lemmascript 0.5.19 → 0.5.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lemmascript",
-  "version": "0.5.19",
+  "version": "0.5.20",
   "description": "A verification toolchain for TypeScript — generates Lean 4 or Dafny from annotated TS",
   "type": "module",
   "engines": {

package/tools/dist/builtins.js

@@ -87,6 +87,7 @@ export const BUILTINS = {
     "string.trimStart": { ret: STRING, pure: true },
     "string.toLowerCase": { ret: STRING, pure: true },
     "string.toUpperCase": { ret: STRING, pure: true },
+    "string.repeat": { ret: STRING, pure: true },
     "string.slice": { ret: STRING, pure: true },
     "string.substring": { ret: STRING, pure: true },
     "string.split": { pure: true,

package/tools/dist/dafny-emit.js

@@ -80,6 +80,24 @@ const DAFNY_KEYWORDS = new Set([
 // by methodHeader and reset per decl. `\result` in an ensures must use the
 // *same* name, so escapeName routes it here.
 let _resultName = "res";
+// User-type names appearing as the type of a havoc anywhere in the module —
+// populated per file by emitDafnyFile, read by the opaque-type case.
+const _havocedTypeNames = new Set();
+/** Collect the user-type names of every havoc in a decl tree. */
+function collectHavocedTypeNames(v, out) {
+    if (Array.isArray(v)) {
+        for (const x of v)
+            collectHavocedTypeNames(x, out);
+        return;
+    }
+    if (v === null || typeof v !== "object")
+        return;
+    const n = v;
+    if (n.kind === "havoc" && n.type?.kind === "user")
+        out.add(n.type.name);
+    for (const x of Object.values(v))
+        collectHavocedTypeNames(x, out);
+}
 // ── Dafny name allocation ──────────────────────────────────
 //
 // freshName (names.ts) freshens in the *raw TS* namespace — but that is not the
@@ -145,6 +163,13 @@ function escapeName(name) {
         return user;
     return escapeGeneratedName(name);
 }
+function isEmittedUserName(name) {
+    for (const emitted of _userDafnyNames.values()) {
+        if (emitted === name)
+            return true;
+    }
+    return false;
+}
 /** Allocate a toolchain-generated name (an ANF temp, a comprehension binder, a
  *  companion `_ensures` lemma). Escapes to a base, then freshens in the Dafny
  *  namespace so it can't collapse onto an escaped user name. Bypasses the user
@@ -447,6 +472,10 @@ function emitExpr(e) {
                     return `(|${obj}| >= |${args[0]}| && ${obj}[..|${args[0]}|] == ${args[0]})`;
                 if (e.method === "charCodeAt")
                     return `(${obj}[${args[0]}] as int)`;
+                if (e.method === "repeat") {
+                    needPreamble("StringRepeat");
+                    return `StringRepeat(${obj}, ${args[0]})`;
+                }
             }
             // Map methods
             if (ty === "map") {
@@ -515,7 +544,7 @@ function emitExpr(e) {
             // Discriminant check: x == .Ctor → x.Ctor?
             const op = mapOp(e.op);
             if ((op === "==" || op === "!=") && e.right.kind === "constructor") {
-                const ctorName = escapeName(e.right.name.replace(/^\./, ""));
+                const ctorName = dafnyCtorName(e.right.name.replace(/^\./, ""));
                 const pred = `${emitExpr(e.left)}.${ctorName}?`;
                 return op === "!=" ? `(!${pred})` : pred;
             }
@@ -582,6 +611,8 @@ function emitExpr(e) {
                 needPreamble("CeilReal");
             if (e.fn === "FloorReal")
                 needPreamble("FloorReal");
+            if (e.fn === "StringFromCharCode")
+                needPreamble("StringFromCharCode");
             if (e.fn === "NatToString")
                 needPreamble("NatToString");
             if (e.fn === "IntToString") {
@@ -611,7 +642,12 @@ function emitExpr(e) {
             // tags come from source strings ("spec-pure") that escapeName leaves alone.
             if (e.ctorOf) {
                 const ctor = dafnyCtorName(e.fn);
-                return _ambiguousCtors.has(e.fn)
+                // A source local may have the same name as a discriminated-union
+                // variant (`const error = ...; return { kind: "error", error }`).
+                // The bare `error(error)` is then parsed as a call through the local.
+                // Qualify whenever the emitted constructor spelling is already claimed
+                // in the user namespace, as well as when two datatypes share it.
+                return _ambiguousCtors.has(e.fn) || isEmittedUserName(ctor)
                     ? `${e.ctorOf}.${ctor}(${args.join(", ")})`
                     : `${ctor}(${args.join(", ")})`;
             }
@@ -875,7 +911,10 @@ function emitDecl(d) {
         case "opaque-type": {
             // Abstract type — no definition. `(==)` so it can sit inside datatypes
             // that derive structural equality. Never constructed or destructured.
-            return `type ${escapeName(d.name)}(==)`;
+            // `0` (auto-init) only when a havoc of this type needs a witness to
+            // satisfy definite assignment — `var x: T := *` requires it.
+            const autoInit = _havocedTypeNames.has(d.name) ? ", 0" : "";
+            return `type ${escapeName(d.name)}(==${autoInit})`;
         }
         case "def": {
             const tp = d.typeParams.length > 0 ? `<${d.typeParams.join(", ")}>` : "";
@@ -1269,6 +1308,27 @@ const STRING_TO_UPPER = `function StringToUpper(s: string): string
     var upper := if 'a' <= c <= 'z' then (c - 'a' + 'A') as char else c;
     [upper] + StringToUpper(s[1..])
 }`;
+// `String.fromCharCode(n)` — the inverse of `s.charCodeAt(i)`'s `(s[i] as int)`.
+// Dafny's `char` is a Unicode scalar value, so the argument must miss the
+// surrogate range; that is the `requires`, discharged at each call site. The two
+// `ensures` give callers the round-trip law without unfolding the body.
+const STRING_FROM_CHAR_CODE = `function StringFromCharCode(n: int): string
+  requires 0 <= n < 0xD800 || 0xE000 <= n < 0x110000
+  ensures |StringFromCharCode(n)| == 1
+  ensures (StringFromCharCode(n)[0] as int) == n
+{
+  [n as char]
+}`;
+// `s.repeat(n)` — n copies of s, concatenated. The per-index ensures is stated
+// for the single-character receiver (the common case: padding with one digit).
+const STRING_REPEAT = `function StringRepeat(s: string, n: int): string
+  requires n >= 0
+  ensures |StringRepeat(s, n)| == |s| * n
+  ensures |s| == 1 ==> forall i :: 0 <= i < n ==> StringRepeat(s, n)[i] == s[0]
+  decreases n
+{
+  if n == 0 then "" else s + StringRepeat(s, n - 1)
+}`;
 const MATH_MIN = `function MathMin(a: int, b: int): int { if a <= b then a else b }`;
 const MATH_MAX = `function MathMax(a: int, b: int): int { if a >= b then a else b }`;
 const MAX_OF_SEQ = `function MaxOfSeq(s: seq<int>): int
@@ -1386,6 +1446,8 @@ const PREAMBLE_CODE = [
     ["StringTrim", STRING_TRIM],
     ["StringToLower", STRING_TO_LOWER],
     ["StringToUpper", STRING_TO_UPPER],
+    ["StringFromCharCode", STRING_FROM_CHAR_CODE],
+    ["StringRepeat", STRING_REPEAT],
     ["NatToString", NAT_TO_STRING],
     ["IntToString", INT_TO_STRING],
     ["MathAbs", MATH_ABS],
@@ -1512,6 +1574,8 @@ export function emitDafnyFile(file, tsFileName, opts) {
     resetDafnyNameCache();
     buildRecordCtorMap(file.decls);
     _neededPreambles.clear();
+    _havocedTypeNames.clear();
+    collectHavocedTypeNames(file.decls, _havocedTypeNames);
     // Track successfully emitted pure defs — method wrappers are only
     // skipped when the corresponding pure def was actually emitted.
     const emittedPureDefs = new Set();

package/tools/dist/extract.js

@@ -11,6 +11,25 @@ import { setUserNames, freshName } from "./names.js";
 // ── Expression extraction ────────────────────────────────────
 /** When set, calls whose function/method name matches this key are replaced with havoc. */
 let _havocKey = null;
+/** A leading `//@ havoc`, `//@ havoc : Type`, or `//@ havoc <key>` directive. */
+function havocDirective(s) {
+    const m = s.getLeadingCommentRanges()
+        .map(r => r.getText().trim().match(/^\/\/@ havoc(?:\s*:\s*(.+)|(?:\s+(\S+)))?$/))
+        .find(m => m !== null);
+    return m ? { type: m[1]?.trim() ?? null, key: m[2] ?? null } : null;
+}
+/** Run `fn` with `key` as the subexpression havoc key, restoring the outer one. */
+function withHavocKey(key, fn) {
+    const saved = _havocKey;
+    if (key)
+        _havocKey = key;
+    try {
+        return fn();
+    }
+    finally {
+        _havocKey = saved;
+    }
+}
 /** Auto-detected cross-file calls. Populated by `extractExpr` whenever it sees
  *  a call `Obj.method(...)` or `foo(...)` whose ts-morph symbol resolves to a
  *  different `.ts` source file. Emitted in Dafny as `function {:axiom} <flat>`.
@@ -326,14 +345,18 @@ function _eraseGenerics(tsType) {
     return tsType;
 }
 function extractExpr(node) {
-    // Havoc key matching: replace matching calls with havoc expression
-    if (_havocKey && Node.isCallExpression(node)) {
+    // Havoc key matching: replace matching calls or new expressions with havoc expression
+    if (_havocKey && (Node.isCallExpression(node) || Node.isNewExpression(node))) {
         const fnExpr = node.getExpression();
         const name = Node.isPropertyAccessExpression(fnExpr) ? fnExpr.getName()
             : Node.isIdentifier(fnExpr) ? fnExpr.getText()
                 : null;
         if (name === _havocKey) {
-            return { kind: "havoc", tsType: typeToString(node.getType()) };
+            // Prefer the contextual type: the abstracted value stands in where the
+            // surrounding code expects it, and a subclass (`new SdkError` into an
+            // `Error` field) has no subtyping relation once both are opaque.
+            const ty = node.getContextualType() ?? node.getType();
+            return { kind: "havoc", tsType: typeToString(ty) };
         }
     }
     // Numeric literal
@@ -1242,12 +1265,10 @@ function extractStmts(stmts) {
             continue;
         }
         if (Node.isVariableStatement(s)) {
-            const havocMatch = s.getLeadingCommentRanges()
-                .map(r => r.getText().trim().match(/^\/\/@ havoc(?:\s*:\s*(.+)|(?:\s+(\S+)))?$/))
-                .find(m => m !== null);
-            const havocType = havocMatch?.[1]?.trim() ?? null; // //@ havoc : Type
-            const havocKey = havocMatch?.[2] ?? null; // //@ havoc key
-            const isHavoc = !!havocMatch;
+            const havoc = havocDirective(s);
+            const havocType = havoc?.type ?? null; // //@ havoc : Type
+            const havocKey = havoc?.key ?? null; // //@ havoc key
+            const isHavoc = !!havoc;
             for (const d of s.getDeclarations()) {
                 // Havoc on destructuring: emit each named binding as a separate havoced variable
                 const nameNode = d.getNameNode();
@@ -1688,7 +1709,11 @@ function extractStmts(stmts) {
             // functions this would emit the wrong shape, but lsc has no current
             // examples of explicit bare return in void functions; revisit if one
             // appears.
-            result.push({ kind: "return", value: expr ? extractExpr(expr) : { kind: "var", name: "undefined" }, line });
+            // `//@ havoc <key>` on a return abstracts the matching calls or new
+            // expressions inside the returned expression — there is no variable to
+            // hang a whole-value havoc on, so only the key form applies here.
+            const value = withHavocKey(havocDirective(s)?.key ?? null, () => expr ? extractExpr(expr) : { kind: "var", name: "undefined" });
+            result.push({ kind: "return", value, line });
             continue;
         }
         if (Node.isBreakStatement(s)) {
@@ -1704,14 +1729,12 @@ function extractStmts(stmts) {
             // //@ havoc before `x = e` — discard the RHS, assign a nondeterministic
             // value of x's type. Only applies to plain `=` with an identifier LHS;
             // compound assigns, `arr[i] = v`, and `x++` fall through to desugaring.
-            const havocMatch = s.getLeadingCommentRanges()
-                .map(r => r.getText().trim().match(/^\/\/@ havoc(?:\s*:\s*(.+))?$/))
-                .find(m => m !== null);
-            if (havocMatch && Node.isBinaryExpression(expr)
+            const havoc = havocDirective(s);
+            if (havoc && !havoc.key && Node.isBinaryExpression(expr)
                 && expr.getOperatorToken().getText() === "="
                 && Node.isIdentifier(expr.getLeft())) {
                 const target = expr.getLeft().getText();
-                const tsType = havocMatch[1]?.trim() ?? _eraseGenerics(typeToString(expr.getLeft().getType()));
+                const tsType = havoc.type ?? _eraseGenerics(typeToString(expr.getLeft().getType()));
                 result.push({ kind: "assign", target, value: { kind: "havoc", tsType }, line });
                 continue;
             }
@@ -1901,6 +1924,12 @@ function extractFunctionInner(fn, parentAnnotations) {
                 return "void"; // Promise<void>
             }
             const node = fn.getReturnTypeNode();
+            // A type predicate (`x is T` / `asserts x is T`) is a `boolean` at
+            // runtime; the narrowing it performs is a TS-only refinement with no
+            // counterpart in the model. Without this, `getText()` yields "x is T"
+            // and the type mapper reads the subject name as an opaque type.
+            if (node && node.getKind() === SyntaxKind.TypePredicate)
+                return "boolean";
             if (node && Node.isUnionTypeNode(node))
                 return _eraseGenerics(_tsTypeFromUnionNode(node));
             if (node)
@@ -2461,6 +2490,28 @@ export function extractModule(sourceFile) {
                 }
             }
         }
+        // A constant's initializer can reference other constants
+        // (`const ZERO_NINE = ZERO + nthDigit(-1)`). Close over those initializers
+        // before filtering — mirroring the transitive type filter below — or a
+        // constant reachable only from another constant is dropped and the backend
+        // sees an undefined name.
+        // Snapshot first: what the closure adds are VALUE references, and a value
+        // and a type can share a name (`const Action = Schema.Literals(…)` next to
+        // `type Action = Schema.Schema.Type<typeof Action>`). Keeping the constant
+        // alive must not also drag in the unrelated type alias, so the type filter
+        // below runs off the pre-closure set.
+        const typeReferencedNames = new Set(referencedNames);
+        for (let grew = true; grew;) {
+            grew = false;
+            for (const c of constants) {
+                if (!referencedNames.has(c.name))
+                    continue;
+                const before = referencedNames.size;
+                collectNamesExpr(c.value);
+                if (referencedNames.size !== before)
+                    grew = true;
+            }
+        }
         constants.splice(0, constants.length, ...constants.filter(c => referencedNames.has(c.name)));
         // Filter types to only those referenced by verified functions (transitive)
         const neededTypes = new Set();
@@ -2479,7 +2530,7 @@ export function extractModule(sourceFile) {
                     for (const m of f.tsType.matchAll(/\b([A-Z]\w*)\b/g))
                         markType(m[1]);
         }
-        for (const name of referencedNames)
+        for (const name of typeReferencedNames)
             markType(name);
         // Signature types also mark their base after stripping array/optional
         // WRAPPERS (`Out[]`/`Msg | undefined` → `Out`/`Msg`), so a function returning

package/tools/dist/lean-emit.js

@@ -385,7 +385,7 @@ function emitExpr(e, parentPrec) {
                 const ctor = rhs.type ? _unionCtors.get(rhs.type)?.find(c => c.name === rhs.name) : undefined;
                 if (ctor && ctor.fields.length > 0) {
                     const [yes, no] = e.op === "=" ? ["true", "false"] : ["false", "true"];
-                    return `(match ${emitExpr(e.left)} with | .${escapeName(rhs.name)} .. => ${yes} | _ => ${no})`;
+                    return `(match ${emitExpr(e.left)} with | .${leanCtorName(rhs.name)} .. => ${yes} | _ => ${no})`;
                 }
             }
             // `k in m` (map/set membership) → `m.contains k` in Lean. Dafny has
@@ -471,7 +471,7 @@ function emitExpr(e, parentPrec) {
                     const idx = owner.fields.findIndex(f => f.name === e.field);
                     const pats = owner.fields.map((_, i) => (i === idx ? "_v" : "_")).join(" ");
                     const fty = tyToLean(owner.fields[idx].type);
-                    return `(match ${emitExpr(e.obj)} with | .${escapeName(owner.name)} ${pats} => _v | _ => (default : ${fty}))`;
+                    return `(match ${emitExpr(e.obj)} with | .${leanCtorName(owner.name)} ${pats} => _v | _ => (default : ${fty}))`;
                 }
             }
             const obj = emitExpr(e.obj);

package/tools/dist/resolve.js

@@ -55,10 +55,36 @@ function resolveTsType(tsType, overrides, varName) {
     }
     return parseTsType(tsType);
 }
-/** If expr is a string literal and targetTy is a user type, coerce the literal's type. */
+/** Infer a conditional's result type after its branches have been resolved or
+ *  contextually coerced. A void branch is the source-level null/undefined arm. */
+function conditionalResultTy(thenTy, elseTy) {
+    let ty = thenTy.kind !== "unknown" ? thenTy : elseTy;
+    if (thenTy.kind === "void" && elseTy.kind !== "void" && elseTy.kind !== "unknown") {
+        ty = { kind: "optional", inner: elseTy };
+    }
+    else if (elseTy.kind === "void" && thenTy.kind !== "void" && thenTy.kind !== "unknown") {
+        ty = { kind: "optional", inner: thenTy };
+    }
+    else if (thenTy.kind === "optional" && elseTy.kind !== "optional" && elseTy.kind !== "unknown") {
+        ty = thenTy;
+    }
+    else if (elseTy.kind === "optional" && thenTy.kind !== "optional" && thenTy.kind !== "unknown") {
+        ty = elseTy;
+    }
+    return ty;
+}
+/** Contextually type string literals as constructors. Ternary branches inherit
+ *  the ternary's target, and an optional target contributes its payload type —
+ *  the caller adds the Some wrapper only after the payload has been coerced. */
 function coerceStr(expr, targetTy) {
-    if (expr.kind === "str" && targetTy.kind === "user")
-        return { ...expr, ty: targetTy };
+    const payloadTy = targetTy.kind === "optional" ? targetTy.inner : targetTy;
+    if (expr.kind === "str" && payloadTy.kind === "user")
+        return { ...expr, ty: payloadTy };
+    if (expr.kind === "conditional") {
+        const then_ = coerceStr(expr.then, payloadTy);
+        const else_ = coerceStr(expr.else, payloadTy);
+        return { ...expr, then: then_, else: else_, ty: conditionalResultTy(then_.ty, else_.ty) };
+    }
     return expr;
 }
 // ── Helpers ──────────────────────────────────────────────────
@@ -84,6 +110,7 @@ function findSynthArrayUnion(name, typeDecls) {
  *  Returns `value` unchanged if no coercion applies (types already match,
  *  source is unknown, or no rule matches). */
 function coerceToTargetTy(value, targetTy, typeDecls) {
+    value = coerceStr(value, targetTy);
     if (value.ty.kind === "unknown" || value.ty.kind === "void")
         return value;
     if (targetTy.kind === "optional" && value.ty.kind !== "optional") {
@@ -328,6 +355,17 @@ function isUnmodeledTy(ty, typeDecls) {
 function isStringUnionTy(ty, typeDecls) {
     return declOfTy(typeDecls, ty)?.kind === "string-union";
 }
+/** Whether ts-morph widened a string-union initializer to the declared string
+ *  shape. Inferred optional locals need the same rescue as bare locals:
+ *  `Option<string>` from TS must not erase an `Option<Color>` initializer. */
+function isWidenedStringUnionTy(declTy, initTy, typeDecls) {
+    if (declTy.kind === "string" && isStringUnionTy(initTy, typeDecls))
+        return true;
+    if (declTy.kind === "optional" && initTy.kind === "optional") {
+        return isWidenedStringUnionTy(declTy.inner, initTy.inner, typeDecls);
+    }
+    return false;
+}
 /** Infer quantifier variable type from usage in body.
  *  If the variable is used as a map/set key (e.g. map.has(k), map.get(k)),
  *  return the collection's key type. Otherwise return null (default to int). */
@@ -399,6 +437,8 @@ function classifyCall(fn, ctx) {
         return "pure";
     if (fn.kind === "field" && fn.obj.kind === "var" && fn.obj.name === "Array" && fn.field === "isArray")
         return "pure";
+    if (fn.kind === "field" && fn.obj.kind === "var" && fn.obj.name === "String" && fn.field === "fromCharCode")
+        return "pure";
     if (fn.kind === "var" && (ctx.inSpec || ctx.inLambda) && ctx.pureFns.has(fn.name))
         return "spec-pure";
     // Bare-name `//@ extern` declarations are emitted as `function {:axiom}` —
@@ -515,7 +555,7 @@ function isDefinedCheckRawLambda(raw) {
     const isUndef = (x) => x.kind === "var" && x.name === "undefined";
     return (isParam(body.left) && isUndef(body.right)) || (isParam(body.right) && isUndef(body.left));
 }
-/** Coerce call arguments: string literals → user types, non-optional → Some, pad missing optional args. */
+/** Coerce call arguments to their declared parameter slots and pad missing optional args. */
 function coerceCallArgs(args, fn, ctx) {
     if (fn.kind !== "var" || !ctx.fnParams.has(fn.name))
         return args;
@@ -523,11 +563,7 @@ function coerceCallArgs(args, fn, ctx) {
     args = args.map((a, i) => {
         if (i >= paramTys.length)
             return a;
-        a = coerceStr(a, paramTys[i]);
-        if (a.ty.kind !== "optional" && paramTys[i].kind === "optional") {
-            return wrapSome(a, paramTys[i]);
-        }
-        return a;
+        return coerceToTargetTy(a, paramTys[i], ctx.typeDecls);
     });
     // Pad missing optional args with None
     for (let i = args.length; i < paramTys.length; i++) {
@@ -546,6 +582,11 @@ function inferMethodReturnTy(fn, args, ctx) {
     if (fn.obj.kind === "var" && fn.obj.name === "Array" && fn.field === "isArray") {
         return { kind: "bool" };
     }
+    // `String.fromCharCode(n)` is the inverse of `s.charCodeAt(i)`: an int code
+    // point in, a one-character string out.
+    if (fn.obj.kind === "var" && fn.obj.name === "String" && fn.field === "fromCharCode") {
+        return { kind: "string" };
+    }
     // Math.* numeric builtins: abs/min/max preserve the operand's numeric type
     // (real if any operand is real); floor/ceil/round/trunc return an integer.
     if (fn.obj.kind === "var" && fn.obj.name === "Math") {
@@ -803,7 +844,7 @@ function resolveExpr(e, ctx) {
                 if (ext) {
                     const args = e.args.map(a => resolveExpr(a, ctx));
                     const fn = { kind: "var", name: ext.flat, ty: { kind: "unknown" } };
-                    return { kind: "call", fn, args, ty: ext.returnTy, callKind: "pure" };
+                    return { kind: "call", fn, args, ty: ext.returnTy, callKind: "pure", paramTys: ext.params };
                 }
             }
             const fn = resolveExpr(e.fn, ctx);
@@ -819,7 +860,8 @@ function resolveExpr(e, ctx) {
             const paramTypes = fn.kind === "var" && ctx.fnParams.has(fn.name) ? ctx.fnParams.get(fn.name) : null;
             let args = coerceCallArgs(rawArgs.map((a, i) => {
                 let aCtx = argCtx;
-                if (paramTypes && i < paramTypes.length && paramTypes[i].kind === "user") {
+                if (paramTypes && i < paramTypes.length &&
+                    (paramTypes[i].kind === "user" || paramTypes[i].kind === "array" || paramTypes[i].kind === "optional")) {
                     aCtx = { ...aCtx, returnTy: paramTypes[i] };
                 }
                 return resolveExpr(a, aCtx);
@@ -854,7 +896,8 @@ function resolveExpr(e, ctx) {
             }
             const builtinId = fn.kind === "field" ? recognizeBuiltin(fn.obj.ty, fn.field) : null;
             return { kind: "call", fn, args, ty, callKind: classifyCall(e.fn, ctx),
-                ...(builtinId ? { builtinId } : {}) };
+                ...(builtinId ? { builtinId } : {}),
+                ...(paramTypes ? { paramTys: paramTypes } : {}) };
         }
         case "index": {
             const obj = resolveExpr(e.obj, ctx);
@@ -935,7 +978,7 @@ function resolveExpr(e, ctx) {
             const inner = left.ty.kind === "optional" ? left.ty.inner : left.ty;
             // The default shares the result type, so coerce a string literal to a
             // string-union enum (e.g. `availableLevels[0] ?? "off"`).
-            const right = coerceStr(resolveExpr(e.right, ctx), inner);
+            const right = coerceToTargetTy(resolveExpr(e.right, ctx), inner, ctx.typeDecls);
             // `??` is only total when its default is: with a nullable right operand
             // (rule-chain style `ruleA(e) ?? ruleB(e) ?? null`), the result stays
             // optional — otherwise the enclosing chain level loses its optionality
@@ -1047,7 +1090,6 @@ function resolveExpr(e, ctx) {
                 let value = resolveExpr(f.value, valueCtx);
                 if (fieldDecl) {
                     const declTy = fieldDecl.type;
-                    value = coerceStr(value, declTy);
                     // Empty {} for map-typed fields → empty map (arrayLiteral with map type → emptyMap in transform)
                     if (value.kind === "record" && value.fields.length === 0 && !value.spread && declTy.kind === "map") {
                         value = { kind: "arrayLiteral", elems: [], ty: declTy };
@@ -1088,7 +1130,7 @@ function resolveExpr(e, ctx) {
                 const elems = e.elems.map((el, i) => {
                     const slot = slots[i];
                     const r = resolveExpr(el, slot ? { ...ctx, returnTy: slot } : ctx);
-                    return slot ? coerceStr(r, slot) : r;
+                    return slot ? coerceToTargetTy(r, slot, ctx.typeDecls) : r;
                 });
                 return { kind: "arrayLiteral", elems, ty: { kind: "tuple", elems: elems.map(x => x.ty) } };
             }
@@ -1105,7 +1147,7 @@ function resolveExpr(e, ctx) {
                 const r = resolveExpr(el, elemCtx);
                 // Coerce a bare string-literal element to a string-union enum (e.g.
                 // `["off", …]: ModelThinkingLevel[]`), like return/arg positions.
-                return expectedElem ? coerceStr(r, expectedElem) : r;
+                return expectedElem ? coerceToTargetTy(r, expectedElem, ctx.typeDecls) : r;
             });
             const elemTy = elems.length > 0 ? elems[0].ty : { kind: "unknown" };
             // No expected collection type: infer array vs tuple from the elements —
@@ -1173,21 +1215,7 @@ function resolveExpr(e, ctx) {
             let else_ = resolveExpr(e.else, elseCtx);
             then_ = coerceStr(then_, else_.ty);
             else_ = coerceStr(else_, then_.ty);
-            let ty = then_.ty.kind !== "unknown" ? then_.ty : else_.ty;
-            if (then_.ty.kind === "void" && else_.ty.kind !== "void" && else_.ty.kind !== "unknown") {
-                ty = { kind: "optional", inner: else_.ty };
-            }
-            else if (else_.ty.kind === "void" && then_.ty.kind !== "void" && then_.ty.kind !== "unknown") {
-                ty = { kind: "optional", inner: then_.ty };
-            }
-            else if (then_.ty.kind === "optional" && else_.ty.kind !== "optional" && else_.ty.kind !== "unknown") {
-                // Asymmetric optional: one branch returns Option<T>, the other returns T.
-                // Widen to Option<T> so callers/return-coercion see the wider type.
-                ty = then_.ty;
-            }
-            else if (else_.ty.kind === "optional" && then_.ty.kind !== "optional" && then_.ty.kind !== "unknown") {
-                ty = else_.ty;
-            }
+            const ty = conditionalResultTy(then_.ty, else_.ty);
             return { kind: "conditional", cond, then: then_, else: else_, ty };
         }
         case "emptyCollection": {
@@ -1284,7 +1312,16 @@ function resolveStmt(s, ctx) {
             // one optional level when consulting returnTy.
             const initCtx = (declTy.kind === "user" || declTy.kind === "array" || declTy.kind === "optional")
                 ? { ...ctx, returnTy: declTy } : ctx;
-            const init = coerceStr(resolveExpr(s.init, initCtx), declTy);
+            let init = coerceStr(resolveExpr(s.init, initCtx), declTy);
+            // Under noUncheckedIndexedAccess, TS gives `const e = arr[i]` type T | undefined
+            // while the index expression itself resolves to T. Leave that mismatch intact:
+            // narrow.ts's ruleOptionalIndexBinding adds the runtime bounds guard and the
+            // corresponding Some/None branches. Wrapping here would turn it into an
+            // unconditional Some(arr[i]) and prevent that JS-semantics rewrite from firing.
+            const deferOptionalIndex = declTy.kind === "optional" && init.kind === "index" &&
+                init.obj.ty.kind === "array" && init.ty.kind !== "optional";
+            if (!deferOptionalIndex)
+                init = coerceToTargetTy(init, declTy, ctx.typeDecls);
             let ty;
             if (isUnmodeledTy(declTy, ctx.typeDecls) && !isUnmodeledTy(init.ty, ctx.typeDecls)) {
                 // ts-morph's declared type is opaque to us (an expanded union it made
@@ -1295,7 +1332,7 @@ function resolveStmt(s, ctx) {
                     ? { kind: "optional", inner: init.ty }
                     : init.ty;
             }
-            else if (declTy.kind === "string" && isStringUnionTy(init.ty, ctx.typeDecls) && !ctx.overrides.has(s.name)) {
+            else if (isWidenedStringUnionTy(declTy, init.ty, ctx.typeDecls) && !ctx.overrides.has(s.name)) {
                 // ts-morph widened a string-union to `string`; keep the initializer's
                 // datatype so `local === "lit"` lowers to a discriminant test.
                 ty = init.ty;
@@ -1321,22 +1358,11 @@ function resolveStmt(s, ctx) {
             // to their named datatypes.
             const valueCtx = (targetTy.kind === "user" || targetTy.kind === "array" || targetTy.kind === "optional")
                 ? { ...ctx, returnTy: targetTy } : ctx;
-            let value = coerceStr(resolveExpr(s.value, valueCtx), targetTy);
-            // Auto-wrap non-optional value in Some when target is optional
-            const isUndef = value.kind === "var" && value.name === "undefined";
-            if (targetTy.kind === "optional" && value.ty.kind !== "optional" && value.ty.kind !== "unknown" && !isUndef) {
-                value = wrapSome(value, targetTy);
-            }
+            const value = coerceToTargetTy(resolveExpr(s.value, valueCtx), targetTy, ctx.typeDecls);
             return [{ kind: "assign", target: s.target, value }, ctx.env];
         }
         case "return": {
-            let value = coerceStr(resolveExpr(s.value, ctx), ctx.returnTy);
-            // Wrap non-optional return value in Some when function returns optional
-            // Skip if already optional, void, or undefined (which maps to None)
-            const isUndef = value.kind === "var" && value.name === "undefined";
-            if (ctx.returnTy.kind === "optional" && value.ty.kind !== "optional" && !isUndef) {
-                value = wrapSome(value, ctx.returnTy);
-            }
+            const value = coerceToTargetTy(resolveExpr(s.value, ctx), ctx.returnTy, ctx.typeDecls);
             return [{ kind: "return", value }, ctx.env];
         }
         case "break":
@@ -1452,14 +1478,27 @@ function resolveStmt(s, ctx) {
     }
 }
 // ── Pure / return-in-loop detection ──────────────────────────
-/** Syntactic purity: no while, no for-of, no mutable let. */
+/** Whether a raw statement or expression tree contains a havoc anywhere. */
+function containsHavoc(v) {
+    if (Array.isArray(v))
+        return v.some(containsHavoc);
+    if (v === null || typeof v !== "object")
+        return false;
+    if (v.kind === "havoc")
+        return true;
+    return Object.values(v).some(containsHavoc);
+}
+/** Syntactic purity: no while, no for-of, no mutable let, no havoc. */
 function isSyntacticallyPure(stmts) {
     for (const s of stmts) {
+        // Havoc lowers to Dafny's `*`, which is only valid in a method.
+        if (containsHavoc(s))
+            return false;
         switch (s.kind) {
             case "while":
             case "forof": return false;
             case "let":
-                if (s.mutable || s.init.kind === "havoc")
+                if (s.mutable)
                     return false;
                 break;
             case "if":
@@ -1779,7 +1818,8 @@ export function resolveModule(raw) {
         // record literals on map-typed constants (e.g. `Record<string, number>`)
         // get their `ty` set to `map<...>` rather than `user("...")`.
         const valueCtx = { ...emptyCtx, returnTy: ty };
-        return { name: c.name, ty, value: resolveExpr(c.value, valueCtx) };
+        const value = coerceToTargetTy(resolveExpr(c.value, valueCtx), ty, raw.typeDecls);
+        return { name: c.name, ty, value };
     });
     const moduleConstants = new Map(constants.map(c => [c.name, c.ty]));
     return {

package/tools/dist/transform.js

@@ -234,7 +234,10 @@ function kindHelperDecl(decl) {
  *  arm body would still be captured, so prime on any module-wide collision.
  *  Deterministic, so the pattern binder and its body substitutions agree. */
 function matchBinder(fieldName, prefix) {
-    return freshName(prefix ? `_${prefix}_${fieldName}` : `_${fieldName}`);
+    const safePrefix = prefix === "\\result"
+        ? "result"
+        : prefix?.replace(/[^A-Za-z0-9_]/g, "_");
+    return freshName(safePrefix ? `_${safePrefix}_${fieldName}` : `_${fieldName}`);
 }
 /** Build a match arm pattern like `.VariantName _v_field1 _v_field2` from variant info. */
 function buildMatchPattern(variantName, fields, scopePrefix) {
@@ -358,20 +361,33 @@ function flattenLambdaBody(stmts) {
  * field, index, record, forall, or exists sub-expressions.
  */
 /** JS truthiness coercion for `if`/`while`/`?:` conditions.
- *  Dafny requires bool; coerce number→`≠0`, string→non-empty, array→`true`
+ *  Dafny requires bool; coerce number→`!== 0`, string→non-empty, array→`true`
  *  (every array, even `[]`, is truthy in JS).
- *  Optional conds are handled separately by narrow.ts (rewritten to someMatch). */
-function coerceCondToBool(cond, ty) {
-    if (ty.kind === "bool")
-        return cond;
-    if (ty.kind === "int" || ty.kind === "nat")
-        return { kind: "binop", op: "≠", left: cond, right: { kind: "num", value: 0 } };
-    if (ty.kind === "string")
-        return { kind: "binop", op: ">", left: { kind: "field", obj: cond, field: "length" }, right: { kind: "num", value: 0 } };
+ *
+ *  Rewrites the typed tree, before lowering, and distributes over `&&`/`||`:
+ *  each operand of a logical connective is itself in condition position, and the
+ *  operands need not share a type — `i >= 0 && carry`, with `carry` an int, is a
+ *  bool conjoined with a number. A conjunction takes its type from its right
+ *  operand (resolve), so coercing the whole expression by its type would emit
+ *  `((i >= 0) && carry) != 0`, which is not well-typed.
+ *
+ *  Optional conds never arrive here — narrow.ts rewrites them to someMatch. */
+function asCondition(e) {
+    const bool = { kind: "bool" };
+    if (e.ty.kind === "bool")
+        return e;
+    if (e.kind === "binop" && (e.op === "&&" || e.op === "||"))
+        return { ...e, left: asCondition(e.left), right: asCondition(e.right), ty: bool };
+    if (e.ty.kind === "int" || e.ty.kind === "nat")
+        return { kind: "binop", op: "!==", left: e, right: { kind: "num", value: 0, ty: e.ty }, ty: bool };
+    if (e.ty.kind === "string")
+        return { kind: "binop", op: ">",
+            left: { kind: "field", obj: e, field: "length", ty: { kind: "nat" } },
+            right: { kind: "num", value: 0, ty: { kind: "nat" } }, ty: bool };
     // Arrays, objects, maps, sets, tuples are always truthy in JS (even `[]`/`{}`).
-    if (["array", "user", "map", "set", "tuple"].includes(ty.kind))
-        return { kind: "bool", value: true };
-    return cond;
+    if (["array", "user", "map", "set", "tuple"].includes(e.ty.kind))
+        return { kind: "bool", value: true, ty: bool };
+    return e;
 }
 /** Wrap an expression in Some/None for optional-typed conditionals.
  *  If the raw TExpr is `undefined`, emit `.none`; otherwise wrap in `Some`. */
@@ -802,6 +818,12 @@ function lowerExpr(e, binds) {
                     }
                 }
             }
+            // String.fromCharCode(n) → preamble function (inverse of charCodeAt,
+            // which lowers to `(s[i] as int)`).
+            if (e.fn.kind === "field" && e.fn.obj.kind === "var" && e.fn.obj.name === "String" &&
+                e.fn.field === "fromCharCode" && e.args.length === 1) {
+                return { kind: "app", fn: "StringFromCharCode", args: [lowerExpr(e.args[0], binds)] };
+            }
             // Math.abs/min/max → preamble functions
             if (e.fn.kind === "field" && e.fn.obj.kind === "var" && e.fn.obj.name === "Math") {
                 if (e.fn.field === "abs" && e.args.length === 1)
@@ -1032,7 +1054,7 @@ function lowerExpr(e, binds) {
             // JS truthiness coercion (string/array/int → ... > 0).  Matches SPEC §3.1
             // negation forms (`!s` → `s == ""`).  Optional conds are already
             // rewritten to someMatch by narrow.ts.
-            const cond = coerceCondToBool(lowerExpr(e.cond, binds), e.cond.ty);
+            const cond = lowerExpr(asCondition(e.cond), binds);
             let thenExpr = lowerExpr(e.then, binds);
             let elseExpr = lowerExpr(e.else, binds);
             if (e.ty.kind === "optional") {
@@ -1372,6 +1394,11 @@ function matchToIfChains(stmts) {
             return [{ ...s, arms }]; // not a user union (e.g. Option) — leave as match
         const scrutExpr = s.scrutinee;
         const defaultArm = arms.find(a => a.pattern.kind === "wild");
+        const declaredCtors = decl.kind === "discriminated-union"
+            ? decl.variants?.map(v => v.name)
+            : decl.kind === "string-union" ? decl.values : undefined;
+        const coveredCtors = new Set(ctorArms.map(a => patternCtor(a.pattern)).filter((c) => !!c));
+        const exhaustiveWithoutDefault = !defaultArm && !!declaredCtors && declaredCtors.every(c => coveredCtors.has(c));
         let elseBranch = defaultArm ? defaultArm.body : [];
         for (let k = ctorArms.length - 1; k >= 0; k--) {
             const armBody = ctorArms[k].body;
@@ -1401,6 +1428,13 @@ function matchToIfChains(stmts) {
                         value: { kind: "field", obj: scrutExpr, field: f.name, fromUnion: decl.name, ctor },
                     });
             });
+            // An exhaustive source match has no fallthrough. Use its final arm as
+            // the unconditional else branch; emitting `else pure ()` would force a
+            // Unit result even when every arm returns the method's result type.
+            if (exhaustiveWithoutDefault && k === ctorArms.length - 1) {
+                elseBranch = [...lets, ...armBody];
+                continue;
+            }
             elseBranch = [{ kind: "if", cond, then: [...lets, ...armBody], else: elseBranch }];
         }
         return elseBranch;
@@ -1754,13 +1788,13 @@ function transformStmt(s, typeDecls) {
         }
         case "if": {
             // Lift from condition only (Lean rule: don't lift from branches).
-            const { binds, expr: cond } = liftMethodCalls(s.cond);
-            return [...binds, { kind: "if", cond: coerceCondToBool(cond, s.cond.ty), then: transformStmts(s.then, typeDecls), else: transformStmts(s.else, typeDecls) }];
+            const { binds, expr: cond } = liftMethodCalls(asCondition(s.cond));
+            return [...binds, { kind: "if", cond, then: transformStmts(s.then, typeDecls), else: transformStmts(s.else, typeDecls) }];
         }
         case "while":
             return [{
                     kind: "while",
-                    cond: coerceCondToBool(transformExpr(s.cond), s.cond.ty),
+                    cond: transformExpr(asCondition(s.cond)),
                     invariants: s.invariants.map(transformExpr),
                     decreasing: s.decreases ? transformExpr(s.decreases) : null,
                     doneWith: s.doneWith ? transformExpr(s.doneWith) : null,
@@ -1967,14 +2001,67 @@ function replaceFieldsInTStmts(stmts, objName, replacements) {
     }));
 }
 /** Replace all variant fields of obj → match binder vars in typed IR.
- *  Thin wrapper around replaceFieldsInTStmts for discriminant match/switch. */
+ *  Before replacing field reads, realize TypeScript's structural argument
+ *  conversion for calls such as `helper(outcome)` inside a narrowed union arm.
+ *  The source value is still the enclosing union in typed IR, while Dafny and
+ *  Lean expect the helper's nominal record. Rebuild that record solely from
+ *  the fields bound by this arm's match pattern. */
 function replaceFieldAccessInTStmts(stmts, varName, fields) {
-    return replaceFieldsInTStmts(stmts, varName, fields.map(f => ({
+    const projected = projectStructuralCallArgsInTStmts(stmts, varName, fields);
+    return replaceFieldsInTStmts(projected, varName, fields.map(f => ({
         fieldName: f.name,
         newName: matchBinder(f.name, varName),
         fallbackTy: f.type ?? parseTsType(f.tsType),
     })));
 }
+/** Project a narrowed union scrutinee into a named structural record expected
+ *  by a same-module/extern call. Resolution stamps named calls with paramTys;
+ *  this pass fires only when every target record field has an identically typed
+ *  match-bound source field. That deliberately avoids inventing a broad cast:
+ *  it is the nominal-backend witness for the structural call TS already accepts. */
+function projectStructuralCallArgsInTStmts(stmts, varName, fields) {
+    const sourceFields = fields.map(f => ({
+        ...f,
+        resolvedTy: f.type ?? parseTsType(f.tsType),
+    }));
+    return stmts.map(s => mapTStmt(s, e => {
+        if (e.kind !== "call" || !e.paramTys)
+            return null;
+        const paramTys = e.paramTys;
+        let changed = false;
+        const args = e.args.map((arg, i) => {
+            if (arg.kind !== "var" || arg.name !== varName || i >= paramTys.length)
+                return arg;
+            const targetTy = paramTys[i];
+            const targetDecl = declOfTy(_typeDecls, targetTy);
+            if (targetTy.kind !== "user" || targetDecl?.kind !== "record" || !targetDecl.fields)
+                return arg;
+            const matched = [];
+            for (const targetField of targetDecl.fields) {
+                const sourceField = sourceFields.find(f => f.name === targetField.name);
+                const targetFieldTy = targetField.type ?? parseTsType(targetField.tsType);
+                if (!sourceField || !tyEqual(sourceField.resolvedTy, targetFieldTy))
+                    return arg;
+                matched.push({ targetField, sourceField });
+            }
+            changed = true;
+            return {
+                kind: "record",
+                spread: null,
+                fields: matched.map(m => ({
+                    name: m.targetField.name,
+                    value: {
+                        kind: "var",
+                        name: matchBinder(m.sourceField.name, varName),
+                        ty: m.sourceField.resolvedTy,
+                    },
+                })),
+                ty: targetTy,
+            };
+        });
+        return changed ? { ...e, args } : null;
+    }));
+}
 /** Replace obj.field → replacement var in typed IR expressions (before lowering).
  *  Mirrors replaceFieldsInTStmts but operates on a single TExpr tree. */
 function replaceFieldInTExpr(expr, objName, replacements) {
@@ -2062,7 +2149,7 @@ function transformPureBody(stmts, typeDecls) {
                 const elseExpr = transformPureBody(elseStmts, typeDecls);
                 if (!elseExpr)
                     return null;
-                return { kind: "if", cond: coerceCondToBool(transformExpr(s.cond), s.cond.ty), then: thenExpr, else: elseExpr };
+                return { kind: "if", cond: transformExpr(asCondition(s.cond)), then: thenExpr, else: elseExpr };
             }
             case "switch": return transformPureSwitch(s, typeDecls);
             case "someMatch": {
@@ -2112,7 +2199,8 @@ function transformPureSwitch(s, typeDecls) {
     const varName = s.expr.kind === "var" ? s.expr.name : undefined;
     const cases = s.cases.map(c => ({ name: c.label, body: c.body }));
     const arms = buildMatchArms(cases, varName, typeName, typeDecls, (body, vn, fields, ctorName) => {
-        let result = transformPureBody(body, typeDecls);
+        const projected = vn ? projectStructuralCallArgsInTStmts(body, vn, fields) : body;
+        let result = transformPureBody(projected, typeDecls);
         if (!result)
             return null;
         if (fields.length > 0 && vn)
@@ -2139,7 +2227,8 @@ function transformPureMatch(chain, typeDecls) {
     // the statement-level counterpart of this substitution.
     const isSynthArrayUnion = decl?.discriminant === "__isArray__";
     const arms = buildMatchArms(cases, chain.varName, chain.typeName, typeDecls, (body, vn, fields, ctorName) => {
-        let result = transformPureBody(body, typeDecls);
+        const projected = vn ? projectStructuralCallArgsInTStmts(body, vn, fields) : body;
+        let result = transformPureBody(projected, typeDecls);
         if (!result)
             return null;
         if (fields.length > 0 && vn)
@@ -2159,7 +2248,8 @@ function transformPureMatch(chain, typeDecls) {
         const remaining = remainingVariant(chain.typeName, chain.cases, typeDecls);
         if (remaining) {
             // Exactly one variant left — destructure for variant-specific field access.
-            let body = transformPureBody(chain.fallthrough, typeDecls);
+            const projected = projectStructuralCallArgsInTStmts(chain.fallthrough, chain.varName, remaining.fields);
+            let body = transformPureBody(projected, typeDecls);
             if (!body)
                 return null;
             if (remaining.fields.length > 0)