lemmascript 0.5.17 → 0.5.19

package/tools/dist/info-command.js

@@ -36,3 +36,71 @@ export function runInfo(raw, outPath) {
     writeFileSync(outPath, JSON.stringify(out, null, 2) + "\n");
     console.log(`Wrote ${outPath}`);
 }
+/** Statement/expression kinds present anywhere in a function body — a cheap
+ *  structural census so consumers can classify (havoc/assume/throw usage)
+ *  without receiving the whole body. */
+function bodyKinds(fn) {
+    // Keys under which a Ty (not a statement/expression) hangs — their `kind`
+    // tags belong to the type grammar and would pollute the census.
+    const TY_KEYS = new Set(["ty", "binderTy", "varTy", "nameTypes"]);
+    const kinds = new Set();
+    const walk = (node) => {
+        if (Array.isArray(node)) {
+            node.forEach(walk);
+            return;
+        }
+        if (node && typeof node === "object") {
+            const o = node;
+            if (typeof o.kind === "string") {
+                kinds.add(o.kind === "assert" && o.assumed === true ? "assume" : o.kind);
+            }
+            for (const [k, v] of Object.entries(o))
+                if (!TY_KEYS.has(k))
+                    walk(v);
+        }
+    };
+    walk(fn.body);
+    return [...kinds].sort();
+}
+function typedFn(fn, rawFn) {
+    // Carry the original TS type string per parameter: Ty conflates types whose
+    // runtime shapes differ (Map<K,V> and Record<K,V> both map to kind "map"),
+    // and satellites that construct runtime values need to tell them apart.
+    const rawTsTypes = new Map((rawFn?.params ?? []).map(p => [p.name, p.tsType]));
+    return {
+        name: fn.name,
+        exported: rawFn?.exported ?? false,
+        typeParams: fn.typeParams,
+        params: fn.params.map(p => ({ ...p, tsType: rawTsTypes.get(p.name) })),
+        returnTy: fn.returnTy,
+        requires: fn.requires,
+        ensures: fn.ensures,
+        decreases: fn.decreases,
+        contract: rawFn?.contract ?? [],
+        isPure: fn.isPure,
+        forcePure: fn.forcePure,
+        autohavoc: fn.autohavoc,
+        bodyKinds: bodyKinds(fn),
+    };
+}
+export function runTypedInfo(raw, typed, version, backendDirective, dafny) {
+    const rawByName = new Map(raw.functions.map(f => [f.name, f]));
+    const rawMethods = new Map(raw.classes.flatMap(c => c.methods.map(m => [`${c.name}.${m.name}`, m])));
+    const out = {
+        schema: 1,
+        lemmascript: version,
+        file: typed.file,
+        backendDirective,
+        typeDecls: typed.typeDecls,
+        externs: typed.externs,
+        constants: typed.constants,
+        functions: typed.functions.map(f => typedFn(f, rawByName.get(f.name))),
+        classes: typed.classes.map(c => ({
+            name: c.name,
+            fields: c.fields,
+            methods: c.methods.map(m => typedFn(m, rawMethods.get(`${c.name}.${m.name}`))),
+        })),
+        dafny,
+    };
+    console.log(JSON.stringify(out, null, 2));
+}

package/tools/dist/ir.js

@@ -5,7 +5,7 @@
  * The emit phase pretty-prints them to backend syntax (Lean or Dafny).
  */
 export const pWild = () => ({ kind: "wild" });
-export const pCtor = (ctor, ...binders) => ({ kind: "ctor", ctor, binders });
+export const pCtor = (c, ...binders) => ({ kind: "ctor", ctor: c, binders });
 /** Binder identifiers a pattern introduces (`[]` for wildcard / nullary ctor). */
 export function patternBinders(p) {
     return p.kind === "ctor" ? p.binders : [];
@@ -17,19 +17,40 @@ export function patternCtor(p) {
 export function patternBinds(p, name) {
     return patternBinders(p).includes(name);
 }
+// ── Literal queries ──────────────────────────────────────────
+/** The exact value of an integer-literal operand (possibly negated), or null
+ *  when `e` isn't one. Answers in compiler-side `bigint` so a backend folding a
+ *  literal into arithmetic stays exact: JS bitwise operators truncate to 32 bits
+ *  and `Math.pow(2, n)` is a double, both of which lie past 2^53. A `num`
+ *  outside the safe-integer range has already lost precision, so it is not a
+ *  usable answer — hence null. */
+export function exactIntegerLiteral(e) {
+    if (e.kind === "bigint")
+        return BigInt(e.value);
+    if (e.kind === "num")
+        return Number.isSafeInteger(e.value) ? BigInt(e.value) : null;
+    // Transform folds `-<num>` into a negative `num`, but leaves a negated
+    // `bigint` structural (folding it would coerce the payload through Number).
+    if (e.kind === "unop" && e.op === "-") {
+        const inner = exactIntegerLiteral(e.expr);
+        return inner === null ? null : -inner;
+    }
+    return null;
+}
 export function anyExpr(e, pred) {
     if (pred(e))
         return true;
     switch (e.kind) {
         case "var":
         case "num":
+        case "bigint":
         case "bool":
         case "str":
         case "emptyMap":
         case "emptySet":
         case "havoc":
         case "default": return false;
-        case "constructor": return (e.args ?? []).some(a => anyExpr(a, pred));
+        case "constructor": return e.args.some(a => anyExpr(a, pred));
         case "binop": return anyExpr(e.left, pred) || anyExpr(e.right, pred);
         case "unop":
         case "toNat":
@@ -46,7 +67,7 @@ export function anyExpr(e, pred) {
         case "methodCall": return anyExpr(e.obj, pred) || e.args.some(a => anyExpr(a, pred));
         case "lambda": return e.body.some(s => anyExprInStmt(s, pred));
         case "if": return anyExpr(e.cond, pred) || anyExpr(e.then, pred) || anyExpr(e.else, pred);
-        case "match": return (typeof e.scrutinee !== "string" && anyExpr(e.scrutinee, pred)) || e.arms.some(a => anyExpr(a.body, pred));
+        case "match": return anyExpr(e.scrutinee, pred) || e.arms.some(a => anyExpr(a.body, pred));
         case "forall":
         case "exists": return anyExpr(e.body, pred);
         case "let": return anyExpr(e.value, pred) || anyExpr(e.body, pred);
@@ -65,7 +86,7 @@ export function anyExprInStmt(s, pred) {
         case "break":
         case "continue": return false;
         case "if": return anyExpr(s.cond, pred) || anyExprInStmts(s.then, pred) || anyExprInStmts(s.else, pred);
-        case "match": return (typeof s.scrutinee !== "string" && anyExpr(s.scrutinee, pred)) || s.arms.some(a => anyExprInStmts(a.body, pred));
+        case "match": return anyExpr(s.scrutinee, pred) || s.arms.some(a => anyExprInStmts(a.body, pred));
         case "while": return anyExpr(s.cond, pred) || s.invariants.some(i => anyExpr(i, pred))
             || (s.decreasing ? anyExpr(s.decreasing, pred) : false) || (s.doneWith ? anyExpr(s.doneWith, pred) : false)
             || anyExprInStmts(s.body, pred);
@@ -80,10 +101,9 @@ export function anyExprInStmts(stmts, pred) {
 // function. These drive the *local* freshness checks for user-facing binders
 // (the result out-parameter, comprehension binders): a binder is checked only
 // against the expressions/scope it actually wraps, not the whole module.
-const _refsName = (name) => e => (e.kind === "var" && e.name === name) ||
+const _refsName = (name) => (e) => (e.kind === "var" && e.name === name) ||
     (e.kind === "app" && e.fn === name) ||
-    (e.kind === "constructor" && e.name === name) ||
-    (e.kind === "match" && typeof e.scrutinee === "string" && e.scrutinee === name);
+    (e.kind === "constructor" && e.name === name);
 export function usesName(e, name) {
     return anyExpr(e, _refsName(name));
 }

package/tools/dist/lean-emit.js

@@ -5,7 +5,7 @@
  * and support-import selection.
  */
 import { anyExpr, usesNameInDecl, patternBinders } from "./ir.js";
-import { freshName } from "./names.js";
+import { freshNameWhere } from "./names.js";
 // ── Ty → Lean type string ──────────────────────────────────
 function tyToLean(ty) {
     switch (ty.kind) {
@@ -190,9 +190,15 @@ let _unknownEmitted = false; // across files in one run — the def file imports
 // built only from decidable atoms (comparisons, Bool-returning calls) coerces fine
 // and stays in the more proof-friendly Prop form.
 let _boolCtx = false;
+/** Constructor names come from source strings (string-union values,
+ *  discriminated-union tags) and may contain non-identifier characters
+ *  ("spec-pure"); guillemet-quote those — exact and collision-free. */
+function leanCtorName(name) {
+    return /^[A-Za-z_][A-Za-z0-9_'!?]*$/.test(name) ? name : `«${name}»`;
+}
 /** Render a match pattern to Lean syntax: `_`, `.none`, `.some x`, `.syn seq`. */
 function renderLeanPattern(p) {
-    return p.kind === "wild" ? "_" : "." + [p.ctor, ...p.binders].join(" ");
+    return p.kind === "wild" ? "_" : "." + [leanCtorName(p.ctor), ...p.binders].join(" ");
 }
 // A Bool-valued atom that does NOT coerce to Prop: an inlined union discriminator
 // (lowered to a match-bool `match x with | .C .. => true | _ => false`) or a raw
@@ -313,6 +319,8 @@ function emitExpr(e, parentPrec) {
         // `undefined` is the IR's spelling of the absent optional (mirrors dafny-emit's None)
         case "var": return e.name === "undefined" ? "none" : escapeName(e.name);
         case "num": return `${e.value}`;
+        // Already canonical decimal; Lean's `Int` is mathematical, so no `n` suffix.
+        case "bigint": return e.value;
         case "bool": return e.value ? "true" : "false";
         case "str": return `"${e.value.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n')}"`;
         case "constructor": {
@@ -320,7 +328,7 @@ function emitExpr(e, parentPrec) {
             // like `match ... | .none => Type.some x` where elaboration can't infer).
             // Without type: emit `.name` (dotted form; works in pattern positions
             // and where the expected type is clear from context).
-            const head = e.type ? `${e.type}.${e.name}` : `.${e.name}`;
+            const head = e.type ? `${e.type}.${leanCtorName(e.name)}` : `.${leanCtorName(e.name)}`;
             if (!e.args || e.args.length === 0)
                 return head;
             const args = e.args.map(a => (a.kind === "binop" || a.kind === "unop" || a.kind === "implies" || a.kind === "app" || a.kind === "methodCall") ? `(${emitExpr(a)})` : emitExpr(a));
@@ -361,9 +369,10 @@ function emitExpr(e, parentPrec) {
         case "unop":
             if (e.op === "¬")
                 return _boolCtx ? `!(${emitExpr(e.expr)})` : `¬(${emitExpr(e.expr)})`;
-            if (e.op === "-" && e.expr.kind === "num")
-                return `-${e.expr.value}`;
-            return `(-${emitExpr(e.expr)})`;
+            if (e.op !== "-")
+                throw new Error(`Unsupported Lean unary operator: ${e.op}`);
+            return (e.expr.kind === "num" || e.expr.kind === "bigint")
+                ? `-${e.expr.value}` : `(-${emitExpr(e.expr)})`;
         case "binop": {
             // Discriminator test against a constructor that carries fields:
             // `x = .Ctor` → `(match x with | .Ctor .. => true | _ => false)`. A
@@ -415,8 +424,10 @@ function emitExpr(e, parentPrec) {
             // Datatype constructor (tagged by transform): Lean needs the qualified name
             // `BaseType.variant`; a bare `variant` is an unknown identifier. (Dafny keeps
             // the bare form, so its output is unaffected.)
-            if (e.ctorOf)
-                return args.length ? `${e.ctorOf}.${e.fn} ${args.join(" ")}` : `${e.ctorOf}.${e.fn}`;
+            if (e.ctorOf) {
+                const ctor = leanCtorName(e.fn);
+                return args.length ? `${e.ctorOf}.${ctor} ${args.join(" ")}` : `${e.ctorOf}.${ctor}`;
+            }
             // Option constructors arrive Dafny-spelled from transform (`app "Some"`);
             // Lean core exports the lowercase forms as top-level names.
             if (e.fn === "Some" && args.length === 1)
@@ -466,12 +477,12 @@ function emitExpr(e, parentPrec) {
             const obj = emitExpr(e.obj);
             if (e.field === "collectionSize")
                 return `${obj}.size`;
-            const wrap = e.obj.kind !== "var" && e.obj.kind !== "num" && e.obj.kind !== "bool";
+            const wrap = e.obj.kind !== "var" && e.obj.kind !== "num" && e.obj.kind !== "bigint" && e.obj.kind !== "bool";
             return wrap ? `(${obj}).${escapeName(e.field)}` : `${obj}.${escapeName(e.field)}`;
         }
         case "toNat": {
             const inner = emitExpr(e.expr);
-            const wrap = e.expr.kind !== "var" && e.expr.kind !== "num";
+            const wrap = e.expr.kind !== "var" && e.expr.kind !== "num" && e.expr.kind !== "bigint";
             return wrap ? `(${inner}).toNat` : `${inner}.toNat`;
         }
         case "toReal":
@@ -498,7 +509,7 @@ function emitExpr(e, parentPrec) {
             // so any token after an arm body (`→`, another match's `|`, etc.) would
             // bleed into the last `.none` case without explicit bracketing.
             const arms = e.arms.map(a => `| ${renderLeanPattern(a.pattern)} => ${emitExpr(a.body)}`);
-            const scrut = typeof e.scrutinee === "string" ? e.scrutinee : emitExpr(e.scrutinee);
+            const scrut = emitExpr(e.scrutinee);
             return `(match ${scrut} with ${arms.join(" ")})`;
         }
         case "forall": return `∀ ${e.var} : ${tyToLean(e.type)}, ${emitExpr(e.body)}`;
@@ -586,7 +597,7 @@ function emitStmt(s, indent) {
             return out;
         }
         case "match": {
-            const scrut = typeof s.scrutinee === "string" ? s.scrutinee : emitExpr(s.scrutinee);
+            const scrut = emitExpr(s.scrutinee);
             // Option match (.some/.none) → emit as if/let for WPGen.if compatibility
             if (s.arms.length === 2) {
                 const someArm = s.arms.find(a => a.pattern.kind === "ctor" && a.pattern.ctor === "some");
@@ -718,11 +729,11 @@ function emitDecl(d) {
             const lines = [`inductive ${d.name} where`];
             for (const c of d.constructors) {
                 if (c.fields.length === 0) {
-                    lines.push(`  | ${c.name} : ${d.name}`);
+                    lines.push(`  | ${leanCtorName(c.name)} : ${d.name}`);
                 }
                 else {
                     const params = c.fields.map(f => `(${escapeName(f.name)} : ${tyToLean(f.type)})`).join(" ");
-                    lines.push(`  | ${c.name} ${params} : ${d.name}`);
+                    lines.push(`  | ${leanCtorName(c.name)} ${params} : ${d.name}`);
                 }
             }
             return lines.join("\n") + emitDeriving(d.name, d.deriving);
@@ -775,7 +786,7 @@ function emitDecl(d) {
             // Prime the return binder only on a collision within *this method's own*
             // signature/body — `res` is a common identifier module-wide (record
             // fields, unrelated params), so a module-wide check would prime spuriously.
-            _resultName = freshName("res", n => d.params.some(p => escapeName(p.name) === n) ||
+            _resultName = freshNameWhere("res", n => d.params.some(p => escapeName(p.name) === n) ||
                 usesNameInDecl(d.requires, d.ensures, d.body, n));
             const lines = [`method ${d.name} ${params} return (${_resultName} : ${tyToLean(d.returnType)})`];
             for (const r of d.requires)
@@ -829,7 +840,7 @@ function emitPureExpr(e, indent) {
         case "if":
             return `${pad}if ${emitExpr(e.cond)} then\n${emitPureExpr(e.then, indent + 1)}\n${pad}else\n${emitPureExpr(e.else, indent + 1)}`;
         case "match": {
-            const lines = [`${pad}match ${typeof e.scrutinee === "string" ? e.scrutinee : emitExpr(e.scrutinee)} with`];
+            const lines = [`${pad}match ${emitExpr(e.scrutinee)} with`];
             for (const arm of e.arms) {
                 lines.push(`${pad}| ${renderLeanPattern(arm.pattern)} =>`);
                 lines.push(emitPureExpr(arm.body, indent + 1));

package/tools/dist/lsc.js

@@ -16,12 +16,25 @@ import { autoHavocModule } from "./autohavoc.js";
 import { transformModuleLean, transformModuleDafny } from "./transform.js";
 import { peepholeModule } from "./peephole.js";
 import { emitLeanFile, resetLeanModule } from "./lean-emit.js";
-import { emitDafnyFile } from "./dafny-emit.js";
+import { emitDafnyFile, emittedNameMap } from "./dafny-emit.js";
 import { dafnyGen, dafnyCheckDiff, dafnyVerify, dafnyRegen } from "./dafny-commands.js";
 import { leanGen, leanCheck } from "./lean-commands.js";
-import { runInfo } from "./info-command.js";
+import { runInfo, runTypedInfo } from "./info-command.js";
+/** Version of the lemmascript package — the root package.json sits two levels
+ *  above this module from both tools/src/ (tsx) and tools/dist/ (installed). */
+function lscVersion() {
+    const pkg = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8"));
+    return pkg.version;
+}
 function main() {
     const args = process.argv.slice(2);
+    // `lsc version` — print the package version. Machine consumers (satellites
+    // like lemmascript-claimcheck/-crosscheck) use this for their version
+    // handshake; keep the output to the bare semver string.
+    if (args[0] === "version") {
+        console.log(lscVersion());
+        return;
+    }
     // `lsc claimcheck <file.ts> …` forwards verbatim to the lemmascript-claimcheck
     // CLI (a dependency; its cli reads the rewritten process.argv). With no
     // leading <file.ts>, batch: one satellite run per LemmaScript-files.txt entry,
@@ -108,6 +121,14 @@ function main() {
         noVerify = true;
         args.splice(noVerifyIdx, 1);
     }
+    // --typed (info only): print the machine-readable Typed IR contract to
+    // stdout instead of writing the human-oriented foo.ts.json.
+    let typedInfo = false;
+    const typedIdx = args.indexOf("--typed");
+    if (typedIdx >= 0) {
+        typedInfo = true;
+        args.splice(typedIdx, 1);
+    }
     // Anything flag-shaped left over is a typo or a space-separated form
     // (`--backend lean`): reject it rather than let it become a positional arg
     // or be silently ignored (which would e.g. verify with the wrong backend).
@@ -119,15 +140,21 @@ function main() {
     const [cmd, filePath] = args;
     if (!cmd) {
         console.error("Usage: lsc <gen|check|regen|extract|info> [--backend=lean|dafny] <file.ts>");
+        console.error("       lsc info --typed <file.ts>   (machine-readable Typed IR contract to stdout)");
         console.error("       lsc <gen|gen-check|check> [--backend=…] [--slow]   (no file: batch over LemmaScript-files.txt)");
         console.error("       lsc claimcheck [<file.ts>] [flags…]   (forwards to lemmascript-claimcheck)");
+        console.error("       lsc version");
+        process.exit(1);
+    }
+    if (typedInfo && cmd !== "info") {
+        console.error(`--typed is only valid with the info command (got: ${cmd})`);
         process.exit(1);
     }
     if (!filePath) {
         runBatch(cmd, backend, slow);
         return;
     }
-    runFile(cmd, filePath, backend, timeLimit, extraFlags, noVerify);
+    runFile(cmd, filePath, backend, timeLimit, extraFlags, noVerify, typedInfo);
 }
 // LemmaScript-files.txt, parsed: `filepath [timeout_in_seconds] [extra dafny
 // flags…]` per line; no timeout = Dafny default. Exits if the file is absent.
@@ -164,7 +191,7 @@ function runBatch(cmd, backend, slow) {
         }
     }
 }
-function runFile(cmd, filePath, backend, timeLimit, extraFlags, noVerify = false) {
+function runFile(cmd, filePath, backend, timeLimit, extraFlags, noVerify = false, typedInfo = false) {
     const absPath = path.resolve(filePath);
     if (!existsSync(absPath)) {
         console.error(`File not found: ${absPath}`);
@@ -212,7 +239,7 @@ function runFile(cmd, filePath, backend, timeLimit, extraFlags, noVerify = false
         console.log(JSON.stringify(raw, null, 2));
         return;
     }
-    if (cmd === "info") {
+    if (cmd === "info" && !typedInfo) {
         const outPath = path.join(path.dirname(absPath), `${path.basename(filePath, ".ts")}.ts.json`);
         runInfo(raw, outPath);
         return;
@@ -224,6 +251,27 @@ function runFile(cmd, filePath, backend, timeLimit, extraFlags, noVerify = false
     // values so verification rests only on the declared contracts (a sound
     // over-approximation). No-op unless a function opts in.
     const typed = autoHavocModule(narrowModule(resolved));
+    if (cmd === "info") {
+        // --typed: the satellite contract. Run an in-memory Dafny emission purely
+        // to harvest the emitted-name map; the file is backend-neutral otherwise,
+        // so a failure here (e.g. Lean-only constructs) degrades to an error note
+        // rather than failing the command.
+        let dafnyInfo;
+        try {
+            let { typesFile, defFile } = transformModuleDafny(typed);
+            if (typesFile)
+                typesFile = peepholeModule(typesFile, "dafny");
+            defFile = peepholeModule(defFile, "dafny");
+            const merged = { ...defFile, decls: [...(typesFile?.decls ?? []), ...defFile.decls] };
+            emitDafnyFile(merged, path.basename(filePath), { safeSlice });
+            dafnyInfo = { emittedNames: Object.fromEntries(emittedNameMap()) };
+        }
+        catch (err) {
+            dafnyInfo = { error: err instanceof Error ? err.message : String(err) };
+        }
+        runTypedInfo(raw, typed, lscVersion(), backendDirective ? backendDirective[1] : null, dafnyInfo);
+        return;
+    }
     const dir = path.dirname(absPath);
     const base = path.basename(filePath, ".ts");
     // ── Dafny backend ─────────────────────────────────────────

package/tools/dist/names.js

@@ -39,12 +39,16 @@ export function isUserName(name) {
 export function userNames() {
     return [..._userNames];
 }
-/** A toolchain-internal name: `base` verbatim, primed on collision. The one
- *  place the priming rule lives. `taken` says what counts as a collision —
- *  by default a user-written name anywhere in the module; callers that know
- *  the exact scope (e.g. a comprehension binder checking only the expressions
- *  it wraps) pass their own predicate. */
-export function freshName(base, taken = isUserName) {
+/** A toolchain-internal name: `base` verbatim, primed on collision against
+ *  user-written names anywhere in the module. The common form — deterministic
+ *  per module. */
+export function freshName(base) {
+    return freshNameWhere(base, isUserName);
+}
+/** The priming rule, against a caller-chosen collision predicate — for
+ *  callers that know the exact scope (e.g. a comprehension binder checking
+ *  only the expressions it wraps). The one place the rule lives. */
+export function freshNameWhere(base, taken) {
     let name = base;
     while (taken(name))
         name += "'";