lemmascript 0.5.12 → 0.5.14

package/tools/dist/names.js

@@ -0,0 +1,52 @@
+/**
+ * Fresh names for toolchain-minted identifiers.
+ *
+ * Several passes synthesize names — loop counters (`_x_idx`), lift temps
+ * (`_t0`), someMatch binders (`_task_val`), quantifier binders. Any such name
+ * can collide with a user-written identifier and either capture it (silently
+ * changing semantics — the `.delete()` binder bug) or shadow it (a
+ * loud duplicate-variable error in the backend).
+ *
+ * The rule, chosen for zero churn to existing output: a minted name is used
+ * verbatim unless the user wrote the same identifier somewhere in the module,
+ * in which case a prime (`'`) is appended. TypeScript identifiers cannot
+ * contain a prime, while Dafny and Lean both accept them, so one prime always
+ * suffices; and priming preserves distinctness among minted names, so the
+ * existing counter/suffix schemes keep working unchanged.
+ *
+ * The module-wide check deliberately over-approximates scope — a colliding
+ * name anywhere in the file primes the mint. False positives only affect
+ * internal names nobody reads. Names with a user-facing meaning stay exact by
+ * different, local means: comprehension binders check the expressions they
+ * actually wrap (`usesName` in dafny-emit), and result binders check the
+ * signature/body in hand (`methodHeader`). Spec text (`//@` comments) is NOT
+ * scanned: specs may legitimately reference minted names (e.g. `_x_idx` loop
+ * counters in invariants), so a spec mention is a reference, not a collision
+ * — when a source collision does force a prime, spec references are expected
+ * to follow it.
+ */
+let _userNames = new Set();
+/** Seeded once per module by extract with every Identifier token in the
+ *  source — params, locals, fields, callees alike. */
+export function setUserNames(names) {
+    _userNames = names;
+}
+export function isUserName(name) {
+    return _userNames.has(name);
+}
+/** The raw user identifiers, for a backend that needs to allocate its own
+ *  emitted names against them (e.g. Dafny escaping — see dafny-emit). */
+export function userNames() {
+    return [..._userNames];
+}
+/** A toolchain-internal name: `base` verbatim, primed on collision. The one
+ *  place the priming rule lives. `taken` says what counts as a collision —
+ *  by default a user-written name anywhere in the module; callers that know
+ *  the exact scope (e.g. a comprehension binder checking only the expressions
+ *  it wraps) pass their own predicate. */
+export function freshName(base, taken = isUserName) {
+    let name = base;
+    while (taken(name))
+        name += "'";
+    return name;
+}

package/tools/dist/narrow.js

@@ -34,6 +34,7 @@
  * (early-return, let-cond) run in `walkStmts` so they can consume the rest
  * of the block.
  */
+import { freshName } from "./names.js";
 // ── Optional-check detection ────────────────────────────────
 /** Counter for naming optChain binders. Reset per module. */
 let _ocCounter = 0;
@@ -52,7 +53,7 @@ function parseOptionalCheck(cond) {
         const hint = binderHintFor(e);
         if (hint === null)
             return null;
-        return { scrutinee: e, innerTy, negated: true, binderHint: hint, truthiness: true };
+        return { scrutinee: e, innerTy, negated: true, binderHint: freshName(hint), truthiness: true };
     }
     if (cond.kind !== "binop" || (cond.op !== "!==" && cond.op !== "===")) {
         // Bare optional truthiness: `if (e)` where e: T | undefined — true iff e is
@@ -61,7 +62,7 @@ function parseOptionalCheck(cond) {
             const hint = binderHintFor(cond);
             if (hint === null)
                 return null;
-            return { scrutinee: cond, innerTy: cond.ty.inner, negated: false, binderHint: hint, truthiness: true };
+            return { scrutinee: cond, innerTy: cond.ty.inner, negated: false, binderHint: freshName(hint), truthiness: true };
         }
         return null;
     }
@@ -77,7 +78,7 @@ function parseOptionalCheck(cond) {
     const hint = binderHintFor(e);
     if (hint === null)
         return null;
-    return { scrutinee: e, innerTy: e.ty.inner, negated: cond.op === "===", binderHint: hint, truthiness: false };
+    return { scrutinee: e, innerTy: e.ty.inner, negated: cond.op === "===", binderHint: freshName(hint), truthiness: false };
 }
 function binderHintFor(e) {
     // Pure access paths: var(x) or field(purePath, name).
@@ -416,6 +417,26 @@ function ruleImplOptional(e) {
         ty: { kind: "bool" },
     };
 }
+/** Apply an optional chain's steps (field / index / call) to a base expr —
+ *  shared by `ruleOptChain` (base = binder) and `ruleOptChainIndex` (base = arr[i]). */
+function applyChain(body, chain) {
+    for (const step of chain) {
+        if (step.kind === "field")
+            body = { kind: "field", obj: body, field: step.name, ty: step.ty };
+        else if (step.kind === "index")
+            body = { kind: "index", obj: body, idx: step.idx, ty: step.ty };
+        else
+            body = { kind: "call", fn: body, args: step.args, ty: step.ty, callKind: step.callKind };
+    }
+    return body;
+}
+/** `0 <= idx && idx < arr.length` — the in-bounds guard for an array index. */
+function arrayBoundsCond(arr, idx) {
+    const len = { kind: "field", obj: arr, field: "length", ty: { kind: "int" } };
+    const lo = { kind: "binop", op: "<=", left: { kind: "num", value: 0, ty: { kind: "int" } }, right: idx, ty: { kind: "bool" } };
+    const hi = { kind: "binop", op: "<", left: idx, right: len, ty: { kind: "bool" } };
+    return { kind: "binop", op: "&&", left: lo, right: hi, ty: { kind: "bool" } };
+}
 /** Rule (expression): `left ?? right` — nullish coalescing.
  *  → `someMatch left { Some(_v) => _v, None => right }`.
  *  Single-evaluation: scrutinee may be any expression. */
@@ -425,7 +446,7 @@ function ruleNullish(e) {
     if (e.left.ty.kind !== "optional")
         return null;
     const innerTy = e.left.ty.inner;
-    const binder = `_oc${_ocCounter++}_val`;
+    const binder = freshName(`_oc${_ocCounter++}_val`);
     return {
         kind: "someMatch",
         scrutinee: e.left, binder, binderTy: innerTy,
@@ -447,11 +468,7 @@ function ruleNullishIndex(e) {
         return null;
     if (e.left.obj.ty.kind !== "array")
         return null;
-    const idx = e.left.idx;
-    const len = { kind: "field", obj: e.left.obj, field: "length", ty: { kind: "int" } };
-    const lo = { kind: "binop", op: "<=", left: { kind: "num", value: 0, ty: { kind: "int" } }, right: idx, ty: { kind: "bool" } };
-    const hi = { kind: "binop", op: "<", left: idx, right: len, ty: { kind: "bool" } };
-    const cond = { kind: "binop", op: "&&", left: lo, right: hi, ty: { kind: "bool" } };
+    const cond = arrayBoundsCond(e.left.obj, e.left.idx);
     return { kind: "conditional", cond, then: e.left, else: e.right, ty: e.ty };
 }
 /** Rule (expression): `arr[i]?.<chain>` — optional chaining on an array index,
@@ -469,23 +486,8 @@ function ruleOptChainIndex(e) {
         return null;
     if (e.obj.obj.ty.kind !== "array")
         return null;
-    const idx = e.obj.idx;
-    const len = { kind: "field", obj: e.obj.obj, field: "length", ty: { kind: "int" } };
-    const lo = { kind: "binop", op: "<=", left: { kind: "num", value: 0, ty: { kind: "int" } }, right: idx, ty: { kind: "bool" } };
-    const hi = { kind: "binop", op: "<", left: idx, right: len, ty: { kind: "bool" } };
-    const cond = { kind: "binop", op: "&&", left: lo, right: hi, ty: { kind: "bool" } };
-    let body = e.obj; // arr[i] — in bounds under `cond`
-    for (const step of e.chain) {
-        if (step.kind === "field") {
-            body = { kind: "field", obj: body, field: step.name, ty: step.ty };
-        }
-        else if (step.kind === "index") {
-            body = { kind: "index", obj: body, idx: step.idx, ty: step.ty };
-        }
-        else {
-            body = { kind: "call", fn: body, args: step.args, ty: step.ty, callKind: step.callKind };
-        }
-    }
+    const cond = arrayBoundsCond(e.obj.obj, e.obj.idx);
+    const body = applyChain(e.obj, e.chain); // arr[i] — in bounds under `cond`
     const undef = { kind: "var", name: "undefined", ty: { kind: "void" } };
     return { kind: "conditional", cond, then: body, else: undef, ty: e.ty };
 }
@@ -499,19 +501,8 @@ function ruleOptChain(e) {
     if (e.obj.ty.kind !== "optional")
         return null;
     const innerTy = e.obj.ty.inner;
-    const binder = `_oc${_ocCounter++}_val`;
-    let body = { kind: "var", name: binder, ty: innerTy };
-    for (const step of e.chain) {
-        if (step.kind === "field") {
-            body = { kind: "field", obj: body, field: step.name, ty: step.ty };
-        }
-        else if (step.kind === "index") {
-            body = { kind: "index", obj: body, idx: step.idx, ty: step.ty };
-        }
-        else {
-            body = { kind: "call", fn: body, args: step.args, ty: step.ty, callKind: step.callKind };
-        }
-    }
+    const binder = freshName(`_oc${_ocCounter++}_val`);
+    const body = applyChain({ kind: "var", name: binder, ty: innerTy }, e.chain);
     const noneBody = { kind: "var", name: "undefined", ty: { kind: "void" } };
     return {
         kind: "someMatch",
@@ -543,9 +534,9 @@ function binderHintForMapAccess(m, k) {
         // mHint is `_m_val`, kHint is `_k_val` — stitch into `_m_k_val`.
         const mStem = mHint.replace(/_val$/, "");
         const kStem = kHint.replace(/^_/, "").replace(/_val$/, "");
-        return `${mStem}_${kStem}_val`;
+        return freshName(`${mStem}_${kStem}_val`);
     }
-    return `_oc${_ocCounter++}_val`;
+    return freshName(`_oc${_ocCounter++}_val`);
 }
 /** Rule (expression): `k in m ? m[k] : default` where m is map-typed.
  *  The then-branch must be exactly `m[k]` (same obj, same key). This mirrors
@@ -592,9 +583,10 @@ function ruleConditionalOptionalTruthy(e) {
         return null;
     if (e.cond.ty.kind !== "optional")
         return null;
-    const binder = binderHintFor(e.cond);
-    if (binder === null)
+    const hint = binderHintFor(e.cond);
+    if (hint === null)
         return null;
+    const binder = freshName(hint);
     return {
         kind: "someMatch",
         scrutinee: e.cond, binderTy: e.cond.ty.inner,
@@ -602,31 +594,39 @@ function ruleConditionalOptionalTruthy(e) {
         someBody: e.then, noneBody: e.else, ty: e.ty,
     };
 }
-/** Extract an optional check from any position in an `&&` chain.
- *  `(x !== undefined && b) && c` → { check, restCond: b && c }.
- *  `a && (x !== undefined)`     → { check, restCond: a }.
- *  Conjunct order doesn't carry semantic weight, so either side is fine. */
-function extractLeftmostOptionalCheck(cond) {
+/** Find the leftmost `parse`-matching conjunct anywhere in an `&&` chain,
+ *  returning it plus the remaining conjunction. Conjunct order doesn't carry
+ *  semantic weight, so either side is fine. Shared by the optional and
+ *  Array.isArray chain extractors — they differ only in `parse`.
+ *  `(x !== undefined && b) && c` → { check, restCond: b && c }. */
+function extractLeftmostCheck(cond, parse) {
     if (cond.kind !== "binop" || cond.op !== "&&")
         return null;
-    const leftCheck = parseSimpleOptionalCheck(cond.left);
-    if (leftCheck && !leftCheck.negated)
-        return { check: leftCheck, restCond: cond.right };
-    const rightCheck = parseSimpleOptionalCheck(cond.right);
-    if (rightCheck && !rightCheck.negated)
-        return { check: rightCheck, restCond: cond.left };
+    const left = parse(cond.left);
+    if (left)
+        return { check: left, restCond: cond.right };
+    const right = parse(cond.right);
+    if (right)
+        return { check: right, restCond: cond.left };
     if (cond.left.kind === "binop" && cond.left.op === "&&") {
-        const inner = extractLeftmostOptionalCheck(cond.left);
+        const inner = extractLeftmostCheck(cond.left, parse);
         if (inner)
             return { check: inner.check, restCond: { ...cond, left: inner.restCond } };
     }
     if (cond.right.kind === "binop" && cond.right.op === "&&") {
-        const inner = extractLeftmostOptionalCheck(cond.right);
+        const inner = extractLeftmostCheck(cond.right, parse);
         if (inner)
             return { check: inner.check, restCond: { ...cond, right: inner.restCond } };
     }
     return null;
 }
+/** `&&`-chain extractor for a positive optional check. */
+function extractLeftmostOptionalCheck(cond) {
+    return extractLeftmostCheck(cond, e => {
+        const c = parseSimpleOptionalCheck(e);
+        return c && !c.negated ? c : null;
+    });
+}
 /** Rule: `if (x !== undefined && rest) then` (no else) where x is a pure
  *  access path.
  *  → `someMatch x { Some(_x_val) => if rest then then; , None => {} }`.
@@ -743,31 +743,11 @@ function isNarrowablePath(e) {
         return isNarrowablePath(e.obj);
     return false;
 }
-/** Mirror of `extractLeftmostOptionalCheck` for synth-array-union checks:
- *  finds `Array.isArray(path)` somewhere in a `&&` chain, returns it plus
- *  the remaining conjunction. The check must be the positive form (negated
- *  `!Array.isArray(...)` would narrow to the wrong variant for then-body
- *  consumers, so we leave those to the existing untouched-conditional path). */
+/** `&&`-chain extractor for `Array.isArray(path)` (positive form only — a negated
+ *  `!Array.isArray(...)` would narrow to the wrong variant for then-body consumers,
+ *  so those are left to the untouched-conditional path). */
 function extractLeftmostArrayIsArrayCheck(cond) {
-    if (cond.kind !== "binop" || cond.op !== "&&")
-        return null;
-    const leftCheck = parseArrayIsArrayCall(cond.left);
-    if (leftCheck)
-        return { check: leftCheck, restCond: cond.right };
-    const rightCheck = parseArrayIsArrayCall(cond.right);
-    if (rightCheck)
-        return { check: rightCheck, restCond: cond.left };
-    if (cond.left.kind === "binop" && cond.left.op === "&&") {
-        const inner = extractLeftmostArrayIsArrayCheck(cond.left);
-        if (inner)
-            return { check: inner.check, restCond: { ...cond, left: inner.restCond } };
-    }
-    if (cond.right.kind === "binop" && cond.right.op === "&&") {
-        const inner = extractLeftmostArrayIsArrayCheck(cond.right);
-        if (inner)
-            return { check: inner.check, restCond: { ...cond, right: inner.restCond } };
-    }
-    return null;
+    return extractLeftmostCheck(cond, parseArrayIsArrayCall);
 }
 /** Detect `x.kind === "variant"`, `'key' in x`, or `Array.isArray(x)` (synth
  *  array-union) as a positive discriminant check. Returns the scrutinee var

package/tools/dist/peephole.js

@@ -1,3 +1,4 @@
+import { patternCtor, patternBinders } from "./ir.js";
 // ── Generic walkers (same shape as transform.ts) ─────────────
 function mapExpr(e, f) {
     const hit = f(e);
@@ -44,21 +45,19 @@ function isMapGet(e) {
         return null;
     return { obj: e.obj, key: e.args[0], objTy: e.objTy };
 }
-/** Parse Some-arm pattern like ".some _val" — returns binder name, or null for ".some _" or unparseable. */
-function parseSomeBinder(pattern) {
-    if (!pattern.startsWith(".some"))
+/** Binder of a Some arm — its name, or null for `.some _` / a non-`some` pattern. */
+function parseSomeBinder(p) {
+    if (patternCtor(p) !== "some")
         return null;
-    const rest = pattern.slice(5).trim();
-    if (rest === "" || rest === "_")
-        return null;
-    return rest.split(/\s+/)[0];
+    const b = patternBinders(p)[0];
+    return b === undefined || b === "_" ? null : b;
 }
 /** Identify a Some/None match's arms. */
 function getSomeNoneArms(arms) {
     if (arms.length !== 2)
         return null;
-    const someArm = arms.find(a => a.pattern.startsWith(".some"));
-    const noneArm = arms.find(a => a.pattern === ".none");
+    const someArm = arms.find(a => patternCtor(a.pattern) === "some");
+    const noneArm = arms.find(a => patternCtor(a.pattern) === "none");
     if (!someArm || !noneArm)
         return null;
     return { someArm, noneArm, binder: parseSomeBinder(someArm.pattern) };

package/tools/dist/resolve.js

@@ -7,6 +7,7 @@
 import { isBigInt } from "./typedir.js";
 import { parseTsType, tyToCanonical } from "./types.js";
 import { parseExpr } from "./specparser.js";
+import { freshName } from "./names.js";
 function lookup(env, name) {
     if (!env)
         return undefined;
@@ -693,7 +694,7 @@ function resolveRecordMerge(base, override, ctx) {
                 return { name: f.name, value: ovf }; // required: override always provides
             // optional: override field wins iff present, else base's field
             const bvf = { kind: "field", obj: bv, field: f.name, ty: ft };
-            const binder = `_m${mergeBinder++}`;
+            const binder = freshName(`_m${mergeBinder++}`);
             // someBody is the unwrapped present value; transform re-wraps each arm in
             // the backend's Some constructor (Dafny `Some`, Lean `Option.some`).
             return { name: f.name, value: {
@@ -704,7 +705,7 @@ function resolveRecordMerge(base, override, ctx) {
     });
     if (tover.ty.kind === "optional") {
         // override may be absent (undefined spreads nothing) → base unchanged
-        const binder = `_mo${mergeBinder++}`;
+        const binder = freshName(`_mo${mergeBinder++}`);
         return {
             kind: "someMatch", scrutinee: tover, binder, binderTy: userTy,
             someBody: merged(tbase, { kind: "var", name: binder, ty: userTy }), noneBody: tbase, ty: userTy,
@@ -1373,7 +1374,9 @@ function resolveStmt(s, ctx) {
                 for (const _ of s.names)
                     nameTypes.push({ kind: "unknown" });
             }
-            const idxName = `_${s.names[0]}_idx`;
+            // Must match the freshened counter transform mints for this loop, so a
+            // spec referencing the loop index resolves to the same name.
+            const idxName = freshName(`_${s.names[0]}_idx`);
             env = extend(env, idxName, { kind: "nat" });
             for (let j = 0; j < s.names.length; j++) {
                 env = extend(env, s.names[j], nameTypes[j] ?? { kind: "unknown" });