lemmascript 0.3.1 → 0.3.3

package/README.md

@@ -13,6 +13,7 @@ Each example and case study is verified in Lean 4 and/or Dafny from the same ann
 See the internal [examples](examples).
 
 See the external case studies:
+- **[collab-todo-lemmascript](https://github.com/midspiral/collab-todo-lemmascript/)** — collaborative task management web app (React + Supabase) with a verified domain model. Single `domain.ts` imported directly by the UI, hooks, and edge functions — no adapter layer. 123 Dafny lemmas (120 in a separate `domain.proofs.dfy`): 16-conjunct invariant preserved across 25 single-project + 3 cross-project actions, NoOp completeness/soundness, initialization. Dafny only.
 - **[colorwheel-lemmascript](https://github.com/midspiral/colorwheel-lemmascript/)** — verified color palette generator with mood + harmony constraints. 31 Lean proofs + 18 behavioral properties, 115 Dafny lemmas (invariant preservation, commutativity, NoOp completeness).
 - **[clear-split-lemmascript](https://github.com/midspiral/clear-split-lemmascript/)** — greenfield verified expense splitting web app. Conservation theorem, invariant preservation, delta laws — all proven in both Lean (no sorry) and Dafny (56 lemmas).
 - **[node-casbin-lemmascript](https://github.com/midspiral/node-casbin-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [node-casbin](https://github.com/casbin/node-casbin). 5 functions verified, 217 existing tests pass. End-to-end correctness and order independence for all 4 effect modes in both Lean and Dafny (39 lemmas).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lemmascript",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "A verification toolchain for TypeScript — generates Lean 4 or Dafny from annotated TS",
   "type": "module",
   "bin": {
@@ -12,7 +12,8 @@
   "scripts": {
     "build": "tsc -p tools/tsconfig.json",
     "prepublishOnly": "npm run build",
-    "typecheck": "tsc -p tools/tsconfig.json --noEmit"
+    "typecheck": "tsc -p tools/tsconfig.json --noEmit",
+    "typecheck:examples": "tsc -p examples/tsconfig.json"
   },
   "dependencies": {
     "ts-morph": "^25.0.0"

package/tools/dist/dafny-emit.js

@@ -94,6 +94,10 @@ function emitExpr(e) {
                     return `${obj}[${args[0]} := ${args[1]}]`;
                 if (e.method === "includes")
                     return `(${args[0]} in ${obj})`;
+                if (e.method === "indexOf") {
+                    needPreamble("SeqIndexOf");
+                    return `SeqIndexOf(${obj}, ${args[0]})`;
+                }
                 if (e.method === "push")
                     return `(${obj} + [${args[0]}])`;
                 if (e.method === "concat")
@@ -321,6 +325,8 @@ function emitExpr(e) {
                 const vals = e.fields.map(f => emitExpr(f.value));
                 return `${ctorName}(${vals.join(", ")})`;
             }
+            if (e.fields.length === 0)
+                return `map[]`;
             const vals = e.fields.map(f => emitExpr(f.value));
             return `(${vals.join(", ")})`;
         }
@@ -469,6 +475,8 @@ function emitDecl(d) {
             const lines = [`function ${d.name}${tp}(${paramList(d.params)}): ${tyToDafny(d.returnType)}`];
             for (const r of d.requires)
                 lines.push(`  requires ${emitExpr(r)}`);
+            if (d.decreases)
+                lines.push(`  decreases ${emitExpr(d.decreases)}`);
             lines.push(`{`);
             lines.push(emitPureExpr(d.body, 1));
             lines.push(`}`);
@@ -487,6 +495,20 @@ function emitDecl(d) {
             }
             return lines.join("\n");
         }
+        case "def-by-method": {
+            const tp = d.typeParams.length > 0 ? `<${d.typeParams.join(", ")}>` : "";
+            const lines = [`function ${d.name}${tp}(${paramList(d.params)}): ${tyToDafny(d.returnType)}`];
+            for (const r of d.requires)
+                lines.push(`  requires ${emitExpr(r)}`);
+            if (d.decreases)
+                lines.push(`  decreases ${emitExpr(d.decreases)}`);
+            lines.push(`{`);
+            lines.push(`}`);
+            lines.push(`by method {`);
+            lines.push(emitStmts(d.methodBody, 1));
+            lines.push(`}`);
+            return lines.join("\n");
+        }
         case "method": {
             const tp = d.typeParams.length > 0 ? `<${d.typeParams.join(", ")}>` : "";
             const lines = [`method ${d.name}${tp}(${paramList(d.params)}) returns (res: ${tyToDafny(d.returnType)})`];
@@ -565,6 +587,25 @@ const CEIL_REAL = `function CeilReal(x: real): int
   if x == (x.Floor as real) then x.Floor
   else x.Floor + 1
 }`;
+const SEQ_INDEX_OF = `function SeqIndexOf<T(==)>(s: seq<T>, x: T): int
+  ensures -1 <= SeqIndexOf(s, x) < |s|
+  ensures SeqIndexOf(s, x) >= 0 ==> s[SeqIndexOf(s, x)] == x
+  ensures SeqIndexOf(s, x) == -1 ==> x !in s
+{
+  SeqIndexOfFrom(s, x, 0)
+}
+
+function SeqIndexOfFrom<T(==)>(s: seq<T>, x: T, from: nat): int
+  requires from <= |s|
+  ensures -1 <= SeqIndexOfFrom(s, x, from) < |s|
+  ensures SeqIndexOfFrom(s, x, from) >= 0 ==> s[SeqIndexOfFrom(s, x, from)] == x
+  ensures SeqIndexOfFrom(s, x, from) == -1 ==> forall i :: from <= i < |s| ==> s[i] != x
+  decreases |s| - from
+{
+  if from == |s| then -1
+  else if s[from] == x then from as int
+  else SeqIndexOfFrom(s, x, from + 1)
+}`;
 const STRING_INDEX_OF = `function StringIndexOf(s: string, sub: string): int
 {
   StringIndexOfFrom(s, sub, 0)
@@ -633,6 +674,7 @@ const MATH_ABS = `function MathAbs(x: int): nat { if x >= 0 then x else -x }`;
 const SET_TO_SEQ = `method SetToSeq<T>(s: set<T>) returns (res: seq<T>)
   ensures forall x :: x in s <==> x in res
   ensures |res| == |s|
+  ensures forall i, j :: 0 <= i < j < |res| ==> res[i] != res[j]
 {
   var remaining := s;
   res := [];
@@ -640,6 +682,7 @@ const SET_TO_SEQ = `method SetToSeq<T>(s: set<T>) returns (res: seq<T>)
     invariant remaining <= s
     invariant forall x :: x in res <==> (x in s && x !in remaining)
     invariant |res| + |remaining| == |s|
+    invariant forall i, j :: 0 <= i < j < |res| ==> res[i] != res[j]
     decreases remaining
   {
     var x :| x in remaining;
@@ -656,6 +699,7 @@ const PREAMBLE_CODE = [
     ["JSFloorDiv", JS_FLOOR_DIV],
     ["CeilReal", CEIL_REAL],
     ["FloorReal", FLOOR_REAL],
+    ["SeqIndexOf", SEQ_INDEX_OF],
     ["StringIndexOf", STRING_INDEX_OF],
     ["StringTrim", STRING_TRIM],
     ["StringToLower", STRING_TO_LOWER],
@@ -736,26 +780,40 @@ function translatePattern(pattern) {
 export function emitDafnyFile(file, tsFileName) {
     buildRecordCtorMap(file.decls);
     _neededPreambles.clear();
-    // Collect pure def names so we can skip their method wrappers
-    const pureDefs = new Set();
-    for (const d of file.decls) {
-        if (d.kind === "namespace") {
-            for (const inner of d.decls)
-                if (inner.kind === "def")
-                    pureDefs.add(inner.name);
-        }
-        if (d.kind === "def")
-            pureDefs.add(d.name);
-    }
+    // Track successfully emitted pure defs — method wrappers are only
+    // skipped when the corresponding pure def was actually emitted.
+    const emittedPureDefs = new Set();
     // Emit declarations
     const declLines = [];
     const skipped = [];
     for (const decl of file.decls) {
-        if (decl.kind === "method" && pureDefs.has(decl.name))
+        if (decl.kind === "method" && emittedPureDefs.has(decl.name))
+            continue;
+        if (decl.kind === "namespace") {
+            // Emit each inner decl individually — if one fails, the rest survive
+            // and failed defs fall back to their method wrappers
+            for (const inner of decl.decls) {
+                try {
+                    declLines.push("");
+                    declLines.push(emitDecl(inner));
+                    if (inner.kind === "def")
+                        emittedPureDefs.add(inner.name);
+                }
+                catch (e) {
+                    const name = "name" in inner ? inner.name : "unknown";
+                    const msg = e.message;
+                    console.error(`WARNING: skipping pure '${name}': ${msg}`);
+                    declLines.push(`\n// LemmaScript: skipped pure ${name}`);
+                    skipped.push(name);
+                }
+            }
             continue;
+        }
         try {
             declLines.push("");
             declLines.push(emitDecl(decl));
+            if (decl.kind === "def-by-method")
+                emittedPureDefs.add(decl.name);
         }
         catch (e) {
             const name = "name" in decl ? decl.name : "unknown";

package/tools/dist/extract.js

@@ -8,6 +8,13 @@ import { Project, Node, SyntaxKind, ScriptTarget } from "ts-morph";
 // ── Expression extraction ────────────────────────────────────
 /** When set, calls whose function/method name matches this key are replaced with havoc. */
 let _havocKey = null;
+/**
+ * Maps property-name fingerprints to type alias names for collapsed single-variant unions.
+ * TypeScript collapses `type X = | { kind: 'A'; ... }` to the underlying object type,
+ * causing getAliasSymbol() to return null. This map lets typeToString recover the alias.
+ * Populated in extractModule before type extraction; used by typeToString.
+ */
+let _collapsedUnionMap = new Map();
 /** Generic bounds erasure map — set during extractFunction, applied in extractStmts. */
 let _typeParamMap = new Map();
 function _eraseGenerics(tsType) {
@@ -106,6 +113,14 @@ function extractExpr(node) {
     }
     // Call expression: f(a, b)
     if (Node.isCallExpression(node)) {
+        // Object.fromEntries(map) → identity (Map IS Record in Dafny)
+        const callee = node.getExpression();
+        if (Node.isPropertyAccessExpression(callee) &&
+            callee.getExpression().getText() === "Object" &&
+            callee.getName() === "fromEntries" &&
+            node.getArguments().length === 1) {
+            return extractExpr(node.getArguments()[0]);
+        }
         return {
             kind: "call",
             fn: extractExpr(node.getExpression()),
@@ -196,6 +211,7 @@ function extractExpr(node) {
     if (Node.isObjectLiteralExpression(node)) {
         let spread = null;
         const fields = [];
+        const computedFields = [];
         for (const prop of node.getProperties()) {
             if (Node.isSpreadAssignment(prop)) {
                 spread = extractExpr(prop.getExpression());
@@ -205,10 +221,26 @@ function extractExpr(node) {
                 fields.push({ name, value: { kind: "var", name } });
             }
             else if (Node.isPropertyAssignment(prop)) {
+                const nameNode = prop.getNameNode();
                 const init = prop.getInitializer();
-                if (init)
+                if (init && Node.isComputedPropertyName(nameNode)) {
+                    computedFields.push({ key: extractExpr(nameNode.getExpression()), value: extractExpr(init) });
+                }
+                else if (init) {
                     fields.push({ name: prop.getName(), value: extractExpr(init) });
+                }
+            }
+        }
+        // Desugar computed keys: { ...base, [k]: v } → base.set(k, v)
+        // No spread: { [k]: v } → {}.set(k, v) (empty map base)
+        if (computedFields.length > 0) {
+            let result = spread ?? { kind: "record", spread: null, fields: [] };
+            for (const cf of computedFields) {
+                result = { kind: "call",
+                    fn: { kind: "field", obj: result, field: "set" },
+                    args: [cf.key, cf.value] };
             }
+            return result;
         }
         return { kind: "record", spread, fields };
     }
@@ -234,8 +266,9 @@ function extractExpr(node) {
             if (name === "Map" && args && args.length === 1) {
                 const argType = args[0].getType();
                 const argSymbol = argType.getSymbol()?.getName() ?? argType.getAliasSymbol()?.getName();
-                if (argSymbol === "Map") {
-                    // new Map(existingMap) — identity (Dafny maps are value types)
+                const argTypeText = _eraseGenerics(typeToString(argType));
+                if (argSymbol === "Map" || argTypeText.startsWith("Record<")) {
+                    // new Map(existingMap) or new Map(record) — identity (Dafny maps are value types)
                     return extractExpr(args[0]);
                 }
                 // new Map(entries) — map-from-array constructor
@@ -257,6 +290,17 @@ function extractExpr(node) {
     if (Node.isAsExpression(node)) {
         return extractExpr(node.getExpression());
     }
+    // delete obj[key] → map delete expression
+    if (Node.isDeleteExpression(node)) {
+        const expr = node.getExpression();
+        if (Node.isElementAccessExpression(expr)) {
+            return {
+                kind: "call",
+                fn: { kind: "field", obj: extractExpr(expr.getExpression()), field: "delete" },
+                args: [extractExpr(expr.getArgumentExpression())],
+            };
+        }
+    }
     // null → undefined (both map to None in backends)
     if (Node.isNullLiteral(node)) {
         return { kind: "var", name: "undefined" };
@@ -289,6 +333,17 @@ function collectAnnotations(node, body) {
         return [...own, ...parseAnnotations(body[0])];
     return own;
 }
+/** Check for bare `//@ pure` annotation (no expression). */
+function hasPureAnnotation(node, body) {
+    const nodes = body && body.length > 0 ? [node, body[0]] : [node];
+    for (const n of nodes) {
+        for (const range of n.getLeadingCommentRanges()) {
+            if (range.getText().trim() === "//@ pure")
+                return true;
+        }
+    }
+    return false;
+}
 // ── Type declaration extraction ──────────────────────────────
 function extractTypeDecl(decl, extraDecls) {
     const name = decl.getName();
@@ -320,6 +375,30 @@ function extractTypeDecl(decl, extraDecls) {
             }
         }
     }
+    // Single-variant discriminated union: type X = | { kind: 'Foo', ... }
+    // TypeScript collapses single-member unions to their member type,
+    // so type.isUnion() returns false. Detect by checking the source text
+    // for union syntax '|' AND a string-literal discriminant field.
+    if (type.isObject() && !type.isIntersection()) {
+        const srcText = decl.getTypeNode()?.getText() ?? "";
+        if (srcText.includes("|")) {
+            const disc = findDiscriminant([type]);
+            if (disc) {
+                const tagProp = type.getProperty(disc);
+                const tagType = tagProp?.getTypeAtLocation(decl);
+                const tag = tagType?.isStringLiteral() ? String(tagType.getLiteralValue()) : null;
+                if (tag) {
+                    const fields = [];
+                    for (const prop of type.getProperties()) {
+                        if (prop.getName() === disc)
+                            continue;
+                        fields.push({ name: prop.getName(), tsType: typeToString(prop.getTypeAtLocation(decl)) });
+                    }
+                    return { name, typeParams: tpField, kind: "discriminated-union", discriminant: disc, variants: [{ name: tag, fields }] };
+                }
+            }
+        }
+    }
     if (type.isObject() || type.isIntersection())
         return extractRecord(name, type, decl, undefined, extraDecls);
     // Primitive type alias: type TaskId = number → alias
@@ -432,6 +511,13 @@ function typeToString(type) {
     const symbol = type.getSymbol() ?? type.getAliasSymbol();
     if (symbol) {
         const name = symbol.getName();
+        // Recover collapsed single-variant union alias via property fingerprint
+        if (name === "__type" && _collapsedUnionMap.size > 0) {
+            const props = type.getProperties().map(p => p.getName()).sort().join(",");
+            const alias = _collapsedUnionMap.get(props);
+            if (alias)
+                return alias;
+        }
         const typeArgs = type.getTypeArguments();
         if (typeArgs.length > 0) {
             return `${name}<${typeArgs.map(t => typeToString(t)).join(", ")}>`;
@@ -511,6 +597,38 @@ function extractStmts(stmts) {
                     }
                     continue;
                 }
+                // Destructuring rest: const { [k]: _, ...rest } = map → let rest = map.delete(k)
+                if (!isHavoc && Node.isObjectBindingPattern(nameNode)) {
+                    const elements = nameNode.getElements();
+                    const restEl = elements.find(el => el.getDotDotDotToken());
+                    const computedEls = elements.filter(el => {
+                        const pn = el.getPropertyNameNode();
+                        return pn && Node.isComputedPropertyName(pn);
+                    });
+                    if (restEl && computedEls.length > 0) {
+                        const initializer = d.getInitializer();
+                        if (initializer) {
+                            let deleteInit = extractExpr(initializer);
+                            for (const cel of computedEls) {
+                                const pn = cel.getPropertyNameNode();
+                                const keyExpr = extractExpr(pn.getExpression());
+                                deleteInit = { kind: "call",
+                                    fn: { kind: "field", obj: deleteInit, field: "delete" },
+                                    args: [keyExpr] };
+                            }
+                            const declType = d.getType();
+                            result.push({
+                                kind: "let",
+                                name: restEl.getName(),
+                                mutable: s.getDeclarationKind() === "let",
+                                tsType: _eraseGenerics(typeToString(declType)),
+                                init: deleteInit,
+                                line,
+                            });
+                            continue;
+                        }
+                    }
+                }
                 const declType = d.getType();
                 let init;
                 if (isHavoc && !havocKey) {
@@ -571,12 +689,49 @@ function extractStmts(stmts) {
             else {
                 names.push("_");
             }
+            // Unwrap Object.entries(expr) / Object.values(expr) to bare map iteration
+            let iterableExpr = s.getExpression();
+            if (Node.isCallExpression(iterableExpr)) {
+                const callee = iterableExpr.getExpression();
+                if (Node.isPropertyAccessExpression(callee) &&
+                    callee.getExpression().getText() === "Object") {
+                    const method = callee.getName();
+                    if ((method === "entries" || method === "values") && iterableExpr.getArguments().length === 1) {
+                        iterableExpr = iterableExpr.getArguments()[0];
+                        // Object.values with single name → prepend "_" so it looks like [_, v] destructuring
+                        if (method === "values" && names.length === 1) {
+                            names.unshift("_");
+                        }
+                    }
+                }
+            }
             const bodyNode = s.getStatement();
             const bodyStmts = Node.isBlock(bodyNode) ? bodyNode.getStatements() : [bodyNode];
             const annots = collectAnnotations(s, bodyStmts);
             result.push({
                 kind: "forof",
                 names,
+                iterable: extractExpr(iterableExpr),
+                invariants: annots.filter(a => a.kind === "invariant").map(a => a.expr),
+                doneWith: annots.find(a => a.kind === "done_with")?.expr ?? null,
+                body: extractStmts(bodyStmts),
+                line,
+            });
+            continue;
+        }
+        // for...in: for (const k in obj) → treat as forof with single key name
+        if (Node.isForInStatement(s)) {
+            const init = s.getInitializer();
+            let name = "_";
+            if (Node.isVariableDeclarationList(init)) {
+                name = init.getDeclarations()[0]?.getName() ?? "_";
+            }
+            const bodyNode = s.getStatement();
+            const bodyStmts = Node.isBlock(bodyNode) ? bodyNode.getStatements() : [bodyNode];
+            const annots = collectAnnotations(s, bodyStmts);
+            result.push({
+                kind: "forof",
+                names: [name],
                 iterable: extractExpr(s.getExpression()),
                 invariants: annots.filter(a => a.kind === "invariant").map(a => a.expr),
                 doneWith: annots.find(a => a.kind === "done_with")?.expr ?? null,
@@ -782,6 +937,8 @@ function extractFunction(fn, parentAnnotations) {
         })(),
         requires: annots.filter(a => a.kind === "requires").map(a => a.expr),
         ensures: annots.filter(a => a.kind === "ensures").map(a => a.expr),
+        decreases: annots.find(a => a.kind === "decreases")?.expr ?? null,
+        pure: hasPureAnnotation(fn, body && Node.isBlock(body) ? body.getStatements() : undefined),
         typeAnnotations,
         body: extractedBody,
         line: fn.getStartLineNumber(),
@@ -825,6 +982,22 @@ export function extractModule(sourceFile) {
             typeDecls.push({ name, kind: "record", fields });
         }
     }
+    // Pre-scan for collapsed single-variant unions so typeToString can recover alias names.
+    // TypeScript collapses `type X = | { kind: 'A'; ... }` to a plain object type, losing
+    // the alias. We record a fingerprint (sorted property names) → alias name mapping.
+    _collapsedUnionMap = new Map();
+    for (const stmt of sourceFile.getStatements()) {
+        if (Node.isTypeAliasDeclaration(stmt)) {
+            const type = stmt.getType();
+            if (!type.isUnion() && type.isObject() && !type.isIntersection()) {
+                const srcText = stmt.getTypeNode()?.getText() ?? "";
+                if (srcText.includes("|") && findDiscriminant([type])) {
+                    const props = type.getProperties().map(p => p.getName()).sort().join(",");
+                    _collapsedUnionMap.set(props, stmt.getName());
+                }
+            }
+        }
+    }
     // Extract type declarations in source order to respect dependencies
     // Skip types already declared via //@ declare-type
     const declaredNames = new Set(typeDecls.map(d => d.name));
@@ -1184,6 +1357,12 @@ export function extractModule(sourceFile) {
         }
         const sym = retType.getSymbol();
         if (sym?.getName() === "__type" && retType.isObject() && !retType.isArray()) {
+            // Try typeToString first — it resolves collapsed single-variant unions
+            const resolved = typeToString(retType);
+            if (resolved !== "__type" && !resolved.includes("__type") && knownTypes.has(resolved)) {
+                fn.returnType = resolved;
+                continue;
+            }
             const synName = fn.name.charAt(0).toUpperCase() + fn.name.slice(1) + "Result";
             if (!knownTypes.has(synName)) {
                 const extra = [];

package/tools/dist/lean-emit.js

@@ -325,6 +325,8 @@ function emitDecl(d) {
             const params = d.params.map(p => `(${escapeName(p.name)} : ${tyToLean(p.type)})`).join(" ");
             return `def ${d.name} ${params} : ${tyToLean(d.returnType)} :=\n${emitPureExpr(d.body, 1)}`;
         }
+        case "def-by-method":
+            throw new Error("function by method is not supported for Lean backend");
         case "method": {
             const params = d.params.map(p => `(${escapeName(p.name)} : ${tyToLean(p.type)})`).join(" ");
             const lines = [`method ${d.name} ${params} return (res : ${tyToLean(d.returnType)})`];