsMathAbs) {
+        lines.push("");
+        lines.push(MATH_ABS);
+    }
+    if (needsMathMin) {
+        lines.push("");
+        lines.push(MATH_MIN);
+    }
+    if (needsMathMax) {
+        lines.push("");
+        lines.push(MATH_MAX);
+    }
     lines.push(...declLines);
     return lines.join("\n") + "\n";
 }