lemmascript 0.5.20 → 0.5.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lemmascript",
-  "version": "0.5.20",
+  "version": "0.5.22",
   "description": "A verification toolchain for TypeScript — generates Lean 4 or Dafny from annotated TS",
   "type": "module",
   "engines": {

package/tools/dist/dafny-emit.js

@@ -1555,15 +1555,18 @@ function qualifyCtor(name, type) {
         return `${type}.${mapped}`;
     return mapped;
 }
-/** Translate a Lean match pattern to Dafny syntax.
+/** Translate a backend-neutral match pattern to Dafny syntax.
  *  ".ctorName field1 field2" → "ctorName(field1, field2)"
  *  ".ctorName" → "ctorName"
+ *  literal value → quoted Dafny string
  *  "_" → "_"
  */
 const CTOR_MAP = { "some": "Some", "none": "None" };
 function translatePattern(p) {
     if (p.kind === "wild")
         return "_";
+    if (p.kind === "literal")
+        return emitExpr({ kind: "str", value: p.value });
     const ctorName = (Object.hasOwn(CTOR_MAP, p.ctor) ? CTOR_MAP[p.ctor] : undefined) ?? dafnyCtorName(p.ctor);
     if (p.binders.length === 0)
         return ctorName;

package/tools/dist/extract.js

@@ -515,19 +515,78 @@ function extractExpr(node) {
     }
     // Arrow function: (x) => expr or (x) => { stmts }
     if (Node.isArrowFunction(node)) {
-        const params = node.getParameters().map(p => {
+        // A binding pattern is not an identifier in either backend. Keep the
+        // callback arity unchanged by replacing a flat object pattern with one
+        // synthetic parameter and binding its fields at the start of the body:
+        //   ({ x, y: z }) => e
+        // becomes, in Raw IR, the equivalent of
+        //   (_lambdaParam0) => { const x = _lambdaParam0.x;
+        //                        const z = _lambdaParam0.y; return e; }
+        // transform's lambda flattener later turns these immutable lets back into
+        // the expression form required by Dafny lambdas. More involved binding
+        // semantics stay explicit errors rather than leaking pattern text into a
+        // generated backend identifier.
+        const destructureBindings = [];
+        const params = node.getParameters().map((p, paramIndex) => {
             const typeNode = p.getTypeNode();
-            return { name: p.getName(), tsType: typeNode ? typeNode.getText() : undefined };
+            const tsType = typeNode ? typeNode.getText() : undefined;
+            const nameNode = p.getNameNode();
+            if (Node.isIdentifier(nameNode))
+                return { name: nameNode.getText(), tsType };
+            if (Node.isArrayBindingPattern(nameNode)) {
+                throw new Error(`array binding pattern in arrow parameter not yet supported: ${nameNode.getText()}`);
+            }
+            if (!Node.isObjectBindingPattern(nameNode)) {
+                throw new Error(`unsupported arrow parameter binding: ${p.getName()}`);
+            }
+            if (p.getInitializer()) {
+                throw new Error(`defaulted object binding pattern in arrow parameter not yet supported: ${p.getText()}`);
+            }
+            const paramName = freshName(`_lambdaParam${paramIndex}`);
+            for (const el of nameNode.getElements()) {
+                if (el.getDotDotDotToken()) {
+                    throw new Error(`rest property in arrow parameter destructuring not yet supported: ${el.getText()}`);
+                }
+                if (el.getInitializer()) {
+                    throw new Error(`default value in arrow parameter destructuring not yet supported: ${el.getText()}`);
+                }
+                const localNode = el.getNameNode();
+                if (!Node.isIdentifier(localNode)) {
+                    throw new Error(`nested binding pattern in arrow parameter destructuring not yet supported: ${el.getText()}`);
+                }
+                const localName = localNode.getText();
+                const propNode = el.getPropertyNameNode();
+                if (propNode && !Node.isIdentifier(propNode)) {
+                    throw new Error(`computed or literal property in arrow parameter destructuring not yet supported: ${el.getText()}`);
+                }
+                destructureBindings.push({
+                    kind: "let",
+                    name: localName,
+                    mutable: false,
+                    tsType: null,
+                    init: {
+                        kind: "field",
+                        obj: { kind: "var", name: paramName },
+                        field: propNode ? propNode.getText() : localName,
+                    },
+                    line: p.getStartLineNumber(),
+                });
+            }
+            return { name: paramName, tsType };
         });
         // Return type from the checker — inferred when unannotated — so resolve can
         // type return-position record literals and give the lambda a real fn type.
         const returnTsType = typeToString(node.getReturnType());
         const body = node.getBody();
         if (Node.isExpression(body)) {
-            return { kind: "lambda", params, body: extractExpr(body), returnTsType };
+            const expr = extractExpr(body);
+            const loweredBody = destructureBindings.length === 0
+                ? expr
+                : [...destructureBindings, { kind: "return", value: expr, line: body.getStartLineNumber() }];
+            return { kind: "lambda", params, body: loweredBody, returnTsType };
         }
         if (Node.isBlock(body)) {
-            return { kind: "lambda", params, body: extractStmts(body.getStatements()), returnTsType };
+            return { kind: "lambda", params, body: [...destructureBindings, ...extractStmts(body.getStatements())], returnTsType };
         }
         throw new Error(`Unsupported arrow function body: ${node.getText().slice(0, 80)}`);
     }
@@ -1675,10 +1734,16 @@ function extractStmts(stmts) {
             // B: ...`) — the stripped breaks are the switch exits.
             const clauseInfos = s.getClauses().map(clause => {
                 const stmts = extractStmts(clause.getStatements());
+                let label = null;
+                if (Node.isCaseClause(clause)) {
+                    const labelExpr = extractExpr(clause.getExpression());
+                    if (labelExpr.kind !== "str") {
+                        throw new Error(`Unsupported switch case at line ${clause.getStartLineNumber()}: expected a string literal`);
+                    }
+                    label = labelExpr.value;
+                }
                 return {
-                    label: Node.isCaseClause(clause)
-                        ? clause.getExpression().getText().replace(/^["']|["']$/g, "")
-                        : null,
+                    label,
                     stmts,
                     exits: isExit(stmts[stmts.length - 1]),
                 };
@@ -1963,6 +2028,17 @@ export function extractModule(sourceFile) {
     // here), deduped by qualified name.
     _externs.clear();
     _externSigTypes.length = 0;
+    // Match a `//@ <kw>` directive only as the first non-whitespace on a line,
+    // so prose mentioning an annotation does not activate it.
+    function hasLineDirective(text, kw) {
+        return new RegExp(String.raw `^[ \t]*//@ ${kw}\b`, "m").test(text);
+    }
+    // Declaration-level directives must be attached as leading comments. Do
+    // not scan a function's whole body: a statement-level `//@ skip` inside it
+    // must not omit the enclosing function.
+    function hasLeadingDirective(node, kw) {
+        return node.getLeadingCommentRanges().some(r => hasLineDirective(r.getText(), kw));
+    }
     // Share the module's ts-morph Project with parseTsType (scratch source file
     // for type-string parsing). Done before declare-type parsing so any
     // parseTsType call downstream uses the same Project.
@@ -2059,6 +2135,8 @@ export function extractModule(sourceFile) {
     const constants = [];
     for (const stmt of sourceFile.getStatements()) {
         if (Node.isVariableStatement(stmt)) {
+            if (hasLeadingDirective(stmt, "skip"))
+                continue;
             for (const decl of stmt.getDeclarationList().getDeclarations()) {
                 if (stmt.getDeclarationList().getFlags() & 2 /* const */) {
                     const init = decl.getInitializer();
@@ -2141,11 +2219,9 @@ export function extractModule(sourceFile) {
     // regex — but its callers should still be verifiable against an
     // uninterpreted predicate. Parallel to auto-extern for cross-file calls,
     // and emitted the same way (`function {:axiom} foo(...)` in Dafny).
-    // Match a `//@ <kw>` directive only as the first non-whitespace on a line, so
-    // a mention mid-line in prose or inside a block/JSDoc comment (e.g. "the
-    // `//@ extern` annotation", or ` * //@ extern`) doesn't falsely trigger it.
-    function hasLineDirective(text, kw) {
-        return new RegExp(String.raw `^[ \t]*//@ ${kw}\b`, "m").test(text);
+    function hasSkip(f) {
+        return hasLeadingDirective(f.parentStmt ?? f.node, "skip")
+            || (!!f.parentStmt && hasLeadingDirective(f.node, "skip"));
     }
     function hasExtern(f) {
         if (hasLineDirective(f.node.getFullText(), "extern"))
@@ -2178,7 +2254,7 @@ export function extractModule(sourceFile) {
         return null;
     }
     for (const f of allFns) {
-        if (!hasExtern(f))
+        if (hasSkip(f) || !hasExtern(f))
             continue;
         const qualified = externName(f) ?? f.name;
         const flat = qualified.replace(/\./g, "_");
@@ -2215,8 +2291,9 @@ export function extractModule(sourceFile) {
         }
         return false;
     }
-    const hasVerifyDirective = hasLineDirective(sourceFile.getFullText(), "verify");
-    const nonExternFns = allFns.filter(f => !hasExtern(f));
+    const nonExternFns = allFns.filter(f => !hasSkip(f) && !hasExtern(f));
+    const hasVerifiedClassMethod = sourceFile.getClasses().some(cls => !hasLeadingDirective(cls, "skip") && cls.getMethods().some(method => !hasLeadingDirective(method, "skip") && hasLineDirective(method.getFullText(), "verify")));
+    const hasVerifyDirective = nonExternFns.some(hasVerify) || hasVerifiedClassMethod;
     const fnsToExtract = hasVerifyDirective ? nonExternFns.filter(hasVerify) : nonExternFns;
     // `//@ autohavoc` — enable the auto-havoc abstraction (see autohavoc.ts).
     // File-level: a directive at column 0 (top of file) enables it for every
@@ -2730,8 +2807,12 @@ export function extractModule(sourceFile) {
     // Extract classes with //@ verify methods
     const classes = [];
     for (const cls of sourceFile.getClasses()) {
+        if (hasLeadingDirective(cls, "skip"))
+            continue;
         const methods = [];
         for (const method of cls.getMethods()) {
+            if (hasLeadingDirective(method, "skip"))
+                continue;
             if (!method.getFullText().includes('//@ verify'))
                 continue;
             methods.push(extractFunction(method));

package/tools/dist/ir.js

@@ -6,6 +6,7 @@
  */
 export const pWild = () => ({ kind: "wild" });
 export const pCtor = (c, ...binders) => ({ kind: "ctor", ctor: c, binders });
+export const pLiteral = (value) => ({ kind: "literal", value });
 /** Binder identifiers a pattern introduces (`[]` for wildcard / nullary ctor). */
 export function patternBinders(p) {
     return p.kind === "ctor" ? p.binders : [];

package/tools/dist/lean-emit.js

@@ -196,9 +196,13 @@ let _boolCtx = false;
 function leanCtorName(name) {
     return /^[A-Za-z_][A-Za-z0-9_'!?]*$/.test(name) ? name : `«${name}»`;
 }
-/** Render a match pattern to Lean syntax: `_`, `.none`, `.some x`, `.syn seq`. */
+/** Render a match pattern to Lean syntax: `_`, a quoted literal, or `.ctor args`. */
 function renderLeanPattern(p) {
-    return p.kind === "wild" ? "_" : "." + [leanCtorName(p.ctor), ...p.binders].join(" ");
+    if (p.kind === "wild")
+        return "_";
+    if (p.kind === "literal")
+        return emitExpr({ kind: "str", value: p.value });
+    return "." + [leanCtorName(p.ctor), ...p.binders].join(" ");
 }
 // A Bool-valued atom that does NOT coerce to Prop: an inlined union discriminator
 // (lowered to a match-bool `match x with | .C .. => true | _ => false`) or a raw
@@ -354,7 +358,30 @@ function emitExpr(e, parentPrec) {
             const obj = emitExpr(e.obj);
             const wrap = e.obj.kind === "binop" || e.obj.kind === "app" || e.obj.kind === "methodCall" || e.obj.kind === "if" || e.obj.kind === "let";
             const receiver = wrap ? `(${obj})` : obj;
-            const args = e.args.map(a => (a.kind === "binop" || a.kind === "unop" || a.kind === "implies" || a.kind === "app" || a.kind === "methodCall") ? `(${emitExpr(a)})` : emitExpr(a));
+            // Predicate-taking array methods require a Bool-valued callback even when
+            // the surrounding expression returns an array/option rather than Bool.
+            // Usually Lean can coerce a decidable Prop-valued predicate. A predicate
+            // containing a raw Bool match cannot be coerced through ∧/∨/¬, though, so
+            // switch just that callback to computational connectives. This is local:
+            // setting the enclosing definition's Bool context would incorrectly
+            // affect unrelated arguments and would still miss predicates inside an
+            // Array-returning definition such as `xs.filter(...)`.
+            const predicateMethod = e.objTy.kind === "array" &&
+                ["filter", "every", "some", "find"].includes(e.method);
+            const args = e.args.map((a, i) => {
+                const prevBoolCtx = _boolCtx;
+                if (predicateMethod && i === 0)
+                    _boolCtx = prevBoolCtx || needsBoolConnectives(a);
+                let rendered;
+                try {
+                    rendered = emitExpr(a);
+                }
+                finally {
+                    _boolCtx = prevBoolCtx;
+                }
+                return (a.kind === "binop" || a.kind === "unop" || a.kind === "implies" || a.kind === "app" || a.kind === "methodCall")
+                    ? `(${rendered})` : rendered;
+            });
             return emitMethodCall(e.objTy.kind, e.method, e.monadic, receiver, args);
         }
         case "lambda": {

package/tools/dist/resolve.js

@@ -370,6 +370,18 @@ function isWidenedStringUnionTy(declTy, initTy, typeDecls) {
  *  If the variable is used as a map/set key (e.g. map.has(k), map.get(k)),
  *  return the collection's key type. Otherwise return null (default to int). */
 function inferQuantVarType(varName, body, ctx) {
+    // Spec membership uses a binary node (`x in collection`), unlike the
+    // executable `.has(x)` / `.includes(x)` calls handled below. Infer the
+    // quantified variable from the RHS collection so documented forms such as
+    // `forall(x, x in \result ==> ...)` do not silently fall back to `int`.
+    if (body.kind === "binop" && body.op === "in" &&
+        body.left.kind === "var" && body.left.name === varName) {
+        const collectionTy = resolveExpr(body.right, ctx).ty;
+        if (collectionTy.kind === "map")
+            return collectionTy.key;
+        if (collectionTy.kind === "set" || collectionTy.kind === "array")
+            return collectionTy.elem;
+    }
     // Look for membership/lookup builtins (map.has(k), map.get(k),
     // array.includes(k) — registry `argIsKey`) where k is our variable
     if (body.kind === "call" && body.fn.kind === "field" &&

package/tools/dist/transform.js

@@ -5,7 +5,7 @@
  * No type lookups, no string parsing, no re-inference.
  */
 import { tyEqual } from "./typedir.js";
-import { anyExprInStmts, pWild, pCtor, patternBinders, patternBinds, patternCtor } from "./ir.js";
+import { anyExprInStmts, pWild, pCtor, pLiteral, patternBinders, patternBinds, patternCtor } from "./ir.js";
 import { parseTsType } from "./types.js";
 import { freshName } from "./names.js";
 import { builtinSpec } from "./builtins.js";
@@ -1387,7 +1387,12 @@ function matchToIfChains(stmts) {
         if (s.kind !== "match")
             return [s];
         const arms = s.arms.map(a => ({ ...a, body: matchToIfChains(a.body) }));
-        const ctorArms = arms.filter(a => a.pattern.kind !== "wild");
+        // Literal-value matches are not user-inductive matches and need no
+        // discriminator rewrite. In particular, don't let a later ctor arm make us
+        // accidentally drop an earlier literal arm from a malformed mixed match.
+        if (arms.some(a => a.pattern.kind === "literal"))
+            return [{ ...s, arms }];
+        const ctorArms = arms.filter(a => a.pattern.kind === "ctor");
         const firstCtor = ctorArms[0] ? patternCtor(ctorArms[0].pattern) : undefined;
         const decl = firstCtor ? declWithVariant(_typeDecls, firstCtor) : undefined;
         if (!decl)
@@ -1842,10 +1847,18 @@ function mapStmtExprs(s, r) {
  *  and delegates body transformation to the caller-provided function.
  *  Returns null if any body transformation returns null (pure path abort). */
 function buildMatchArms(cases, varName, typeName, typeDecls, transformBody) {
-    const decl = typeName ? declOf(typeDecls, typeName) : undefined;
+    const decl = declOf(typeDecls, typeName);
+    if (!decl || (decl.kind !== "string-union" && decl.kind !== "discriminated-union")) {
+        throw new Error(`match type ${typeName} is not a declared union`);
+    }
     const arms = [];
     for (const c of cases) {
         const variant = decl?.variants?.find(v => v.name === c.name);
+        const declared = decl.kind === "string-union"
+            ? decl.values?.includes(c.name)
+            : !!variant;
+        if (!declared)
+            throw new Error(`case ${JSON.stringify(c.name)} is not a variant of ${typeName}`);
         const fields = variant?.fields ?? [];
         const pattern = buildMatchPattern(c.name, fields, varName);
         const body = transformBody(c.body, varName, fields, c.name);
@@ -1855,6 +1868,19 @@ function buildMatchArms(cases, varName, typeName, typeDecls, transformBody) {
     }
     return arms;
 }
+/** Build value-pattern arms for a switch on a plain string. Case labels have
+ *  already been validated and decoded by extraction; unlike datatype cases,
+ *  these are literal values and introduce no constructor-field binders. */
+function buildLiteralMatchArms(cases, transformBody) {
+    const arms = [];
+    for (const c of cases) {
+        const body = transformBody(c.body);
+        if (body === null)
+            return null;
+        arms.push({ pattern: pLiteral(c.name), body });
+    }
+    return arms;
+}
 function emitMatchStmt(scrutinee, typeName, cases, fallthrough, typeDecls) {
     const decl = declOf(typeDecls, typeName);
     // Synth array-unions (discriminant "__isArray__") have single-field variants
@@ -1937,8 +1963,8 @@ function remainingVariant(typeName, cases, typeDecls) {
 /** `switch(obj.field)` is stripped at extraction to scrutinee `obj` + discriminant
  *  `field`, assuming `obj` is a discriminated union with `field` as its
  *  discriminant. When that's NOT so — e.g. `obj` is a plain record with an
- *  enum-typed `field` — the switch is really on the enum VALUE. This returns the
- *  enum scrutinee `obj.field` (+ the field's enum type) to match directly; null
+ *  enum- or string-typed `field` — the switch is really on the field VALUE. This
+ *  returns the scrutinee `obj.field` (+ its resolved type) to match directly; null
  *  for a genuine discriminant switch or `switch(localVar)`, which callers handle
  *  their usual way. Shared by emitSwitchStmt and transformPureSwitch. */
 function enumFieldSwitch(s, typeDecls) {
@@ -1950,9 +1976,18 @@ function enumFieldSwitch(s, typeDecls) {
     const fieldTy = objDecl?.kind === "record" ? objDecl.fields?.find(f => f.name === s.discriminant)?.type : undefined;
     return {
         scrutinee: { kind: "field", obj: transformExpr(s.expr), field: s.discriminant },
-        enumTyName: fieldTy?.kind === "user" ? fieldTy.name : undefined,
+        fieldTy,
     };
 }
+/** Declared datatype matched by a switch, excluding records/aliases/opaque
+ *  types. A plain `string` intentionally has no declaration and uses literal
+ *  patterns instead. */
+function switchCtorDecl(typeDecls, ty) {
+    if (!ty)
+        return undefined;
+    const decl = declOfTy(typeDecls, ty);
+    return decl?.kind === "string-union" || decl?.kind === "discriminated-union" ? decl : undefined;
+}
 /** Stamp variant ctor info onto datatype updates of the match scrutinee in
  *  lowered arm bodies (`{ ...vn, f: v }`) — the statement-path twin of
  *  `replaceFieldAccess`'s stamping. Emitters need the pin to use
@@ -1971,15 +2006,24 @@ function stampScrutineeUpdates(body, varName, ctorName, ctorOf) {
 function emitSwitchStmt(s, typeDecls) {
     const cases = s.cases.map(c => ({ name: c.label, body: c.body }));
     const ef = enumFieldSwitch(s, typeDecls);
+    const matchTy = ef ? ef.fieldTy : s.expr.ty;
+    const literalCases = matchTy?.kind === "string";
+    const ctorDecl = switchCtorDecl(typeDecls, matchTy);
+    if (!literalCases && !ctorDecl) {
+        const typeName = !matchTy ? "unknown" : matchTy.kind === "user" ? matchTy.name : matchTy.kind;
+        throw new Error(`switch scrutinee must be string-typed or a declared union, got ${typeName}`);
+    }
     const baseName = s.expr.ty.kind === "user" ? tyBaseName(s.expr.ty.name) : undefined;
-    const arms = ef
-        ? buildMatchArms(cases, undefined, ef.enumTyName, typeDecls, (body) => transformStmts(body, typeDecls))
-        : buildMatchArms(cases, s.expr.kind === "var" ? s.expr.name : "?", s.expr.ty.kind === "user" ? s.expr.ty.name : undefined, typeDecls, (body, vn, fields, ctorName) => {
-            let out = transformStmts(replaceFieldAccessInTStmts(body, vn, fields), typeDecls);
-            if (ctorName && vn && baseName)
-                out = stampScrutineeUpdates(out, vn, ctorName, baseName);
-            return out;
-        });
+    const arms = literalCases
+        ? buildLiteralMatchArms(cases, (body) => transformStmts(body, typeDecls))
+        : ef
+            ? buildMatchArms(cases, undefined, ctorDecl.name, typeDecls, (body) => transformStmts(body, typeDecls))
+            : buildMatchArms(cases, s.expr.kind === "var" ? s.expr.name : "?", ctorDecl.name, typeDecls, (body, vn, fields, ctorName) => {
+                let out = transformStmts(replaceFieldAccessInTStmts(body, vn, fields), typeDecls);
+                if (ctorName && vn && baseName)
+                    out = stampScrutineeUpdates(out, vn, ctorName, baseName);
+                return out;
+            });
     if (s.defaultBody.length > 0)
         arms.push({ pattern: pWild(), body: transformStmts(s.defaultBody, typeDecls) });
     return { kind: "match", scrutinee: ef ? ef.scrutinee : varE(s.expr.kind === "var" ? s.expr.name : "?"), arms };
@@ -2182,7 +2226,13 @@ function transformPureSwitch(s, typeDecls) {
     const ef = enumFieldSwitch(s, typeDecls);
     if (ef) {
         const cases = s.cases.map(c => ({ name: c.label, body: c.body }));
-        const arms = buildMatchArms(cases, undefined, ef.enumTyName, typeDecls, (body) => transformPureBody(body, typeDecls));
+        const literalCases = ef.fieldTy?.kind === "string";
+        const ctorDecl = switchCtorDecl(typeDecls, ef.fieldTy);
+        if (!literalCases && !ctorDecl)
+            return null;
+        const arms = literalCases
+            ? buildLiteralMatchArms(cases, (body) => transformPureBody(body, typeDecls))
+            : buildMatchArms(cases, undefined, ctorDecl.name, typeDecls, (body) => transformPureBody(body, typeDecls));
         if (!arms)
             return null;
         if (s.defaultBody.length > 0) {
@@ -2193,9 +2243,10 @@ function transformPureSwitch(s, typeDecls) {
         }
         return { kind: "match", scrutinee: ef.scrutinee, arms };
     }
-    const typeName = s.expr.ty.kind === "user" ? s.expr.ty.name : "";
-    if (!declOf(typeDecls, typeName))
+    const ctorDecl = switchCtorDecl(typeDecls, s.expr.ty);
+    if (!ctorDecl)
         return null;
+    const typeName = ctorDecl.name;
     const varName = s.expr.kind === "var" ? s.expr.name : undefined;
     const cases = s.cases.map(c => ({ name: c.label, body: c.body }));
     const arms = buildMatchArms(cases, varName, typeName, typeDecls, (body, vn, fields, ctorName) => {
@@ -2474,7 +2525,8 @@ export function transformModule(mod, specImport, moduleBaseOverride) {
         };
     });
     // Def file: Velvet methods
-    // Pure functions get a thin wrapper that calls Pure.fnName
+    // Pure functions get a thin wrapper. Lean keeps pure definitions in the
+    // `Pure` namespace; Dafny flattens that namespace, so its call is unqualified.
     // def-by-method functions also skip their method wrappers
     const pureDefNames = new Set([...pureDefs.map(d => d.name), ...defByMethods.map(d => d.name)]);
     const methods = mod.functions.map(fn => {
@@ -2488,7 +2540,7 @@ export function transformModule(mod, specImport, moduleBaseOverride) {
         }
         _forofCounters.clear();
         let body = pureDefNames.has(fn.name)
-            ? [{ kind: "return", value: { kind: "app", fn: `Pure.${fn.name}`, args: fn.params.map(p => ({ kind: "var", name: p.name })) } }]
+            ? [{ kind: "return", value: { kind: "app", fn: _opts.backend === "lean" ? `Pure.${fn.name}` : fn.name, args: fn.params.map(p => ({ kind: "var", name: p.name })) } }]
             : promoteAssignedLets(transformStmts(fn.body, mod.typeDecls));
         // Lean-only method-body rewrites (Velvet can't WP-synthesize monadic matches
         // and forbids `return` in loops):