lemmascript 0.3.3 → 0.5.0

package/tools/dist/dafny-emit.js

@@ -18,6 +18,7 @@ function tyToDafny(ty) {
             return `Option<${tyToDafny(ty.inner)}>`;
         }
         case "user": return ty.name;
+        case "fn": return `(${ty.params.map(tyToDafny).join(", ")}) -> ${tyToDafny(ty.result)}`;
         case "unknown": return "int";
     }
 }
@@ -36,6 +37,10 @@ const DAFNY_KEYWORDS = new Set([
     "by", "calc", "reveal",
 ]);
 function escapeName(name) {
+    // \result is carried through the IR as the var name "\\result"; render it
+    // as Dafny's canonical return-value identifier.
+    if (name === "\\result")
+        return "res";
     if (DAFNY_KEYWORDS.has(name))
         return `${name}_`;
     // Dafny doesn't allow identifiers starting with _
@@ -47,6 +52,13 @@ function escapeName(name) {
 function paramList(params) {
     return params.map(p => `${escapeName(p.name)}: ${tyToDafny(p.type)}`).join(", ");
 }
+/** Format a method signature header, omitting `returns` for void methods.
+ *  Dafny's definite-assignment rule rejects unassigned out-parameters, so a
+ *  `returns (res: ())` on a void method fails verification. */
+function methodHeader(prefix, params, returnType) {
+    const sig = `${prefix}(${paramList(params)})`;
+    return returnType.kind === "void" ? sig : `${sig} returns (res: ${tyToDafny(returnType)})`;
+}
 // ── Lean op → Dafny op ─────────────────────────────────────
 const OP_MAP = {
     "=": "==", "≠": "!=", "≥": ">=", "≤": "<=",
@@ -71,19 +83,42 @@ function emitQuantifier(e, keyword) {
     }
     return `${keyword} ${vars.join(", ")} :: ${emitExpr(body)}`;
 }
+// Dafny's `forall`/`exists ::` body extends as far as possible. So
+// `(forall i :: P(i)) <op> Q` (or `... ==> Q`) would parse with the operator
+// absorbed into the body. Wrap a quantifier in parens to terminate its body
+// before the operator. Only the LEFT operand needs this — a quantifier in
+// right-operand position is fine because its body correctly spans the rest.
+function wrapQuantifier(sub) {
+    const inner = emitExpr(sub);
+    return (sub.kind === "forall" || sub.kind === "exists") ? `(${inner})` : inner;
+}
 function emitExpr(e) {
     switch (e.kind) {
         case "var": return e.name === "undefined" ? "None" : escapeName(e.name);
         case "num": return `${e.value}`;
         case "bool": return e.value ? "true" : "false";
         case "str": return `"${e.value.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n')}"`;
-        case "constructor": return qualifyCtor(e.name, e.type);
+        case "constructor": {
+            // Option constructors (Some/None) may appear in inferred positions
+            // (e.g. lambda result) without an explicit `optional<T>` in any
+            // signature, so request the preamble here.
+            if (e.type === "Option")
+                needPreamble("OptionType");
+            const head = qualifyCtor(e.name, e.type);
+            if (!e.args || e.args.length === 0)
+                return head;
+            return `${head}(${e.args.map(emitExpr).join(", ")})`;
+        }
         case "arrayLiteral":
             if (e.elems.length === 0)
                 return `[]`;
             return `[${e.elems.map(emitExpr).join(", ")}]`;
         case "emptyMap": return `map[]`;
         case "emptySet": return `{}`;
+        case "mapLiteral": {
+            const entries = e.entries.map(en => `${emitExpr(en.key)} := ${emitExpr(en.value)}`);
+            return `map[${entries.join(", ")}]`;
+        }
         case "methodCall": {
             const obj = emitExpr(e.obj);
             const args = e.args.map(emitExpr);
@@ -102,16 +137,45 @@ function emitExpr(e) {
                     return `(${obj} + [${args[0]}])`;
                 if (e.method === "concat")
                     return `(${obj} + [${args[0]}])`;
+                // No-arg slice is a full copy; Dafny seq is an immutable value type, so
+                // the copy is just the seq itself (the idiom for "copy then mutate").
+                if (e.method === "slice" && args.length === 0)
+                    return obj;
                 if (e.method === "slice" && args.length === 1)
                     return `${obj}[${args[0]}..]`;
-                if (e.method === "slice" && args.length === 2)
+                if (e.method === "slice" && args.length === 2) {
+                    // JS slice clamps both bounds; Dafny requires `0 <= lo <= hi <= |s|`.
+                    // Direct slice is default (matches existing case studies that wrote
+                    // bounded calls). Files needing JS clamping opt in via `//@ safe-slice`.
+                    if (_useSafeSlice) {
+                        needPreamble("SafeSlice");
+                        return `SafeSlice(${obj}, ${args[0]}, ${args[1]})`;
+                    }
                     return `${obj}[${args[0]}..${args[1]}]`;
+                }
                 if (e.method === "map")
                     return `Std.Collections.Seq.Map(${args[0]}, ${obj})`;
                 if (e.method === "filter")
                     return `Std.Collections.Seq.Filter(${args[0]}, ${obj})`;
                 if (e.method === "every")
                     return `Std.Collections.Seq.All(${obj}, ${args[0]})`;
+                if (e.method === "findLast") {
+                    needPreamble("OptionType");
+                    needPreamble("SeqFindLast");
+                    return `SeqFindLast(${obj}, ${args[0]})`;
+                }
+                if (e.method === "findIndex") {
+                    needPreamble("SeqFindIndex");
+                    return `SeqFindIndex(${obj}, ${args[0]})`;
+                }
+                if (e.method === "flat" && args.length === 0) {
+                    needPreamble("SeqFlatten");
+                    return `SeqFlatten(${obj})`;
+                }
+                if (e.method === "join") {
+                    needPreamble("SeqJoin");
+                    return `SeqJoin(${obj}, ${args[0]})`;
+                }
                 if (e.method === "some" && e.args[0].kind === "lambda" &&
                     e.args[0].body.length === 1 && e.args[0].body[0].kind === "return") {
                     const lam = e.args[0];
@@ -127,14 +191,46 @@ function emitExpr(e) {
             if (ty === "string") {
                 if (e.method === "indexOf") {
                     needPreamble("StringIndexOf");
+                    if (args.length === 2)
+                        return `StringIndexOfFrom(${obj}, ${args[0]}, ${args[1]})`;
                     return `StringIndexOf(${obj}, ${args[0]})`;
                 }
-                if (e.method === "slice")
+                if (e.method === "split") {
+                    needPreamble("StringSplit");
+                    return `StringSplit(${obj}, ${args[0]})`;
+                }
+                if (e.method === "slice") {
+                    // JS negative index: arr.slice(0, -N) → arr[0..|arr|-N]. After
+                    // transform, unary minus on a numeric literal is folded to a
+                    // negative `num` IR node, so check for that here.
+                    const negVal = (a) => a.kind === "num" && a.value < 0 ? -a.value : null;
+                    const loN = negVal(e.args[0]);
+                    const loEx = loN !== null ? `|${obj}|-${loN}` : args[0];
+                    if (args.length === 1)
+                        return `${obj}[${loEx}..]`;
+                    const hiN = negVal(e.args[1]);
+                    const hiEx = hiN !== null ? `|${obj}|-${hiN}` : args[1];
+                    return `${obj}[${loEx}..${hiEx}]`;
+                }
+                if (e.method === "substring") {
+                    if (args.length === 1)
+                        return `${obj}[${args[0]}..]`;
                     return `${obj}[${args[0]}..${args[1]}]`;
+                }
+                if (e.method === "endsWith")
+                    return `(|${obj}| >= |${args[0]}| && ${obj}[|${obj}|-|${args[0]}|..] == ${args[0]})`;
                 if (e.method === "trim") {
                     needPreamble("StringTrim");
                     return `StringTrim(${obj})`;
                 }
+                if (e.method === "trimEnd") {
+                    needPreamble("StringTrim");
+                    return `StringTrimRight(${obj})`;
+                }
+                if (e.method === "trimStart") {
+                    needPreamble("StringTrim");
+                    return `StringTrimLeft(${obj})`;
+                }
                 if (e.method === "toLowerCase") {
                     needPreamble("StringToLower");
                     return `StringToLower(${obj})`;
@@ -147,6 +243,8 @@ function emitExpr(e) {
                     needPreamble("StringIndexOf");
                     return `(StringIndexOf(${obj}, ${args[0]}) >= 0)`;
                 }
+                if (e.method === "startsWith")
+                    return `(|${obj}| >= |${args[0]}| && ${obj}[..|${args[0]}|] == ${args[0]})`;
                 if (e.method === "charCodeAt")
                     return `(${obj}[${args[0]}] as int)`;
             }
@@ -173,6 +271,20 @@ function emitExpr(e) {
                     return `(${obj} + {${args[0]}})`;
                 if (e.method === "delete")
                     return `(${obj} - {${args[0]}})`;
+                // `.filter(pred)` on a set: extract collapses the JS idiom
+                // `new Set([...s].filter(p))` into `s.filter(p)` with set receiver
+                // (the spread → array → set round-trip is identity over set
+                // semantics). Lower to Dafny set-builder: `set x | x in s && p(x)`.
+                if (e.method === "filter" && e.args.length === 1 && e.args[0].kind === "lambda" &&
+                    e.args[0].body.length === 1 && e.args[0].body[0].kind === "return") {
+                    const lam = e.args[0];
+                    const ret = lam.body[0];
+                    if (ret.kind !== "return")
+                        throw new Error("unreachable");
+                    const p = escapeName(lam.params[0]?.name ?? "x");
+                    const body = emitExpr(ret.value);
+                    return `(set ${p} | ${p} in ${obj} && ${body})`;
+                }
             }
             throw new Error(`Unsupported Dafny method call: .${e.method}() on ${ty}`);
         }
@@ -239,10 +351,10 @@ function emitExpr(e) {
                     return `(${left} ${op} ${right})`;
                 }
             }
-            return `(${emitExpr(e.left)} ${op} ${emitExpr(e.right)})`;
+            return `(${wrapQuantifier(e.left)} ${op} ${emitExpr(e.right)})`;
         }
         case "implies": {
-            const parts = [...e.premises.map(emitExpr), emitExpr(e.conclusion)];
+            const parts = [...e.premises.map(wrapQuantifier), emitExpr(e.conclusion)];
             return `(${parts.join(" ==> ")})`;
         }
         case "app": {
@@ -270,6 +382,14 @@ function emitExpr(e) {
                 needPreamble("MathMin");
             if (e.fn === "MathMax")
                 needPreamble("MathMax");
+            if (e.fn === "MaxOfSeq") {
+                needPreamble("MathMax");
+                needPreamble("MaxOfSeq");
+            }
+            if (e.fn === "MinOfSeq") {
+                needPreamble("MathMin");
+                needPreamble("MinOfSeq");
+            }
             return `${escapeName(e.fn)}(${args.join(", ")})`;
         }
         case "field": {
@@ -285,10 +405,19 @@ function emitExpr(e) {
         case "toNat":
             // Dafny doesn't need toNat — just emit the inner expression
             return emitExpr(e.expr);
-        case "index":
-            return `${emitExpr(e.arr)}[${emitExpr(e.idx)}]`;
+        case "index": {
+            const obj = emitExpr(e.arr);
+            const idx = emitExpr(e.idx);
+            // Plain seq/map subscript. For maps where the result is meant to be
+            // `Option<V>` (the TS `Record<K,V>[k]` shape), transform should have
+            // wrapped this in an Option-coercion; here we just emit the subscript.
+            return `${obj}[${idx}]`;
+        }
         case "record": {
             if (e.spread) {
+                if (e.fields.length === 0) {
+                    return emitExpr(e.spread);
+                }
                 const updates = e.fields.map(f => `${escapeName(f.name)} := ${emitExpr(f.value)}`);
                 return `${emitExpr(e.spread)}.(${updates.join(", ")})`;
             }
@@ -307,8 +436,9 @@ function emitExpr(e) {
             }
             if (ctorName) {
                 const structFields = _structureDecls.get(ctorName);
-                if (structFields && e.fields.length < structFields.length) {
-                    // Pad missing fields: match by name, fill None for optional
+                // Always reorder by struct field name — TS object literal order ≠ Dafny
+                // positional order. Pad missing optional fields with None.
+                if (structFields) {
                     const provided = new Map(e.fields.map(f => [f.name, f]));
                     const vals = structFields.map(sf => {
                         const f = provided.get(sf.name);
@@ -331,7 +461,7 @@ function emitExpr(e) {
             return `(${vals.join(", ")})`;
         }
         case "if":
-            return `if ${emitExpr(e.cond)} then ${emitExpr(e.then)} else ${emitExpr(e.else)}`;
+            return `(if ${emitExpr(e.cond)} then ${emitExpr(e.then)} else ${emitExpr(e.else)})`;
         case "match": {
             const scrut = emitScrutinee(e.scrutinee);
             const arms = e.arms.map(a => `case ${translatePattern(a.pattern)} => ${emitExpr(a.body)}`);
@@ -339,7 +469,7 @@ function emitExpr(e) {
         }
         case "forall": return emitQuantifier(e, "forall");
         case "exists": return emitQuantifier(e, "exists");
-        case "let": return `var ${escapeName(e.name)} := ${emitExpr(e.value)}; ${emitExpr(e.body)}`;
+        case "let": return `(var ${escapeName(e.name)} := ${emitExpr(e.value)}; ${emitExpr(e.body)})`;
         case "havoc": return "*";
     }
 }
@@ -389,7 +519,7 @@ function emitStmt(s, indent) {
         case "ghostAssign":
             return `${pad}${escapeName(s.target)} := ${emitExpr(s.value)};`;
         case "assert":
-            return `${pad}assert ${emitExpr(s.expr)};`;
+            return `${pad}${s.assumed ? "assume {:axiom}" : "assert"} ${emitExpr(s.expr)};`;
         case "bind":
             // Monadic bind shouldn't appear in Dafny mode, emit as regular assign
             return `${pad}${escapeName(s.target)} := ${emitExpr(s.value)};`;
@@ -511,7 +641,7 @@ function emitDecl(d) {
         }
         case "method": {
             const tp = d.typeParams.length > 0 ? `<${d.typeParams.join(", ")}>` : "";
-            const lines = [`method ${d.name}${tp}(${paramList(d.params)}) returns (res: ${tyToDafny(d.returnType)})`];
+            const lines = [methodHeader(`method ${d.name}${tp}`, d.params, d.returnType)];
             for (const r of d.requires)
                 lines.push(`  requires ${emitExpr(r)}`);
             for (const e of d.ensures)
@@ -529,7 +659,7 @@ function emitDecl(d) {
             if (d.fields.length > 0 && d.methods.length > 0)
                 lines.push("");
             for (const m of d.methods) {
-                lines.push(`  method ${m.name}(${paramList(m.params)}) returns (res: ${tyToDafny(m.returnType)})`);
+                lines.push(`  ${methodHeader(`method ${m.name}`, m.params, m.returnType)}`);
                 for (const r of m.requires)
                     lines.push(`    requires ${emitExpr(r)}`);
                 for (const e of m.ensures)
@@ -544,6 +674,18 @@ function emitDecl(d) {
         case "const": {
             return `const ${escapeName(d.name)}: ${tyToDafny(d.type)} := ${emitExpr(d.value)}`;
         }
+        case "extern": {
+            // Body-less Dafny function — `:axiom` makes Dafny accept the missing body
+            // and treats it as an uninterpreted symbol. Any `requires`/`ensures` were
+            // lifted from the source declaration's annotations.
+            const tp = d.typeParams.length > 0 ? `<${d.typeParams.join(", ")}>` : "";
+            const lines = [`function {:axiom} ${escapeName(d.name)}${tp}(${paramList(d.params)}): ${tyToDafny(d.returnType)}`];
+            for (const r of d.requires)
+                lines.push(`  requires ${emitExpr(r)}`);
+            for (const e of d.ensures)
+                lines.push(`  ensures ${emitExpr(e)}`);
+            return lines.join("\n");
+        }
         case "namespace": {
             // Dafny doesn't need namespaces — flatten declarations
             return d.decls.map(emitDecl).join("\n\n");
@@ -555,6 +697,11 @@ function emitDecl(d) {
 /** Preamble tracking — emitters add keys via `needPreamble(key)`, emitDafnyFile emits them. */
 const _neededPreambles = new Set();
 function needPreamble(key) { _neededPreambles.add(key); }
+/** File-level opt-in for JS-clamp semantics on `arr.slice(lo, hi)`. Set by
+ *  `emitDafnyFile` from the `//@ safe-slice` directive; consulted by the
+ *  array-method emit. Off by default — case studies that wrote their `.slice`
+ *  calls with provable bounds get direct `s[lo..hi]` emission. */
+let _useSafeSlice = false;
 const POW2 = `function Pow2(n: int): int
   requires n >= 0
   decreases n
@@ -587,6 +734,31 @@ const CEIL_REAL = `function CeilReal(x: real): int
   if x == (x.Floor as real) then x.Floor
   else x.Floor + 1
 }`;
+const SEQ_FIND_INDEX = `function SeqFindIndex<T>(s: seq<T>, p: T -> bool): int
+  ensures -1 <= SeqFindIndex(s, p) < |s|
+  ensures SeqFindIndex(s, p) >= 0 ==> p(s[SeqFindIndex(s, p)])
+  ensures SeqFindIndex(s, p) >= 0 ==>
+    (forall i: nat :: i < SeqFindIndex(s, p) ==> !p(s[i]))
+  ensures SeqFindIndex(s, p) == -1 ==> (forall i: nat :: i < |s| ==> !p(s[i]))
+{
+  SeqFindIndexFrom(s, p, 0)
+}
+
+function SeqFindIndexFrom<T>(s: seq<T>, p: T -> bool, from: nat): int
+  requires from <= |s|
+  ensures -1 <= SeqFindIndexFrom(s, p, from) < |s|
+  ensures SeqFindIndexFrom(s, p, from) >= 0 ==>
+    from <= SeqFindIndexFrom(s, p, from) && p(s[SeqFindIndexFrom(s, p, from)])
+  ensures SeqFindIndexFrom(s, p, from) >= 0 ==>
+    (forall i: nat :: from <= i < SeqFindIndexFrom(s, p, from) ==> !p(s[i]))
+  ensures SeqFindIndexFrom(s, p, from) == -1 ==>
+    (forall i: nat :: from <= i < |s| ==> !p(s[i]))
+  decreases |s| - from
+{
+  if from >= |s| then -1
+  else if p(s[from]) then from as int
+  else SeqFindIndexFrom(s, p, from + 1)
+}`;
 const SEQ_INDEX_OF = `function SeqIndexOf<T(==)>(s: seq<T>, x: T): int
   ensures -1 <= SeqIndexOf(s, x) < |s|
   ensures SeqIndexOf(s, x) >= 0 ==> s[SeqIndexOf(s, x)] == x
@@ -606,18 +778,75 @@ function SeqIndexOfFrom<T(==)>(s: seq<T>, x: T, from: nat): int
   else if s[from] == x then from as int
   else SeqIndexOfFrom(s, x, from + 1)
 }`;
+const SEQ_FIND_LAST = `function SeqFindLast<T>(s: seq<T>, p: T -> bool): Option<T>
+  ensures SeqFindLast(s, p).Some? ==> p(SeqFindLast(s, p).value)
+  ensures SeqFindLast(s, p).Some? ==> SeqFindLast(s, p).value in s
+  ensures SeqFindLast(s, p).Some? ==>
+    exists i: nat :: i < |s| && s[i] == SeqFindLast(s, p).value && p(s[i]) &&
+                     (forall j: nat :: i < j < |s| ==> !p(s[j]))
+  ensures SeqFindLast(s, p).None? ==> forall i :: 0 <= i < |s| ==> !p(s[i])
+  decreases |s|
+{
+  if |s| == 0 then None
+  else if p(s[|s|-1]) then Some(s[|s|-1])
+  else SeqFindLast(s[..|s|-1], p)
+}`;
+const SEQ_FLATTEN = `function SeqFlatten<T>(s: seq<seq<T>>): seq<T>
+  decreases |s|
+{
+  if |s| == 0 then []
+  else s[0] + SeqFlatten(s[1..])
+}`;
+const SEQ_JOIN = `function SeqJoin(s: seq<string>, sep: string): string
+  decreases |s|
+{
+  if |s| == 0 then ""
+  else if |s| == 1 then s[0]
+  else s[0] + sep + SeqJoin(s[1..], sep)
+}`;
+const SAFE_SLICE = `function SafeSlice<T>(s: seq<T>, lo: int, hi: int): seq<T>
+  ensures |SafeSlice(s, lo, hi)| <= |s|
+{
+  var lo' := if lo < 0 then 0 else if lo > |s| as int then |s| else lo;
+  var hi' := if hi > |s| as int then |s| else if hi < lo' then lo' else hi;
+  s[lo'..hi']
+}`;
 const STRING_INDEX_OF = `function StringIndexOf(s: string, sub: string): int
+  ensures StringIndexOf(s, sub) == -1
+       || (0 <= StringIndexOf(s, sub) <= |s| - |sub| && s[StringIndexOf(s, sub)..StringIndexOf(s, sub) + |sub|] == sub)
 {
   StringIndexOfFrom(s, sub, 0)
 }
 
-function StringIndexOfFrom(s: string, sub: string, from: nat): int
+function StringIndexOfFrom(s: string, sub: string, from: int): int
+  ensures StringIndexOfFrom(s, sub, from) == -1
+       || (0 <= StringIndexOfFrom(s, sub, from) <= |s| - |sub|
+           && s[StringIndexOfFrom(s, sub, from)..StringIndexOfFrom(s, sub, from) + |sub|] == sub
+           && StringIndexOfFrom(s, sub, from) >= from)
+{
+  StringIndexOfFromN(s, sub, if from < 0 then 0 else from)
+}
+
+function StringIndexOfFromN(s: string, sub: string, from: nat): int
   decreases |s| - from
+  ensures StringIndexOfFromN(s, sub, from) == -1
+       || (from <= StringIndexOfFromN(s, sub, from) <= |s| - |sub|
+           && s[StringIndexOfFromN(s, sub, from)..StringIndexOfFromN(s, sub, from) + |sub|] == sub)
 {
   if from + |sub| > |s| then -1
   else if s[from..from + |sub|] == sub then from as int
-  else StringIndexOfFrom(s, sub, from + 1)
+  else StringIndexOfFromN(s, sub, from + 1)
 }`;
+// `s.split(d)` in TS returns a non-empty sequence of segments. Modeled here as
+// an axiom — defining it recursively would force StringIndexOf to grow ensures
+// clauses that callers don't need. The two ensures cover what verification
+// usually wants: result has at least one element, and every element fits
+// within the source length.
+const STRING_SPLIT = `function {:axiom} StringSplit(s: string, d: string): seq<string>
+  requires |d| > 0
+  ensures |StringSplit(s, d)| >= 1
+  ensures |StringSplit(s, d)| <= |s| + 1
+  ensures forall k :: 0 <= k < |StringSplit(s, d)| ==> |StringSplit(s, d)[k]| <= |s|`;
 const STRING_TRIM = `function StringTrimLeft(s: string): string
   ensures |StringTrimLeft(s)| <= |s|
   ensures StringTrimLeft(s) == "" || (|StringTrimLeft(s)| > 0 && StringTrimLeft(s)[0] != ' ')
@@ -663,6 +892,53 @@ const STRING_TO_UPPER = `function StringToUpper(s: string): string
 }`;
 const MATH_MIN = `function MathMin(a: int, b: int): int { if a <= b then a else b }`;
 const MATH_MAX = `function MathMax(a: int, b: int): int { if a >= b then a else b }`;
+const MAX_OF_SEQ = `function MaxOfSeq(s: seq<int>): int
+  requires |s| > 0
+  ensures forall i: nat :: i < |s| ==> s[i] <= MaxOfSeq(s)
+  ensures exists i: nat :: i < |s| && s[i] == MaxOfSeq(s)
+  decreases |s|
+{
+  if |s| == 1 then s[0]
+  else MathMax(s[0], MaxOfSeq(s[1..]))
+}
+
+// Helper for proofs about MaxOfSeq applied to concatenations. Users invoke
+// this in _ensures lemma bodies when Dafny doesn't automatically connect
+// indices through (a + b)[i].
+lemma MaxOfSeqConcat(a: seq<int>, b: seq<int>)
+  requires |a| + |b| > 0
+  ensures forall i: nat :: i < |a| ==> a[i] <= MaxOfSeq(a + b)
+  ensures forall i: nat :: i < |b| ==> b[i] <= MaxOfSeq(a + b)
+{
+  forall i: nat | i < |a| ensures a[i] <= MaxOfSeq(a + b) {
+    assert (a + b)[i] == a[i];
+  }
+  forall i: nat | i < |b| ensures b[i] <= MaxOfSeq(a + b) {
+    assert (a + b)[|a| + i] == b[i];
+  }
+}`;
+const MIN_OF_SEQ = `function MinOfSeq(s: seq<int>): int
+  requires |s| > 0
+  ensures forall i: nat :: i < |s| ==> MinOfSeq(s) <= s[i]
+  ensures exists i: nat :: i < |s| && s[i] == MinOfSeq(s)
+  decreases |s|
+{
+  if |s| == 1 then s[0]
+  else MathMin(s[0], MinOfSeq(s[1..]))
+}
+
+lemma MinOfSeqConcat(a: seq<int>, b: seq<int>)
+  requires |a| + |b| > 0
+  ensures forall i: nat :: i < |a| ==> MinOfSeq(a + b) <= a[i]
+  ensures forall i: nat :: i < |b| ==> MinOfSeq(a + b) <= b[i]
+{
+  forall i: nat | i < |a| ensures MinOfSeq(a + b) <= a[i] {
+    assert (a + b)[i] == a[i];
+  }
+  forall i: nat | i < |b| ensures MinOfSeq(a + b) <= b[i] {
+    assert (a + b)[|a| + i] == b[i];
+  }
+}`;
 const NAT_TO_STRING = `function NatToString(n: nat): string
   decreases n
 {
@@ -700,7 +976,13 @@ const PREAMBLE_CODE = [
     ["CeilReal", CEIL_REAL],
     ["FloorReal", FLOOR_REAL],
     ["SeqIndexOf", SEQ_INDEX_OF],
+    ["SeqFindIndex", SEQ_FIND_INDEX],
+    ["SeqFindLast", SEQ_FIND_LAST],
+    ["SeqFlatten", SEQ_FLATTEN],
+    ["SeqJoin", SEQ_JOIN],
+    ["SafeSlice", SAFE_SLICE],
     ["StringIndexOf", STRING_INDEX_OF],
+    ["StringSplit", STRING_SPLIT],
     ["StringTrim", STRING_TRIM],
     ["StringToLower", STRING_TO_LOWER],
     ["StringToUpper", STRING_TO_UPPER],
@@ -708,6 +990,8 @@ const PREAMBLE_CODE = [
     ["MathAbs", MATH_ABS],
     ["MathMin", MATH_MIN],
     ["MathMax", MATH_MAX],
+    ["MaxOfSeq", MAX_OF_SEQ],
+    ["MinOfSeq", MIN_OF_SEQ],
 ];
 // ── Constructor and record helpers ───────────────────────────
 let _recordCtors = new Map();
@@ -777,7 +1061,8 @@ function translatePattern(pattern) {
     const fieldNames = fields.split(/\s+/).map(escapeName);
     return `${ctorName}(${fieldNames.join(", ")})`;
 }
-export function emitDafnyFile(file, tsFileName) {
+export function emitDafnyFile(file, tsFileName, opts) {
+    _useSafeSlice = !!opts?.safeSlice;
     buildRecordCtorMap(file.decls);
     _neededPreambles.clear();
     // Track successfully emitted pure defs — method wrappers are only