lemmascript 0.5.15 → 0.5.16

package/README.md

@@ -30,6 +30,7 @@ See the external case studies:
 - **[rallly-lemmascript](https://github.com/midspiral/rallly-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [rallly](https://github.com/lukevella/rallly)'s meeting-poll Next.js app. 2 functions: `validateRedirectUrl` (in-place — open-redirect predicate; non-`undefined` outputs start with `/` but not `//`) and `scorePoll` (extracted ranking core — length preservation, score bounds, top-choice characterization, score-formula equality, within-poll monotonicity, tiebreaker injectivity). The injectivity proof surfaced a real spec-level constraint on the existing `(yes + ifNeedBe) * 1000 + yes` encoding: it overflows when an option has ≥ 1000 yes votes. 10 Dafny VCs, 0 errors. Drove four toolchain additions: `s.startsWith()`, `T | null` nullability, `\result` narrowing under `==>`, `Math.max(...arr)` spread. Dafny only.
 - **[opencode-lemmascript](https://github.com/midspiral/opencode-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [opencode](https://github.com/anomalyco/opencode)'s permission system and unified-diff patch parser. Highlights: (1) `Patch.parsePatch` carries conservation loop invariants over local ghost state — a parser bug here would silently corrupt user files when an AI applies a patch, and (2) the permission-engine work mechanically closes opencode bug #26514 (subagents bypassing Plan Mode's file-edit restrictions). 9 functions verified in-place, 0 errors. Dafny only.
 - **[pi-lemmascript](https://github.com/midspiral/pi-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield, **in-place** verification of the context-compaction cut-point selector in **pi** (the [earendil-works](https://pi.dev) agent harness). When the context window fills, pi discards history before a chosen cut; a provider API rejects a retained prefix containing an orphaned `toolResult` (a tool result whose tool call was cut away). Both selector functions proven: the cut never lets the kept suffix *start with* — nor *split a tool-use/tool-result run* into — an orphaned tool result, even across the backward metadata snap. The no-orphan result forced the session tree's tool-pairing ordering into an explicit `requires`. 4 VCs, 0 errors. Drove five toolchain additions, headlined by an **opaque fall-through type**: a union LemmaScript can't discriminate (here an array-element union of unreachable imports) becomes a single opaque `type` — the field stays present so distinct values stay distinct, and with no constructor or tag predicate it can only be passed through, never unsoundly observed. **Dafny + Lean**: the no-orphan theorem, the changelog semver core, and both tool-output truncators also carry Lean 4 (Velvet/Loom) proofs from the same annotated source, zero `sorry`; the Lean port drove the backend's brownfield batch (cross-file externs, union destructor lowering, Bool-vs-Prop contexts, `return`-in-loop elimination).
+- **[flue-lemmascript](https://github.com/midspiral/flue-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield, **in-place** verification of pure logic in **Flue** ([withastro/flue](https://github.com/withastro/flue)), Astro's agent harness — crash-recovery and context-compaction functions proven byte-identical. What it drove into the toolchain: native Dafny `continue`, bounds-guarded `noUncheckedIndexedAccess` optional indexing, optional narrowing past an `opt?.disc` guard composing with discriminated-union matching, and object truthiness. Dafny only.
 - **[balanced-match-lemmascript](https://github.com/midspiral/balanced-match-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield, **in-place** verification of [balanced-match](https://github.com/juliangruber/balanced-match), the ~70-line balanced-bracket finder pulled in by `npm`, `webpack`, and most of the JS tooling stack (1B+ downloads/month). The stack-based `range` core is verified by **refinement**: a pure recursive spec `range_spec` mirrors the loop one branch per recursive case, so the single equivalence `range == range_spec` transfers every property automatically — including an unconditional Dyck body-balance theorem for the interior of every returned pair. 2233 VCs, 0 errors under `--isolate-assertions` (registered on the `dafny-slow` track). Dafny only.
 - **[guardians-lemmascript](https://github.com/midspiral/guardians-lemmascript)** — greenfield verification of the core safety argument behind [Guardians](https://github.com/metareflection/guardians) (Erik Meijer, "Guardians of the Agents", CACM Jan 2026), a generate-verify-execute checker for AI-agent workflows. Instead of verifying an app, it proves the agent *guardrail itself sound* — that a static taint/automaton check over the real recursive workflow AST can never admit an unsafe plan. Highlights: taint over **nested conditionals** as a sound branch-union over-approximation; per-source **provenance** with a join (a multi-input tool is tainted if *any* input was); **unbounded loops** discharged by a one-step pre-fixpoint (`sat = t0 ‖ bodyTaint(t0)`) that bounds taint over any iteration count without iterating to a fixpoint; and a **unified capstone** (`verifyWfSound`) — one clean verdict rules out, on *every* path, both a tainted-data-to-sink leak and a security-automaton error. 54 Dafny obligations, 0 errors. The verified cores are reached from a Guardians-style `Workflow`/`Policy` through a thin *unverified* adapter, differentially tested against the real Python Guardians (used as the oracle, not a porting target). Dafny only.
 - **[quorum-lemmascript](https://github.com/midspiral/quorum-lemmascript)** — greenfield verified when2meet/Doodle-style group scheduler (React + Cloudflare Durable Objects), with one `domain.ts` running unchanged in the browser, the in-app query, and the server. The standout is that **the proof licenses the architecture**: `countFree` is a homomorphism from participant-list concatenation to integer addition (so the heatmap is order-independent) plus same-participant last-writer-wins convergence — which is exactly what makes the lock-free, no-login, *optimistic* multi-device backend safe, with the Durable Object and the browser applying the **same** verified `applyOp` (server-authoritatively, client-optimistically) with no rollback or operational transform. Also: heatmap is exactly the per-slot count and `isBest` exactly its argmax; monotonicity; invariant-preserving mutations + op-log `replay`; a sparse export codec round-trip; an in-app `whoIsFree(e, s)` whose length provably equals the cell's count; and a separate `grid.ts` proving the `(day, time) → slot` map in-range + injective — which makes specific-dates-vs-days-of-the-week pure shell labeling at zero proof cost; and full element-level permutation invariance (`heatmapPermInvariant` — the heatmap depends only on the *multiset* of participant rows), which drove the `perm(...)` spec predicate into LemmaScript itself. 100 Dafny VCs (90 + 10), 0 errors. The *aggregate* is proven; the React UI, WebSocket/DO I/O, and timezone labeling are the stated trust boundary. Dafny only.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lemmascript",
-  "version": "0.5.15",
+  "version": "0.5.16",
   "description": "A verification toolchain for TypeScript — generates Lean 4 or Dafny from annotated TS",
   "type": "module",
   "engines": {

package/tools/dist/dafny-commands.js

@@ -67,7 +67,7 @@ export function dafnyVerify(dfyPath, dir, timeLimit, extraFlags) {
         return false;
     }
 }
-export function dafnyRegen(genPath, dfyPath, basePath, text, dir, timeLimit, extraFlags) {
+export function dafnyRegen(genPath, dfyPath, basePath, text, dir, timeLimit, extraFlags, noVerify = false) {
     // 1. Read old gen before overwriting (needed for base seeding)
     const oldGen = existsSync(genPath) ? readFileSync(genPath, "utf-8") : "";
     // 2. Always write new gen so user can inspect latest output
@@ -76,7 +76,7 @@ export function dafnyRegen(genPath, dfyPath, basePath, text, dir, timeLimit, ext
     if (!existsSync(dfyPath)) {
         writeFileSync(dfyPath, text);
         console.log(`Created: ${path.basename(dfyPath)}`);
-        if (!dafnyVerify(dfyPath, dir, timeLimit, extraFlags)) {
+        if (!noVerify && !dafnyVerify(dfyPath, dir, timeLimit, extraFlags)) {
             console.error(`FAILED: ${path.basename(dfyPath)} verification failed on first run.`);
             process.exit(1);
         }
@@ -110,8 +110,8 @@ export function dafnyRegen(genPath, dfyPath, basePath, text, dir, timeLimit, ext
         console.error(`FAILED: ${path.basename(dfyPath)} has modifications to generated lines.`);
         process.exit(1);
     }
-    // 7. Verify
-    if (!dafnyVerify(dfyPath, dir, timeLimit, extraFlags)) {
+    // 7. Verify (skipped under --no-verify: caller verifies separately)
+    if (!noVerify && !dafnyVerify(dfyPath, dir, timeLimit, extraFlags)) {
         console.error(`FAILED: ${path.basename(dfyPath)} verification failed.`);
         process.exit(1);
     }

package/tools/dist/dafny-emit.js

@@ -36,6 +36,7 @@ function tyToDafny(ty) {
         case "string": return "string";
         case "void": return "()";
         case "array": return `seq<${tyToDafny(ty.elem)}>`;
+        case "tuple": return `(${ty.elems.map(tyToDafny).join(", ")})`;
         case "map": return `map<${tyToDafny(ty.key)}, ${tyToDafny(ty.value)}>`;
         case "set": return `set<${tyToDafny(ty.elem)}>`;
         case "optional": {
@@ -228,6 +229,8 @@ function emitExpr(e) {
             if (e.elems.length === 0)
                 return `[]`;
             return `[${e.elems.map(emitExpr).join(", ")}]`;
+        case "tupleLiteral": return `(${e.elems.map(emitExpr).join(", ")})`;
+        case "tupleProj": return `${emitExpr(e.obj)}.${e.index}`;
         case "emptyMap": return `map[]`;
         case "emptySet": return `{}`;
         case "mapLiteral": {
@@ -694,7 +697,7 @@ function emitStmt(s, indent) {
         case "break":
             return `${pad}break;`;
         case "continue":
-            throw new Error("Unsupported Dafny construct: 'continue' statement");
+            return `${pad}continue;`;
         case "if": {
             let out = `${pad}if ${emitExpr(s.cond)} {\n${emitStmts(s.then, indent + 1)}\n${pad}}`;
             if (s.else.length > 0) {
@@ -1303,6 +1306,8 @@ function resolveTy(ty) {
         return { kind: "optional", inner: resolveTy(ty.inner) };
     if (ty.kind === "array")
         return { kind: "array", elem: resolveTy(ty.elem) };
+    if (ty.kind === "tuple")
+        return { kind: "tuple", elems: ty.elems.map(resolveTy) };
     if (ty.kind === "map")
         return { kind: "map", key: resolveTy(ty.key), value: resolveTy(ty.value) };
     if (ty.kind === "set")

package/tools/dist/ir.js

@@ -37,6 +37,8 @@ export function anyExpr(e, pred) {
         case "app": return e.args.some(a => anyExpr(a, pred));
         case "field": return anyExpr(e.obj, pred);
         case "index": return anyExpr(e.arr, pred) || anyExpr(e.idx, pred);
+        case "tupleLiteral": return e.elems.some(x => anyExpr(x, pred));
+        case "tupleProj": return anyExpr(e.obj, pred);
         case "implies": return e.premises.some(p => anyExpr(p, pred)) || anyExpr(e.conclusion, pred);
         case "record": return (e.spread ? anyExpr(e.spread, pred) : false) || e.fields.some(f => anyExpr(f.value, pred));
         case "arrayLiteral": return e.elems.some(x => anyExpr(x, pred));

package/tools/dist/lean-emit.js

@@ -34,6 +34,13 @@ function tyToLean(ty) {
             const elem = tyToLean(ty.elem);
             return elem.includes(" ") ? `Array (${elem})` : `Array ${elem}`;
         }
+        case "tuple":
+            // Right-nested Prod: `A × B × C` = `A × (B × C)`. Parenthesize any element
+            // whose rendering has a space so it binds tighter than `×` (e.g. `A → B`).
+            return ty.elems.map(el => {
+                const s = tyToLean(el);
+                return s.includes(" ") ? `(${s})` : s;
+            }).join(" × ");
         case "map": {
             const k = tyToLean(ty.key);
             const v = tyToLean(ty.value);
@@ -112,6 +119,9 @@ function collectUserRefs(ty, into) {
         case "set":
             collectUserRefs(ty.elem, into);
             break;
+        case "tuple":
+            ty.elems.forEach(el => collectUserRefs(el, into));
+            break;
         case "optional":
             collectUserRefs(ty.inner, into);
             break;
@@ -318,6 +328,15 @@ function emitExpr(e, parentPrec) {
             if (e.elems.length === 0)
                 return `#[]`;
             return `#[${e.elems.map(el => emitExpr(el)).join(", ")}]`;
+        case "tupleLiteral":
+            return `(${e.elems.map(el => emitExpr(el)).join(", ")})`;
+        case "tupleProj": {
+            // Right-nested Prod projection: element i is `.2`×i then `.1`, except the
+            // last (i = arity-1) which is `.2`×i with no trailing `.1`.
+            const obj = emitExpr(e.obj);
+            const twos = ".2".repeat(e.index);
+            return e.index === e.arity - 1 ? `${obj}${twos}` : `${obj}${twos}.1`;
+        }
         case "emptyMap": return `Std.HashMap.empty`;
         case "emptySet": return `Std.HashSet.empty`;
         case "default": return `(default : ${tyToLean(e.type)})`;

package/tools/dist/lsc.js

@@ -98,6 +98,16 @@ function main() {
         slow = true;
         args.splice(slowIdx, 1);
     }
+    // --no-verify (regen only): do regen + three-way merge + additions-only check
+    // but skip `dafny verify`. CI's `tools` job passes this to regen-dafny.sh so
+    // regen only enforces the drift + additions-only invariants; the separate
+    // `lsc check` pass over the same files does the one and only verification.
+    let noVerify = false;
+    const noVerifyIdx = args.indexOf("--no-verify");
+    if (noVerifyIdx >= 0) {
+        noVerify = true;
+        args.splice(noVerifyIdx, 1);
+    }
     // Anything flag-shaped left over is a typo or a space-separated form
     // (`--backend lean`): reject it rather than let it become a positional arg
     // or be silently ignored (which would e.g. verify with the wrong backend).
@@ -117,7 +127,7 @@ function main() {
         runBatch(cmd, backend, slow);
         return;
     }
-    runFile(cmd, filePath, backend, timeLimit, extraFlags);
+    runFile(cmd, filePath, backend, timeLimit, extraFlags, noVerify);
 }
 // LemmaScript-files.txt, parsed: `filepath [timeout_in_seconds] [extra dafny
 // flags…]` per line; no timeout = Dafny default. Exits if the file is absent.
@@ -154,7 +164,7 @@ function runBatch(cmd, backend, slow) {
         }
     }
 }
-function runFile(cmd, filePath, backend, timeLimit, extraFlags) {
+function runFile(cmd, filePath, backend, timeLimit, extraFlags, noVerify = false) {
     const absPath = path.resolve(filePath);
     if (!existsSync(absPath)) {
         console.error(`File not found: ${absPath}`);
@@ -247,7 +257,7 @@ function runFile(cmd, filePath, backend, timeLimit, extraFlags) {
             return;
         }
         if (cmd === "regen") {
-            dafnyRegen(genPath, dfyPath, basePath, text, dir, timeLimit, extraFlags);
+            dafnyRegen(genPath, dfyPath, basePath, text, dir, timeLimit, extraFlags, noVerify);
             return;
         }
         console.error(`Unknown command: ${cmd}`);

package/tools/dist/narrow.js

@@ -145,7 +145,7 @@ function walkStmt(s) {
     // array rule fires; independent narrows commute, so the order is harmless.)
     // && rules fire before the simple rule because they produce nested ifs whose
     // inner shape doesn't match the simple rule directly.
-    return ruleIfAndOptional(r) ?? ruleIfAndArrayIsArray(r) ?? ruleIfOptionalSimple(r) ?? ruleExprStmtAndOptional(r) ?? r;
+    return ruleIfAndOptional(r) ?? ruleIfAndArrayIsArray(r) ?? ruleIfOptionalSimple(r) ?? ruleExprStmtAndOptional(r) ?? ruleOptionalIndexBinding(r) ?? r;
 }
 function walkStmts(stmts) {
     const result = [];
@@ -159,7 +159,7 @@ function walkStmts(stmts) {
             i += tagged.consumed - 1;
             continue;
         }
-        const consumed = ruleEarlyReturnOrChain(s, rest) ?? ruleEarlyReturnConsume(s, rest);
+        const consumed = ruleEarlyReturnOrChain(s, rest) ?? ruleEarlyReturnConsume(s, rest) ?? ruleEarlyReturnOptChainCompare(s, rest);
         if (consumed) {
             result.push(walkStmt(consumed));
             return result;
@@ -308,6 +308,55 @@ function ruleEarlyReturnOrChain(s, rest) {
     }
     return inner[0];
 }
+/** Rule: `if (opt?.chain !== lit) terminate; rest` where `opt` is optional.
+ *  `opt?.chain` is `undefined` when `opt` is None, and `undefined !== lit` is
+ *  true, so the None case takes the terminating branch — falling through to
+ *  `rest` proves `opt` is Some. Rewrite to
+ *    someMatch opt { Some(v) => [if (v.chain !== lit) terminate; rest]; None => terminate }
+ *  narrowing `opt` to `v` across `rest` (transform substitutes the scrutinee) and
+ *  handing the now-non-optional inner guard to the ordinary rules (e.g.
+ *  discriminant narrowing). Bound-optional companion to ruleEarlyReturnConsume,
+ *  which handles only a bare presence check (`opt !== undefined`). Restricted to
+ *  `!==` so the None case is guaranteed to terminate. */
+function ruleEarlyReturnOptChainCompare(s, rest) {
+    if (s.kind !== "if")
+        return null;
+    if (rest.length === 0)
+        return null;
+    if (s.else.length !== 0 || !isTerminating(s.then))
+        return null;
+    const c = s.cond;
+    if (c.kind !== "binop" || c.op !== "!==")
+        return null;
+    const oc = c.left.kind === "optChain" ? c.left : c.right.kind === "optChain" ? c.right : null;
+    if (!oc || oc.kind !== "optChain" || oc.obj.ty.kind !== "optional")
+        return null;
+    const lit = c.left === oc ? c.right : c.left;
+    const innerTy = oc.obj.ty.inner;
+    const hint = binderHintFor(oc.obj);
+    if (hint === null)
+        return null;
+    const binder = freshName(hint);
+    const binderVar = { kind: "var", name: binder, ty: innerTy };
+    const unwrapped = applyChain(binderVar, oc.chain);
+    // applyChain rebuilds the field without the `isDiscriminant` flag resolve sets
+    // on a direct `x.disc`; restore it when the unwrapped access is the binder
+    // union's discriminant, so the inner guard feeds discriminant narrowing.
+    if (unwrapped.kind === "field" && unwrapped.obj.ty.kind === "user") {
+        const base = unwrapped.obj.ty.name.replace(/<.*/, "");
+        const decl = _typeDecls.find(d => d.name === base);
+        if (decl?.kind === "discriminated-union" && decl.discriminant === unwrapped.field) {
+            unwrapped.isDiscriminant = true;
+        }
+    }
+    const innerGuard = { kind: "binop", op: "!==", left: unwrapped, right: lit, ty: { kind: "bool" } };
+    // Keep `rest` as trailing statements (not an else branch) — `s.then` terminates,
+    // so `if (g) terminate; rest` ≡ `if (g) terminate else rest`, and the trailing
+    // form lets the ordinary early-exit rules (e.g. discriminant narrowing) fire on
+    // the now-non-optional inner guard when `chain` is a union discriminant.
+    const someBody = [{ kind: "if", cond: innerGuard, then: s.then, else: [] }, ...rest];
+    return { kind: "someMatch", scrutinee: oc.obj, binder, binderTy: innerTy, someBody, noneBody: s.then };
+}
 /** Rule (expression): `e !== undefined ? a : b`. */
 function ruleConditionalOptionalSimple(e) {
     if (e.kind !== "conditional")
@@ -491,6 +540,32 @@ function ruleOptChainIndex(e) {
     const undef = { kind: "var", name: "undefined", ty: { kind: "void" } };
     return { kind: "conditional", cond, then: body, else: undef, ty: e.ty };
 }
+/** Rule (statement): reconcile a `const e = arr[i]` whose binding is optional
+ *  (`e: T | undefined`) but whose array-index initializer is total (`T`). Model
+ *  the index as its JS semantics — `e := (0 <= i && i < arr.length) ? arr[i] :
+ *  undefined` — so `e` is a real `Option<T>` and a later `e?.f` someMatch is
+ *  well-typed; an in-bounds proof makes the None branch dead, so safely-indexed
+ *  code verifies as if total. Bound-form sibling of ruleOptChainIndex /
+ *  ruleNullishIndex. Fires purely on the optional-binding/total-index shape (the
+ *  usual source is `noUncheckedIndexedAccess`, but the flag itself is never
+ *  checked). Skipped when the element type is already optional: no mismatch. */
+function ruleOptionalIndexBinding(s) {
+    if (s.kind !== "let")
+        return null;
+    if (s.ty.kind !== "optional")
+        return null;
+    const init = s.init;
+    if (init.kind !== "index")
+        return null;
+    if (init.obj.ty.kind !== "array")
+        return null;
+    if (init.ty.kind === "optional")
+        return null; // array-of-optionals: not a flag artifact
+    const cond = arrayBoundsCond(init.obj, init.idx);
+    const undef = { kind: "var", name: "undefined", ty: { kind: "void" } };
+    const guarded = { kind: "conditional", cond, then: init, else: undef, ty: s.ty };
+    return { ...s, init: guarded };
+}
 /** Rule (expression): `obj?.<chain>` — single-eval optional chain.
  *  → `someMatch obj { Some(_oc{N}_val) => apply(chain, _oc{N}_val), None => undefined }`.
  *  The someBody applies the chain to the binder directly (field/call/index),

package/tools/dist/peephole.js

@@ -24,6 +24,8 @@ function mapExpr(e, f) {
         case "toNat": return { ...e, expr: r(e.expr) };
         case "toReal": return { ...e, expr: r(e.expr) };
         case "index": return { ...e, arr: r(e.arr), idx: r(e.idx) };
+        case "tupleLiteral": return { ...e, elems: e.elems.map(r) };
+        case "tupleProj": return { ...e, obj: r(e.obj) };
         case "record": return { ...e, spread: e.spread ? r(e.spread) : null,
             fields: e.fields.map(fi => ({ ...fi, value: r(fi.value) })) };
         case "arrayLiteral": return { ...e, elems: e.elems.map(r) };
@@ -368,6 +370,8 @@ function rewriteChildrenExpr(e) {
         case "toNat": return { ...e, expr: r(e.expr) };
         case "toReal": return { ...e, expr: r(e.expr) };
         case "index": return { ...e, arr: r(e.arr), idx: r(e.idx) };
+        case "tupleLiteral": return { ...e, elems: e.elems.map(r) };
+        case "tupleProj": return { ...e, obj: r(e.obj) };
         case "record": return { ...e, spread: e.spread ? r(e.spread) : null,
             fields: e.fields.map(fi => ({ ...fi, value: r(fi.value) })) };
         case "arrayLiteral": return { ...e, elems: e.elems.map(r) };

package/tools/dist/resolve.js

@@ -4,7 +4,7 @@
  * Uses linked environments (Scheme-style) for lexical scoping.
  * No mutation — each let extends the chain, lookup walks it.
  */
-import { isBigInt } from "./typedir.js";
+import { isBigInt, tyEqual } from "./typedir.js";
 import { parseTsType, tyToCanonical } from "./types.js";
 import { parseExpr } from "./specparser.js";
 import { freshName } from "./names.js";
@@ -283,6 +283,8 @@ function expandAlias(ty, typeDecls, seen = new Set()) {
         return { kind: "optional", inner: expandAlias(ty.inner, typeDecls, seen) };
     if (ty.kind === "array")
         return { kind: "array", elem: expandAlias(ty.elem, typeDecls, seen) };
+    if (ty.kind === "tuple")
+        return { kind: "tuple", elems: ty.elems.map(e => expandAlias(e, typeDecls, seen)) };
     if (ty.kind === "set")
         return { kind: "set", elem: expandAlias(ty.elem, typeDecls, seen) };
     if (ty.kind === "map")
@@ -300,7 +302,7 @@ function getDiscriminant(ctx, typeName) {
 // unions, arrays, maps, sets, and unresolved generics are reference-compared at
 // runtime, so a structural proof over them is unsound. Returns true for those.
 function refEqHazard(ty, typeDecls) {
-    if (ty.kind === "array" || ty.kind === "map" || ty.kind === "set")
+    if (ty.kind === "array" || ty.kind === "map" || ty.kind === "set" || ty.kind === "tuple")
         return true;
     if (ty.kind === "user") {
         let decl = typeDecls.find(d => d.name === ty.name);
@@ -340,6 +342,8 @@ function isUnmodeledTy(ty, typeDecls) {
         return isUnmodeledTy(ty.inner, typeDecls);
     if (ty.kind === "array")
         return isUnmodeledTy(ty.elem, typeDecls);
+    if (ty.kind === "tuple")
+        return ty.elems.some(e => isUnmodeledTy(e, typeDecls));
     if (ty.kind === "set")
         return isUnmodeledTy(ty.elem, typeDecls);
     if (ty.kind === "map")
@@ -926,6 +930,16 @@ function resolveExpr(e, ctx) {
             if (obj.ty.kind === "array") {
                 idxTy = obj.ty.elem;
             }
+            else if (obj.ty.kind === "tuple") {
+                // Tuple projection: the position must be a literal — a tuple has a
+                // distinct type per slot, so a runtime index has no single result type
+                // and no backend projection (`t.0`/`t.1`) exists for it.
+                const elems = obj.ty.elems;
+                if (idx.kind !== "num" || !Number.isInteger(idx.value) || idx.value < 0 || idx.value >= elems.length) {
+                    throw new Error(`tuple index must be an integer literal in [0, ${elems.length}); got ${tyToCanonical(idx.ty)} index into ${tyToCanonical(obj.ty)}`);
+                }
+                idxTy = elems[idx.value];
+            }
             else if (obj.ty.kind === "map") {
                 const objPath = asTExprAccessPath(obj);
                 const idxPath = asTExprAccessPath(idx);
@@ -1090,6 +1104,17 @@ function resolveExpr(e, ctx) {
             return { kind: "exists", var: e.var, varTy, body: resolveExpr(e.body, withEnv(ctx, extend(ctx.env, e.var, varTy))), ty: { kind: "bool" } };
         }
         case "arrayLiteral": {
+            // Expected-tuple context: type each element against its own slot type and
+            // produce a tuple literal (`[1, "a"]: [number, string]`).
+            if (ctx.returnTy.kind === "tuple") {
+                const slots = ctx.returnTy.elems;
+                const elems = e.elems.map((el, i) => {
+                    const slot = slots[i];
+                    const r = resolveExpr(el, slot ? { ...ctx, returnTy: slot } : ctx);
+                    return slot ? coerceStr(r, slot) : r;
+                });
+                return { kind: "arrayLiteral", elems, ty: { kind: "tuple", elems: elems.map(x => x.ty) } };
+            }
             // Thread the expected element type into each element, so a record/union
             // literal in an array resolves to its named datatype rather than an
             // anonymous tuple (mirrors return-position and call-argument records, which
@@ -1104,6 +1129,12 @@ function resolveExpr(e, ctx) {
                 return expectedElem ? coerceStr(r, expectedElem) : r;
             });
             const elemTy = elems.length > 0 ? elems[0].ty : { kind: "unknown" };
+            // No expected collection type: infer array vs tuple from the elements —
+            // heterogeneous element types can't be a homogeneous seq, so they form a
+            // tuple (`[1, "a"]` → `(int, string)`); otherwise a seq.
+            if (!expectedElem && elems.length >= 2 && !elems.every(x => tyEqual(x.ty, elemTy))) {
+                return { kind: "arrayLiteral", elems, ty: { kind: "tuple", elems: elems.map(x => x.ty) } };
+            }
             return { kind: "arrayLiteral", elems, ty: { kind: "array", elem: elemTy } };
         }
         case "lambda": {
@@ -1369,6 +1400,12 @@ function resolveStmt(s, ctx) {
                 // Map destructuring: [key, value]
                 nameTypes.push(iterable.ty.key, iterable.ty.value);
             }
+            else if (s.names.length >= 2 && iterable.ty.kind === "array" && iterable.ty.elem.kind === "tuple") {
+                // Array of tuples: bind each name to its slot type.
+                const elems = iterable.ty.elem.elems;
+                for (let i = 0; i < s.names.length; i++)
+                    nameTypes.push(elems[i] ?? { kind: "unknown" });
+            }
             else {
                 // General tuple destructuring: all unknown
                 for (const _ of s.names)

package/tools/dist/transform.js

@@ -37,6 +37,8 @@ function mapExpr(e, f) {
         case "toNat": return { ...e, expr: r(e.expr) };
         case "toReal": return { ...e, expr: r(e.expr) };
         case "index": return { ...e, arr: r(e.arr), idx: r(e.idx) };
+        case "tupleLiteral": return { ...e, elems: e.elems.map(r) };
+        case "tupleProj": return { ...e, obj: r(e.obj) };
         case "record": return { ...e, spread: e.spread ? r(e.spread) : null, fields: e.fields.map(fi => ({ ...fi, value: r(fi.value) })) };
         case "arrayLiteral": return { ...e, elems: e.elems.map(r) };
         case "if": return { ...e, cond: r(e.cond), then: r(e.then), else: r(e.else) };
@@ -439,8 +441,9 @@ function lowerExpr(e, binds) {
             // Number truthiness: !n → n == 0
             if (e.op === "!" && (e.expr.ty.kind === "int" || e.expr.ty.kind === "nat"))
                 return { kind: "binop", op: "=", left: lowerExpr(e.expr, binds), right: { kind: "num", value: 0 } };
-            // Array truthiness: every array is truthy in JS, so !xs is always false.
-            if (e.op === "!" && e.expr.ty.kind === "array") {
+            // Object truthiness: arrays, objects, maps, and sets are always truthy in
+            // JS, so `!x` is always false.
+            if (e.op === "!" && ["array", "user", "map", "set", "tuple"].includes(e.expr.ty.kind)) {
                 lowerExpr(e.expr, binds); // preserve any lifted side effects; value is the constant false
                 return { kind: "bool", value: false };
             }
@@ -697,6 +700,10 @@ function lowerExpr(e, binds) {
             return { kind: "field", obj: transformExpr(e.obj), field: e.field, datatypeField: isRecordType(e.obj.ty) };
         case "index": {
             const idx = transformExpr(e.idx);
+            if (e.obj.ty.kind === "tuple") {
+                // resolve guarantees a numeric-literal index here; project at that slot.
+                return { kind: "tupleProj", obj: transformExpr(e.obj), index: e.idx.value, arity: e.obj.ty.elems.length };
+            }
             if (e.obj.ty.kind === "map") {
                 // Mirrors the .get() → .getDirect switch at line ~453: when resolve has
                 // narrowed the index type to non-optional (via `k in m` atoms in scope),
@@ -918,6 +925,8 @@ function lowerExpr(e, binds) {
             // Set with initial elements: new Set([a, b]) → {a, b}
             if (e.ty.kind === "set")
                 return { kind: "app", fn: "SetLiteral", args: e.elems.map(el => lowerExpr(el, binds)) };
+            if (e.ty.kind === "tuple")
+                return { kind: "tupleLiteral", elems: e.elems.map(el => lowerExpr(el, binds)) };
             return { kind: "arrayLiteral", elems: e.elems.map(el => lowerExpr(el, binds)) };
         case "lambda": {
             // Pass the module typeDecls (not []), so type lookups inside the lambda
@@ -1397,86 +1406,73 @@ function transformStmts(stmts, typeDecls) {
         const s = stmts[i];
         // Transform for-of → for-in over range
         if (s.kind === "forof") {
-            const varName = s.names[0];
-            const varTy = s.nameTypes[0] ?? { kind: "unknown" };
-            let iterExpr = transformExpr(s.iterable);
-            // Map key-only iteration: for (const k in record) → iterate keys only
-            if (s.names.length === 1 && s.iterable.ty.kind === "map") {
-                const keyName = s.names[0];
+            const headName = s.names[0];
+            const headTy = s.nameTypes[0] ?? { kind: "unknown" };
+            const iterExpr = transformExpr(s.iterable);
+            // All for-of shapes lower to the same range loop `for idx in 0..seq.size`;
+            // they differ only in (a) which indexable `seq` is iterated and (b) the
+            // per-iteration `let`s that bind the loop names. Compute the shared loop-
+            // variable naming once, then let each shape fill in `seq` + `perIter`.
+            const count = _forofCounters.get(headName) ?? 0;
+            _forofCounters.set(headName, count + 1);
+            const suffix = count === 0 ? "" : `${count + 1}`;
+            const idxName = freshName(`_${headName}_idx${suffix}`);
+            const idxVar = { kind: "var", name: idxName };
+            let seq;
+            let perIter;
+            if (s.iterable.ty.kind === "map") {
+                // for (const k of map) / for (const [k, v] of map): materialize the keys
+                // as a seq and index into it; a value name looks up via getDirect.
                 const keyTy = s.nameTypes[0] ?? s.iterable.ty.key ?? { kind: "unknown" };
-                const count = _forofCounters.get(keyName) ?? 0;
-                _forofCounters.set(keyName, count + 1);
-                const suffix = count === 0 ? "" : `${count + 1}`;
-                const keysSeqName = freshName(`_${keyName}_keys${suffix}`);
-                const convExpr = { kind: "app", fn: "SetToSeq", args: [{ kind: "field", obj: iterExpr, field: "keys" }] };
-                result.push({ kind: "let", name: keysSeqName, type: { kind: "array", elem: keyTy }, mutable: false, value: convExpr });
-                const keysVar = { kind: "var", name: keysSeqName };
-                const idxName = freshName(`_${keyName}_idx${suffix}`);
-                const idx = { kind: "var", name: idxName };
-                const arrSize = { kind: "field", obj: keysVar, field: "size" };
-                const bodyStmts = eliminateTopLevelContinue(transformStmts(s.body, typeDecls));
-                const letKey = { kind: "let", name: keyName, type: keyTy, mutable: false, value: { kind: "index", arr: keysVar, idx } };
-                const boundInv = { kind: "binop", op: "≤", left: idx, right: arrSize };
-                result.push({
-                    kind: "forin", idx: idxName, bound: arrSize,
-                    invariants: [boundInv, ...s.invariants.map(transformExpr)],
-                    body: [letKey, ...bodyStmts],
-                });
-                i++;
-                continue;
+                const keysSeqName = freshName(`_${headName}_keys${suffix}`);
+                result.push({ kind: "let", name: keysSeqName, type: { kind: "array", elem: keyTy }, mutable: false,
+                    value: { kind: "app", fn: "SetToSeq", args: [{ kind: "field", obj: iterExpr, field: "keys" }] } });
+                seq = { kind: "var", name: keysSeqName };
+                const letKey = { kind: "let", name: headName, type: keyTy, mutable: false, value: { kind: "index", arr: seq, idx: idxVar } };
+                if (s.names.length >= 2) {
+                    const valueTy = s.nameTypes[1] ?? { kind: "unknown" };
+                    const letVal = { kind: "let", name: s.names[1], type: valueTy, mutable: false,
+                        value: { kind: "methodCall", obj: iterExpr, objTy: s.iterable.ty, method: "getDirect", args: [{ kind: "var", name: headName }], monadic: false } };
+                    perIter = [letKey, letVal];
+                }
+                else {
+                    perIter = [letKey];
+                }
             }
-            // Map iteration: for (const [k, v] of map) → iterate keys, look up values
-            if (s.names.length >= 2 && s.iterable.ty.kind === "map") {
-                const keyName = s.names[0], valueName = s.names[1];
-                const keyTy = s.nameTypes[0] ?? { kind: "unknown" };
-                const valueTy = s.nameTypes[1] ?? { kind: "unknown" };
-                const count = _forofCounters.get(keyName) ?? 0;
-                _forofCounters.set(keyName, count + 1);
-                const suffix = count === 0 ? "" : `${count + 1}`;
-                const keysSeqName = freshName(`_${keyName}_keys${suffix}`);
-                const convExpr = { kind: "app", fn: "SetToSeq", args: [{ kind: "field", obj: iterExpr, field: "keys" }] };
-                result.push({ kind: "let", name: keysSeqName, type: { kind: "array", elem: keyTy }, mutable: false, value: convExpr });
-                const keysVar = { kind: "var", name: keysSeqName };
-                const idxName = freshName(`_${keyName}_idx${suffix}`);
-                const idx = { kind: "var", name: idxName };
-                const arrSize = { kind: "field", obj: keysVar, field: "size" };
-                const bodyStmts = eliminateTopLevelContinue(transformStmts(s.body, typeDecls));
-                const letKey = { kind: "let", name: keyName, type: keyTy, mutable: false, value: { kind: "index", arr: keysVar, idx } };
-                const letVal = { kind: "let", name: valueName, type: valueTy, mutable: false,
-                    value: { kind: "methodCall", obj: iterExpr, objTy: s.iterable.ty, method: "getDirect", args: [{ kind: "var", name: keyName }], monadic: false } };
-                const boundInv = { kind: "binop", op: "≤", left: idx, right: arrSize };
-                result.push({
-                    kind: "forin", idx: idxName, bound: arrSize,
-                    invariants: [boundInv, ...s.invariants.map(transformExpr)],
-                    body: [letKey, letVal, ...bodyStmts],
-                });
-                i++;
-                continue;
+            else if (s.names.length >= 2 && s.iterable.ty.kind === "array" && s.iterable.ty.elem.kind === "tuple") {
+                // for (const [a, b] of tupleArr): bind the element once, then destructure
+                // it into each name via a tuple projection.
+                const tupleTy = s.iterable.ty.elem;
+                seq = iterExpr;
+                const elemName = freshName(`_${headName}_elem${suffix}`);
+                const letElem = { kind: "let", name: elemName, type: tupleTy, mutable: false, value: { kind: "index", arr: seq, idx: idxVar } };
+                perIter = [letElem, ...s.names.map((n, k) => ({
+                        kind: "let", name: n, type: tupleTy.elems[k] ?? { kind: "unknown" }, mutable: false,
+                        value: { kind: "tupleProj", obj: { kind: "var", name: elemName }, index: k, arity: tupleTy.elems.length },
+                    }))];
             }
-            // Sets aren't indexable — bind SetToSeq to a variable for iteration
-            if (s.iterable.ty.kind === "set") {
-                const seqName = freshName(`_${varName}_seq`);
-                const convExpr = { kind: "app", fn: "SetToSeq", args: [iterExpr] };
-                const elemTy = varTy.kind !== "unknown" ? varTy : { kind: "string" };
-                result.push({ kind: "let", name: seqName, type: { kind: "array", elem: elemTy }, mutable: false, value: convExpr });
-                iterExpr = { kind: "var", name: seqName };
+            else {
+                // Single element by index. Sets aren't indexable, so materialize first.
+                if (s.iterable.ty.kind === "set") {
+                    const seqName = freshName(`_${headName}_seq${suffix}`);
+                    const elemTy = headTy.kind !== "unknown" ? headTy : { kind: "string" };
+                    result.push({ kind: "let", name: seqName, type: { kind: "array", elem: elemTy }, mutable: false,
+                        value: { kind: "app", fn: "SetToSeq", args: [iterExpr] } });
+                    seq = { kind: "var", name: seqName };
+                }
+                else {
+                    seq = iterExpr;
+                }
+                perIter = [{ kind: "let", name: headName, type: headTy, mutable: false, value: { kind: "index", arr: seq, idx: idxVar } }];
             }
-            const count = _forofCounters.get(varName) ?? 0;
-            _forofCounters.set(varName, count + 1);
-            const suffix = count === 0 ? "" : `${count + 1}`;
-            const idxName = freshName(`_${varName}_idx${suffix}`);
-            const idx = { kind: "var", name: idxName };
-            const arrSize = { kind: "field", obj: iterExpr, field: "size" };
-            const bodyStmts = eliminateTopLevelContinue(transformStmts(s.body, typeDecls));
-            const letElem = { kind: "let", name: varName, type: varTy, mutable: false, value: { kind: "index", arr: iterExpr, idx } };
+            const arrSize = { kind: "field", obj: seq, field: "size" };
             // Auto-add bound invariant: idx ≤ bound (always true for range loops)
-            const boundInv = { kind: "binop", op: "≤", left: idx, right: arrSize };
+            const boundInv = { kind: "binop", op: "≤", left: idxVar, right: arrSize };
+            const bodyStmts = eliminateTopLevelContinue(transformStmts(s.body, typeDecls));
             result.push({
-                kind: "forin",
-                idx: idxName,
-                bound: arrSize,
+                kind: "forin", idx: idxName, bound: arrSize,
                 invariants: [boundInv, ...s.invariants.map(transformExpr)],
-                body: [letElem, ...bodyStmts],
+                body: [...perIter, ...bodyStmts],
             });
             i++;
             continue;

package/tools/dist/typedir.js

@@ -8,3 +8,39 @@
 export function isBigInt(ty) {
     return (ty.kind === "int" || ty.kind === "nat") && !!ty.big;
 }
+/** Structural equality on Ty. Used to decide whether a tuple type is homogeneous
+ *  (all elements equal ⇒ lower to `seq`) vs heterogeneous (⇒ keep as `tuple`). */
+export function tyEqual(a, b) {
+    if (a.kind !== b.kind)
+        return false;
+    switch (a.kind) {
+        case "array": return tyEqual(a.elem, b.elem);
+        case "set": return tyEqual(a.elem, b.elem);
+        case "tuple": {
+            const bt = b;
+            return a.elems.length === bt.elems.length && a.elems.every((e, i) => tyEqual(e, bt.elems[i]));
+        }
+        case "map": {
+            const bm = b;
+            return tyEqual(a.key, bm.key) && tyEqual(a.value, bm.value);
+        }
+        case "optional": return tyEqual(a.inner, b.inner);
+        case "user": return a.name === b.name;
+        case "fn": {
+            const bf = b;
+            return a.params.length === bf.params.length
+                && a.params.every((p, i) => tyEqual(p, bf.params[i]))
+                && tyEqual(a.result, bf.result);
+        }
+        case "string": {
+            const bs = b;
+            return JSON.stringify(a.values ?? null) === JSON.stringify(bs.values ?? null);
+        }
+        case "int":
+        case "nat": return !!a.big === !!b.big;
+        case "bool":
+        case "real":
+        case "void":
+        case "unknown": return true; // no payload
+    }
+}

package/tools/dist/types.js

@@ -4,6 +4,7 @@
  * Single source of truth for type-related decisions.
  * The transform phase imports this.
  */
+import { tyEqual } from "./typedir.js";
 import { Node, Project, SyntaxKind } from "ts-morph";
 /**
  * Parses TS type strings via a real ts-morph parse — no regex cascade. Set
@@ -90,10 +91,14 @@ function tyFromTypeNode(tn) {
     if (Node.isArrayTypeNode(tn))
         return { kind: "array", elem: tyFromTypeNode(tn.getElementTypeNode()) };
     if (Node.isTupleTypeNode(tn)) {
-        const elems = tn.getElements();
+        const elems = tn.getElements().map(tyFromTypeNode);
         if (elems.length === 0)
             return { kind: "array", elem: { kind: "unknown" } };
-        return { kind: "array", elem: tyFromTypeNode(elems[0]) };
+        // Homogeneous tuple → seq; only heterogeneous tuples need the tuple
+        // representation.
+        if (elems.every(e => tyEqual(e, elems[0])))
+            return { kind: "array", elem: elems[0] };
+        return { kind: "tuple", elems };
     }
     if (Node.isFunctionTypeNode(tn)) {
         const params = tn.getParameters().map(p => {
@@ -158,6 +163,7 @@ export function tyToCanonical(ty) {
         case "void": return "void";
         case "unknown": return "unknown";
         case "array": return `seq<${tyToCanonical(ty.elem)}>`;
+        case "tuple": return `(${ty.elems.map(tyToCanonical).join(", ")})`;
         case "map": return `map<${tyToCanonical(ty.key)}, ${tyToCanonical(ty.value)}>`;
         case "set": return `set<${tyToCanonical(ty.elem)}>`;
         case "optional": return `Option<${tyToCanonical(ty.inner)}>`;