lemmascript 0.3.2 → 0.4.0

package/README.md

@@ -13,11 +13,14 @@ Each example and case study is verified in Lean 4 and/or Dafny from the same ann
 See the internal [examples](examples).
 
 See the external case studies:
+- **[collab-todo-lemmascript](https://github.com/midspiral/collab-todo-lemmascript/)** — collaborative task management web app (React + Supabase) with a verified domain model. Single `domain.ts` imported directly by the UI, hooks, and edge functions — no adapter layer. 123 Dafny lemmas (120 in a separate `domain.proofs.dfy`): 16-conjunct invariant preserved across 25 single-project + 3 cross-project actions, NoOp completeness/soundness, initialization. Dafny only.
 - **[colorwheel-lemmascript](https://github.com/midspiral/colorwheel-lemmascript/)** — verified color palette generator with mood + harmony constraints. 31 Lean proofs + 18 behavioral properties, 115 Dafny lemmas (invariant preservation, commutativity, NoOp completeness).
 - **[clear-split-lemmascript](https://github.com/midspiral/clear-split-lemmascript/)** — greenfield verified expense splitting web app. Conservation theorem, invariant preservation, delta laws — all proven in both Lean (no sorry) and Dafny (56 lemmas).
+- **[github-star-checker-lemmascript](https://github.com/midspiral/github-star-checker-lemmascript/)** — small verified CLI that tracks GitHub star counts across repos and reports per-run deltas. Verifies: per-row diff correctness and `totalDiff == sumDiffs(rows)` (via an inductive `SumDiffs_append` lemma); three sign-classified extractors (gainers / losers / unchanged) with soundness, completeness, **ordered completeness** (gainers appear in the notification in the same order they were listed on the command line), and count/sum equalities against prefix-indexed `upTo` helpers; conservation theorem `decompose(r)` — the three splits partition every row exactly once, and `sumDiffs(increases) + sumDiffs(decreases) == totalDiff`. 33 Dafny VCs, 0 errors; proof additions include a head/tail bridge (`sumDiffs` ↔ `sumDiffsUpTo`) and two partition-on-n inductions. Dafny only.
+- **[equality-game-lemmascript](https://github.com/midspiral/equality-game-lemmascript/)** — greenfield verified arithmetic equality card game (React + Tailwind). Sound + complete decision procedure for "can these two card lists be combined into equal expressions": `canEqualize(L, R) ⟺ ∃ eL, eR. eval(eL) == eval(eR) ∧ multiset(leaves(eL)) == multiset(L) ∧ same for R`. Algorithm is subset-DP over a bitmask `m ∈ [1, 2^n − 1)`; the proof composes a `PopCount` upper/lower bound chain (with stdlib `LemmaDivDenominator` / `LemmaFundamentalDivModConverse`), a `splitLeft`/`splitRight` ↔ imperative-loop connection, a `WitnessCombine` lemma threading existential `Expr` witnesses through the cross-product loops, and a `ChooseMask` combinatorial constructor that, given any sub-multiset of `cards`, produces the realizing mask. Capped by `CompletenessFromMaskCoverage`. **753 verification conditions, 0 errors, 0 `assume`s, 0 axioms** under `--isolate-assertions --verification-time-limit 180`. Dafny only.
 - **[node-casbin-lemmascript](https://github.com/midspiral/node-casbin-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [node-casbin](https://github.com/casbin/node-casbin). 5 functions verified, 217 existing tests pass. End-to-end correctness and order independence for all 4 effect modes in both Lean and Dafny (39 lemmas).
 - **[hono-lemmascript](https://github.com/midspiral/hono-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [hono](https://github.com/honojs/hono)'s security middleware. Two CVEs verified: IP restriction bypass ([CVE-2026-39409](https://github.com/honojs/hono/security/advisories/GHSA-3mpf-rcc7-5347)) and cookie name bypass ([CVE-2026-39410](https://github.com/honojs/hono/security/advisories/GHSA-r5rp-j6wh-rvv4)) — 51 Dafny lemmas. [Cookie verification done **in-place**](https://github.com/midspiral/hono-lemmascript/blob/lemmascript/src/utils/cookie.ts#L79). Dafny only.
-- **[charmchat](https://github.com/CHARM-BDF/charmchat/tree/lemma)** — brownfield verification of an AI agent orchestration backend. `isEmptyResult` (string emptiness predicate, 8 postconditions, <1s) and `topologicalSort` (Kahn's algorithm — memory safety, output bounds, completeness via acyclicity ranking witness, termination; 5 helper lemmas, 28 loop invariants). Dafny only.
+- **[charmchat](https://github.com/CHARM-BDF/charmchat/blob/lemma/README_LemmaScript.md)** — brownfield verification of an AI agent orchestration backend. `isEmptyResult` (string emptiness predicate, 8 postconditions, <1s) and `topologicalSort` (Kahn's algorithm — memory safety, output bounds, completeness via acyclicity ranking witness, termination). Full completeness proof: 23 helper lemmas, 14 opaque ghost predicates, 115 loop invariants; 736 VCs verified under `--isolate-assertions --verification-time-limit 600`. Key technique: snapshot-based inner invariants (`ghost var originalRemDeps := remDeps`) replace the mid-iteration SEEN/UNSEEN split so preservation is frame reasoning against a ghost-constant rather than set-subtraction against mutating state. Dafny only.
 - **[xyflow-lemmascript](https://github.com/midspiral/xyflow-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [xyflow](https://github.com/xyflow/xyflow)'s core edge and geometry utilities. 9 functions verified: `addEdge` (dedup — never loses edges, adds at most one), `reconnectEdge` (replace — bounded length), `connectionExists`, `getEdgeCenter` (midpoint correctness), `clamp` (bounds), `rectToBox`/`boxToRect` (field arithmetic), `getBoundsOfBoxes` (enclosure), `getOverlappingArea` (non-negative), `areSetsEqual` (subset + same size). 14 Dafny proof obligations. Dafny only.
 
 ## Setup
@@ -59,7 +62,7 @@ The Dafny backend generates two files per TS source: `foo.dfy.gen` (always regen
 ### Lean backend
 
 ```sh
-npx lsc gen src/myModule.ts
+npx lsc gen --backend=lean src/myModule.ts
 lake build
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lemmascript",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "description": "A verification toolchain for TypeScript — generates Lean 4 or Dafny from annotated TS",
   "type": "module",
   "bin": {
@@ -12,7 +12,8 @@
   "scripts": {
     "build": "tsc -p tools/tsconfig.json",
     "prepublishOnly": "npm run build",
-    "typecheck": "tsc -p tools/tsconfig.json --noEmit"
+    "typecheck": "tsc -p tools/tsconfig.json --noEmit",
+    "typecheck:examples": "tsc -p examples/tsconfig.json"
   },
   "dependencies": {
     "ts-morph": "^25.0.0"

package/tools/dist/dafny-commands.js

@@ -2,7 +2,7 @@
  * Dafny backend commands: gen, check, regen.
  */
 import { existsSync, readFileSync, writeFileSync, copyFileSync, unlinkSync } from "fs";
-import { execSync } from "child_process";
+import { execFileSync } from "child_process";
 import path from "path";
 function writeGen(genPath, text) {
     writeFileSync(genPath, text);
@@ -18,27 +18,44 @@ export function dafnyGen(genPath, dfyPath, text) {
 export function dafnyCheckDiff(genPath, dfyPath) {
     if (!existsSync(dfyPath))
         return true;
+    let diff = "";
     try {
-        const diff = execSync(`git diff --no-index -- "${genPath}" "${dfyPath}" 2>/dev/null || true`, { encoding: "utf-8" });
-        const deletions = diff.split("\n").filter(l => l.startsWith("-") && !l.startsWith("---"));
-        if (deletions.length > 0) {
-            console.error(`WARNING: ${path.basename(dfyPath)} has modifications to generated lines (not additions-only):`);
-            for (const d of deletions.slice(0, 5))
-                console.error("  " + d);
-            return false;
+        diff = execFileSync("git", ["diff", "--no-index", "--", genPath, dfyPath], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] });
+    }
+    catch (e) {
+        // git diff exits 1 when files differ; stdout still holds the diff
+        if (e && e.stdout != null) {
+            diff = typeof e.stdout === "string" ? e.stdout : e.stdout.toString("utf-8");
+        }
+        else {
+            return true;
         }
     }
-    catch { /* diff not available */ }
+    const deletions = diff.split("\n").filter(l => l.startsWith("-") && !l.startsWith("---"));
+    if (deletions.length > 0) {
+        console.error(`WARNING: ${path.basename(dfyPath)} has modifications to generated lines (not additions-only):`);
+        for (const d of deletions.slice(0, 5))
+            console.error("  " + d);
+        return false;
+    }
     return true;
 }
 export function dafnyVerify(dfyPath, dir, timeLimit, extraFlags) {
     console.log("Running dafny verify...");
     try {
         const content = readFileSync(dfyPath, "utf-8");
-        const stdLibFlag = content.includes("Std.") ? " --standard-libraries" : "";
-        const timeLimitFlag = timeLimit ? ` --verification-time-limit ${timeLimit}` : "";
-        const extra = extraFlags ? ` ${extraFlags}` : "";
-        execSync(`dafny verify${stdLibFlag}${timeLimitFlag}${extra} "${dfyPath}"`, { cwd: dir, stdio: "inherit" });
+        const args = ["verify"];
+        if (content.includes("Std."))
+            args.push("--standard-libraries");
+        if (timeLimit)
+            args.push("--verification-time-limit", String(timeLimit));
+        if (extraFlags) {
+            for (const tok of extraFlags.split(/\s+/))
+                if (tok)
+                    args.push(tok);
+        }
+        args.push(dfyPath);
+        execFileSync("dafny", args, { cwd: dir, stdio: "inherit" });
         return true;
     }
     catch {
@@ -70,7 +87,7 @@ export function dafnyRegen(genPath, dfyPath, basePath, text, dir) {
         const mergedPath = dfyPath + ".merged";
         console.log("Gen changed. Three-way merging...");
         try {
-            execSync(`git merge-file "${dfyPath}" "${basePath}" "${genPath}"`, { stdio: "pipe" });
+            execFileSync("git", ["merge-file", dfyPath, basePath, genPath], { stdio: "pipe" });
             console.log(`Merged: ${path.basename(dfyPath)}`);
         }
         catch (e) {

package/tools/dist/dafny-emit.js

@@ -47,6 +47,13 @@ function escapeName(name) {
 function paramList(params) {
     return params.map(p => `${escapeName(p.name)}: ${tyToDafny(p.type)}`).join(", ");
 }
+/** Format a method signature header, omitting `returns` for void methods.
+ *  Dafny's definite-assignment rule rejects unassigned out-parameters, so a
+ *  `returns (res: ())` on a void method fails verification. */
+function methodHeader(prefix, params, returnType) {
+    const sig = `${prefix}(${paramList(params)})`;
+    return returnType.kind === "void" ? sig : `${sig} returns (res: ${tyToDafny(returnType)})`;
+}
 // ── Lean op → Dafny op ─────────────────────────────────────
 const OP_MAP = {
     "=": "==", "≠": "!=", "≥": ">=", "≤": "<=",
@@ -77,7 +84,12 @@ function emitExpr(e) {
         case "num": return `${e.value}`;
         case "bool": return e.value ? "true" : "false";
         case "str": return `"${e.value.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n')}"`;
-        case "constructor": return qualifyCtor(e.name, e.type);
+        case "constructor": {
+            const head = qualifyCtor(e.name, e.type);
+            if (!e.args || e.args.length === 0)
+                return head;
+            return `${head}(${e.args.map(emitExpr).join(", ")})`;
+        }
         case "arrayLiteral":
             if (e.elems.length === 0)
                 return `[]`;
@@ -325,11 +337,13 @@ function emitExpr(e) {
                 const vals = e.fields.map(f => emitExpr(f.value));
                 return `${ctorName}(${vals.join(", ")})`;
             }
+            if (e.fields.length === 0)
+                return `map[]`;
             const vals = e.fields.map(f => emitExpr(f.value));
             return `(${vals.join(", ")})`;
         }
         case "if":
-            return `if ${emitExpr(e.cond)} then ${emitExpr(e.then)} else ${emitExpr(e.else)}`;
+            return `(if ${emitExpr(e.cond)} then ${emitExpr(e.then)} else ${emitExpr(e.else)})`;
         case "match": {
             const scrut = emitScrutinee(e.scrutinee);
             const arms = e.arms.map(a => `case ${translatePattern(a.pattern)} => ${emitExpr(a.body)}`);
@@ -337,7 +351,7 @@ function emitExpr(e) {
         }
         case "forall": return emitQuantifier(e, "forall");
         case "exists": return emitQuantifier(e, "exists");
-        case "let": return `var ${escapeName(e.name)} := ${emitExpr(e.value)}; ${emitExpr(e.body)}`;
+        case "let": return `(var ${escapeName(e.name)} := ${emitExpr(e.value)}; ${emitExpr(e.body)})`;
         case "havoc": return "*";
     }
 }
@@ -473,6 +487,8 @@ function emitDecl(d) {
             const lines = [`function ${d.name}${tp}(${paramList(d.params)}): ${tyToDafny(d.returnType)}`];
             for (const r of d.requires)
                 lines.push(`  requires ${emitExpr(r)}`);
+            if (d.decreases)
+                lines.push(`  decreases ${emitExpr(d.decreases)}`);
             lines.push(`{`);
             lines.push(emitPureExpr(d.body, 1));
             lines.push(`}`);
@@ -491,9 +507,23 @@ function emitDecl(d) {
             }
             return lines.join("\n");
         }
+        case "def-by-method": {
+            const tp = d.typeParams.length > 0 ? `<${d.typeParams.join(", ")}>` : "";
+            const lines = [`function ${d.name}${tp}(${paramList(d.params)}): ${tyToDafny(d.returnType)}`];
+            for (const r of d.requires)
+                lines.push(`  requires ${emitExpr(r)}`);
+            if (d.decreases)
+                lines.push(`  decreases ${emitExpr(d.decreases)}`);
+            lines.push(`{`);
+            lines.push(`}`);
+            lines.push(`by method {`);
+            lines.push(emitStmts(d.methodBody, 1));
+            lines.push(`}`);
+            return lines.join("\n");
+        }
         case "method": {
             const tp = d.typeParams.length > 0 ? `<${d.typeParams.join(", ")}>` : "";
-            const lines = [`method ${d.name}${tp}(${paramList(d.params)}) returns (res: ${tyToDafny(d.returnType)})`];
+            const lines = [methodHeader(`method ${d.name}${tp}`, d.params, d.returnType)];
             for (const r of d.requires)
                 lines.push(`  requires ${emitExpr(r)}`);
             for (const e of d.ensures)
@@ -511,7 +541,7 @@ function emitDecl(d) {
             if (d.fields.length > 0 && d.methods.length > 0)
                 lines.push("");
             for (const m of d.methods) {
-                lines.push(`  method ${m.name}(${paramList(m.params)}) returns (res: ${tyToDafny(m.returnType)})`);
+                lines.push(`  ${methodHeader(`method ${m.name}`, m.params, m.returnType)}`);
                 for (const r of m.requires)
                     lines.push(`    requires ${emitExpr(r)}`);
                 for (const e of m.ensures)
@@ -656,6 +686,7 @@ const MATH_ABS = `function MathAbs(x: int): nat { if x >= 0 then x else -x }`;
 const SET_TO_SEQ = `method SetToSeq<T>(s: set<T>) returns (res: seq<T>)
   ensures forall x :: x in s <==> x in res
   ensures |res| == |s|
+  ensures forall i, j :: 0 <= i < j < |res| ==> res[i] != res[j]
 {
   var remaining := s;
   res := [];
@@ -663,6 +694,7 @@ const SET_TO_SEQ = `method SetToSeq<T>(s: set<T>) returns (res: seq<T>)
     invariant remaining <= s
     invariant forall x :: x in res <==> (x in s && x !in remaining)
     invariant |res| + |remaining| == |s|
+    invariant forall i, j :: 0 <= i < j < |res| ==> res[i] != res[j]
     decreases remaining
   {
     var x :| x in remaining;
@@ -760,26 +792,40 @@ function translatePattern(pattern) {
 export function emitDafnyFile(file, tsFileName) {
     buildRecordCtorMap(file.decls);
     _neededPreambles.clear();
-    // Collect pure def names so we can skip their method wrappers
-    const pureDefs = new Set();
-    for (const d of file.decls) {
-        if (d.kind === "namespace") {
-            for (const inner of d.decls)
-                if (inner.kind === "def")
-                    pureDefs.add(inner.name);
-        }
-        if (d.kind === "def")
-            pureDefs.add(d.name);
-    }
+    // Track successfully emitted pure defs — method wrappers are only
+    // skipped when the corresponding pure def was actually emitted.
+    const emittedPureDefs = new Set();
     // Emit declarations
     const declLines = [];
     const skipped = [];
     for (const decl of file.decls) {
-        if (decl.kind === "method" && pureDefs.has(decl.name))
+        if (decl.kind === "method" && emittedPureDefs.has(decl.name))
             continue;
+        if (decl.kind === "namespace") {
+            // Emit each inner decl individually — if one fails, the rest survive
+            // and failed defs fall back to their method wrappers
+            for (const inner of decl.decls) {
+                try {
+                    declLines.push("");
+                    declLines.push(emitDecl(inner));
+                    if (inner.kind === "def")
+                        emittedPureDefs.add(inner.name);
+                }
+                catch (e) {
+                    const name = "name" in inner ? inner.name : "unknown";
+                    const msg = e.message;
+                    console.error(`WARNING: skipping pure '${name}': ${msg}`);
+                    declLines.push(`\n// LemmaScript: skipped pure ${name}`);
+                    skipped.push(name);
+                }
+            }
+            continue;
+        }
         try {
             declLines.push("");
             declLines.push(emitDecl(decl));
+            if (decl.kind === "def-by-method")
+                emittedPureDefs.add(decl.name);
         }
         catch (e) {
             const name = "name" in decl ? decl.name : "unknown";

package/tools/dist/extract.js

@@ -8,6 +8,13 @@ import { Project, Node, SyntaxKind, ScriptTarget } from "ts-morph";
 // ── Expression extraction ────────────────────────────────────
 /** When set, calls whose function/method name matches this key are replaced with havoc. */
 let _havocKey = null;
+/**
+ * Maps property-name fingerprints to type alias names for collapsed single-variant unions.
+ * TypeScript collapses `type X = | { kind: 'A'; ... }` to the underlying object type,
+ * causing getAliasSymbol() to return null. This map lets typeToString recover the alias.
+ * Populated in extractModule before type extraction; used by typeToString.
+ */
+let _collapsedUnionMap = new Map();
 /** Generic bounds erasure map — set during extractFunction, applied in extractStmts. */
 let _typeParamMap = new Map();
 function _eraseGenerics(tsType) {
@@ -79,38 +86,54 @@ function extractExpr(node) {
         return { kind: "var", name: "this" };
     }
     // Property access: x.foo or x?.foo
+    // Each `?.` is its own short-circuit point — wrap the inner in a new optChain.
+    // Non-`?` continuation of an existing optChain extends the chain (no new
+    // short-circuit, just keep evaluating after the prior `?` succeeded).
     if (Node.isPropertyAccessExpression(node)) {
         const obj = extractExpr(node.getExpression());
         const field = node.getName();
-        // Optional chaining on data access: x?.foo → x !== undefined ? x.foo : undefined
-        // Skip if this is a method call (parent is CallExpression) — handled differently.
         if (node.hasQuestionDotToken()) {
-            const parent = node.getParent();
-            const isMethodCall = parent && Node.isCallExpression(parent) && parent.getExpression() === node;
-            if (!isMethodCall) {
-                return { kind: "conditional",
-                    cond: { kind: "binop", op: "!==", left: obj, right: { kind: "var", name: "undefined" } },
-                    then: { kind: "field", obj, field },
-                    else: { kind: "var", name: "undefined" },
-                };
-            }
+            return { kind: "optChain", obj, chain: [{ kind: "field", name: field }] };
+        }
+        if (obj.kind === "optChain") {
+            return { ...obj, chain: [...obj.chain, { kind: "field", name: field }] };
         }
         return { kind: "field", obj, field };
     }
-    // Element access: arr[i]
+    // Element access: arr[i] or arr?.[i]
     if (Node.isElementAccessExpression(node)) {
         const arg = node.getArgumentExpression();
         if (!arg)
             throw new Error(`Missing index in element access: ${node.getText()}`);
-        return { kind: "index", obj: extractExpr(node.getExpression()), idx: extractExpr(arg) };
+        const obj = extractExpr(node.getExpression());
+        const idx = extractExpr(arg);
+        if (node.hasQuestionDotToken()) {
+            return { kind: "optChain", obj, chain: [{ kind: "index", idx }] };
+        }
+        if (obj.kind === "optChain") {
+            return { ...obj, chain: [...obj.chain, { kind: "index", idx }] };
+        }
+        return { kind: "index", obj, idx };
     }
-    // Call expression: f(a, b)
+    // Call expression: f(a, b), x?.foo() (`?.` on the property), or x?.() (`?.` on call)
     if (Node.isCallExpression(node)) {
-        return {
-            kind: "call",
-            fn: extractExpr(node.getExpression()),
-            args: node.getArguments().map(a => extractExpr(a)),
-        };
+        // Object.fromEntries(map) → identity (Map IS Record in Dafny)
+        const callee = node.getExpression();
+        if (Node.isPropertyAccessExpression(callee) &&
+            callee.getExpression().getText() === "Object" &&
+            callee.getName() === "fromEntries" &&
+            node.getArguments().length === 1) {
+            return extractExpr(node.getArguments()[0]);
+        }
+        const fn = extractExpr(callee);
+        const args = node.getArguments().map(a => extractExpr(a));
+        if (node.hasQuestionDotToken()) {
+            return { kind: "optChain", obj: fn, chain: [{ kind: "call", args }] };
+        }
+        if (fn.kind === "optChain") {
+            return { ...fn, chain: [...fn.chain, { kind: "call", args }] };
+        }
+        return { kind: "call", fn, args };
     }
     // Binary expression: a + b, a === b, etc.
     if (Node.isBinaryExpression(node)) {
@@ -120,6 +143,10 @@ function extractExpr(node) {
             // This is an assignment expression; extract as binop for now
             return { kind: "binop", op: "=", left: extractExpr(node.getLeft()), right: extractExpr(node.getRight()) };
         }
+        // Nullish coalescing: a ?? b — single-eval, narrow rewrites to someMatch
+        if (op === "??") {
+            return { kind: "nullish", left: extractExpr(node.getLeft()), right: extractExpr(node.getRight()) };
+        }
         return { kind: "binop", op, left: extractExpr(node.getLeft()), right: extractExpr(node.getRight()) };
     }
     // Prefix unary: !x, -x
@@ -318,6 +345,17 @@ function collectAnnotations(node, body) {
         return [...own, ...parseAnnotations(body[0])];
     return own;
 }
+/** Check for bare `//@ pure` annotation (no expression). */
+function hasPureAnnotation(node, body) {
+    const nodes = body && body.length > 0 ? [node, body[0]] : [node];
+    for (const n of nodes) {
+        for (const range of n.getLeadingCommentRanges()) {
+            if (range.getText().trim() === "//@ pure")
+                return true;
+        }
+    }
+    return false;
+}
 // ── Type declaration extraction ──────────────────────────────
 function extractTypeDecl(decl, extraDecls) {
     const name = decl.getName();
@@ -349,6 +387,30 @@ function extractTypeDecl(decl, extraDecls) {
             }
         }
     }
+    // Single-variant discriminated union: type X = | { kind: 'Foo', ... }
+    // TypeScript collapses single-member unions to their member type,
+    // so type.isUnion() returns false. Detect by checking the source text
+    // for union syntax '|' AND a string-literal discriminant field.
+    if (type.isObject() && !type.isIntersection()) {
+        const srcText = decl.getTypeNode()?.getText() ?? "";
+        if (srcText.includes("|")) {
+            const disc = findDiscriminant([type]);
+            if (disc) {
+                const tagProp = type.getProperty(disc);
+                const tagType = tagProp?.getTypeAtLocation(decl);
+                const tag = tagType?.isStringLiteral() ? String(tagType.getLiteralValue()) : null;
+                if (tag) {
+                    const fields = [];
+                    for (const prop of type.getProperties()) {
+                        if (prop.getName() === disc)
+                            continue;
+                        fields.push({ name: prop.getName(), tsType: typeToString(prop.getTypeAtLocation(decl)) });
+                    }
+                    return { name, typeParams: tpField, kind: "discriminated-union", discriminant: disc, variants: [{ name: tag, fields }] };
+                }
+            }
+        }
+    }
     if (type.isObject() || type.isIntersection())
         return extractRecord(name, type, decl, undefined, extraDecls);
     // Primitive type alias: type TaskId = number → alias
@@ -461,6 +523,13 @@ function typeToString(type) {
     const symbol = type.getSymbol() ?? type.getAliasSymbol();
     if (symbol) {
         const name = symbol.getName();
+        // Recover collapsed single-variant union alias via property fingerprint
+        if (name === "__type" && _collapsedUnionMap.size > 0) {
+            const props = type.getProperties().map(p => p.getName()).sort().join(",");
+            const alias = _collapsedUnionMap.get(props);
+            if (alias)
+                return alias;
+        }
         const typeArgs = type.getTypeArguments();
         if (typeArgs.length > 0) {
             return `${name}<${typeArgs.map(t => typeToString(t)).join(", ")}>`;
@@ -632,13 +701,29 @@ function extractStmts(stmts) {
             else {
                 names.push("_");
             }
+            // Unwrap Object.entries(expr) / Object.values(expr) to bare map iteration
+            let iterableExpr = s.getExpression();
+            if (Node.isCallExpression(iterableExpr)) {
+                const callee = iterableExpr.getExpression();
+                if (Node.isPropertyAccessExpression(callee) &&
+                    callee.getExpression().getText() === "Object") {
+                    const method = callee.getName();
+                    if ((method === "entries" || method === "values") && iterableExpr.getArguments().length === 1) {
+                        iterableExpr = iterableExpr.getArguments()[0];
+                        // Object.values with single name → prepend "_" so it looks like [_, v] destructuring
+                        if (method === "values" && names.length === 1) {
+                            names.unshift("_");
+                        }
+                    }
+                }
+            }
             const bodyNode = s.getStatement();
             const bodyStmts = Node.isBlock(bodyNode) ? bodyNode.getStatements() : [bodyNode];
             const annots = collectAnnotations(s, bodyStmts);
             result.push({
                 kind: "forof",
                 names,
-                iterable: extractExpr(s.getExpression()),
+                iterable: extractExpr(iterableExpr),
                 invariants: annots.filter(a => a.kind === "invariant").map(a => a.expr),
                 doneWith: annots.find(a => a.kind === "done_with")?.expr ?? null,
                 body: extractStmts(bodyStmts),
@@ -864,6 +949,8 @@ function extractFunction(fn, parentAnnotations) {
         })(),
         requires: annots.filter(a => a.kind === "requires").map(a => a.expr),
         ensures: annots.filter(a => a.kind === "ensures").map(a => a.expr),
+        decreases: annots.find(a => a.kind === "decreases")?.expr ?? null,
+        pure: hasPureAnnotation(fn, body && Node.isBlock(body) ? body.getStatements() : undefined),
         typeAnnotations,
         body: extractedBody,
         line: fn.getStartLineNumber(),
@@ -907,6 +994,22 @@ export function extractModule(sourceFile) {
             typeDecls.push({ name, kind: "record", fields });
         }
     }
+    // Pre-scan for collapsed single-variant unions so typeToString can recover alias names.
+    // TypeScript collapses `type X = | { kind: 'A'; ... }` to a plain object type, losing
+    // the alias. We record a fingerprint (sorted property names) → alias name mapping.
+    _collapsedUnionMap = new Map();
+    for (const stmt of sourceFile.getStatements()) {
+        if (Node.isTypeAliasDeclaration(stmt)) {
+            const type = stmt.getType();
+            if (!type.isUnion() && type.isObject() && !type.isIntersection()) {
+                const srcText = stmt.getTypeNode()?.getText() ?? "";
+                if (srcText.includes("|") && findDiscriminant([type])) {
+                    const props = type.getProperties().map(p => p.getName()).sort().join(",");
+                    _collapsedUnionMap.set(props, stmt.getName());
+                }
+            }
+        }
+    }
     // Extract type declarations in source order to respect dependencies
     // Skip types already declared via //@ declare-type
     const declaredNames = new Set(typeDecls.map(d => d.name));
@@ -982,7 +1085,7 @@ export function extractModule(sourceFile) {
         }
         return false;
     }
-    const hasVerifyDirective = allFns.some(hasVerify);
+    const hasVerifyDirective = sourceFile.getFullText().includes('//@ verify');
     const fnsToExtract = hasVerifyDirective ? allFns.filter(hasVerify) : allFns;
     const functions = fnsToExtract.map(f => {
         // For expression-body arrows, annotations come from the parent variable statement
@@ -1266,6 +1369,12 @@ export function extractModule(sourceFile) {
         }
         const sym = retType.getSymbol();
         if (sym?.getName() === "__type" && retType.isObject() && !retType.isArray()) {
+            // Try typeToString first — it resolves collapsed single-variant unions
+            const resolved = typeToString(retType);
+            if (resolved !== "__type" && !resolved.includes("__type") && knownTypes.has(resolved)) {
+                fn.returnType = resolved;
+                continue;
+            }
             const synName = fn.name.charAt(0).toUpperCase() + fn.name.slice(1) + "Result";
             if (!knownTypes.has(synName)) {
                 const extra = [];

package/tools/dist/lean-emit.js

@@ -75,6 +75,8 @@ function emitMethodCall(tyKind, method, monadic, obj, args) {
             return `${obj}.set! ${args[0]} ${args[1]}`;
         if (method === "push")
             return `Array.push ${obj} ${args[0]}`;
+        if (method === "concat")
+            return `Array.push ${obj} ${args[0]}`;
     }
     // String methods
     if (tyKind === "string") {
@@ -113,7 +115,17 @@ function emitExpr(e, parentPrec) {
         case "num": return `${e.value}`;
         case "bool": return e.value ? "true" : "false";
         case "str": return `"${e.value.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n')}"`;
-        case "constructor": return `.${e.name}`;
+        case "constructor": {
+            // With type: emit `Type.name` (unambiguous; needed in expression positions
+            // like `match ... | .none => Type.some x` where elaboration can't infer).
+            // Without type: emit `.name` (dotted form; works in pattern positions
+            // and where the expected type is clear from context).
+            const head = e.type ? `${e.type}.${e.name}` : `.${e.name}`;
+            if (!e.args || e.args.length === 0)
+                return head;
+            const args = e.args.map(a => (a.kind === "binop" || a.kind === "unop" || a.kind === "implies" || a.kind === "app" || a.kind === "methodCall") ? `(${emitExpr(a)})` : emitExpr(a));
+            return `${head} ${args.join(" ")}`;
+        }
         case "arrayLiteral":
             if (e.elems.length === 0)
                 return `#[]`;
@@ -143,6 +155,13 @@ function emitExpr(e, parentPrec) {
                 return `-${e.expr.value}`;
             return `(-${emitExpr(e.expr)})`;
         case "binop": {
+            // `k in m` (map/set membership) → `m.contains k` in Lean. Dafny has
+            // native `in`; Lean uses the method form for HashMap/HashSet.
+            if (e.op === "in") {
+                const recv = emitExpr(e.right);
+                const wrap = e.right.kind === "binop" || e.right.kind === "app" || e.right.kind === "methodCall";
+                return `${wrap ? `(${recv})` : recv}.contains ${emitExpr(e.left)}`;
+            }
             const op = e.op === "arrayConcat" ? "++" : e.op;
             const s = `${emitExpr(e.left, prec(e.op))} ${op} ${emitExpr(e.right, prec(e.op))}`;
             return (parentPrec !== undefined && prec(e.op) < parentPrec) ? `(${s})` : s;
@@ -182,8 +201,12 @@ function emitExpr(e, parentPrec) {
         case "if":
             return `if ${emitExpr(e.cond)} then ${emitExpr(e.then)} else ${emitExpr(e.else)}`;
         case "match": {
+            // Always parenthesize inline matches — Lean parses alternatives greedily,
+            // so any token after an arm body (`→`, another match's `|`, etc.) would
+            // bleed into the last `.none` case without explicit bracketing.
             const arms = e.arms.map(a => `| ${a.pattern} => ${emitExpr(a.body)}`);
-            return `match ${typeof e.scrutinee === "string" ? e.scrutinee : emitExpr(e.scrutinee)} with ${arms.join(" ")}`;
+            const scrut = typeof e.scrutinee === "string" ? e.scrutinee : emitExpr(e.scrutinee);
+            return `(match ${scrut} with ${arms.join(" ")})`;
         }
         case "forall": return `∀ ${e.var} : ${tyToLean(e.type)}, ${emitExpr(e.body)}`;
         case "exists": return `∃ ${e.var} : ${tyToLean(e.type)}, ${emitExpr(e.body)}`;
@@ -191,6 +214,24 @@ function emitExpr(e, parentPrec) {
         default: throw new Error(`Unsupported Lean expression: ${e.kind}`);
     }
 }
+/** True if the IR expression emits to a Prop-valued Lean term. `transformExpr`
+ *  routes TS comparisons/logicals through `OP_MAP` (`===`→`=`, `&&`→`∧`, `!`→`¬`)
+ *  so these top-level ops land in Prop. `in` stays Bool (emits `.contains`), and
+ *  bare method calls / vars / field accesses remain at their declared type. */
+function isPropValued(e) {
+    switch (e.kind) {
+        case "binop":
+            return ["=", "≠", "≥", "≤", ">", "<", "∧", "∨"].includes(e.op);
+        case "unop":
+            return e.op === "¬";
+        case "implies":
+        case "forall":
+        case "exists":
+            return true;
+        default:
+            return false;
+    }
+}
 // ── Statement emission ──────────────────────────────────────
 function emitStmts(stmts, indent) {
     const pad = "  ".repeat(indent);
@@ -207,7 +248,16 @@ function emitStmt(s, indent) {
         case "ghostLet":
             return `${pad}let mut ${escapeName(s.name)} : ${tyToLean(s.type)} := ${emitExpr(s.value)}`;
         case "ghostAssign": return `${pad}${escapeName(s.target)} := ${emitExpr(s.value)}`;
-        case "assert": return `${pad}assertGadget (${emitExpr(s.expr)})`;
+        case "assert": {
+            // WPGen.assert needs a Prop; bare Bool expressions (`k in m` → `.contains`,
+            // method calls, vars) lack a matching WPGen instance and silently fall back
+            // to WPGen.default, which drops the assertion. Coerce to Prop via `= true`.
+            // Top-level Prop constructs (`=`, `<`, `∧`, `¬`, `∀`, `∃`, `→`) already
+            // land in Prop — Lean auto-coerces inner Bools there.
+            const inner = emitExpr(s.expr);
+            const wrapped = isPropValued(s.expr) ? inner : `(${inner}) = true`;
+            return `${pad}assertGadget (${wrapped})`;
+        }
         case "bind": return `${pad}${escapeName(s.target)} ← ${emitExpr(s.value)}`;
         case "let-bind": return `${pad}let ${s.name} ← ${emitExpr(s.value)}`;
         case "return": return `${pad}return ${emitExpr(s.value)}`;
@@ -325,6 +375,8 @@ function emitDecl(d) {
             const params = d.params.map(p => `(${escapeName(p.name)} : ${tyToLean(p.type)})`).join(" ");
             return `def ${d.name} ${params} : ${tyToLean(d.returnType)} :=\n${emitPureExpr(d.body, 1)}`;
         }
+        case "def-by-method":
+            throw new Error("function by method is not supported for Lean backend");
         case "method": {
             const params = d.params.map(p => `(${escapeName(p.name)} : ${tyToLean(p.type)})`).join(" ");
             const lines = [`method ${d.name} ${params} return (res : ${tyToLean(d.returnType)})`];