lemmascript 0.4.0 → 0.5.1

package/README.md

@@ -2,10 +2,12 @@
 
 A verification toolchain for TypeScript. Write ordinary TypeScript with `//@ ` specification annotations. The toolchain generates verifiable code from your TypeScript — either in Dafny or Lean 4 (with Velvet/Loom).
 
-See [SPEC.md](SPEC.md) and [DESIGN.md](DESIGN.md).
+See [SPEC.md](SPEC.md), [DESIGN.md](DESIGN.md), and [GETTING_STARTED.md](GETTING_STARTED.md).
 
 This is a **Tech Preview**: the core idea is there, but support, semantics, and ergonomics are still evolving.
 
+See our [blog post](https://midspiral.com/blog/lemmascript-a-verification-toolchain-for-typescript/).
+
 ## Examples and Case Studies
 
 Each example and case study is verified in Lean 4 and/or Dafny from the same annotated TypeScript source.
@@ -17,11 +19,14 @@ See the external case studies:
 - **[colorwheel-lemmascript](https://github.com/midspiral/colorwheel-lemmascript/)** — verified color palette generator with mood + harmony constraints. 31 Lean proofs + 18 behavioral properties, 115 Dafny lemmas (invariant preservation, commutativity, NoOp completeness).
 - **[clear-split-lemmascript](https://github.com/midspiral/clear-split-lemmascript/)** — greenfield verified expense splitting web app. Conservation theorem, invariant preservation, delta laws — all proven in both Lean (no sorry) and Dafny (56 lemmas).
 - **[github-star-checker-lemmascript](https://github.com/midspiral/github-star-checker-lemmascript/)** — small verified CLI that tracks GitHub star counts across repos and reports per-run deltas. Verifies: per-row diff correctness and `totalDiff == sumDiffs(rows)` (via an inductive `SumDiffs_append` lemma); three sign-classified extractors (gainers / losers / unchanged) with soundness, completeness, **ordered completeness** (gainers appear in the notification in the same order they were listed on the command line), and count/sum equalities against prefix-indexed `upTo` helpers; conservation theorem `decompose(r)` — the three splits partition every row exactly once, and `sumDiffs(increases) + sumDiffs(decreases) == totalDiff`. 33 Dafny VCs, 0 errors; proof additions include a head/tail bridge (`sumDiffs` ↔ `sumDiffsUpTo`) and two partition-on-n inductions. Dafny only.
-- **[equality-game-lemmascript](https://github.com/midspiral/equality-game-lemmascript/)** — greenfield verified arithmetic equality card game (React + Tailwind). Sound + complete decision procedure for "can these two card lists be combined into equal expressions": `canEqualize(L, R) ⟺ ∃ eL, eR. eval(eL) == eval(eR) ∧ multiset(leaves(eL)) == multiset(L) ∧ same for R`. Algorithm is subset-DP over a bitmask `m ∈ [1, 2^n − 1)`; the proof composes a `PopCount` upper/lower bound chain (with stdlib `LemmaDivDenominator` / `LemmaFundamentalDivModConverse`), a `splitLeft`/`splitRight` ↔ imperative-loop connection, a `WitnessCombine` lemma threading existential `Expr` witnesses through the cross-product loops, and a `ChooseMask` combinatorial constructor that, given any sub-multiset of `cards`, produces the realizing mask. Capped by `CompletenessFromMaskCoverage`. **753 verification conditions, 0 errors, 0 `assume`s, 0 axioms** under `--isolate-assertions --verification-time-limit 180`. Dafny only.
+- **[equality-game-lemmascript](https://github.com/midspiral/equality-game-lemmascript/)** — greenfield verified arithmetic equality card game (React + Tailwind). Sound + complete decision procedure for "can these two card lists be combined into equal expressions": `canEqualize(L, R) ⟺ ∃ eL, eR. eval(eL) == eval(eR) ∧ multiset(leaves(eL)) == multiset(L) ∧ same for R`. Algorithm is subset-DP over a bitmask `m ∈ [1, 2^n − 1)`; the proof composes a `PopCount` upper/lower bound chain (with stdlib `LemmaDivDenominator` / `LemmaFundamentalDivModConverse`), a `splitLeft`/`splitRight` ↔ imperative-loop connection, a `WitnessCombine` lemma threading existential `Expr` witnesses through the cross-product loops, and a `ChooseMask` combinatorial constructor that, given any sub-multiset of `cards`, produces the realizing mask. Capped by `CompletenessFromMaskCoverage`. 753 verification conditions, 0 errors, 0 `assume`s, 0 axioms under `--isolate-assertions --verification-time-limit 180`. Dafny only.
+- **[talktimer-lemmascript](https://github.com/midspiral/talktimer-lemmascript/)** — verified talk timer React app, ported from a Dafny-only [`talktimer-lemmafit`](https://github.com/midspiral/talktimer-lemmafit/) twin. 17-variant `Action` state machine + verified `History` (undo/redo/preview/commitFrom) all in one `domain.ts` — the original Dafny's `Domain refines Kernel` abstract-module pattern inlined since LS has no abstract modules. 108 VCs in `domain.dfy` (invariant preservation) + 123 in `domain.proofs.dfy` (behavioral lemmas + Kernel round-trip). Dafny only.
 - **[node-casbin-lemmascript](https://github.com/midspiral/node-casbin-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [node-casbin](https://github.com/casbin/node-casbin). 5 functions verified, 217 existing tests pass. End-to-end correctness and order independence for all 4 effect modes in both Lean and Dafny (39 lemmas).
-- **[hono-lemmascript](https://github.com/midspiral/hono-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [hono](https://github.com/honojs/hono)'s security middleware. Two CVEs verified: IP restriction bypass ([CVE-2026-39409](https://github.com/honojs/hono/security/advisories/GHSA-3mpf-rcc7-5347)) and cookie name bypass ([CVE-2026-39410](https://github.com/honojs/hono/security/advisories/GHSA-r5rp-j6wh-rvv4)) — 51 Dafny lemmas. [Cookie verification done **in-place**](https://github.com/midspiral/hono-lemmascript/blob/lemmascript/src/utils/cookie.ts#L79). Dafny only.
+- **[hono-lemmascript](https://github.com/midspiral/hono-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [hono](https://github.com/honojs/hono)'s security middleware. Four CVEs covered: IP restriction bypass ([CVE-2026-39409](https://github.com/honojs/hono/security/advisories/GHSA-3mpf-rcc7-5347)) and cookie name bypass ([CVE-2026-39410](https://github.com/honojs/hono/security/advisories/GHSA-r5rp-j6wh-rvv4)) — 51 Dafny lemmas, [cookie verification **in-place**](https://github.com/midspiral/hono-lemmascript/blob/lemmascript/src/utils/cookie.ts#L79); plus `serveStatic`'s URL-encoded directory traversal ([CVE-2024-32869](https://github.com/honojs/hono/security/advisories/GHSA-q5w7-8mq6-2hxq)) + repeated-slash bypass ([CVE-2026-39407](https://github.com/honojs/hono/security/advisories/GHSA-jw53-c2g8-vmwm)), proved as a *composition* — `decode(rawPath)` before `check(decoded)`, so a buggy implementation that reordered the steps would fail the proof. First use of `//@ assume` + `//@ havoc`-on-assign. Dafny only.
 - **[charmchat](https://github.com/CHARM-BDF/charmchat/blob/lemma/README_LemmaScript.md)** — brownfield verification of an AI agent orchestration backend. `isEmptyResult` (string emptiness predicate, 8 postconditions, <1s) and `topologicalSort` (Kahn's algorithm — memory safety, output bounds, completeness via acyclicity ranking witness, termination). Full completeness proof: 23 helper lemmas, 14 opaque ghost predicates, 115 loop invariants; 736 VCs verified under `--isolate-assertions --verification-time-limit 600`. Key technique: snapshot-based inner invariants (`ghost var originalRemDeps := remDeps`) replace the mid-iteration SEEN/UNSEEN split so preservation is frame reasoning against a ghost-constant rather than set-subtraction against mutating state. Dafny only.
-- **[xyflow-lemmascript](https://github.com/midspiral/xyflow-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [xyflow](https://github.com/xyflow/xyflow)'s core edge and geometry utilities. 9 functions verified: `addEdge` (dedup — never loses edges, adds at most one), `reconnectEdge` (replace — bounded length), `connectionExists`, `getEdgeCenter` (midpoint correctness), `clamp` (bounds), `rectToBox`/`boxToRect` (field arithmetic), `getBoundsOfBoxes` (enclosure), `getOverlappingArea` (non-negative), `areSetsEqual` (subset + same size). 14 Dafny proof obligations. Dafny only.
+- **[xyflow-lemmascript](https://github.com/midspiral/xyflow-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [xyflow](https://github.com/xyflow/xyflow)'s core edge and geometry utilities. 9 functions verified: `addEdge` (dedup — never loses edges, adds at most one), `reconnectEdge` (semantic: under a unique-id precondition, the result is in-place — `|result| ≤ |edges|`, no insertion — *and* when a matching edge existed with non-empty new endpoints, the output contains an edge with those endpoints. Uses `//@ assume` to characterize destructuring, `find`, and the constructed edge), `connectionExists`, `getEdgeCenter` (midpoint correctness), `clamp` (bounds), `rectToBox`/`boxToRect` (field arithmetic), `getBoundsOfBoxes` (enclosure), `getOverlappingArea` (non-negative), `areSetsEqual` (subset + same size). 14 Dafny proof obligations. Dafny only.
+- **[rallly-lemmascript](https://github.com/midspiral/rallly-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [rallly](https://github.com/lukevella/rallly)'s meeting-poll Next.js app. 2 functions: `validateRedirectUrl` (in-place — open-redirect predicate; non-`undefined` outputs start with `/` but not `//`) and `scorePoll` (extracted ranking core — length preservation, score bounds, top-choice characterization, score-formula equality, within-poll monotonicity, tiebreaker injectivity). The injectivity proof surfaced a real spec-level constraint on the existing `(yes + ifNeedBe) * 1000 + yes` encoding: it overflows when an option has ≥ 1000 yes votes. 10 Dafny VCs, 0 errors. Drove four toolchain additions: `s.startsWith()`, `T | null` nullability, `\result` narrowing under `==>`, `Math.max(...arr)` spread. Dafny only.
+- **[opencode-lemmascript](https://github.com/midspiral/opencode-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [opencode](https://github.com/anomalyco/opencode)'s permission system and unified-diff patch parser. Highlights: (1) `Patch.parsePatch` carries conservation loop invariants over local ghost state — a parser bug here would silently corrupt user files when an AI applies a patch, and (2) the permission-engine work mechanically closes opencode bug #26514 (subagents bypassing Plan Mode's file-edit restrictions). 9 functions verified in-place, 0 errors. Dafny only.
 
 ## Setup
 
@@ -84,17 +89,17 @@ lake build
 
 | File | Generated? | Purpose |
 |------|-----------|---------|
-| `foo.ts` | — | TypeScript source with `//@ ` annotations |
-| `foo.dfy.gen` | Yes | Generated Dafny (merge base, always regeneratable) |
-| `foo.dfy` | Yes (initial) | Annotated Dafny (gen + proof additions) |
+| [**.ts**](examples/majority.ts) | — | TypeScript source with `//@ ` annotations |
+| [**.dfy.gen**](examples/majority.dfy.gen) | Yes | Generated Dafny (merge base, always regeneratable) |
+| [**.dfy**](examples/majority.dfy) | Yes (initial) | Annotated Dafny (gen + proof additions) |
 
 ### Lean backend
 
 | File | Generated? | Purpose |
 |------|-----------|---------|
-| `foo.ts` | — | TypeScript source with `//@ ` annotations |
-| `foo.types.lean` | Yes | Lean types, `namespace Pure` defs |
-| `foo.spec.lean` | No | Ghost definitions, helper lemmas |
-| `foo.def.lean` | Yes | Velvet method definitions |
-| `foo.proof.lean` | No | `prove_correct` with proof tactics |
+| [**.ts**](examples/majority.ts) | — | TypeScript source with `//@ ` annotations |
+| [**.types.lean**](examples/majority.types.lean) | Yes | Lean types, `namespace Pure` defs |
+| [**.spec.lean**](examples/majority.spec.lean) | No | Ghost definitions, helper lemmas |
+| [**.def.lean**](examples/majority.def.lean) | Yes | Velvet method definitions |
+| [**.proof.lean**](examples/majority.proof.lean) | No | `prove_correct` with proof tactics |
 

package/package.json

@@ -1,8 +1,11 @@
 {
   "name": "lemmascript",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "A verification toolchain for TypeScript — generates Lean 4 or Dafny from annotated TS",
   "type": "module",
+  "engines": {
+    "node": ">=18"
+  },
   "bin": {
     "lsc": "tools/dist/lsc.js"
   },

package/tools/dist/dafny-emit.js

@@ -18,6 +18,7 @@ function tyToDafny(ty) {
             return `Option<${tyToDafny(ty.inner)}>`;
         }
         case "user": return ty.name;
+        case "fn": return `(${ty.params.map(tyToDafny).join(", ")}) -> ${tyToDafny(ty.result)}`;
         case "unknown": return "int";
     }
 }
@@ -34,8 +35,21 @@ const DAFNY_KEYWORDS = new Set([
     "datatype", "type", "const", "ghost", "static",
     "reads", "modifies", "assert", "assume", "print",
     "by", "calc", "reveal",
+    // Further reserved words (validated against the Dafny parser) that are also
+    // legal TS identifiers. `this` stays excluded above — class methods emit it
+    // directly. `then`/`else` already covered.
+    "bool", "char", "int", "nat", "real", "string", "object", "array",
+    "as", "is", "label", "modify", "expect", "yield", "yields", "returns",
+    "unchanged", "witness", "constructor", "iterator", "abstract", "extends",
+    "refines", "opened", "provides", "reveals", "include", "newtype",
+    "codatatype", "nameonly", "twostate", "opaque", "replaceable", "colemma",
+    "copredicate", "inductive",
 ]);
 function escapeName(name) {
+    // \result is carried through the IR as the var name "\\result"; render it
+    // as Dafny's canonical return-value identifier.
+    if (name === "\\result")
+        return "res";
     if (DAFNY_KEYWORDS.has(name))
         return `${name}_`;
     // Dafny doesn't allow identifiers starting with _
@@ -78,6 +92,15 @@ function emitQuantifier(e, keyword) {
     }
     return `${keyword} ${vars.join(", ")} :: ${emitExpr(body)}`;
 }
+// Dafny's `forall`/`exists ::` body extends as far as possible. So
+// `(forall i :: P(i)) <op> Q` (or `... ==> Q`) would parse with the operator
+// absorbed into the body. Wrap a quantifier in parens to terminate its body
+// before the operator. Only the LEFT operand needs this — a quantifier in
+// right-operand position is fine because its body correctly spans the rest.
+function wrapQuantifier(sub) {
+    const inner = emitExpr(sub);
+    return (sub.kind === "forall" || sub.kind === "exists") ? `(${inner})` : inner;
+}
 function emitExpr(e) {
     switch (e.kind) {
         case "var": return e.name === "undefined" ? "None" : escapeName(e.name);
@@ -85,6 +108,11 @@ function emitExpr(e) {
         case "bool": return e.value ? "true" : "false";
         case "str": return `"${e.value.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n')}"`;
         case "constructor": {
+            // Option constructors (Some/None) may appear in inferred positions
+            // (e.g. lambda result) without an explicit `optional<T>` in any
+            // signature, so request the preamble here.
+            if (e.type === "Option")
+                needPreamble("OptionType");
             const head = qualifyCtor(e.name, e.type);
             if (!e.args || e.args.length === 0)
                 return head;
@@ -96,6 +124,10 @@ function emitExpr(e) {
             return `[${e.elems.map(emitExpr).join(", ")}]`;
         case "emptyMap": return `map[]`;
         case "emptySet": return `{}`;
+        case "mapLiteral": {
+            const entries = e.entries.map(en => `${emitExpr(en.key)} := ${emitExpr(en.value)}`);
+            return `map[${entries.join(", ")}]`;
+        }
         case "methodCall": {
             const obj = emitExpr(e.obj);
             const args = e.args.map(emitExpr);
@@ -114,16 +146,45 @@ function emitExpr(e) {
                     return `(${obj} + [${args[0]}])`;
                 if (e.method === "concat")
                     return `(${obj} + [${args[0]}])`;
+                // No-arg slice is a full copy; Dafny seq is an immutable value type, so
+                // the copy is just the seq itself (the idiom for "copy then mutate").
+                if (e.method === "slice" && args.length === 0)
+                    return obj;
                 if (e.method === "slice" && args.length === 1)
                     return `${obj}[${args[0]}..]`;
-                if (e.method === "slice" && args.length === 2)
+                if (e.method === "slice" && args.length === 2) {
+                    // JS slice clamps both bounds; Dafny requires `0 <= lo <= hi <= |s|`.
+                    // Direct slice is default (matches existing case studies that wrote
+                    // bounded calls). Files needing JS clamping opt in via `//@ safe-slice`.
+                    if (_useSafeSlice) {
+                        needPreamble("SafeSlice");
+                        return `SafeSlice(${obj}, ${args[0]}, ${args[1]})`;
+                    }
                     return `${obj}[${args[0]}..${args[1]}]`;
+                }
                 if (e.method === "map")
                     return `Std.Collections.Seq.Map(${args[0]}, ${obj})`;
                 if (e.method === "filter")
                     return `Std.Collections.Seq.Filter(${args[0]}, ${obj})`;
                 if (e.method === "every")
                     return `Std.Collections.Seq.All(${obj}, ${args[0]})`;
+                if (e.method === "findLast") {
+                    needPreamble("OptionType");
+                    needPreamble("SeqFindLast");
+                    return `SeqFindLast(${obj}, ${args[0]})`;
+                }
+                if (e.method === "findIndex") {
+                    needPreamble("SeqFindIndex");
+                    return `SeqFindIndex(${obj}, ${args[0]})`;
+                }
+                if (e.method === "flat" && args.length === 0) {
+                    needPreamble("SeqFlatten");
+                    return `SeqFlatten(${obj})`;
+                }
+                if (e.method === "join") {
+                    needPreamble("SeqJoin");
+                    return `SeqJoin(${obj}, ${args[0]})`;
+                }
                 if (e.method === "some" && e.args[0].kind === "lambda" &&
                     e.args[0].body.length === 1 && e.args[0].body[0].kind === "return") {
                     const lam = e.args[0];
@@ -139,14 +200,46 @@ function emitExpr(e) {
             if (ty === "string") {
                 if (e.method === "indexOf") {
                     needPreamble("StringIndexOf");
+                    if (args.length === 2)
+                        return `StringIndexOfFrom(${obj}, ${args[0]}, ${args[1]})`;
                     return `StringIndexOf(${obj}, ${args[0]})`;
                 }
-                if (e.method === "slice")
+                if (e.method === "split") {
+                    needPreamble("StringSplit");
+                    return `StringSplit(${obj}, ${args[0]})`;
+                }
+                if (e.method === "slice") {
+                    // JS negative index: arr.slice(0, -N) → arr[0..|arr|-N]. After
+                    // transform, unary minus on a numeric literal is folded to a
+                    // negative `num` IR node, so check for that here.
+                    const negVal = (a) => a.kind === "num" && a.value < 0 ? -a.value : null;
+                    const loN = negVal(e.args[0]);
+                    const loEx = loN !== null ? `|${obj}|-${loN}` : args[0];
+                    if (args.length === 1)
+                        return `${obj}[${loEx}..]`;
+                    const hiN = negVal(e.args[1]);
+                    const hiEx = hiN !== null ? `|${obj}|-${hiN}` : args[1];
+                    return `${obj}[${loEx}..${hiEx}]`;
+                }
+                if (e.method === "substring") {
+                    if (args.length === 1)
+                        return `${obj}[${args[0]}..]`;
                     return `${obj}[${args[0]}..${args[1]}]`;
+                }
+                if (e.method === "endsWith")
+                    return `(|${obj}| >= |${args[0]}| && ${obj}[|${obj}|-|${args[0]}|..] == ${args[0]})`;
                 if (e.method === "trim") {
                     needPreamble("StringTrim");
                     return `StringTrim(${obj})`;
                 }
+                if (e.method === "trimEnd") {
+                    needPreamble("StringTrim");
+                    return `StringTrimRight(${obj})`;
+                }
+                if (e.method === "trimStart") {
+                    needPreamble("StringTrim");
+                    return `StringTrimLeft(${obj})`;
+                }
                 if (e.method === "toLowerCase") {
                     needPreamble("StringToLower");
                     return `StringToLower(${obj})`;
@@ -159,6 +252,8 @@ function emitExpr(e) {
                     needPreamble("StringIndexOf");
                     return `(StringIndexOf(${obj}, ${args[0]}) >= 0)`;
                 }
+                if (e.method === "startsWith")
+                    return `(|${obj}| >= |${args[0]}| && ${obj}[..|${args[0]}|] == ${args[0]})`;
                 if (e.method === "charCodeAt")
                     return `(${obj}[${args[0]}] as int)`;
             }
@@ -185,6 +280,20 @@ function emitExpr(e) {
                     return `(${obj} + {${args[0]}})`;
                 if (e.method === "delete")
                     return `(${obj} - {${args[0]}})`;
+                // `.filter(pred)` on a set: extract collapses the JS idiom
+                // `new Set([...s].filter(p))` into `s.filter(p)` with set receiver
+                // (the spread → array → set round-trip is identity over set
+                // semantics). Lower to Dafny set-builder: `set x | x in s && p(x)`.
+                if (e.method === "filter" && e.args.length === 1 && e.args[0].kind === "lambda" &&
+                    e.args[0].body.length === 1 && e.args[0].body[0].kind === "return") {
+                    const lam = e.args[0];
+                    const ret = lam.body[0];
+                    if (ret.kind !== "return")
+                        throw new Error("unreachable");
+                    const p = escapeName(lam.params[0]?.name ?? "x");
+                    const body = emitExpr(ret.value);
+                    return `(set ${p} | ${p} in ${obj} && ${body})`;
+                }
             }
             throw new Error(`Unsupported Dafny method call: .${e.method}() on ${ty}`);
         }
@@ -251,10 +360,10 @@ function emitExpr(e) {
                     return `(${left} ${op} ${right})`;
                 }
             }
-            return `(${emitExpr(e.left)} ${op} ${emitExpr(e.right)})`;
+            return `(${wrapQuantifier(e.left)} ${op} ${emitExpr(e.right)})`;
         }
         case "implies": {
-            const parts = [...e.premises.map(emitExpr), emitExpr(e.conclusion)];
+            const parts = [...e.premises.map(wrapQuantifier), emitExpr(e.conclusion)];
             return `(${parts.join(" ==> ")})`;
         }
         case "app": {
@@ -282,6 +391,14 @@ function emitExpr(e) {
                 needPreamble("MathMin");
             if (e.fn === "MathMax")
                 needPreamble("MathMax");
+            if (e.fn === "MaxOfSeq") {
+                needPreamble("MathMax");
+                needPreamble("MaxOfSeq");
+            }
+            if (e.fn === "MinOfSeq") {
+                needPreamble("MathMin");
+                needPreamble("MinOfSeq");
+            }
             return `${escapeName(e.fn)}(${args.join(", ")})`;
         }
         case "field": {
@@ -297,10 +414,19 @@ function emitExpr(e) {
         case "toNat":
             // Dafny doesn't need toNat — just emit the inner expression
             return emitExpr(e.expr);
-        case "index":
-            return `${emitExpr(e.arr)}[${emitExpr(e.idx)}]`;
+        case "index": {
+            const obj = emitExpr(e.arr);
+            const idx = emitExpr(e.idx);
+            // Plain seq/map subscript. For maps where the result is meant to be
+            // `Option<V>` (the TS `Record<K,V>[k]` shape), transform should have
+            // wrapped this in an Option-coercion; here we just emit the subscript.
+            return `${obj}[${idx}]`;
+        }
         case "record": {
             if (e.spread) {
+                if (e.fields.length === 0) {
+                    return emitExpr(e.spread);
+                }
                 const updates = e.fields.map(f => `${escapeName(f.name)} := ${emitExpr(f.value)}`);
                 return `${emitExpr(e.spread)}.(${updates.join(", ")})`;
             }
@@ -319,8 +445,9 @@ function emitExpr(e) {
             }
             if (ctorName) {
                 const structFields = _structureDecls.get(ctorName);
-                if (structFields && e.fields.length < structFields.length) {
-                    // Pad missing fields: match by name, fill None for optional
+                // Always reorder by struct field name — TS object literal order ≠ Dafny
+                // positional order. Pad missing optional fields with None.
+                if (structFields) {
                     const provided = new Map(e.fields.map(f => [f.name, f]));
                     const vals = structFields.map(sf => {
                         const f = provided.get(sf.name);
@@ -401,7 +528,7 @@ function emitStmt(s, indent) {
         case "ghostAssign":
             return `${pad}${escapeName(s.target)} := ${emitExpr(s.value)};`;
         case "assert":
-            return `${pad}assert ${emitExpr(s.expr)};`;
+            return `${pad}${s.assumed ? "assume {:axiom}" : "assert"} ${emitExpr(s.expr)};`;
         case "bind":
             // Monadic bind shouldn't appear in Dafny mode, emit as regular assign
             return `${pad}${escapeName(s.target)} := ${emitExpr(s.value)};`;
@@ -556,6 +683,18 @@ function emitDecl(d) {
         case "const": {
             return `const ${escapeName(d.name)}: ${tyToDafny(d.type)} := ${emitExpr(d.value)}`;
         }
+        case "extern": {
+            // Body-less Dafny function — `:axiom` makes Dafny accept the missing body
+            // and treats it as an uninterpreted symbol. Any `requires`/`ensures` were
+            // lifted from the source declaration's annotations.
+            const tp = d.typeParams.length > 0 ? `<${d.typeParams.join(", ")}>` : "";
+            const lines = [`function {:axiom} ${escapeName(d.name)}${tp}(${paramList(d.params)}): ${tyToDafny(d.returnType)}`];
+            for (const r of d.requires)
+                lines.push(`  requires ${emitExpr(r)}`);
+            for (const e of d.ensures)
+                lines.push(`  ensures ${emitExpr(e)}`);
+            return lines.join("\n");
+        }
         case "namespace": {
             // Dafny doesn't need namespaces — flatten declarations
             return d.decls.map(emitDecl).join("\n\n");
@@ -567,6 +706,11 @@ function emitDecl(d) {
 /** Preamble tracking — emitters add keys via `needPreamble(key)`, emitDafnyFile emits them. */
 const _neededPreambles = new Set();
 function needPreamble(key) { _neededPreambles.add(key); }
+/** File-level opt-in for JS-clamp semantics on `arr.slice(lo, hi)`. Set by
+ *  `emitDafnyFile` from the `//@ safe-slice` directive; consulted by the
+ *  array-method emit. Off by default — case studies that wrote their `.slice`
+ *  calls with provable bounds get direct `s[lo..hi]` emission. */
+let _useSafeSlice = false;
 const POW2 = `function Pow2(n: int): int
   requires n >= 0
   decreases n
@@ -599,6 +743,31 @@ const CEIL_REAL = `function CeilReal(x: real): int
   if x == (x.Floor as real) then x.Floor
   else x.Floor + 1
 }`;
+const SEQ_FIND_INDEX = `function SeqFindIndex<T>(s: seq<T>, p: T -> bool): int
+  ensures -1 <= SeqFindIndex(s, p) < |s|
+  ensures SeqFindIndex(s, p) >= 0 ==> p(s[SeqFindIndex(s, p)])
+  ensures SeqFindIndex(s, p) >= 0 ==>
+    (forall i: nat :: i < SeqFindIndex(s, p) ==> !p(s[i]))
+  ensures SeqFindIndex(s, p) == -1 ==> (forall i: nat :: i < |s| ==> !p(s[i]))
+{
+  SeqFindIndexFrom(s, p, 0)
+}
+
+function SeqFindIndexFrom<T>(s: seq<T>, p: T -> bool, from: nat): int
+  requires from <= |s|
+  ensures -1 <= SeqFindIndexFrom(s, p, from) < |s|
+  ensures SeqFindIndexFrom(s, p, from) >= 0 ==>
+    from <= SeqFindIndexFrom(s, p, from) && p(s[SeqFindIndexFrom(s, p, from)])
+  ensures SeqFindIndexFrom(s, p, from) >= 0 ==>
+    (forall i: nat :: from <= i < SeqFindIndexFrom(s, p, from) ==> !p(s[i]))
+  ensures SeqFindIndexFrom(s, p, from) == -1 ==>
+    (forall i: nat :: from <= i < |s| ==> !p(s[i]))
+  decreases |s| - from
+{
+  if from >= |s| then -1
+  else if p(s[from]) then from as int
+  else SeqFindIndexFrom(s, p, from + 1)
+}`;
 const SEQ_INDEX_OF = `function SeqIndexOf<T(==)>(s: seq<T>, x: T): int
   ensures -1 <= SeqIndexOf(s, x) < |s|
   ensures SeqIndexOf(s, x) >= 0 ==> s[SeqIndexOf(s, x)] == x
@@ -618,18 +787,75 @@ function SeqIndexOfFrom<T(==)>(s: seq<T>, x: T, from: nat): int
   else if s[from] == x then from as int
   else SeqIndexOfFrom(s, x, from + 1)
 }`;
+const SEQ_FIND_LAST = `function SeqFindLast<T>(s: seq<T>, p: T -> bool): Option<T>
+  ensures SeqFindLast(s, p).Some? ==> p(SeqFindLast(s, p).value)
+  ensures SeqFindLast(s, p).Some? ==> SeqFindLast(s, p).value in s
+  ensures SeqFindLast(s, p).Some? ==>
+    exists i: nat :: i < |s| && s[i] == SeqFindLast(s, p).value && p(s[i]) &&
+                     (forall j: nat :: i < j < |s| ==> !p(s[j]))
+  ensures SeqFindLast(s, p).None? ==> forall i :: 0 <= i < |s| ==> !p(s[i])
+  decreases |s|
+{
+  if |s| == 0 then None
+  else if p(s[|s|-1]) then Some(s[|s|-1])
+  else SeqFindLast(s[..|s|-1], p)
+}`;
+const SEQ_FLATTEN = `function SeqFlatten<T>(s: seq<seq<T>>): seq<T>
+  decreases |s|
+{
+  if |s| == 0 then []
+  else s[0] + SeqFlatten(s[1..])
+}`;
+const SEQ_JOIN = `function SeqJoin(s: seq<string>, sep: string): string
+  decreases |s|
+{
+  if |s| == 0 then ""
+  else if |s| == 1 then s[0]
+  else s[0] + sep + SeqJoin(s[1..], sep)
+}`;
+const SAFE_SLICE = `function SafeSlice<T>(s: seq<T>, lo: int, hi: int): seq<T>
+  ensures |SafeSlice(s, lo, hi)| <= |s|
+{
+  var lo' := if lo < 0 then 0 else if lo > |s| as int then |s| else lo;
+  var hi' := if hi > |s| as int then |s| else if hi < lo' then lo' else hi;
+  s[lo'..hi']
+}`;
 const STRING_INDEX_OF = `function StringIndexOf(s: string, sub: string): int
+  ensures StringIndexOf(s, sub) == -1
+       || (0 <= StringIndexOf(s, sub) <= |s| - |sub| && s[StringIndexOf(s, sub)..StringIndexOf(s, sub) + |sub|] == sub)
 {
   StringIndexOfFrom(s, sub, 0)
 }
 
-function StringIndexOfFrom(s: string, sub: string, from: nat): int
+function StringIndexOfFrom(s: string, sub: string, from: int): int
+  ensures StringIndexOfFrom(s, sub, from) == -1
+       || (0 <= StringIndexOfFrom(s, sub, from) <= |s| - |sub|
+           && s[StringIndexOfFrom(s, sub, from)..StringIndexOfFrom(s, sub, from) + |sub|] == sub
+           && StringIndexOfFrom(s, sub, from) >= from)
+{
+  StringIndexOfFromN(s, sub, if from < 0 then 0 else from)
+}
+
+function StringIndexOfFromN(s: string, sub: string, from: nat): int
   decreases |s| - from
+  ensures StringIndexOfFromN(s, sub, from) == -1
+       || (from <= StringIndexOfFromN(s, sub, from) <= |s| - |sub|
+           && s[StringIndexOfFromN(s, sub, from)..StringIndexOfFromN(s, sub, from) + |sub|] == sub)
 {
   if from + |sub| > |s| then -1
   else if s[from..from + |sub|] == sub then from as int
-  else StringIndexOfFrom(s, sub, from + 1)
+  else StringIndexOfFromN(s, sub, from + 1)
 }`;
+// `s.split(d)` in TS returns a non-empty sequence of segments. Modeled here as
+// an axiom — defining it recursively would force StringIndexOf to grow ensures
+// clauses that callers don't need. The two ensures cover what verification
+// usually wants: result has at least one element, and every element fits
+// within the source length.
+const STRING_SPLIT = `function {:axiom} StringSplit(s: string, d: string): seq<string>
+  requires |d| > 0
+  ensures |StringSplit(s, d)| >= 1
+  ensures |StringSplit(s, d)| <= |s| + 1
+  ensures forall k :: 0 <= k < |StringSplit(s, d)| ==> |StringSplit(s, d)[k]| <= |s|`;
 const STRING_TRIM = `function StringTrimLeft(s: string): string
   ensures |StringTrimLeft(s)| <= |s|
   ensures StringTrimLeft(s) == "" || (|StringTrimLeft(s)| > 0 && StringTrimLeft(s)[0] != ' ')
@@ -675,6 +901,53 @@ const STRING_TO_UPPER = `function StringToUpper(s: string): string
 }`;
 const MATH_MIN = `function MathMin(a: int, b: int): int { if a <= b then a else b }`;
 const MATH_MAX = `function MathMax(a: int, b: int): int { if a >= b then a else b }`;
+const MAX_OF_SEQ = `function MaxOfSeq(s: seq<int>): int
+  requires |s| > 0
+  ensures forall i: nat :: i < |s| ==> s[i] <= MaxOfSeq(s)
+  ensures exists i: nat :: i < |s| && s[i] == MaxOfSeq(s)
+  decreases |s|
+{
+  if |s| == 1 then s[0]
+  else MathMax(s[0], MaxOfSeq(s[1..]))
+}
+
+// Helper for proofs about MaxOfSeq applied to concatenations. Users invoke
+// this in _ensures lemma bodies when Dafny doesn't automatically connect
+// indices through (a + b)[i].
+lemma MaxOfSeqConcat(a: seq<int>, b: seq<int>)
+  requires |a| + |b| > 0
+  ensures forall i: nat :: i < |a| ==> a[i] <= MaxOfSeq(a + b)
+  ensures forall i: nat :: i < |b| ==> b[i] <= MaxOfSeq(a + b)
+{
+  forall i: nat | i < |a| ensures a[i] <= MaxOfSeq(a + b) {
+    assert (a + b)[i] == a[i];
+  }
+  forall i: nat | i < |b| ensures b[i] <= MaxOfSeq(a + b) {
+    assert (a + b)[|a| + i] == b[i];
+  }
+}`;
+const MIN_OF_SEQ = `function MinOfSeq(s: seq<int>): int
+  requires |s| > 0
+  ensures forall i: nat :: i < |s| ==> MinOfSeq(s) <= s[i]
+  ensures exists i: nat :: i < |s| && s[i] == MinOfSeq(s)
+  decreases |s|
+{
+  if |s| == 1 then s[0]
+  else MathMin(s[0], MinOfSeq(s[1..]))
+}
+
+lemma MinOfSeqConcat(a: seq<int>, b: seq<int>)
+  requires |a| + |b| > 0
+  ensures forall i: nat :: i < |a| ==> MinOfSeq(a + b) <= a[i]
+  ensures forall i: nat :: i < |b| ==> MinOfSeq(a + b) <= b[i]
+{
+  forall i: nat | i < |a| ensures MinOfSeq(a + b) <= a[i] {
+    assert (a + b)[i] == a[i];
+  }
+  forall i: nat | i < |b| ensures MinOfSeq(a + b) <= b[i] {
+    assert (a + b)[|a| + i] == b[i];
+  }
+}`;
 const NAT_TO_STRING = `function NatToString(n: nat): string
   decreases n
 {
@@ -712,7 +985,13 @@ const PREAMBLE_CODE = [
     ["CeilReal", CEIL_REAL],
     ["FloorReal", FLOOR_REAL],
     ["SeqIndexOf", SEQ_INDEX_OF],
+    ["SeqFindIndex", SEQ_FIND_INDEX],
+    ["SeqFindLast", SEQ_FIND_LAST],
+    ["SeqFlatten", SEQ_FLATTEN],
+    ["SeqJoin", SEQ_JOIN],
+    ["SafeSlice", SAFE_SLICE],
     ["StringIndexOf", STRING_INDEX_OF],
+    ["StringSplit", STRING_SPLIT],
     ["StringTrim", STRING_TRIM],
     ["StringToLower", STRING_TO_LOWER],
     ["StringToUpper", STRING_TO_UPPER],
@@ -720,6 +999,8 @@ const PREAMBLE_CODE = [
     ["MathAbs", MATH_ABS],
     ["MathMin", MATH_MIN],
     ["MathMax", MATH_MAX],
+    ["MaxOfSeq", MAX_OF_SEQ],
+    ["MinOfSeq", MIN_OF_SEQ],
 ];
 // ── Constructor and record helpers ───────────────────────────
 let _recordCtors = new Map();
@@ -789,7 +1070,8 @@ function translatePattern(pattern) {
     const fieldNames = fields.split(/\s+/).map(escapeName);
     return `${ctorName}(${fieldNames.join(", ")})`;
 }
-export function emitDafnyFile(file, tsFileName) {
+export function emitDafnyFile(file, tsFileName, opts) {
+    _useSafeSlice = !!opts?.safeSlice;
     buildRecordCtorMap(file.decls);
     _neededPreambles.clear();
     // Track successfully emitted pure defs — method wrappers are only