lemmascript 0.5.0 → 0.5.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lemmascript",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "A verification toolchain for TypeScript — generates Lean 4 or Dafny from annotated TS",
   "type": "module",
   "engines": {

package/tools/dist/dafny-emit.js

@@ -35,6 +35,15 @@ const DAFNY_KEYWORDS = new Set([
     "datatype", "type", "const", "ghost", "static",
     "reads", "modifies", "assert", "assume", "print",
     "by", "calc", "reveal",
+    // Further reserved words (validated against the Dafny parser) that are also
+    // legal TS identifiers. `this` stays excluded above — class methods emit it
+    // directly. `then`/`else` already covered.
+    "bool", "char", "int", "nat", "real", "string", "object", "array",
+    "as", "is", "label", "modify", "expect", "yield", "yields", "returns",
+    "unchanged", "witness", "constructor", "iterator", "abstract", "extends",
+    "refines", "opened", "provides", "reveals", "include", "newtype",
+    "codatatype", "nameonly", "twostate", "opaque", "replaceable", "colemma",
+    "copredicate", "inductive",
 ]);
 function escapeName(name) {
     // \result is carried through the IR as the var name "\\result"; render it

package/tools/dist/extract.js

@@ -1502,17 +1502,39 @@ function extractStmts(stmts) {
             const switchExpr = exprAst.kind === "field" ? exprAst.obj : exprAst;
             const cases = [];
             let defaultBody = [];
+            // Two JS-`switch` faithfulness concerns the Dafny `match` doesn't share:
+            //  (1) Fall-through: stacked `case A: case B: body` is several clauses
+            //      where the leading ones have no statements; those labels share the
+            //      next clause's body (we duplicate it per label).
+            //  (2) `break` is the switch exit, not a loop break. We extract the full
+            //      body (extractStmts flattens `{ }` blocks but keeps loop bodies
+            //      nested) and strip the *top-level* breaks — so a `break` written
+            //      inside a `{ }` case block is stripped, while a `break` inside a
+            //      nested loop stays put.
+            const stripExitBreaks = (b) => b.filter(st => st.kind !== "break");
+            let fallthrough = [];
             for (const clause of s.getClauses()) {
                 if (Node.isCaseClause(clause)) {
                     const label = clause.getExpression().getText().replace(/^["']|["']$/g, "");
-                    const bodyStmts = clause.getStatements().filter(st => !Node.isBreakStatement(st));
-                    cases.push({ label, body: extractStmts(bodyStmts) });
+                    if (clause.getStatements().length === 0) {
+                        fallthrough.push(label);
+                        continue;
+                    }
+                    const body = stripExitBreaks(extractStmts(clause.getStatements()));
+                    for (const l of fallthrough)
+                        cases.push({ label: l, body });
+                    cases.push({ label, body });
+                    fallthrough = [];
                 }
                 else {
-                    const bodyStmts = clause.getStatements().filter(st => !Node.isBreakStatement(st));
-                    defaultBody = extractStmts(bodyStmts);
+                    defaultBody = stripExitBreaks(extractStmts(clause.getStatements()));
+                    for (const l of fallthrough)
+                        cases.push({ label: l, body: defaultBody });
+                    fallthrough = [];
                 }
             }
+            for (const l of fallthrough)
+                cases.push({ label: l, body: [] });
             result.push({ kind: "switch", expr: switchExpr, discriminant, cases, defaultBody, line });
             continue;
         }
@@ -1735,7 +1757,19 @@ export function extractModule(sourceFile) {
         }
         const aliasMatch = body.match(/^(\w+)\s*=\s*(.+)$/);
         if (aliasMatch) {
-            typeDecls.push({ name: aliasMatch[1], kind: "alias", aliasOf: aliasMatch[2].trim() });
+            const rhs = aliasMatch[2].trim();
+            // A string-literal union (`= "a" | "b" | …`) becomes an enum datatype —
+            // the same shape a real string-union alias resolves to. Dafny has no
+            // string-literal type, so a plain alias (`type X = "a" | "b"`) would be
+            // invalid. Other RHS forms (`Rule[]`, `number`, `A | B`) fall through.
+            const parts = rhs.split("|").map(s => s.trim());
+            const lits = parts.map(p => p.match(/^["'](.+)["']$/));
+            if (parts.length >= 2 && lits.every(m => m !== null)) {
+                typeDecls.push({ name: aliasMatch[1], kind: "string-union", values: lits.map(m => m[1]) });
+            }
+            else {
+                typeDecls.push({ name: aliasMatch[1], kind: "alias", aliasOf: rhs });
+            }
         }
     }
     for (const range of sourceFile.getLeadingCommentRanges()) {

package/tools/dist/resolve.js

@@ -290,6 +290,41 @@ function expandAlias(ty, typeDecls, seen = new Set()) {
 function getDiscriminant(ctx, typeName) {
     return findDecl(ctx, typeName)?.discriminant;
 }
+// ── Equality hazard: structural in the proof vs reference at runtime ─────────
+// `===`/`!==` is modeled as Dafny structural equality, but the SAME TypeScript
+// runs `===` as JS *reference* equality on objects/arrays. The two agree only
+// when the operand is a primitive at runtime: number / string / bool, or a
+// string-union enum (which runs as a plain string). Records, discriminated
+// unions, arrays, maps, sets, and unresolved generics are reference-compared at
+// runtime, so a structural proof over them is unsound. Returns true for those.
+function refEqHazard(ty, typeDecls) {
+    if (ty.kind === "array" || ty.kind === "map" || ty.kind === "set")
+        return true;
+    if (ty.kind === "user") {
+        let decl = typeDecls.find(d => d.name === ty.name);
+        if (!decl && ty.name.includes(".")) {
+            const tail = ty.name.slice(ty.name.lastIndexOf(".") + 1);
+            decl = typeDecls.find(d => d.name === tail);
+        }
+        if (!decl)
+            return true; // generic type parameter / unknown → assume reference
+        if (decl.kind === "string-union")
+            return false; // runs as a JS string → `===` is structural
+        if (decl.kind === "alias")
+            return decl.aliasOfTy ? refEqHazard(decl.aliasOfTy, typeDecls) : false;
+        return true; // record / discriminated-union → reference at runtime
+    }
+    return false; // primitives, optional, unknown, fn, void
+}
+const _warnedRefEq = new Set();
+function warnRefEq(op, l, r) {
+    const label = (t) => t.kind === "user" ? t.name : t.kind;
+    const msg = `'${op}' compares non-primitive operands (${label(l)} ${op} ${label(r)}): structural equality in the proof, but reference equality when this TypeScript runs. Sound only if operands are primitives or a canonical (string/number) encoding; otherwise compare via an explicit structural equals.`;
+    if (_warnedRefEq.has(msg))
+        return;
+    _warnedRefEq.add(msg);
+    console.error(`WARNING: ${msg}`);
+}
 /** A type ts-morph handed us that LemmaScript hasn't modeled: contains
  *  `unknown` (TS `any`), or a `user` type whose name isn't a known declaration
  *  (an opaque expanded union like `"AssistantMsg | ToolMsg"` that ts-morph
@@ -606,6 +641,11 @@ function resolveExpr(e, ctx) {
             if (e.op === "===" || e.op === "!==") {
                 left = coerceStr(left, right.ty);
                 right = coerceStr(right, left.ty);
+                // Spec (`//@`) comparisons are proof-only, so they can't diverge at
+                // runtime; only warn on executable code.
+                if (!ctx.inSpec && refEqHazard(left.ty, ctx.typeDecls) && refEqHazard(right.ty, ctx.typeDecls)) {
+                    warnRefEq(e.op, left.ty, right.ty);
+                }
             }
             let ty = { kind: "unknown" };
             if (["===", "!==", ">=", "<=", ">", "<", "in"].includes(e.op))
@@ -1388,6 +1428,7 @@ function precomputeFieldTypesInner(typeDecls) {
     }
 }
 export function resolveModule(raw) {
+    _warnedRefEq.clear();
     precomputeFieldTypes(raw.typeDecls);
     const pureFns = computePureFns(raw.functions);
     // Pre-compute function parameter and return types