lemmascript 0.3.3 → 0.4.0

package/README.md

@@ -16,9 +16,11 @@ See the external case studies:
 - **[collab-todo-lemmascript](https://github.com/midspiral/collab-todo-lemmascript/)** — collaborative task management web app (React + Supabase) with a verified domain model. Single `domain.ts` imported directly by the UI, hooks, and edge functions — no adapter layer. 123 Dafny lemmas (120 in a separate `domain.proofs.dfy`): 16-conjunct invariant preserved across 25 single-project + 3 cross-project actions, NoOp completeness/soundness, initialization. Dafny only.
 - **[colorwheel-lemmascript](https://github.com/midspiral/colorwheel-lemmascript/)** — verified color palette generator with mood + harmony constraints. 31 Lean proofs + 18 behavioral properties, 115 Dafny lemmas (invariant preservation, commutativity, NoOp completeness).
 - **[clear-split-lemmascript](https://github.com/midspiral/clear-split-lemmascript/)** — greenfield verified expense splitting web app. Conservation theorem, invariant preservation, delta laws — all proven in both Lean (no sorry) and Dafny (56 lemmas).
+- **[github-star-checker-lemmascript](https://github.com/midspiral/github-star-checker-lemmascript/)** — small verified CLI that tracks GitHub star counts across repos and reports per-run deltas. Verifies: per-row diff correctness and `totalDiff == sumDiffs(rows)` (via an inductive `SumDiffs_append` lemma); three sign-classified extractors (gainers / losers / unchanged) with soundness, completeness, **ordered completeness** (gainers appear in the notification in the same order they were listed on the command line), and count/sum equalities against prefix-indexed `upTo` helpers; conservation theorem `decompose(r)` — the three splits partition every row exactly once, and `sumDiffs(increases) + sumDiffs(decreases) == totalDiff`. 33 Dafny VCs, 0 errors; proof additions include a head/tail bridge (`sumDiffs` ↔ `sumDiffsUpTo`) and two partition-on-n inductions. Dafny only.
+- **[equality-game-lemmascript](https://github.com/midspiral/equality-game-lemmascript/)** — greenfield verified arithmetic equality card game (React + Tailwind). Sound + complete decision procedure for "can these two card lists be combined into equal expressions": `canEqualize(L, R) ⟺ ∃ eL, eR. eval(eL) == eval(eR) ∧ multiset(leaves(eL)) == multiset(L) ∧ same for R`. Algorithm is subset-DP over a bitmask `m ∈ [1, 2^n − 1)`; the proof composes a `PopCount` upper/lower bound chain (with stdlib `LemmaDivDenominator` / `LemmaFundamentalDivModConverse`), a `splitLeft`/`splitRight` ↔ imperative-loop connection, a `WitnessCombine` lemma threading existential `Expr` witnesses through the cross-product loops, and a `ChooseMask` combinatorial constructor that, given any sub-multiset of `cards`, produces the realizing mask. Capped by `CompletenessFromMaskCoverage`. **753 verification conditions, 0 errors, 0 `assume`s, 0 axioms** under `--isolate-assertions --verification-time-limit 180`. Dafny only.
 - **[node-casbin-lemmascript](https://github.com/midspiral/node-casbin-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [node-casbin](https://github.com/casbin/node-casbin). 5 functions verified, 217 existing tests pass. End-to-end correctness and order independence for all 4 effect modes in both Lean and Dafny (39 lemmas).
 - **[hono-lemmascript](https://github.com/midspiral/hono-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [hono](https://github.com/honojs/hono)'s security middleware. Two CVEs verified: IP restriction bypass ([CVE-2026-39409](https://github.com/honojs/hono/security/advisories/GHSA-3mpf-rcc7-5347)) and cookie name bypass ([CVE-2026-39410](https://github.com/honojs/hono/security/advisories/GHSA-r5rp-j6wh-rvv4)) — 51 Dafny lemmas. [Cookie verification done **in-place**](https://github.com/midspiral/hono-lemmascript/blob/lemmascript/src/utils/cookie.ts#L79). Dafny only.
-- **[charmchat](https://github.com/CHARM-BDF/charmchat/tree/lemma)** — brownfield verification of an AI agent orchestration backend. `isEmptyResult` (string emptiness predicate, 8 postconditions, <1s) and `topologicalSort` (Kahn's algorithm — memory safety, output bounds, completeness via acyclicity ranking witness, termination; 5 helper lemmas, 28 loop invariants). Dafny only.
+- **[charmchat](https://github.com/CHARM-BDF/charmchat/blob/lemma/README_LemmaScript.md)** — brownfield verification of an AI agent orchestration backend. `isEmptyResult` (string emptiness predicate, 8 postconditions, <1s) and `topologicalSort` (Kahn's algorithm — memory safety, output bounds, completeness via acyclicity ranking witness, termination). Full completeness proof: 23 helper lemmas, 14 opaque ghost predicates, 115 loop invariants; 736 VCs verified under `--isolate-assertions --verification-time-limit 600`. Key technique: snapshot-based inner invariants (`ghost var originalRemDeps := remDeps`) replace the mid-iteration SEEN/UNSEEN split so preservation is frame reasoning against a ghost-constant rather than set-subtraction against mutating state. Dafny only.
 - **[xyflow-lemmascript](https://github.com/midspiral/xyflow-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [xyflow](https://github.com/xyflow/xyflow)'s core edge and geometry utilities. 9 functions verified: `addEdge` (dedup — never loses edges, adds at most one), `reconnectEdge` (replace — bounded length), `connectionExists`, `getEdgeCenter` (midpoint correctness), `clamp` (bounds), `rectToBox`/`boxToRect` (field arithmetic), `getBoundsOfBoxes` (enclosure), `getOverlappingArea` (non-negative), `areSetsEqual` (subset + same size). 14 Dafny proof obligations. Dafny only.
 
 ## Setup
@@ -60,7 +62,7 @@ The Dafny backend generates two files per TS source: `foo.dfy.gen` (always regen
 ### Lean backend
 
 ```sh
-npx lsc gen src/myModule.ts
+npx lsc gen --backend=lean src/myModule.ts
 lake build
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lemmascript",
-  "version": "0.3.3",
+  "version": "0.4.0",
   "description": "A verification toolchain for TypeScript — generates Lean 4 or Dafny from annotated TS",
   "type": "module",
   "bin": {

package/tools/dist/dafny-commands.js

@@ -2,7 +2,7 @@
  * Dafny backend commands: gen, check, regen.
  */
 import { existsSync, readFileSync, writeFileSync, copyFileSync, unlinkSync } from "fs";
-import { execSync } from "child_process";
+import { execFileSync } from "child_process";
 import path from "path";
 function writeGen(genPath, text) {
     writeFileSync(genPath, text);
@@ -18,27 +18,44 @@ export function dafnyGen(genPath, dfyPath, text) {
 export function dafnyCheckDiff(genPath, dfyPath) {
     if (!existsSync(dfyPath))
         return true;
+    let diff = "";
     try {
-        const diff = execSync(`git diff --no-index -- "${genPath}" "${dfyPath}" 2>/dev/null || true`, { encoding: "utf-8" });
-        const deletions = diff.split("\n").filter(l => l.startsWith("-") && !l.startsWith("---"));
-        if (deletions.length > 0) {
-            console.error(`WARNING: ${path.basename(dfyPath)} has modifications to generated lines (not additions-only):`);
-            for (const d of deletions.slice(0, 5))
-                console.error("  " + d);
-            return false;
+        diff = execFileSync("git", ["diff", "--no-index", "--", genPath, dfyPath], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] });
+    }
+    catch (e) {
+        // git diff exits 1 when files differ; stdout still holds the diff
+        if (e && e.stdout != null) {
+            diff = typeof e.stdout === "string" ? e.stdout : e.stdout.toString("utf-8");
+        }
+        else {
+            return true;
         }
     }
-    catch { /* diff not available */ }
+    const deletions = diff.split("\n").filter(l => l.startsWith("-") && !l.startsWith("---"));
+    if (deletions.length > 0) {
+        console.error(`WARNING: ${path.basename(dfyPath)} has modifications to generated lines (not additions-only):`);
+        for (const d of deletions.slice(0, 5))
+            console.error("  " + d);
+        return false;
+    }
     return true;
 }
 export function dafnyVerify(dfyPath, dir, timeLimit, extraFlags) {
     console.log("Running dafny verify...");
     try {
         const content = readFileSync(dfyPath, "utf-8");
-        const stdLibFlag = content.includes("Std.") ? " --standard-libraries" : "";
-        const timeLimitFlag = timeLimit ? ` --verification-time-limit ${timeLimit}` : "";
-        const extra = extraFlags ? ` ${extraFlags}` : "";
-        execSync(`dafny verify${stdLibFlag}${timeLimitFlag}${extra} "${dfyPath}"`, { cwd: dir, stdio: "inherit" });
+        const args = ["verify"];
+        if (content.includes("Std."))
+            args.push("--standard-libraries");
+        if (timeLimit)
+            args.push("--verification-time-limit", String(timeLimit));
+        if (extraFlags) {
+            for (const tok of extraFlags.split(/\s+/))
+                if (tok)
+                    args.push(tok);
+        }
+        args.push(dfyPath);
+        execFileSync("dafny", args, { cwd: dir, stdio: "inherit" });
         return true;
     }
     catch {
@@ -70,7 +87,7 @@ export function dafnyRegen(genPath, dfyPath, basePath, text, dir) {
         const mergedPath = dfyPath + ".merged";
         console.log("Gen changed. Three-way merging...");
         try {
-            execSync(`git merge-file "${dfyPath}" "${basePath}" "${genPath}"`, { stdio: "pipe" });
+            execFileSync("git", ["merge-file", dfyPath, basePath, genPath], { stdio: "pipe" });
             console.log(`Merged: ${path.basename(dfyPath)}`);
         }
         catch (e) {

package/tools/dist/dafny-emit.js

@@ -47,6 +47,13 @@ function escapeName(name) {
 function paramList(params) {
     return params.map(p => `${escapeName(p.name)}: ${tyToDafny(p.type)}`).join(", ");
 }
+/** Format a method signature header, omitting `returns` for void methods.
+ *  Dafny's definite-assignment rule rejects unassigned out-parameters, so a
+ *  `returns (res: ())` on a void method fails verification. */
+function methodHeader(prefix, params, returnType) {
+    const sig = `${prefix}(${paramList(params)})`;
+    return returnType.kind === "void" ? sig : `${sig} returns (res: ${tyToDafny(returnType)})`;
+}
 // ── Lean op → Dafny op ─────────────────────────────────────
 const OP_MAP = {
     "=": "==", "≠": "!=", "≥": ">=", "≤": "<=",
@@ -77,7 +84,12 @@ function emitExpr(e) {
         case "num": return `${e.value}`;
         case "bool": return e.value ? "true" : "false";
         case "str": return `"${e.value.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n')}"`;
-        case "constructor": return qualifyCtor(e.name, e.type);
+        case "constructor": {
+            const head = qualifyCtor(e.name, e.type);
+            if (!e.args || e.args.length === 0)
+                return head;
+            return `${head}(${e.args.map(emitExpr).join(", ")})`;
+        }
         case "arrayLiteral":
             if (e.elems.length === 0)
                 return `[]`;
@@ -331,7 +343,7 @@ function emitExpr(e) {
             return `(${vals.join(", ")})`;
         }
         case "if":
-            return `if ${emitExpr(e.cond)} then ${emitExpr(e.then)} else ${emitExpr(e.else)}`;
+            return `(if ${emitExpr(e.cond)} then ${emitExpr(e.then)} else ${emitExpr(e.else)})`;
         case "match": {
             const scrut = emitScrutinee(e.scrutinee);
             const arms = e.arms.map(a => `case ${translatePattern(a.pattern)} => ${emitExpr(a.body)}`);
@@ -339,7 +351,7 @@ function emitExpr(e) {
         }
         case "forall": return emitQuantifier(e, "forall");
         case "exists": return emitQuantifier(e, "exists");
-        case "let": return `var ${escapeName(e.name)} := ${emitExpr(e.value)}; ${emitExpr(e.body)}`;
+        case "let": return `(var ${escapeName(e.name)} := ${emitExpr(e.value)}; ${emitExpr(e.body)})`;
         case "havoc": return "*";
     }
 }
@@ -511,7 +523,7 @@ function emitDecl(d) {
         }
         case "method": {
             const tp = d.typeParams.length > 0 ? `<${d.typeParams.join(", ")}>` : "";
-            const lines = [`method ${d.name}${tp}(${paramList(d.params)}) returns (res: ${tyToDafny(d.returnType)})`];
+            const lines = [methodHeader(`method ${d.name}${tp}`, d.params, d.returnType)];
             for (const r of d.requires)
                 lines.push(`  requires ${emitExpr(r)}`);
             for (const e of d.ensures)
@@ -529,7 +541,7 @@ function emitDecl(d) {
             if (d.fields.length > 0 && d.methods.length > 0)
                 lines.push("");
             for (const m of d.methods) {
-                lines.push(`  method ${m.name}(${paramList(m.params)}) returns (res: ${tyToDafny(m.returnType)})`);
+                lines.push(`  ${methodHeader(`method ${m.name}`, m.params, m.returnType)}`);
                 for (const r of m.requires)
                     lines.push(`    requires ${emitExpr(r)}`);
                 for (const e of m.ensures)

package/tools/dist/extract.js

@@ -86,32 +86,36 @@ function extractExpr(node) {
         return { kind: "var", name: "this" };
     }
     // Property access: x.foo or x?.foo
+    // Each `?.` is its own short-circuit point — wrap the inner in a new optChain.
+    // Non-`?` continuation of an existing optChain extends the chain (no new
+    // short-circuit, just keep evaluating after the prior `?` succeeded).
     if (Node.isPropertyAccessExpression(node)) {
         const obj = extractExpr(node.getExpression());
         const field = node.getName();
-        // Optional chaining on data access: x?.foo → x !== undefined ? x.foo : undefined
-        // Skip if this is a method call (parent is CallExpression) — handled differently.
         if (node.hasQuestionDotToken()) {
-            const parent = node.getParent();
-            const isMethodCall = parent && Node.isCallExpression(parent) && parent.getExpression() === node;
-            if (!isMethodCall) {
-                return { kind: "conditional",
-                    cond: { kind: "binop", op: "!==", left: obj, right: { kind: "var", name: "undefined" } },
-                    then: { kind: "field", obj, field },
-                    else: { kind: "var", name: "undefined" },
-                };
-            }
+            return { kind: "optChain", obj, chain: [{ kind: "field", name: field }] };
+        }
+        if (obj.kind === "optChain") {
+            return { ...obj, chain: [...obj.chain, { kind: "field", name: field }] };
         }
         return { kind: "field", obj, field };
     }
-    // Element access: arr[i]
+    // Element access: arr[i] or arr?.[i]
     if (Node.isElementAccessExpression(node)) {
         const arg = node.getArgumentExpression();
         if (!arg)
             throw new Error(`Missing index in element access: ${node.getText()}`);
-        return { kind: "index", obj: extractExpr(node.getExpression()), idx: extractExpr(arg) };
+        const obj = extractExpr(node.getExpression());
+        const idx = extractExpr(arg);
+        if (node.hasQuestionDotToken()) {
+            return { kind: "optChain", obj, chain: [{ kind: "index", idx }] };
+        }
+        if (obj.kind === "optChain") {
+            return { ...obj, chain: [...obj.chain, { kind: "index", idx }] };
+        }
+        return { kind: "index", obj, idx };
     }
-    // Call expression: f(a, b)
+    // Call expression: f(a, b), x?.foo() (`?.` on the property), or x?.() (`?.` on call)
     if (Node.isCallExpression(node)) {
         // Object.fromEntries(map) → identity (Map IS Record in Dafny)
         const callee = node.getExpression();
@@ -121,11 +125,15 @@ function extractExpr(node) {
             node.getArguments().length === 1) {
             return extractExpr(node.getArguments()[0]);
         }
-        return {
-            kind: "call",
-            fn: extractExpr(node.getExpression()),
-            args: node.getArguments().map(a => extractExpr(a)),
-        };
+        const fn = extractExpr(callee);
+        const args = node.getArguments().map(a => extractExpr(a));
+        if (node.hasQuestionDotToken()) {
+            return { kind: "optChain", obj: fn, chain: [{ kind: "call", args }] };
+        }
+        if (fn.kind === "optChain") {
+            return { ...fn, chain: [...fn.chain, { kind: "call", args }] };
+        }
+        return { kind: "call", fn, args };
     }
     // Binary expression: a + b, a === b, etc.
     if (Node.isBinaryExpression(node)) {
@@ -135,6 +143,10 @@ function extractExpr(node) {
             // This is an assignment expression; extract as binop for now
             return { kind: "binop", op: "=", left: extractExpr(node.getLeft()), right: extractExpr(node.getRight()) };
         }
+        // Nullish coalescing: a ?? b — single-eval, narrow rewrites to someMatch
+        if (op === "??") {
+            return { kind: "nullish", left: extractExpr(node.getLeft()), right: extractExpr(node.getRight()) };
+        }
         return { kind: "binop", op, left: extractExpr(node.getLeft()), right: extractExpr(node.getRight()) };
     }
     // Prefix unary: !x, -x
@@ -1073,7 +1085,7 @@ export function extractModule(sourceFile) {
         }
         return false;
     }
-    const hasVerifyDirective = allFns.some(hasVerify);
+    const hasVerifyDirective = sourceFile.getFullText().includes('//@ verify');
     const fnsToExtract = hasVerifyDirective ? allFns.filter(hasVerify) : allFns;
     const functions = fnsToExtract.map(f => {
         // For expression-body arrows, annotations come from the parent variable statement

package/tools/dist/lean-emit.js

@@ -75,6 +75,8 @@ function emitMethodCall(tyKind, method, monadic, obj, args) {
             return `${obj}.set! ${args[0]} ${args[1]}`;
         if (method === "push")
             return `Array.push ${obj} ${args[0]}`;
+        if (method === "concat")
+            return `Array.push ${obj} ${args[0]}`;
     }
     // String methods
     if (tyKind === "string") {
@@ -113,7 +115,17 @@ function emitExpr(e, parentPrec) {
         case "num": return `${e.value}`;
         case "bool": return e.value ? "true" : "false";
         case "str": return `"${e.value.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n')}"`;
-        case "constructor": return `.${e.name}`;
+        case "constructor": {
+            // With type: emit `Type.name` (unambiguous; needed in expression positions
+            // like `match ... | .none => Type.some x` where elaboration can't infer).
+            // Without type: emit `.name` (dotted form; works in pattern positions
+            // and where the expected type is clear from context).
+            const head = e.type ? `${e.type}.${e.name}` : `.${e.name}`;
+            if (!e.args || e.args.length === 0)
+                return head;
+            const args = e.args.map(a => (a.kind === "binop" || a.kind === "unop" || a.kind === "implies" || a.kind === "app" || a.kind === "methodCall") ? `(${emitExpr(a)})` : emitExpr(a));
+            return `${head} ${args.join(" ")}`;
+        }
         case "arrayLiteral":
             if (e.elems.length === 0)
                 return `#[]`;
@@ -143,6 +155,13 @@ function emitExpr(e, parentPrec) {
                 return `-${e.expr.value}`;
             return `(-${emitExpr(e.expr)})`;
         case "binop": {
+            // `k in m` (map/set membership) → `m.contains k` in Lean. Dafny has
+            // native `in`; Lean uses the method form for HashMap/HashSet.
+            if (e.op === "in") {
+                const recv = emitExpr(e.right);
+                const wrap = e.right.kind === "binop" || e.right.kind === "app" || e.right.kind === "methodCall";
+                return `${wrap ? `(${recv})` : recv}.contains ${emitExpr(e.left)}`;
+            }
             const op = e.op === "arrayConcat" ? "++" : e.op;
             const s = `${emitExpr(e.left, prec(e.op))} ${op} ${emitExpr(e.right, prec(e.op))}`;
             return (parentPrec !== undefined && prec(e.op) < parentPrec) ? `(${s})` : s;
@@ -182,8 +201,12 @@ function emitExpr(e, parentPrec) {
         case "if":
             return `if ${emitExpr(e.cond)} then ${emitExpr(e.then)} else ${emitExpr(e.else)}`;
         case "match": {
+            // Always parenthesize inline matches — Lean parses alternatives greedily,
+            // so any token after an arm body (`→`, another match's `|`, etc.) would
+            // bleed into the last `.none` case without explicit bracketing.
             const arms = e.arms.map(a => `| ${a.pattern} => ${emitExpr(a.body)}`);
-            return `match ${typeof e.scrutinee === "string" ? e.scrutinee : emitExpr(e.scrutinee)} with ${arms.join(" ")}`;
+            const scrut = typeof e.scrutinee === "string" ? e.scrutinee : emitExpr(e.scrutinee);
+            return `(match ${scrut} with ${arms.join(" ")})`;
         }
         case "forall": return `∀ ${e.var} : ${tyToLean(e.type)}, ${emitExpr(e.body)}`;
         case "exists": return `∃ ${e.var} : ${tyToLean(e.type)}, ${emitExpr(e.body)}`;
@@ -191,6 +214,24 @@ function emitExpr(e, parentPrec) {
         default: throw new Error(`Unsupported Lean expression: ${e.kind}`);
     }
 }
+/** True if the IR expression emits to a Prop-valued Lean term. `transformExpr`
+ *  routes TS comparisons/logicals through `OP_MAP` (`===`→`=`, `&&`→`∧`, `!`→`¬`)
+ *  so these top-level ops land in Prop. `in` stays Bool (emits `.contains`), and
+ *  bare method calls / vars / field accesses remain at their declared type. */
+function isPropValued(e) {
+    switch (e.kind) {
+        case "binop":
+            return ["=", "≠", "≥", "≤", ">", "<", "∧", "∨"].includes(e.op);
+        case "unop":
+            return e.op === "¬";
+        case "implies":
+        case "forall":
+        case "exists":
+            return true;
+        default:
+            return false;
+    }
+}
 // ── Statement emission ──────────────────────────────────────
 function emitStmts(stmts, indent) {
     const pad = "  ".repeat(indent);
@@ -207,7 +248,16 @@ function emitStmt(s, indent) {
         case "ghostLet":
             return `${pad}let mut ${escapeName(s.name)} : ${tyToLean(s.type)} := ${emitExpr(s.value)}`;
         case "ghostAssign": return `${pad}${escapeName(s.target)} := ${emitExpr(s.value)}`;
-        case "assert": return `${pad}assertGadget (${emitExpr(s.expr)})`;
+        case "assert": {
+            // WPGen.assert needs a Prop; bare Bool expressions (`k in m` → `.contains`,
+            // method calls, vars) lack a matching WPGen instance and silently fall back
+            // to WPGen.default, which drops the assertion. Coerce to Prop via `= true`.
+            // Top-level Prop constructs (`=`, `<`, `∧`, `¬`, `∀`, `∃`, `→`) already
+            // land in Prop — Lean auto-coerces inner Bools there.
+            const inner = emitExpr(s.expr);
+            const wrapped = isPropValued(s.expr) ? inner : `(${inner}) = true`;
+            return `${pad}assertGadget (${wrapped})`;
+        }
         case "bind": return `${pad}${escapeName(s.target)} ← ${emitExpr(s.value)}`;
         case "let-bind": return `${pad}let ${s.name} ← ${emitExpr(s.value)}`;
         case "return": return `${pad}return ${emitExpr(s.value)}`;

package/tools/dist/lsc.js

@@ -9,7 +9,9 @@ import { existsSync } from "fs";
 import path from "path";
 import { extractModule } from "./extract.js";
 import { resolveModule } from "./resolve.js";
+import { narrowModule } from "./narrow.js";
 import { transformModuleLean, transformModuleDafny } from "./transform.js";
+import { peepholeModule } from "./peephole.js";
 import { emitLeanFile } from "./lean-emit.js";
 import { emitDafnyFile } from "./dafny-emit.js";
 import { dafnyGen, dafnyCheckDiff, dafnyVerify, dafnyRegen } from "./dafny-commands.js";
@@ -81,12 +83,17 @@ function main() {
         return;
     }
     // Resolve: Raw IR → Typed IR
-    const typed = resolveModule(raw);
+    const resolved = resolveModule(raw);
+    // Narrow: Typed IR → Typed IR (rewrites optional-narrowing patterns to someMatch)
+    const typed = narrowModule(resolved);
     const dir = path.dirname(absPath);
     const base = path.basename(filePath, ".ts");
     // ── Dafny backend ─────────────────────────────────────────
     if (backend === "dafny") {
-        const { typesFile, defFile } = transformModuleDafny(typed);
+        let { typesFile, defFile } = transformModuleDafny(typed);
+        if (typesFile)
+            typesFile = peepholeModule(typesFile, "dafny");
+        defFile = peepholeModule(defFile, "dafny");
         const allDecls = [...(typesFile?.decls ?? []), ...defFile.decls];
         const merged = { ...defFile, decls: allDecls };
         const text = emitDafnyFile(merged, path.basename(filePath));
@@ -121,7 +128,10 @@ function main() {
     // ── Lean backend ──────────────────────────────────────────
     const specPath = path.join(dir, `${base}.spec.lean`);
     const specImport = existsSync(specPath) ? `«${base}.spec»` : undefined;
-    const { typesFile, defFile } = transformModuleLean(typed, specImport);
+    let { typesFile, defFile } = transformModuleLean(typed, specImport);
+    if (typesFile)
+        typesFile = peepholeModule(typesFile, "lean");
+    defFile = peepholeModule(defFile, "lean");
     const typesPath = typesFile ? path.join(dir, `${base}.types.lean`) : null;
     const typesText = typesFile ? emitLeanFile(typesFile) : null;
     const defPath = path.join(dir, `${base}.def.lean`);