lemmascript 0.5.3 → 0.5.5

package/README.md

@@ -24,7 +24,7 @@ See the external case studies:
 - **[talktimer-lemmascript](https://github.com/midspiral/talktimer-lemmascript/)** — verified talk timer React app, ported from a Dafny-only [`talktimer-lemmafit`](https://github.com/midspiral/talktimer-lemmafit/) twin. 17-variant `Action` state machine + verified `History` (undo/redo/preview/commitFrom) all in one `domain.ts` — the original Dafny's `Domain refines Kernel` abstract-module pattern inlined since LS has no abstract modules. 108 VCs in `domain.dfy` (invariant preservation) + 123 in `domain.proofs.dfy` (behavioral lemmas + Kernel round-trip). Dafny only.
 - **[node-casbin-lemmascript](https://github.com/midspiral/node-casbin-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [node-casbin](https://github.com/casbin/node-casbin). 5 functions verified, 217 existing tests pass. End-to-end correctness and order independence for all 4 effect modes in both Lean and Dafny (39 lemmas).
 - **[hono-lemmascript](https://github.com/midspiral/hono-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [hono](https://github.com/honojs/hono)'s security middleware. Four CVEs covered: IP restriction bypass ([CVE-2026-39409](https://github.com/honojs/hono/security/advisories/GHSA-3mpf-rcc7-5347)) and cookie name bypass ([CVE-2026-39410](https://github.com/honojs/hono/security/advisories/GHSA-r5rp-j6wh-rvv4)) — 51 Dafny lemmas, [cookie verification **in-place**](https://github.com/midspiral/hono-lemmascript/blob/lemmascript/src/utils/cookie.ts#L79); plus `serveStatic`'s URL-encoded directory traversal ([CVE-2024-32869](https://github.com/honojs/hono/security/advisories/GHSA-q5w7-8mq6-2hxq)) + repeated-slash bypass ([CVE-2026-39407](https://github.com/honojs/hono/security/advisories/GHSA-jw53-c2g8-vmwm)), proved as a *composition* — `decode(rawPath)` before `check(decoded)`, so a buggy implementation that reordered the steps would fail the proof. First use of `//@ assume` + `//@ havoc`-on-assign. Dafny only.
-- **[hono-rate-limiter-with-lemmascript](https://github.com/midspiral/hono-rate-limiter-with-lemmascript)** — a greenfield verified feature shipped through a brownfield host's *middleware seam*: a standalone [Hono](https://hono.dev) rate-limit middleware whose admission decision is a machine-checked theorem. Every fixed-window "N per minute" limiter leaks the same way — a client fires `limit` requests just before a boundary and `limit` more just after, a 2× burst the docs swear can't happen. The verified core proves the crisp guarantee people actually want: over an integer-millisecond admission log, `admit` keeps `|log| ≤ limit` and window-faithful, and folding it over **any** monotone request stream (`run`) keeps the cumulative log `Spread` — so **no half-open window `(s, s+W]` ever admits more than `limit`** (`SlidingWindowBound`); the boundary burst is not mitigated but *impossible*. The naive cousin is refuted in the same file: `FixedWindowLeaks` exhibits a concrete trace where a fixed-window counter admits `2 × limit` in one sliding window while the verified `admit` rejects the overflow. An invariant-over-a-stateful-core proof (not a one-shot algorithm), wired into a live Hono server that gates real HTTP. 23 Dafny VCs, 0 errors; the clock's monotonicity and the per-key store's atomicity are the named trust boundary. Dafny only.
+- **[hono-rate-limiter-with-lemmascript](https://github.com/midspiral/hono-rate-limiter-with-lemmascript)** — a greenfield verified feature shipped through a brownfield host's *middleware seam*: a standalone [Hono](https://hono.dev) sliding-window rate-limit middleware whose admission decision is a machine-checked theorem. `SlidingWindowBound` proves no half-open window `(s, s+W]` ever admits more than `limit`, so the boundary-straddling 2× burst that every fixed-window limiter leaks is *impossible* (the naive cousin is refuted in the same file, `FixedWindowLeaks`); the proof is wired into a live Hono server, with the clock's monotonicity and the per-key store's atomicity as the named trust boundary. 23 Dafny VCs, 0 errors. Dafny only.
 - **[charmchat](https://github.com/CHARM-BDF/charmchat/blob/lemma/README_LemmaScript.md)** — brownfield verification of an AI agent orchestration backend. `isEmptyResult` (string emptiness predicate, 8 postconditions, <1s) and `topologicalSort` (Kahn's algorithm — memory safety, output bounds, completeness via acyclicity ranking witness, termination). Full completeness proof: 23 helper lemmas, 14 opaque ghost predicates, 115 loop invariants; 736 VCs verified under `--isolate-assertions --verification-time-limit 600`. Key technique: snapshot-based inner invariants (`ghost var originalRemDeps := remDeps`) replace the mid-iteration SEEN/UNSEEN split so preservation is frame reasoning against a ghost-constant rather than set-subtraction against mutating state. Dafny only.
 - **[xyflow-lemmascript](https://github.com/midspiral/xyflow-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [xyflow](https://github.com/xyflow/xyflow)'s core edge and geometry utilities. 9 functions verified: `addEdge` (dedup — never loses edges, adds at most one), `reconnectEdge` (semantic: under a unique-id precondition, the result is in-place — `|result| ≤ |edges|`, no insertion — *and* when a matching edge existed with non-empty new endpoints, the output contains an edge with those endpoints. Uses `//@ assume` to characterize destructuring, `find`, and the constructed edge), `connectionExists`, `getEdgeCenter` (midpoint correctness), `clamp` (bounds), `rectToBox`/`boxToRect` (field arithmetic), `getBoundsOfBoxes` (enclosure), `getOverlappingArea` (non-negative), `areSetsEqual` (subset + same size). 14 Dafny proof obligations. Also adds a new verified feature — a **DAG connection gate**: `canReach` decides reachability soundly *and* completely, and `wouldCreateCycle` gates both new connections and edge reconnections so the graph is proven to stay acyclic, with `isAcyclic` (sound + complete) establishing the base case and a topological-rank witness giving a safe evaluation order (+29 obligations), shown live in a React Flow demo that refuses cycle-closing edges — extending the case study from verifying existing code to adding a verified feature. Dafny only.
 - **[rallly-lemmascript](https://github.com/midspiral/rallly-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [rallly](https://github.com/lukevella/rallly)'s meeting-poll Next.js app. 2 functions: `validateRedirectUrl` (in-place — open-redirect predicate; non-`undefined` outputs start with `/` but not `//`) and `scorePoll` (extracted ranking core — length preservation, score bounds, top-choice characterization, score-formula equality, within-poll monotonicity, tiebreaker injectivity). The injectivity proof surfaced a real spec-level constraint on the existing `(yes + ifNeedBe) * 1000 + yes` encoding: it overflows when an option has ≥ 1000 yes votes. 10 Dafny VCs, 0 errors. Drove four toolchain additions: `s.startsWith()`, `T | null` nullability, `\result` narrowing under `==>`, `Math.max(...arr)` spread. Dafny only.
@@ -36,6 +36,7 @@ See the external case studies:
 - **[quota-lemmascript](https://github.com/midspiral/quota-lemmascript)** — greenfield verified booking app: providers publish a page of limited-capacity *featured slots*, signed-in users grab them (React + Cloudflare Durable Objects + D1). A deliberate **inverse** of [quorum-lemmascript](https://github.com/midspiral/quorum-lemmascript): where Quorum counts *up to* a threshold over data partitioned **per participant** (no conflicts ⇒ optimistic, lock-free, no rollback), Quota's bookings **contend** for shared inventory, so the load-bearing fact flips from a count to a **bound** — for every slot `j`, `confirmedCount(bookings, j) <= slots[j].capacity` — and so does the concurrency story: the *same* `domain.ts` runs in the browser and the Durable Object, but **server-authoritatively** (it never oversells under contention; no optimistic client apply). Proven: no overbooking (invariant preservation across `tryBook` / cancel), accept-iff-room, an **idempotent three-way `tryBook`** (a retry reads as success, not rejection — only "confirmed" mutates), cancellation frees seats, replay determinism, and full order-invariance of availability under contention — `confirmedCountPerm` / `hasRoomPermInvariant` show availability depends only on the *multiset* of the booking log (any reordering, not just a pairwise swap), via the same `perm(...)` predicate Quorum drove into LemmaScript. NDJSON export is built on the verified `confirmedOnly`. The counting kernel is Quorum's `countFree` re-pointed at bookings — total and precondition-free so it composes. 80 Dafny VCs, 0 errors. Trust boundary (stated plainly): auth, the React UI, WebSocket/DO/D1 I/O, email, slot date/time labeling, and abuse/rate-limiting. Dafny only.
 - **[henri-lemmascript](https://github.com/midspiral/henri-lemmascript)** — a runnable TypeScript coding-agent CLI (a port of [henri](https://github.com/metareflection/henri/); multi-provider, Anthropic + AWS Bedrock) whose security- and protocol-critical core is verified and **imported directly by the live agent** — `decide()` gates every real tool call and the conversation invariant is asserted on every turn (it streams end-to-end against Bedrock). Three modules, 48 Dafny VCs, 0 errors. (1) **Permission gate**: soundness (`decide == Allow ⟺ isAllowed`), **path-traversal containment** — auto-allow-in-cwd can never resolve outside cwd, with `.`/`..` normalization proved in-core so the shell is trusted only to `resolve().split('/')` — grant monotonicity, and `rejectPrompts` is deny-only. (2) **Conversation protocol**: tool-call/result pairing plus the [pi-lemmascript](https://github.com/midspiral/pi-lemmascript)-style **no-orphaned-`tool_result`** property, proved as an invariant *preserved by the loop* — `wellFormed(msgs + [assistant(calls), tool(makeResults(calls))])` — not checked after the fact. (3) **Hook/config merge**: removal, **tool-name uniqueness — a fix** (henri concatenated hook tool lists with no dedup, so two hooks could shadow a name), order-independence, and additivity composed **cross-module** with the gate's monotonicity (merging only grows the allow-sets, which by P3 never revokes an `Allow`). The merge is verified **in place** via `//@ declare-type Tool { name: string }`, shadowing the real `Tool`'s function-valued `execute` so the actual `mergeTools(Tool[])` is the proof target rather than a parallel model. Dafny only.
 - **[eslint-plugin-with-lemmascript](https://github.com/midspiral/eslint-plugin-with-lemmascript)** — a greenfield verified feature shipped through a brownfield host's *extension API*: a real, npm-published [ESLint](https://eslint.org) flat-config plugin whose rule decision is a machine-checked theorem. `no-forbidden-reach` enforces architecture boundaries — "the UI must never reach the DB layer" — through **any** import chain, catching the *laundered* `ui → service → db` violation that every one-hop incumbent (`import/no-restricted-paths`, `eslint-plugin-boundaries`, Nx module boundaries) silently passes. The verified core decides reachability soundly *and* completely (`reachesAny` / `violates`) and **constructs** the offending chain in proven code (`findReachPath` — a path-carrying BFS proven sound + complete by mirroring the frontier's endpoints in a ghost seq, so completeness reduces to the same closure argument as the reachability search; the chain printed in the lint error is therefore itself a *verified* import path, not a heuristic guess). The headline is a meta-theorem — `Domination` + `Strictness` — proving the transitive check **strictly dominates** one-hop checking: every direct violation is caught, *and* there provably exist laundered violations that direct-edge checks miss. 30 Dafny VCs, 0 errors. The reachability decision and the witness are proven; the import-graph extraction (which edges exist) is the stated trust boundary, and `dist/*.js` is `tsc`'s erasure of the verified source it ships alongside. Dafny only.
+- **[infisical-lemmascript](https://github.com/midspiral/infisical-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield, **in-place** verification of the permission-boundary glob set-containment check in [Infisical](https://github.com/Infisical/infisical) — the privilege-escalation guard that stops a role from delegating broader secret-path access than it holds. The loop-bearing `segmentMatch` compiles to a Dafny `method` (unnameable in specs), so soundness is proven by **refinement**: the method certifies `result == segMatchSpec` (a pure mirror), and a standalone lemma proves that spec sound against a hand-written segment-glob semantics — *if it returns true, every path the subset glob matches, the parent matches too*. 12 Dafny VCs, 0 errors; drove a toolchain fix (recursive `method`s now carry a method-level `//@ decreases`). Dafny only.
 
 ## Setup
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lemmascript",
-  "version": "0.5.3",
+  "version": "0.5.5",
   "description": "A verification toolchain for TypeScript — generates Lean 4 or Dafny from annotated TS",
   "type": "module",
   "engines": {
@@ -34,6 +34,8 @@
   "keywords": [
     "lemmascript",
     "verification",
+    "formal-verification",
+    "verified",
     "typescript",
     "lean4",
     "dafny",

package/tools/dist/dafny-emit.js

@@ -458,12 +458,19 @@ function emitExpr(e) {
             let ctorName;
             if (e.fields.length > 0) {
                 const fieldNames = new Set(e.fields.map(f => f.name));
+                const matches = [];
                 for (const [name, fields] of _structureDecls) {
                     if (fields.length >= e.fields.length && fields.every(f => fieldNames.has(f.name) || f.type.kind === "optional")) {
-                        ctorName = name;
-                        break;
+                        matches.push(name);
                     }
                 }
+                // When several datatypes share this field-name set (e.g. Event vs
+                // SparseEvent), disambiguate by the resolved record type carried from
+                // transform; otherwise take the sole structural match.
+                if (e.ctor && matches.includes(e.ctor))
+                    ctorName = e.ctor;
+                else if (matches.length > 0)
+                    ctorName = matches[0];
                 if (!ctorName)
                     ctorName = _recordCtors.get(e.fields[0].name);
             }
@@ -708,6 +715,8 @@ function emitDecl(d) {
                 lines.push(`  requires ${emitExpr(r)}`);
             for (const e of d.ensures)
                 lines.push(`  ensures ${emitExpr(e)}`);
+            if (d.decreases)
+                lines.push(`  decreases ${emitExpr(d.decreases)}`);
             lines.push(`{`);
             lines.push(emitStmts(d.body, 1));
             lines.push(`}`);

package/tools/dist/narrow.js

@@ -44,25 +44,29 @@ let _typeDecls = [];
  *  pure-access-path optional-typed e. `!e` is equivalent to `=== undefined`.
  *  Following TS, only pure access paths narrow; complex scrutinees return null. */
 function parseOptionalCheck(cond) {
-    // `!e` where e is optional — same as `e === undefined` (negated: true).
+    // `!e` where e is optional — a truthiness form: false iff e is absent OR its
+    // inner value is itself falsy (so `Some(0)`/`Some("")` count as falsy too).
     if (cond.kind === "unop" && cond.op === "!" && cond.expr.ty.kind === "optional") {
         const e = cond.expr;
         const innerTy = cond.expr.ty.inner;
         const hint = binderHintFor(e);
         if (hint === null)
             return null;
-        return { scrutinee: e, innerTy, negated: true, binderHint: hint };
+        return { scrutinee: e, innerTy, negated: true, binderHint: hint, truthiness: true };
     }
     if (cond.kind !== "binop" || (cond.op !== "!==" && cond.op !== "===")) {
-        // Bare optional truthiness: `if (e)` where e: T | undefined — same as `e !== undefined`.
+        // Bare optional truthiness: `if (e)` where e: T | undefined — true iff e is
+        // present AND its inner value is truthy.
         if (cond.ty.kind === "optional") {
             const hint = binderHintFor(cond);
             if (hint === null)
                 return null;
-            return { scrutinee: cond, innerTy: cond.ty.inner, negated: false, binderHint: hint };
+            return { scrutinee: cond, innerTy: cond.ty.inner, negated: false, binderHint: hint, truthiness: true };
         }
         return null;
     }
+    // Explicit `e === undefined` / `e !== undefined` — a pure presence check,
+    // independent of the inner value (so NOT a truthiness form).
     let e = null;
     if (cond.right.kind === "var" && cond.right.name === "undefined")
         e = cond.left;
@@ -73,7 +77,7 @@ function parseOptionalCheck(cond) {
     const hint = binderHintFor(e);
     if (hint === null)
         return null;
-    return { scrutinee: e, innerTy: e.ty.inner, negated: cond.op === "===", binderHint: hint };
+    return { scrutinee: e, innerTy: e.ty.inner, negated: cond.op === "===", binderHint: hint, truthiness: false };
 }
 function binderHintFor(e) {
     // Pure access paths: var(x) or field(purePath, name).
@@ -205,6 +209,8 @@ function recurseStmt(s) {
             fallthrough: rs(s.fallthrough) };
     }
 }
+const canBeFalsy = (c) => c.truthiness && ["int", "nat", "string", "bool"].includes(c.innerTy.kind);
+const bound = (c) => ({ kind: "var", name: c.binderHint, ty: c.innerTy });
 // ── Rules ───────────────────────────────────────────────────
 /** Rule: `if (e !== undefined) then else` where e is a simple optional var or
  *  `obj.field` chain, and the Some branch is non-empty.
@@ -223,7 +229,8 @@ function ruleIfOptionalSimple(s) {
         kind: "someMatch",
         scrutinee: check.scrutinee, binderTy: check.innerTy,
         binder: check.binderHint,
-        someBody, noneBody,
+        someBody: canBeFalsy(check) ? [{ kind: "if", cond: bound(check), then: someBody, else: noneBody }] : someBody,
+        noneBody,
     };
 }
 /** Rule: `if (e === undefined) terminate; rest` (early return / throw / break).
@@ -246,7 +253,7 @@ function ruleEarlyReturnConsume(s, rest) {
         kind: "someMatch",
         scrutinee: check.scrutinee, binderTy: check.innerTy,
         binder: check.binderHint,
-        someBody: rest,
+        someBody: canBeFalsy(check) ? [{ kind: "if", cond: bound(check), then: rest, else: noneBranch }] : rest,
         noneBody: noneBranch,
     };
 }
@@ -308,7 +315,8 @@ function ruleConditionalOptionalSimple(e) {
         kind: "someMatch",
         scrutinee: check.scrutinee, binderTy: check.innerTy,
         binder: check.binderHint,
-        someBody, noneBody,
+        someBody: canBeFalsy(check) ? { kind: "conditional", cond: bound(check), then: someBody, else: noneBody, ty: e.ty } : someBody,
+        noneBody,
         ty: e.ty,
     };
 }

package/tools/dist/peephole.js

@@ -440,7 +440,8 @@ function peepholeDecl(d) {
                 decreases: d.decreases ? peepholeExpr(d.decreases) : null };
         case "method":
             return { ...d, body: peepholeStmts(d.body),
-                requires: d.requires.map(peepholeExpr), ensures: d.ensures.map(peepholeExpr) };
+                requires: d.requires.map(peepholeExpr), ensures: d.ensures.map(peepholeExpr),
+                decreases: d.decreases ? peepholeExpr(d.decreases) : null };
         case "namespace": return { ...d, decls: d.decls.map(peepholeDecl) };
         case "class": return { ...d, methods: d.methods.map(m => peepholeDecl(m)) };
         case "const": return { ...d, value: peepholeExpr(d.value) };

package/tools/dist/transform.js

@@ -248,15 +248,18 @@ function flattenLambdaBody(stmts) {
  * field, index, record, forall, or exists sub-expressions.
  */
 /** JS truthiness coercion for `if`/`while`/`?:` conditions.
- *  Dafny requires bool; TS treats number/string/array as truthy when non-empty.
+ *  Dafny requires bool; coerce number→`≠0`, string→non-empty, array→`true`
+ *  (every array, even `[]`, is truthy in JS).
  *  Optional conds are handled separately by narrow.ts (rewritten to someMatch). */
 function coerceCondToBool(cond, ty) {
     if (ty.kind === "bool")
         return cond;
     if (ty.kind === "int" || ty.kind === "nat")
-        return { kind: "binop", op: ">", left: cond, right: { kind: "num", value: 0 } };
-    if (ty.kind === "string" || ty.kind === "array")
-        return { kind: "binop", op: ">", left: { kind: "field", obj: cond, field: "size" }, right: { kind: "num", value: 0 } };
+        return { kind: "binop", op: "≠", left: cond, right: { kind: "num", value: 0 } };
+    if (ty.kind === "string")
+        return { kind: "binop", op: ">", left: { kind: "field", obj: cond, field: "length" }, right: { kind: "num", value: 0 } };
+    if (ty.kind === "array")
+        return { kind: "bool", value: true };
     return cond;
 }
 /** Wrap an expression in Some/None for optional-typed conditionals.
@@ -309,6 +312,14 @@ function lowerExpr(e, binds) {
                     ],
                 };
             }
+            // Number truthiness: !n → n == 0
+            if (e.op === "!" && (e.expr.ty.kind === "int" || e.expr.ty.kind === "nat"))
+                return { kind: "binop", op: "=", left: lowerExpr(e.expr, binds), right: { kind: "num", value: 0 } };
+            // Array truthiness: every array is truthy in JS, so !xs is always false.
+            if (e.op === "!" && e.expr.ty.kind === "array") {
+                lowerExpr(e.expr, binds); // preserve any lifted side effects; value is the constant false
+                return { kind: "bool", value: false };
+            }
             return { kind: "unop", op: e.op === "!" ? "¬" : e.op, expr: lowerExpr(e.expr, binds) };
         case "binop": {
             // Implication: flatten (A && B) ==> C → implies [A, B] C
@@ -327,8 +338,10 @@ function lowerExpr(e, binds) {
                     right: { kind: "constructor", name: e.right.value, type: objTy },
                 };
             }
-            // String literal comparison — constructor if user type, string literal if string
-            if ((e.op === "===" || e.op === "!==") && e.right.kind === "str") {
+            // String literal comparison — constructor if user type, string literal if string.
+            // Skip when the left is optional: fall through to the optional-comparison rule,
+            // which unwraps and compares the inner value (`Some(v) => v == "")`.
+            if ((e.op === "===" || e.op === "!==") && e.right.kind === "str" && e.left.ty.kind !== "optional") {
                 const left = lowerExpr(e.left, binds);
                 const leftTy = e.left.ty.kind === "user" ? e.left.ty.name : undefined;
                 const right = isUser(e.left.ty)
@@ -352,7 +365,13 @@ function lowerExpr(e, binds) {
                         ],
                     };
                 }
-                const valExpr = lowerExpr(valSide, binds);
+                // A string literal compared against an optional user type is the variant
+                // constructor (`o === "red"` → `Some(v) => v == Color.red`), mirroring the
+                // non-optional string-literal rule above.
+                const innerTy = optSide.ty.kind === "optional" ? optSide.ty.inner : optSide.ty;
+                const valExpr = valSide.kind === "str" && innerTy.kind === "user"
+                    ? { kind: "constructor", name: valSide.value, type: innerTy.name }
+                    : lowerExpr(valSide, binds);
                 const cmpOp = BOOL_OP_MAP[e.op] ?? e.op;
                 const noneVal = e.op === "!==" ? true : false;
                 const bound = matchBinder("value");
@@ -402,7 +421,9 @@ function lowerExpr(e, binds) {
                 const rightIsUndef = e.right.kind === "var" && e.right.name === "undefined";
                 return {
                     kind: "if",
-                    cond: { kind: "binop", op: ">", left: { kind: "field", obj: left, field: "size" }, right: { kind: "num", value: 0 } },
+                    // strings carry the `length` marker, arrays `size` — both render to `|x|`
+                    // in Dafny, but Lean's String has no `.size` field (it's `.length`).
+                    cond: { kind: "binop", op: ">", left: { kind: "field", obj: left, field: e.left.ty.kind === "string" ? "length" : "size" }, right: { kind: "num", value: 0 } },
                     then: rightIsUndef ? { kind: "app", fn: "Some", args: [left] } : left,
                     else: right,
                 };
@@ -676,7 +697,14 @@ function lowerExpr(e, binds) {
                     })),
                 };
             }
-            return { kind: "record", spread: null, fields: e.fields.map(f => ({ name: f.name, value: lowerExpr(f.value, binds) })) };
+            // Carry the resolved record type so the emitter can pick the right
+            // constructor when two datatypes share a field-name set (Event vs
+            // SparseEvent) — structural matching alone would take the first-declared.
+            const recName = e.ty.kind === "user"
+                ? (e.ty.name.includes("<") ? e.ty.name.slice(0, e.ty.name.indexOf("<")) : e.ty.name)
+                : undefined;
+            const ctor = recName && _typeDecls.find(d => d.name === recName && d.kind === "record") ? recName : undefined;
+            return { kind: "record", spread: null, ctor, fields: e.fields.map(f => ({ name: f.name, value: lowerExpr(f.value, binds) })) };
         }
         case "arrayLiteral":
             if (e.ty.kind === "map" && e.elems.length === 0)
@@ -1514,7 +1542,7 @@ function transformPureBody(stmts, typeDecls) {
                 const elseExpr = transformPureBody(elseStmts, typeDecls);
                 if (!elseExpr)
                     return null;
-                return { kind: "if", cond: transformExpr(s.cond), then: thenExpr, else: elseExpr };
+                return { kind: "if", cond: coerceCondToBool(transformExpr(s.cond), s.cond.ty), then: thenExpr, else: elseExpr };
             }
             case "switch": return transformPureSwitch(s, typeDecls);
             case "someMatch": {
@@ -1878,6 +1906,7 @@ export function transformModule(mod, specImport) {
             returnType: fn.returnTy,
             requires: fn.requires.map(transformExpr),
             ensures,
+            decreases: fn.decreases ? transformExpr(fn.decreases) : null,
             body,
         };
     });
@@ -1895,6 +1924,7 @@ export function transformModule(mod, specImport) {
                 returnType: fn.returnTy,
                 requires: fn.requires.map(transformExpr),
                 ensures,
+                decreases: fn.decreases ? transformExpr(fn.decreases) : null,
                 body,
             };
         });