lemmascript 0.5.5 → 0.5.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lemmascript",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "description": "A verification toolchain for TypeScript — generates Lean 4 or Dafny from annotated TS",
   "type": "module",
   "engines": {

package/tools/dist/dafny-commands.js

@@ -28,7 +28,9 @@ export function dafnyCheckDiff(genPath, dfyPath) {
             diff = typeof e.stdout === "string" ? e.stdout : e.stdout.toString("utf-8");
         }
         else {
-            return true;
+            // git couldn't be spawned: the check never ran, so fail loud, don't green-pass.
+            console.error(`ERROR: could not run \`git diff\` to verify ${path.basename(dfyPath)} is additions-only (is git installed?)`);
+            return false;
         }
     }
     const deletions = diff.split("\n").filter(l => l.startsWith("-") && !l.startsWith("---"));

package/tools/dist/dafny-emit.js

@@ -86,7 +86,7 @@ function methodHeader(prefix, params, returnType) {
 // ── Lean op → Dafny op ─────────────────────────────────────
 const OP_MAP = {
     "=": "==", "≠": "!=", "≥": ">=", "≤": "<=",
-    "∧": "&&", "∨": "||", "¬": "!",
+    "∧": "&&", "∨": "||", "¬": "!", "↔": "<==>",
     "arrayConcat": "+",
 };
 function mapOp(op) { return OP_MAP[op] ?? op; }
@@ -152,15 +152,15 @@ function emitExpr(e) {
                 if (e.method === "with")
                     return `${obj}[${args[0]} := ${args[1]}]`;
                 if (e.method === "includes")
-                    return `(${args[0]} in ${obj})`;
+                    return args.length > 1 ? `(${args[0]} in ${obj}[${args[1]}..])` : `(${args[0]} in ${obj})`;
                 if (e.method === "indexOf") {
                     needPreamble("SeqIndexOf");
-                    return `SeqIndexOf(${obj}, ${args[0]})`;
+                    return args.length > 1 ? `SeqIndexOfFrom(${obj}, ${args[0]}, ${args[1]})` : `SeqIndexOf(${obj}, ${args[0]})`;
                 }
                 if (e.method === "push")
-                    return `(${obj} + [${args[0]}])`;
+                    return `(${obj} + [${args.join(", ")}])`;
                 if (e.method === "concat")
-                    return `(${obj} + [${args[0]}])`;
+                    return `(${obj} + [${args.join(", ")}])`;
                 // No-arg slice is a full copy; Dafny seq is an immutable value type, so
                 // the copy is just the seq itself (the idiom for "copy then mutate").
                 if (e.method === "slice" && args.length === 0)
@@ -399,12 +399,22 @@ function emitExpr(e) {
                 return `{${args.join(", ")}}`;
             if (e.fn === "JSFloorDiv")
                 needPreamble("JSFloorDiv");
+            if (e.fn === "JSRem")
+                needPreamble("JSRem");
+            if (e.fn === "JSTruncDiv")
+                needPreamble("JSTruncDiv");
+            if (e.fn === "JSStringLt")
+                needPreamble("JSStringLt");
             if (e.fn === "CeilReal")
                 needPreamble("CeilReal");
             if (e.fn === "FloorReal")
                 needPreamble("FloorReal");
             if (e.fn === "NatToString")
                 needPreamble("NatToString");
+            if (e.fn === "IntToString") {
+                needPreamble("NatToString");
+                needPreamble("IntToString");
+            }
             if (e.fn === "MathAbs")
                 needPreamble("MathAbs");
             if (e.fn === "MathMin")
@@ -421,6 +431,8 @@ function emitExpr(e) {
             }
             if (e.fn === "Perm")
                 needPreamble("Perm");
+            if (e.fn === "SetFromSeq")
+                needPreamble("SetFromSeq");
             return `${escapeName(e.fn)}(${args.join(", ")})`;
         }
         case "field": {
@@ -804,6 +816,26 @@ const JS_FLOOR_DIV = `function JSFloorDiv(a: int, b: int): int
     if a <= 0 then (-a) / (-b)
     else -((a - 1) / (-b)) - 1
 }`;
+const JS_REM = `function JSRem(a: int, b: int): int
+  requires b != 0
+{
+  var r := (if a < 0 then -a else a) % (if b < 0 then -b else b);
+  if a < 0 then -r else r
+}`;
+const JS_TRUNC_DIV = `function JSTruncDiv(a: int, b: int): int
+  requires b != 0
+{
+  var q := (if a < 0 then -a else a) / (if b < 0 then -b else b);
+  if (a < 0) != (b < 0) then -q else q
+}`;
+const JS_STRING_LT = `predicate JSStringLt(s: string, t: string)
+  decreases |s|
+{
+  if |s| == 0 then |t| > 0
+  else if |t| == 0 then false
+  else if s[0] != t[0] then s[0] < t[0]
+  else JSStringLt(s[1..], t[1..])
+}`;
 const FLOOR_REAL = `function FloorReal(x: real): int
 {
   x.Floor
@@ -1031,11 +1063,16 @@ const NAT_TO_STRING = `function NatToString(n: nat): string
   if n < 10 then [digit]
   else NatToString(n / 10) + [digit]
 }`;
+const INT_TO_STRING = `function IntToString(n: int): string
+{
+  if n < 0 then "-" + NatToString(-n) else NatToString(n)
+}`;
 const MATH_ABS = `function MathAbs(x: int): nat { if x >= 0 then x else -x }`;
 // perm(a, b) — `a` and `b` are reorderings of each other (equal as multisets).
 // Transparent (Dafny unfolds it), so hand-proofs can reason with `multiset`
 // directly. The `(==)` bound requires the element type to support equality.
 const PERM = `predicate Perm<T(==)>(a: seq<T>, b: seq<T>) { multiset(a) == multiset(b) }`;
+const SET_FROM_SEQ = `function SetFromSeq<T(==)>(s: seq<T>): set<T> { set x | x in s }`;
 const SET_TO_SEQ = `method SetToSeq<T>(s: set<T>) returns (res: seq<T>)
   ensures forall x :: x in s <==> x in res
   ensures |res| == |s|
@@ -1063,6 +1100,9 @@ const PREAMBLE_CODE = [
     ["BitAnd", BIT_AND],
     ["BitOr", BIT_OR],
     ["JSFloorDiv", JS_FLOOR_DIV],
+    ["JSRem", JS_REM],
+    ["JSTruncDiv", JS_TRUNC_DIV],
+    ["JSStringLt", JS_STRING_LT],
     ["CeilReal", CEIL_REAL],
     ["FloorReal", FLOOR_REAL],
     ["SeqIndexOf", SEQ_INDEX_OF],
@@ -1078,12 +1118,14 @@ const PREAMBLE_CODE = [
     ["StringToLower", STRING_TO_LOWER],
     ["StringToUpper", STRING_TO_UPPER],
     ["NatToString", NAT_TO_STRING],
+    ["IntToString", INT_TO_STRING],
     ["MathAbs", MATH_ABS],
     ["MathMin", MATH_MIN],
     ["MathMax", MATH_MAX],
     ["MaxOfSeq", MAX_OF_SEQ],
     ["MinOfSeq", MIN_OF_SEQ],
     ["Perm", PERM],
+    ["SetFromSeq", SET_FROM_SEQ],
 ];
 // ── Constructor and record helpers ───────────────────────────
 let _recordCtors = new Map();

package/tools/dist/extract.js

@@ -4,7 +4,7 @@
  * Produces structured AST nodes, not strings.
  * The only strings are //@ annotation expressions (parsed later by specparser).
  */
-import { Project, Node, SyntaxKind, ScriptTarget } from "ts-morph";
+import { Project, Node, SyntaxKind, ScriptTarget, ts } from "ts-morph";
 import { initTypeParser } from "./types.js";
 // ── Expression extraction ────────────────────────────────────
 /** When set, calls whose function/method name matches this key are replaced with havoc. */
@@ -87,11 +87,16 @@ function detectCrossFileExtern(callee, sourceFile) {
     // types in the callee's own type-parameter namespace, so these names match
     // what `params`/`returnType` reference — declare them on the emitted axiom.
     const typeParams = sig.getTypeParameters().map(tp => tp.getText());
+    // Print types relative to the call site (enclosingNode = callee, alias names
+    // kept): a bare `TMsg`, not `import("/abs/path/transcript").TMsg` — the
+    // importing module declares the datatype locally, so the axiom must use the
+    // local name.
+    const externTypeText = (t) => t.getText(callee, ts.TypeFormatFlags.UseAliasDefinedOutsideCurrentScope);
     const params = sig.getParameters().map(p => ({
         name: p.getName(),
-        tsType: p.getTypeAtLocation(callee).getText(),
+        tsType: externTypeText(p.getTypeAtLocation(callee)),
     }));
-    const returnType = sig.getReturnType().getText();
+    const returnType = externTypeText(sig.getReturnType());
     let qualified;
     if (Node.isPropertyAccessExpression(callee)) {
         qualified = `${callee.getExpression().getText()}.${callee.getName()}`;
@@ -309,9 +314,10 @@ function extractExpr(node) {
     // Template literal: `foo${x}bar` → "foo" + x + "bar"
     if (Node.isTemplateExpression(node)) {
         const parts = [];
-        const head = node.getHead().getLiteralText();
-        if (head)
-            parts.push({ kind: "str", value: head });
+        // Always push the head, even when empty: a leading string literal anchors the
+        // whole chain as string-typed so each interpolated value is stringified (not
+        // added numerically — `${a}${b}` is concatenation, not `a + b`).
+        parts.push({ kind: "str", value: node.getHead().getLiteralText() });
         for (const span of node.getTemplateSpans()) {
             parts.push(extractExpr(span.getExpression()));
             const text = span.getLiteral().getLiteralText();
@@ -481,43 +487,42 @@ function extractExpr(node) {
     }
     // Object literal: { res: true, done: false } or { ...obj, res: true }
     if (Node.isObjectLiteralExpression(node)) {
-        let spread = null;
-        const fields = [];
-        const computedFields = [];
+        // Fold properties in source order: a later spread overrides everything before
+        // it, a named field is a record-update on the accumulator, a computed key is a
+        // map `.set`. Order matters: if `a` has `k`, `{ k: v, ...a }` is `a`, not `a.(k := v)`.
+        let acc = null;
+        const update = (name, value) => {
+            acc = acc && acc.kind === "record"
+                ? { kind: "record", spread: acc.spread, fields: [...acc.fields, { name, value }] }
+                : { kind: "record", spread: acc, fields: [{ name, value }] };
+        };
         for (const prop of node.getProperties()) {
             if (Node.isSpreadAssignment(prop)) {
-                spread = extractExpr(prop.getExpression());
+                acc = extractExpr(prop.getExpression());
             }
             else if (Node.isShorthandPropertyAssignment(prop)) {
                 const name = prop.getName();
-                fields.push({ name, value: { kind: "var", name } });
+                update(name, { kind: "var", name });
             }
             else if (Node.isPropertyAssignment(prop)) {
                 const nameNode = prop.getNameNode();
                 const init = prop.getInitializer();
-                if (init && Node.isComputedPropertyName(nameNode)) {
-                    computedFields.push({ key: extractExpr(nameNode.getExpression()), value: extractExpr(init) });
+                if (!init)
+                    continue;
+                if (Node.isComputedPropertyName(nameNode)) {
+                    // { ...base, [k]: v } → base.set(k, v); { [k]: v } → {}.set(k, v)
+                    const base = acc ?? { kind: "record", spread: null, fields: [] };
+                    acc = { kind: "call", fn: { kind: "field", obj: base, field: "set" }, args: [extractExpr(nameNode.getExpression()), extractExpr(init)] };
                 }
-                else if (init) {
+                else {
                     // String-literal keys (e.g. `"bun run": 3`) — use the unquoted literal
                     // value; otherwise `prop.getName()` may include surrounding quotes.
                     const name = Node.isStringLiteral(nameNode) ? nameNode.getLiteralValue() : prop.getName();
-                    fields.push({ name, value: extractExpr(init) });
+                    update(name, extractExpr(init));
                 }
             }
         }
-        // Desugar computed keys: { ...base, [k]: v } → base.set(k, v)
-        // No spread: { [k]: v } → {}.set(k, v) (empty map base)
-        if (computedFields.length > 0) {
-            let result = spread ?? { kind: "record", spread: null, fields: [] };
-            for (const cf of computedFields) {
-                result = { kind: "call",
-                    fn: { kind: "field", obj: result, field: "set" },
-                    args: [cf.key, cf.value] };
-            }
-            return result;
-        }
-        return { kind: "record", spread, fields };
+        return acc ?? { kind: "record", spread: null, fields: [] };
     }
     // Ternary: cond ? then : else
     if (Node.isConditionalExpression(node)) {
@@ -555,8 +560,12 @@ function extractExpr(node) {
                 if (Node.isArrayLiteralExpression(arg)) {
                     return { kind: "emptyCollection", collectionType: "Set", tsType, initElems: arg.getElements().map(e => extractExpr(e)) };
                 }
-                // new Set(existingSet) — pass through
-                return extractExpr(arg);
+                const argSymbol = arg.getType().getSymbol()?.getName() ?? arg.getType().getAliasSymbol()?.getName();
+                // new Set(existingSet) — identity (sets are value types)
+                if (argSymbol === "Set")
+                    return extractExpr(arg);
+                // new Set(arr) — build a deduplicated set from the array's elements
+                return { kind: "call", fn: { kind: "var", name: "__setFromArray" }, args: [extractExpr(arg)] };
             }
             return { kind: "emptyCollection", collectionType: name, tsType };
         }
@@ -1557,6 +1566,7 @@ function extractStmts(stmts) {
             //      inside a `{ }` case block is stripped, while a `break` inside a
             //      nested loop stays put.
             const stripExitBreaks = (b) => b.filter(st => st.kind !== "break");
+            const isExit = (st) => !!st && ["break", "return", "throw", "continue"].includes(st.kind);
             let fallthrough = [];
             for (const clause of s.getClauses()) {
                 if (Node.isCaseClause(clause)) {
@@ -1565,7 +1575,10 @@ function extractStmts(stmts) {
                         fallthrough.push(label);
                         continue;
                     }
-                    const body = stripExitBreaks(extractStmts(clause.getStatements()));
+                    const raw = extractStmts(clause.getStatements());
+                    if (!isExit(raw[raw.length - 1]))
+                        throw new Error(`switch case "${label}" at line ${line}: a non-empty case must end with break/return/throw; fall-through into the next case is not supported`);
+                    const body = stripExitBreaks(raw);
                     for (const l of fallthrough)
                         cases.push({ label: l, body });
                     cases.push({ label, body });

package/tools/dist/lean-emit.js

@@ -77,6 +77,7 @@ function escapeName(name) {
 }
 // ── Operator precedence (for parenthesization) ──────────────
 const PREC = {
+    "↔": 0, // Lean: Iff (20) binds looser than → (25)
     "→": 1, "∨": 2, "∧": 3,
     "=": 4, "≠": 4, "≥": 4, "≤": 4, ">": 4, "<": 4,
     "+": 5, "-": 5, "++": 5, "arrayConcat": 5, "*": 6, "/": 6, "%": 6,
@@ -96,15 +97,15 @@ function emitMethodCall(tyKind, method, monadic, obj, args) {
         if (method === "some")
             return `${obj}.${monadic ? "anyM" : "any"} ${args[0]}`;
         if (method === "includes")
-            return `${obj}.contains ${args[0]}`;
+            return args.length > 1 ? `(${obj}.extract ${args[1]} ${obj}.size).contains ${args[0]}` : `${obj}.contains ${args[0]}`;
         if (method === "find")
             return `${obj}.find? ${args[0]}`;
         if (method === "with")
             return `${obj}.set! ${args[0]} ${args[1]}`;
         if (method === "push")
-            return `Array.push ${obj} ${args[0]}`;
+            return args.length === 1 ? `Array.push ${obj} ${args[0]}` : `${obj} ++ #[${args.join(", ")}]`;
         if (method === "concat")
-            return `Array.push ${obj} ${args[0]}`;
+            return args.length === 1 ? `Array.push ${obj} ${args[0]}` : `${obj} ++ #[${args.join(", ")}]`;
         // arr.slice → Array.extract. No-arg slice is a full copy (Array is a value
         // type in Lean, so the receiver itself); one arg drops the prefix, two args
         // give the half-open range. Matches JS for non-negative bounds (negative
@@ -184,7 +185,7 @@ function emitExpr(e, parentPrec) {
         case "emptySet": return `Std.HashSet.empty`;
         case "methodCall": {
             const obj = emitExpr(e.obj);
-            const wrap = e.obj.kind === "binop" || e.obj.kind === "app" || e.obj.kind === "methodCall";
+            const wrap = e.obj.kind === "binop" || e.obj.kind === "app" || e.obj.kind === "methodCall" || e.obj.kind === "if" || e.obj.kind === "let";
             const receiver = wrap ? `(${obj})` : obj;
             const args = e.args.map(a => (a.kind === "binop" || a.kind === "unop" || a.kind === "implies" || a.kind === "app" || a.kind === "methodCall") ? `(${emitExpr(a)})` : emitExpr(a));
             return emitMethodCall(e.objTy.kind, e.method, e.monadic, receiver, args);
@@ -213,11 +214,23 @@ function emitExpr(e, parentPrec) {
                 return `${wrap ? `(${recv})` : recv}.contains ${emitExpr(e.left)}`;
             }
             const op = e.op === "arrayConcat" ? "++" : e.op;
-            const s = `${wrapOperand(e.left, prec(e.op))} ${op} ${wrapOperand(e.right, prec(e.op))}`;
+            // ↔ does not chain in Lean — a nested iff operand needs parens.
+            const childPrec = e.op === "↔" ? prec(e.op) + 1 : prec(e.op);
+            // `-`, `/`, `%` are left-associative and non-associative, so an equal-
+            // precedence right operand must be parenthesized: `a - (b - c)` would
+            // otherwise emit as `a - b - c`, i.e. `(a - b) - c`.
+            const rightPrec = e.op === "↔" ? childPrec
+                : ["-", "/", "%"].includes(e.op) ? prec(e.op) + 1 : childPrec;
+            const s = `${wrapOperand(e.left, childPrec)} ${op} ${wrapOperand(e.right, rightPrec)}`;
             return (parentPrec !== undefined && prec(e.op) < parentPrec) ? `(${s})` : s;
         }
         case "implies": {
-            const parts = [...e.premises.map(p => wrapOperand(p)), emitExpr(e.conclusion)];
+            // Premises bind at →'s level: a nested-implication premise must keep its
+            // parens (→ is right-associative, so `(a → b) → c` ≠ `a → b → c`), and
+            // ↔ binds looser than → in Lean. The conclusion is the right-assoc tail,
+            // where a nested implication is safe bare — only ↔ needs parens there.
+            const wrapIff = (x) => x.kind === "binop" && x.op === "↔" ? `(${emitExpr(x)})` : undefined;
+            const parts = [...e.premises.map(p => wrapOperand(p, prec("→"))), wrapIff(e.conclusion) ?? emitExpr(e.conclusion)];
             const s = parts.join(" → ");
             return parentPrec !== undefined ? `(${s})` : s;
         }
@@ -231,6 +244,16 @@ function emitExpr(e, parentPrec) {
             // SetToSeq → .toArray for Lean (HashSet has native toArray)
             if (e.fn === "SetToSeq" && args.length === 1)
                 return `${args[0]}.toArray`;
+            if (e.fn === "SetFromSeq" && args.length === 1)
+                return `Std.HashSet.ofList ${args[0]}.toList`;
+            if (e.fn === "ToString" && args.length === 1)
+                return `toString ${args[0]}`;
+            // JSRem (JS truncated remainder) → Lean's native truncated `Int.tmod`
+            if (e.fn === "JSRem" && args.length === 2)
+                return `Int.tmod ${args[0]} ${args[1]}`;
+            // JSTruncDiv (JS truncated bigint division) → Lean's native `Int.tdiv`
+            if (e.fn === "JSTruncDiv" && args.length === 2)
+                return `Int.tdiv ${args[0]} ${args[1]}`;
             // perm(a, b) → `List.Perm` on the underlying lists. Dafny lowers it to
             // `multiset(a) == multiset(b)`; the Lean image is `a.toList ~ b.toList`,
             // which mathlib's `List.Perm` provides (reflexivity, symmetry,

package/tools/dist/narrow.js

@@ -249,6 +249,8 @@ function ruleEarlyReturnConsume(s, rest) {
     const noneBranch = check.negated ? s.then : s.else;
     if (someBranch.length !== 0)
         return null;
+    if (!isTerminating(noneBranch))
+        return null;
     return {
         kind: "someMatch",
         scrutinee: check.scrutinee, binderTy: check.innerTy,
@@ -292,11 +294,14 @@ function ruleEarlyReturnOrChain(s, rest) {
     let inner = rest;
     for (let i = checks.length - 1; i >= 0; i--) {
         const check = checks[i];
+        const someBody = canBeFalsy(check)
+            ? [{ kind: "if", cond: bound(check), then: inner, else: s.then }]
+            : inner;
         inner = [{
                 kind: "someMatch",
                 scrutinee: check.scrutinee, binderTy: check.innerTy,
                 binder: check.binderHint,
-                someBody: inner,
+                someBody,
                 noneBody: s.then,
             }];
     }
@@ -582,11 +587,14 @@ function ruleIfAndOptional(s) {
         return null;
     const { check, restCond } = extracted;
     const innerIf = { kind: "if", cond: restCond, then: s.then, else: [] };
+    const someBody = canBeFalsy(check)
+        ? [{ kind: "if", cond: bound(check), then: [walkStmt(innerIf)], else: [] }]
+        : [walkStmt(innerIf)];
     return {
         kind: "someMatch",
         scrutinee: check.scrutinee, binderTy: check.innerTy,
         binder: check.binderHint,
-        someBody: [walkStmt(innerIf)],
+        someBody,
         noneBody: [],
     };
 }
@@ -776,8 +784,16 @@ function ruleDiscriminantChain(stmts) {
     }
     if (cases.length === 0)
         return null;
+    // If every case terminates, the trailing statements are the default arm
+    // (preserving the clean dispatch-as-expression shape). Otherwise the tail runs
+    // after the match for every variant, so leave it to the caller (empty default)
+    // rather than mis-routing it into the default arm only.
+    if (cases.every(c => isTerminating(c.body))) {
+        return { stmt: { kind: "tagMatch", scrutinee: first.scrutinee, typeName: first.typeName,
+                cases, fallthrough: stmts.slice(consumed) }, consumed: stmts.length };
+    }
     return { stmt: { kind: "tagMatch", scrutinee: first.scrutinee, typeName: first.typeName,
-            cases, fallthrough: stmts.slice(consumed) }, consumed: stmts.length };
+            cases, fallthrough: [] }, consumed };
 }
 /** Rule (list-level): `if (x.kind !== "v") terminate; rest` → tagMatch
  *  with cases = [{ variant: v, body: rest }] and fallthrough = terminate. */
@@ -809,12 +825,16 @@ function ruleLetCondAndOptional(s) {
     if (!extracted)
         return null;
     const { check, restCond } = extracted;
+    const assignIf = { kind: "if", cond: restCond,
+        then: [{ kind: "assign", target: s.name, value: s.init.then }], else: [] };
+    const someBody = canBeFalsy(check)
+        ? [{ kind: "if", cond: bound(check), then: [assignIf], else: [] }]
+        : [assignIf];
     const sm = {
         kind: "someMatch",
         scrutinee: check.scrutinee, binderTy: check.innerTy,
         binder: check.binderHint,
-        someBody: [{ kind: "if", cond: restCond,
-                then: [{ kind: "assign", target: s.name, value: s.init.then }], else: [] }],
+        someBody,
         noneBody: [],
     };
     return [
@@ -889,11 +909,15 @@ function ruleConditionalAndOptional(e) {
         kind: "conditional",
         cond: restCond, then: e.then, else: e.else, ty: e.ty,
     };
+    const someExpr = walkExpr(innerCond);
+    const someBody = canBeFalsy(check)
+        ? { kind: "conditional", cond: bound(check), then: someExpr, else: e.else, ty: e.ty }
+        : someExpr;
     return {
         kind: "someMatch",
         scrutinee: check.scrutinee, binderTy: check.innerTy,
         binder: check.binderHint,
-        someBody: walkExpr(innerCond), noneBody: e.else, ty: e.ty,
+        someBody, noneBody: e.else, ty: e.ty,
     };
 }
 /** Rule (statement): `if (<rest> && Array.isArray(path) && <more>) then [else]`

package/tools/dist/resolve.js

@@ -685,7 +685,9 @@ function resolveExpr(e, ctx) {
                 }
             }
             let ty = { kind: "unknown" };
-            if (["===", "!==", ">=", "<=", ">", "<", "in"].includes(e.op))
+            // <==> is bool like the comparisons; unlike ==>, neither side narrows
+            // the other (no premise to assume).
+            if (["===", "!==", ">=", "<=", ">", "<", "in", "<==>"].includes(e.op))
                 ty = { kind: "bool" };
             else if (e.op === "&&")
                 ty = right.ty;
@@ -727,6 +729,16 @@ function resolveExpr(e, ctx) {
                 const fn = { kind: "var", name: "Perm", ty: { kind: "unknown" } };
                 return { kind: "call", fn, args: [a, b], ty: { kind: "bool" }, callKind: "pure" };
             }
+            // new Set(arr): build a deduplicated set from the array's elements (extract
+            // marks the array form `__setFromArray`). Lowers to the SetFromSeq preamble
+            // (Dafny `set x | x in s`); size/membership are then set semantics.
+            if (e.fn.kind === "var" && e.fn.name === "__setFromArray" && e.args.length === 1) {
+                const arr = resolveExpr(e.args[0], ctx);
+                if (arr.ty.kind !== "array")
+                    throw new Error(`new Set(...) expects an array argument (got ${arr.ty.kind})`);
+                const fn = { kind: "var", name: "SetFromSeq", ty: { kind: "unknown" } };
+                return { kind: "call", fn, args: [arr], ty: { kind: "set", elem: arr.ty.elem }, callKind: "pure" };
+            }
             // Extern dispatch: `NS.method(args)` where NS.method is declared via
             // `//@ extern`. Rewrite into a flat-name call (`NS_method(args)`) so the
             // rest of the pipeline sees an ordinary pure function. The extern's

package/tools/dist/specparser.js

@@ -2,7 +2,7 @@
  * Spec expression parser.
  * Parses //@ annotation expressions into RawExpr AST nodes.
  */
-const MULTI_OPS = ["==>", "===", "!==", "==", "!=", ">=", "<=", "&&", "||"];
+const MULTI_OPS = ["<==>", "==>", "===", "!==", "==", "!=", ">=", "<=", "&&", "||"];
 function tokenize(input) {
     const tokens = [];
     let i = 0;
@@ -20,8 +20,22 @@ function tokenize(input) {
             const quote = input[i];
             i++;
             let s = "";
-            while (i < input.length && input[i] !== quote)
-                s += input[i++];
+            while (i < input.length && input[i] !== quote) {
+                if (input[i] === "\\") {
+                    // Standard escapes, where TS source, Dafny, and Lean all agree.
+                    // The emitters re-escape on output, so the round trip is faithful.
+                    const esc = input[i + 1];
+                    const mapped = esc === "n" ? "\n" : esc === "r" ? "\r" : esc === "t" ? "\t"
+                        : esc === "0" ? "\0" : esc === "\\" || esc === '"' || esc === "'" ? esc : null;
+                    if (mapped === null)
+                        throw new Error(`Unsupported string escape '\\${esc}' at ${i} in: ${input}`);
+                    s += mapped;
+                    i += 2;
+                }
+                else {
+                    s += input[i++];
+                }
+            }
             if (i < input.length)
                 i++;
             tokens.push({ type: "str", value: s });
@@ -103,11 +117,19 @@ class Parser {
         return false;
     }
     parse() {
-        const r = this.parseImplies();
+        const r = this.parseIff();
         if (this.pos < this.tokens.length)
             throw new Error(`Unexpected: ${JSON.stringify(this.peek())}`);
         return r;
     }
+    // <==> binds loosest (Dafny precedence: a ==> b <==> c is (a ==> b) <==> c),
+    // right-associative like ==> — immaterial semantically, iff is associative.
+    parseIff() {
+        const left = this.parseImplies();
+        if (this.match("op", "<==>"))
+            return { kind: "binop", op: "<==>", left, right: this.parseIff() };
+        return left;
+    }
     parseImplies() {
         const left = this.parseTernary();
         if (this.match("op", "==>"))
@@ -117,9 +139,9 @@ class Parser {
     parseTernary() {
         const cond = this.parseOr();
         if (this.match("op", "?")) {
-            const then_ = this.parseImplies();
+            const then_ = this.parseIff();
             this.expect("punc", ":");
-            const else_ = this.parseImplies();
+            const else_ = this.parseIff();
             return { kind: "conditional", cond, then: then_, else: else_ };
         }
         return cond;
@@ -187,16 +209,16 @@ class Parser {
                 expr = { kind: "field", obj: expr, field: this.expect("ident").value };
             }
             else if (this.match("punc", "[")) {
-                const idx = this.parseImplies();
+                const idx = this.parseIff();
                 this.expect("punc", "]");
                 expr = { kind: "index", obj: expr, idx };
             }
             else if (this.match("punc", "(")) {
                 const args = [];
                 if (!this.match("punc", ")")) {
-                    args.push(this.parseImplies());
+                    args.push(this.parseIff());
                     while (this.match("punc", ","))
-                        args.push(this.parseImplies());
+                        args.push(this.parseIff());
                     this.expect("punc", ")");
                 }
                 expr = { kind: "call", fn: expr, args };
@@ -276,7 +298,7 @@ class Parser {
                     varType = ty;
                 }
                 this.expect("punc", ",");
-                const body = this.parseImplies();
+                const body = this.parseIff();
                 this.expect("punc", ")");
                 return { kind: q, var: v, varType, body };
             }
@@ -285,7 +307,7 @@ class Parser {
         }
         if (t.type === "punc" && t.value === "(") {
             this.advance();
-            const expr = this.parseImplies();
+            const expr = this.parseIff();
             this.expect("punc", ")");
             return expr;
         }
@@ -293,9 +315,9 @@ class Parser {
             this.advance();
             const elems = [];
             if (!this.match("punc", "]")) {
-                elems.push(this.parseImplies());
+                elems.push(this.parseIff());
                 while (this.match("punc", ","))
-                    elems.push(this.parseImplies());
+                    elems.push(this.parseIff());
                 this.expect("punc", "]");
             }
             return { kind: "arrayLiteral", elems };
@@ -306,11 +328,11 @@ class Parser {
             if (!this.match("punc", "}")) {
                 const name = this.expect("ident").value;
                 this.expect("punc", ":");
-                fields.push({ name, value: this.parseImplies() });
+                fields.push({ name, value: this.parseIff() });
                 while (this.match("punc", ",")) {
                     const n = this.expect("ident").value;
                     this.expect("punc", ":");
-                    fields.push({ name: n, value: this.parseImplies() });
+                    fields.push({ name: n, value: this.parseIff() });
                 }
                 this.expect("punc", "}");
             }

package/tools/dist/transform.js

@@ -158,6 +158,24 @@ function isNat(ty) { return ty.kind === "nat"; }
 function isIntegral(ty) { return ty.kind === "int" || ty.kind === "nat"; }
 function isArray(ty) { return ty.kind === "array"; }
 function isUser(ty) { return ty.kind === "user"; }
+/** Truthiness test for a *lowered* value of source type `ty`, used by `||`
+ *  falsiness lowering. Mirrors narrow.ts's `canBeFalsy`: only int/nat/string/bool
+ *  values can be falsy in JS (`0`, `""`, `false`); every other value (array, user
+ *  type, …) is always truthy. Returns null for the always-truthy types so callers
+ *  can unwrap directly instead of emitting a redundant guard. */
+function valueTruthyCond(value, ty) {
+    switch (ty.kind) {
+        case "int":
+        case "nat":
+            return { kind: "binop", op: "≠", left: value, right: { kind: "num", value: 0 } };
+        case "string":
+            return { kind: "binop", op: ">", left: { kind: "field", obj: value, field: "length" }, right: { kind: "num", value: 0 } };
+        case "bool":
+            return value;
+        default:
+            return null;
+    }
+}
 /** Check if transformed lambda body contains monadic binds. */
 function isMonadicBody(stmts) {
     for (const s of stmts) {
@@ -182,7 +200,7 @@ function isMonadicBody(stmts) {
 const OP_MAP = {
     "===": "=", "!==": "≠", ">=": "≥", "<=": "≤", ">": ">", "<": "<",
     "&&": "∧", "||": "∨", "+": "+", "-": "-", "*": "*", "/": "/", "%": "%",
-    "==": "=", "!=": "≠",
+    "==": "=", "!=": "≠", "<==>": "↔",
 };
 /** Bool-valued operators (for code-level conditions needing Decidable). */
 const BOOL_OP_MAP = {
@@ -275,6 +293,55 @@ function wrapOptionalBranch(expr, raw) {
         return expr; // already Option<T>, don't double-wrap
     return { kind: "constructor", name: "some", type: "Option", args: [expr] };
 }
+/** Lean needs `let mut` for any local that is later reassigned. A const local
+ *  whose collection field is mutated (`b.items.push(v)` → `b := b.(items := …)`)
+ *  becomes an assign in the lowered body, so scan for assign targets and flip
+ *  matching lets to mutable. Harmless on Dafny (method locals are `var`); and an
+ *  assigned let already forces a method, so purity is unaffected. */
+function promoteAssignedLets(stmts) {
+    const assigned = new Set();
+    const collect = (ss) => {
+        for (const s of ss) {
+            if (s.kind === "assign")
+                assigned.add(s.target);
+            else if (s.kind === "if") {
+                collect(s.then);
+                collect(s.else);
+            }
+            else if (s.kind === "while" || s.kind === "forin")
+                collect(s.body);
+            else if (s.kind === "match")
+                s.arms.forEach(a => collect(a.body));
+        }
+    };
+    collect(stmts);
+    if (assigned.size === 0)
+        return stmts;
+    const fix = (ss) => ss.map(s => {
+        const s2 = s.kind === "let" && !s.mutable && assigned.has(s.name) ? { ...s, mutable: true } : s;
+        if (s2.kind === "if")
+            return { ...s2, then: fix(s2.then), else: fix(s2.else) };
+        if (s2.kind === "while" || s2.kind === "forin")
+            return { ...s2, body: fix(s2.body) };
+        if (s2.kind === "match")
+            return { ...s2, arms: s2.arms.map(a => ({ ...a, body: fix(a.body) })) };
+        return s2;
+    });
+    return fix(stmts);
+}
+/** Build a nested record-update assigning `newVal` to a field-path receiver
+ *  rooted at a var: `b.a.items` → `b := b.(a := b.a.(items := newVal))`.
+ *  Returns null if the path isn't a chain of field accesses ending at a var. */
+function buildNestedFieldUpdate(recv, newVal) {
+    if (recv.kind !== "field")
+        return null;
+    const upd = { kind: "record", spread: lowerExpr(recv.obj, null), fields: [{ name: recv.field, value: newVal }] };
+    if (recv.obj.kind === "var")
+        return { root: recv.obj.name, value: upd };
+    if (recv.obj.kind === "field")
+        return buildNestedFieldUpdate(recv.obj, upd);
+    return null;
+}
 function lowerExpr(e, binds) {
     // Monadic lifting: extract embedded method calls to let-binds.
     // `callKind: "method"` means a global var-fn call (classifyCall returns
@@ -301,13 +368,17 @@ function lowerExpr(e, binds) {
             // String truthiness: !str → str == ""
             if (e.op === "!" && e.expr.ty.kind === "string")
                 return { kind: "binop", op: "=", left: lowerExpr(e.expr, binds), right: { kind: "str", value: "" } };
-            // Optional truthiness: !opt → opt is None
+            // Optional truthiness: !opt → None negates to `true`. The Some branch is
+            // `!(value truthy)`: always-truthy inners (array/user) give a plain `false`,
+            // while falsy-capable inners re-test the wrapped value (`!Some(0)` is `true`).
+            // Mirrors the `||` falsiness rule.
             if (e.op === "!" && e.expr.ty.kind === "optional") {
                 const bound = matchBinder("value");
+                const truthy = valueTruthyCond({ kind: "var", name: bound }, e.expr.ty.inner);
                 return {
                     kind: "match", scrutinee: lowerExpr(e.expr, binds),
                     arms: [
-                        { pattern: `.some ${bound}`, body: { kind: "bool", value: false } },
+                        { pattern: `.some ${bound}`, body: truthy ? { kind: "unop", op: "¬", expr: truthy } : { kind: "bool", value: false } },
                         { pattern: ".none", body: { kind: "bool", value: true } },
                     ],
                 };
@@ -383,37 +454,76 @@ function lowerExpr(e, binds) {
                     ],
                 };
             }
-            // || undefined on optional → identity (no-op: x || undefined = x)
+            // || undefined on optional → identity (no-op: x || undefined = x) when the
+            // inner type is always truthy. When it can be falsy, JS still drops the
+            // wrapped value: `Some(0) || undefined === undefined`, so the Some arm
+            // re-tests and falls back to None.
             if (e.op === "||" && e.left.ty.kind === "optional" &&
                 e.right.kind === "var" && e.right.name === "undefined") {
-                return lowerExpr(e.left, binds);
+                const optExpr = lowerExpr(e.left, binds);
+                const bound = matchBinder("value");
+                const truthy = valueTruthyCond({ kind: "var", name: bound }, e.left.ty.inner);
+                if (!truthy)
+                    return optExpr;
+                return {
+                    kind: "match", scrutinee: optExpr,
+                    arms: [
+                        { pattern: `.some ${bound}`, body: {
+                                kind: "if", cond: truthy,
+                                then: { kind: "app", fn: "Some", args: [{ kind: "var", name: bound }] },
+                                else: { kind: "var", name: "undefined" }
+                            } },
+                        { pattern: ".none", body: { kind: "var", name: "undefined" } },
+                    ],
+                };
             }
-            // || on optional → match Some/None with default
+            // || on optional → match Some/None with default. JS `||` tests falsiness of
+            // the *unwrapped* value, so when the inner type can be falsy the Some arm must
+            // re-test (`Some(0) || 1 === 1`); array/user inners are always truthy and
+            // unwrap directly. Mirrors narrow.ts's canBeFalsy gate.
             if (e.op === "||" && e.left.ty.kind === "optional") {
                 const optExpr = lowerExpr(e.left, binds);
                 const defaultExpr = lowerExpr(e.right, binds);
                 const bound = matchBinder("value");
+                const truthy = valueTruthyCond({ kind: "var", name: bound }, e.left.ty.inner);
+                const someBody = truthy
+                    ? { kind: "if", cond: truthy, then: { kind: "var", name: bound }, else: defaultExpr }
+                    : { kind: "var", name: bound };
                 return {
                     kind: "match", scrutinee: optExpr,
                     arms: [
-                        { pattern: `.some ${bound}`, body: { kind: "var", name: bound } },
+                        { pattern: `.some ${bound}`, body: someBody },
                         { pattern: ".none", body: defaultExpr },
                     ],
                 };
             }
-            // || on map index → if key in map then map[key] else default
+            // || on map index → if key in map then map[key] else default. The stored
+            // value is still subject to JS falsiness (`counts.get(k) || 1` returns 1 when
+            // the stored value is 0), so for falsy-capable value types the present branch
+            // re-tests the value too. Always-truthy value types unwrap directly.
             if (e.op === "||" && e.left.kind === "index" && e.left.obj.ty.kind === "map") {
                 const map = lowerExpr(e.left.obj, binds);
                 const key = lowerExpr(e.left.idx, binds);
                 const right = lowerExpr(e.right, binds);
+                const got = { kind: "index", arr: map, idx: key };
+                const truthy = valueTruthyCond(got, e.left.obj.ty.value);
                 return {
                     kind: "if",
                     cond: { kind: "binop", op: "in", left: key, right: map },
-                    then: { kind: "index", arr: map, idx: key }, else: right,
+                    then: truthy ? { kind: "if", cond: truthy, then: got, else: right } : got,
+                    else: right,
                 };
             }
-            // || on non-optional string/array/user → if non-empty then x else default
-            if (e.op === "||" && (e.left.ty.kind === "string" || e.left.ty.kind === "array" ||
+            // || on non-optional array → `xs` itself: every array (even `[]`) is truthy
+            // in JS, so `xs || ys` short-circuits to `xs` and `ys` is never evaluated.
+            // resolve types the whole `||` as the array, so any optional context (e.g.
+            // `xs || undefined`) gets its single Some-wrap from the standard coercion at
+            // the use site — this rule must not add one. Mirrors the `!array` rule above.
+            if (e.op === "||" && e.left.ty.kind === "array") {
+                return lowerExpr(e.left, binds);
+            }
+            // || on non-optional string/user → if non-empty then x else default
+            if (e.op === "||" && (e.left.ty.kind === "string" ||
                 (e.left.ty.kind === "user" && e.right.ty.kind === "string"))) {
                 const left = lowerExpr(e.left, binds);
                 const right = lowerExpr(e.right, binds);
@@ -421,8 +531,8 @@ function lowerExpr(e, binds) {
                 const rightIsUndef = e.right.kind === "var" && e.right.name === "undefined";
                 return {
                     kind: "if",
-                    // strings carry the `length` marker, arrays `size` — both render to `|x|`
-                    // in Dafny, but Lean's String has no `.size` field (it's `.length`).
+                    // strings carry the `length` marker — it renders to `|x|` in Dafny and
+                    // `.length` in Lean (whose String has no `.size` field).
                     cond: { kind: "binop", op: ">", left: { kind: "field", obj: left, field: e.left.ty.kind === "string" ? "length" : "size" }, right: { kind: "num", value: 0 } },
                     then: rightIsUndef ? { kind: "app", fn: "Some", args: [left] } : left,
                     else: right,
@@ -442,20 +552,43 @@ function lowerExpr(e, binds) {
                     else: { kind: "var", name: "undefined" },
                 };
             }
-            // int + string → NatToString(int) + string (string concatenation)
-            if (e.op === "+" && _opts.backend === "dafny") {
-                const isIntL = e.left.ty.kind === "int" || e.left.ty.kind === "nat";
-                const isIntR = e.right.ty.kind === "int" || e.right.ty.kind === "nat";
-                if (isIntL && e.right.ty.kind === "string") {
-                    return { kind: "binop", op: "+",
-                        left: { kind: "app", fn: "NatToString", args: [lowerExpr(e.left, binds)] },
-                        right: lowerExpr(e.right, binds) };
-                }
-                if (e.left.ty.kind === "string" && isIntR) {
-                    return { kind: "binop", op: "+",
-                        left: lowerExpr(e.left, binds),
-                        right: { kind: "app", fn: "NatToString", args: [lowerExpr(e.right, binds)] } };
-                }
+            // String concatenation: `+` with a string operand. Stringify int/nat
+            // operands (Dafny NatToString, Lean toString) and join with arrayConcat
+            // (rendered `+` in Dafny, `++` in Lean).
+            if (e.op === "+" && (e.left.ty.kind === "string" || e.right.ty.kind === "string")) {
+                const strify = (o) => {
+                    if (o.ty.kind !== "int" && o.ty.kind !== "nat")
+                        return lowerExpr(o, binds);
+                    // Lean `toString` handles any Int; Dafny needs IntToString for signed
+                    // ints (NatToString is nat-only).
+                    const fn = _opts.backend !== "dafny" ? "ToString" : o.ty.kind === "nat" ? "NatToString" : "IntToString";
+                    return { kind: "app", fn, args: [lowerExpr(o, binds)] };
+                };
+                return { kind: "binop", op: "arrayConcat", left: strify(e.left), right: strify(e.right) };
+            }
+            // JS `%` is truncated (sign of the dividend); a signed `int` differs from the
+            // Euclidean `%` of Dafny/Lean, so route it through JSRem (Lean: `Int.tmod`).
+            if (e.op === "%" && e.left.ty.kind === "int") {
+                return { kind: "app", fn: "JSRem", args: [lowerExpr(e.left, binds), lowerExpr(e.right, binds)] };
+            }
+            // JS bigint `/` truncates toward zero (`-3n / 2n === -1n`); it differs from the
+            // floored `/` of Dafny/Lean, so route it through JSTruncDiv (Lean: `Int.tdiv`).
+            if (e.op === "/" && e.ty.kind === "int") {
+                return { kind: "app", fn: "JSTruncDiv", args: [lowerExpr(e.left, binds), lowerExpr(e.right, binds)] };
+            }
+            // JS string ordering is lexicographic vs Dafny's seq prefix order, so route
+            // through JSStringLt. Dafny-only: Lean's native `<` is already lexicographic.
+            if (_opts.backend === "dafny" && ["<", "<=", ">", ">="].includes(e.op) && e.left.ty.kind === "string") {
+                const l = lowerExpr(e.left, binds), r = lowerExpr(e.right, binds);
+                const lt = (x, y) => ({ kind: "app", fn: "JSStringLt", args: [x, y] });
+                const not = (x) => ({ kind: "unop", op: "¬", expr: x });
+                if (e.op === "<")
+                    return lt(l, r);
+                if (e.op === ">")
+                    return lt(r, l);
+                if (e.op === "<=")
+                    return not(lt(r, l));
+                return not(lt(l, r)); // >=
             }
             // Numeric int→real coercion. After resolve, `/` is always real, and any
             // arithmetic/comparison mixing real and integral operands is real-valued.
@@ -571,14 +704,21 @@ function lowerExpr(e, binds) {
                 let method = e.fn.field;
                 const args = e.args.map((a, i) => {
                     const lowered = lowerExpr(a, binds);
-                    // arr.with index (first arg) needs .toNat when Int-typed
-                    if (e.fn.kind === "field" && e.fn.field === "with" && e.fn.obj.ty.kind === "array" && i === 0 && !isNat(a.ty))
+                    // Array index args must be nat in Lean: `with`'s index (0), includes/indexOf `from` (1).
+                    const isArrIdxArg = e.fn.kind === "field" && e.fn.obj.ty.kind === "array" &&
+                        ((e.fn.field === "with" && i === 0) || ((e.fn.field === "includes" || e.fn.field === "indexOf") && i === 1));
+                    if (isArrIdxArg && !isNat(a.ty))
                         return { kind: "toNat", expr: lowered };
                     return lowered;
                 });
-                // arr.concat(otherArr): array argument → real concatenation, not push
-                if (method === "concat" && e.fn.obj.ty.kind === "array" && e.args.length === 1 && e.args[0].ty.kind === "array") {
-                    return { kind: "binop", op: "arrayConcat", left: recv, right: args[0] };
+                // arr.concat(...args): each array arg is spread, each value arg appended.
+                if (method === "concat" && e.fn.obj.ty.kind === "array") {
+                    let acc = recv;
+                    for (let k = 0; k < args.length; k++) {
+                        const piece = e.args[k].ty.kind === "array" ? args[k] : { kind: "arrayLiteral", elems: [args[k]] };
+                        acc = { kind: "binop", op: "arrayConcat", left: acc, right: piece };
+                    }
+                    return acc;
                 }
                 // Spec-context map get: result type is non-optional → direct access
                 if (method === "get" && e.fn.obj.ty.kind === "map" && e.ty.kind !== "optional") {
@@ -1212,18 +1352,24 @@ function transformStmt(s, typeDecls) {
         case "break": return [{ kind: "break" }];
         case "continue": return [{ kind: "continue" }];
         case "expr": {
-            // Mutating collection call: m.set(k, v) → m := m.set(k, v)
-            // Same for s.add(x) on sets, arr.push(x)
-            if (s.expr.kind === "call" && s.expr.fn.kind === "field" &&
-                s.expr.fn.obj.kind === "var" &&
-                ((s.expr.fn.obj.ty.kind === "map" || s.expr.fn.obj.ty.kind === "set") &&
-                    (s.expr.fn.field === "set" || s.expr.fn.field === "add" || s.expr.fn.field === "delete")) ||
-                (s.expr.kind === "call" && s.expr.fn.kind === "field" &&
-                    s.expr.fn.obj.kind === "var" && s.expr.fn.obj.ty.kind === "array" &&
-                    s.expr.fn.field === "push")) {
-                const receiver = s.expr.fn.obj.name;
-                const { binds, expr } = liftMethodCalls(s.expr);
-                return [...binds, { kind: "assign", target: receiver, value: expr }];
+            // Mutating collection call: m.set(k, v) → m := m.set(k, v) (same for set
+            // .add/.delete and array .push). The receiver may be a bare var, or a
+            // field path rooted at a var (b.items.push(v) → b := b.(items := b.items + [v])).
+            if (s.expr.kind === "call" && s.expr.fn.kind === "field") {
+                const recv = s.expr.fn.obj;
+                const f = s.expr.fn.field;
+                const isMutating = ((recv.ty.kind === "map" || recv.ty.kind === "set") && (f === "set" || f === "add" || f === "delete")) ||
+                    (recv.ty.kind === "array" && f === "push");
+                if (isMutating && recv.kind === "var") {
+                    const { binds, expr } = liftMethodCalls(s.expr);
+                    return [...binds, { kind: "assign", target: recv.name, value: expr }];
+                }
+                if (isMutating && recv.kind === "field") {
+                    const { binds, expr } = liftMethodCalls(s.expr);
+                    const upd = buildNestedFieldUpdate(recv, expr);
+                    if (upd)
+                        return [...binds, { kind: "assign", target: upd.root, value: upd.value }];
+                }
             }
             // Optional chaining on map.get at statement level: m.get(k)?.push(v)
             // → if k in m { m[k] := m[k] + [v] } (actual mutation, not value-discard).
@@ -1826,7 +1972,7 @@ export function transformModule(mod, specImport) {
         else if (fn.forcePure) {
             // //@ pure but body can't be auto-converted — emit function by method
             _forofCounters.clear();
-            const methodBody = transformStmts(fn.body, mod.typeDecls);
+            const methodBody = promoteAssignedLets(transformStmts(fn.body, mod.typeDecls));
             defByMethods.push({
                 kind: "def-by-method",
                 name: fn.name,
@@ -1888,7 +2034,7 @@ export function transformModule(mod, specImport) {
         _forofCounters.clear();
         let body = pureDefNames.has(fn.name)
             ? [{ kind: "return", value: { kind: "app", fn: `Pure.${fn.name}`, args: fn.params.map(p => ({ kind: "var", name: p.name })) } }]
-            : transformStmts(fn.body, mod.typeDecls);
+            : promoteAssignedLets(transformStmts(fn.body, mod.typeDecls));
         // Shadow reassigned parameters with mutable locals
         const paramNames = new Set(fn.params.map(p => p.name));
         const reassigned = findReassignedNames(fn.body, paramNames);
@@ -1915,7 +2061,7 @@ export function transformModule(mod, specImport) {
         const classMethods = cls.methods.map(fn => {
             const ensures = fn.ensures.map(transformExpr);
             _forofCounters.clear();
-            const body = transformStmts(fn.body, mod.typeDecls);
+            const body = promoteAssignedLets(transformStmts(fn.body, mod.typeDecls));
             return {
                 kind: "method",
                 name: fn.name,

package/tools/dist/emit.js

@@ -1,253 +0,0 @@
-/**
- * Lean IR → text. Trivial pretty-printer.
- * No logic, no type decisions — just serialization.
- */
-// ── Lean keyword escaping ────────────────────────────────────
-const LEAN_KEYWORDS = new Set([
-    "def", "theorem", "lemma", "example", "structure", "class", "instance",
-    "inductive", "where", "match", "with", "if", "then", "else", "do",
-    "let", "mut", "return", "for", "in", "while", "break", "continue",
-    "import", "open", "section", "namespace", "end", "set_option",
-    "variable", "axiom", "constant", "private", "protected", "noncomputable",
-    "partial", "unsafe", "macro", "syntax", "by", "fun", "have", "show",
-    "at", "from", "to", "deriving", "extends", "true", "false",
-]);
-function escapeName(name) {
-    return LEAN_KEYWORDS.has(name) ? `«${name}»` : name;
-}
-// ── Operator precedence (for parenthesization) ──────────────
-const PREC = {
-    "→": 1, "∨": 2, "∧": 3,
-    "=": 4, "≠": 4, "≥": 4, "≤": 4, ">": 4, "<": 4,
-    "+": 5, "-": 5, "*": 6, "/": 6, "%": 6,
-};
-function prec(op) { return PREC[op] ?? 10; }
-// ── Expression emission ─────────────────────────────────────
-function emitExpr(e, parentPrec) {
-    switch (e.kind) {
-        case "var": return escapeName(e.name);
-        case "num": return `${e.value}`;
-        case "bool": return e.value ? "true" : "false";
-        case "str": return `"${e.value}"`;
-        case "constructor": return `.${e.name}`;
-        case "arrayLiteral":
-            if (e.elems.length === 0)
-                return `#[]`;
-            return `#[${e.elems.map(el => emitExpr(el)).join(", ")}]`;
-        case "dotCall": {
-            const obj = emitExpr(e.obj);
-            const wrap = e.obj.kind === "binop" || e.obj.kind === "app" || e.obj.kind === "dotCall";
-            const receiver = wrap ? `(${obj})` : obj;
-            const args = e.args.map(a => (a.kind === "binop" || a.kind === "unop" || a.kind === "implies" || a.kind === "app") ? `(${emitExpr(a)})` : emitExpr(a));
-            return args.length > 0 ? `${receiver}.${e.method} ${args.join(" ")}` : `${receiver}.${e.method}`;
-        }
-        case "lambda": {
-            const params = e.params.map(p => p.name).join(" ");
-            // Single return statement → expression lambda
-            if (e.body.length === 1 && e.body[0].kind === "return") {
-                return `(fun ${params} => ${emitExpr(e.body[0].value)})`;
-            }
-            // Multi-statement → do block
-            return `(fun ${params} => do\n${emitStmts(e.body, 2)})`;
-        }
-        case "unop":
-            if (e.op === "¬")
-                return `¬(${emitExpr(e.expr)})`;
-            if (e.op === "-" && e.expr.kind === "num")
-                return `-${e.expr.value}`;
-            return `(-${emitExpr(e.expr)})`;
-        case "binop": {
-            const s = `${emitExpr(e.left, prec(e.op))} ${e.op} ${emitExpr(e.right, prec(e.op))}`;
-            return (parentPrec !== undefined && prec(e.op) < parentPrec) ? `(${s})` : s;
-        }
-        case "implies": {
-            const parts = [...e.premises.map(p => emitExpr(p)), emitExpr(e.conclusion)];
-            const s = parts.join(" → ");
-            return parentPrec !== undefined ? `(${s})` : s;
-        }
-        case "app": {
-            const args = e.args.map(a => (a.kind === "binop" || a.kind === "unop" || a.kind === "implies" || a.kind === "app") ? `(${emitExpr(a)})` : emitExpr(a));
-            return `${e.fn} ${args.join(" ")}`;
-        }
-        case "field": {
-            const obj = emitExpr(e.obj);
-            const wrap = e.obj.kind !== "var" && e.obj.kind !== "num" && e.obj.kind !== "bool";
-            return wrap ? `(${obj}).${escapeName(e.field)}` : `${obj}.${escapeName(e.field)}`;
-        }
-        case "toNat": {
-            const inner = emitExpr(e.expr);
-            const wrap = e.expr.kind !== "var" && e.expr.kind !== "num";
-            return wrap ? `(${inner}).toNat` : `${inner}.toNat`;
-        }
-        case "index":
-            return `${emitExpr(e.arr)}[${emitExpr(e.idx)}]!`;
-        case "record": {
-            const fields = e.fields.map(f => `${escapeName(f.name)} := ${emitExpr(f.value)}`);
-            if (e.spread)
-                return `{ ${emitExpr(e.spread)} with ${fields.join(", ")} }`;
-            return `{ ${fields.join(", ")} }`;
-        }
-        case "if":
-            return `if ${emitExpr(e.cond)} then ${emitExpr(e.then)} else ${emitExpr(e.else)}`;
-        case "match": {
-            const arms = e.arms.map(a => `| ${a.pattern} => ${emitExpr(a.body)}`);
-            return `match ${e.scrutinee} with ${arms.join(" ")}`;
-        }
-        case "forall": return `∀ ${e.var} : ${e.type}, ${emitExpr(e.body)}`;
-        case "exists": return `∃ ${e.var} : ${e.type}, ${emitExpr(e.body)}`;
-        case "let": return `let ${e.name} := ${emitExpr(e.value)}\n${emitExpr(e.body)}`;
-    }
-}
-// ── Statement emission ──────────────────────────────────────
-function emitStmts(stmts, indent) {
-    const pad = "  ".repeat(indent);
-    return stmts.map(s => emitStmt(s, indent)).join("\n");
-}
-function emitStmt(s, indent) {
-    const pad = "  ".repeat(indent);
-    switch (s.kind) {
-        case "let":
-            return s.mutable
-                ? `${pad}let mut ${escapeName(s.name)} : ${s.type} := ${emitExpr(s.value)}`
-                : `${pad}let ${escapeName(s.name)} := ${emitExpr(s.value)}`;
-        case "assign": return `${pad}${escapeName(s.target)} := ${emitExpr(s.value)}`;
-        case "bind": return `${pad}${escapeName(s.target)} ← ${emitExpr(s.value)}`;
-        case "let-bind": return `${pad}let ${s.name} ← ${emitExpr(s.value)}`;
-        case "return": return `${pad}return ${emitExpr(s.value)}`;
-        case "break": return `${pad}break`;
-        case "continue": return `${pad}continue`;
-        case "if": {
-            let out = `${pad}if ${emitExpr(s.cond)} then\n${emitStmts(s.then, indent + 1)}`;
-            if (s.else.length > 0) {
-                if (s.else.length === 1 && s.else[0].kind === "if") {
-                    const ei = s.else[0];
-                    out += `\n${pad}else if ${emitExpr(ei.cond)} then\n${emitStmts(ei.then, indent + 1)}`;
-                    if (ei.else.length > 0)
-                        out += `\n${pad}else\n${emitStmts(ei.else, indent + 1)}`;
-                }
-                else {
-                    out += `\n${pad}else\n${emitStmts(s.else, indent + 1)}`;
-                }
-            }
-            return out;
-        }
-        case "match": {
-            const lines = [`${pad}match ${s.scrutinee} with`];
-            for (const arm of s.arms) {
-                lines.push(`${pad}| ${arm.pattern} =>`);
-                lines.push(emitStmts(arm.body, indent + 1));
-            }
-            return lines.join("\n");
-        }
-        case "while": {
-            const lines = [`${pad}while ${emitExpr(s.cond)}`];
-            for (const inv of s.invariants)
-                lines.push(`${pad}  invariant ${emitExpr(inv)}`);
-            if (s.doneWith)
-                lines.push(`${pad}  done_with ${emitExpr(s.doneWith)}`);
-            if (s.decreasing)
-                lines.push(`${pad}  decreasing ${emitExpr(s.decreasing)}`);
-            lines.push(`${pad}do`);
-            lines.push(emitStmts(s.body, indent + 1));
-            return lines.join("\n");
-        }
-        case "forin": {
-            const lines = [`${pad}for ${s.idx} in [:${emitExpr(s.bound)}]`];
-            for (const inv of s.invariants)
-                lines.push(`${pad}  invariant ${emitExpr(inv)}`);
-            lines.push(`${pad}do`);
-            lines.push(emitStmts(s.body, indent + 1));
-            return lines.join("\n");
-        }
-    }
-}
-// ── Declaration emission ─────────────────────────────────────
-function emitDecl(d) {
-    switch (d.kind) {
-        case "inductive": {
-            const lines = [`inductive ${d.name} where`];
-            for (const c of d.constructors) {
-                if (c.fields.length === 0) {
-                    lines.push(`  | ${c.name} : ${d.name}`);
-                }
-                else {
-                    const params = c.fields.map(f => `(${escapeName(f.name)} : ${f.type})`).join(" ");
-                    lines.push(`  | ${c.name} ${params} : ${d.name}`);
-                }
-            }
-            if (d.deriving.length > 0)
-                lines.push(`deriving ${d.deriving.join(", ")}`);
-            return lines.join("\n");
-        }
-        case "structure": {
-            const lines = [`structure ${d.name} where`];
-            for (const f of d.fields)
-                lines.push(`  ${escapeName(f.name)} : ${f.type}`);
-            if (d.deriving.length > 0)
-                lines.push(`deriving ${d.deriving.join(", ")}`);
-            return lines.join("\n");
-        }
-        case "def": {
-            const params = d.params.map(p => `(${escapeName(p.name)} : ${p.type})`).join(" ");
-            return `def ${d.name} ${params} : ${d.returnType} :=\n${emitPureExpr(d.body, 1)}`;
-        }
-        case "method": {
-            const params = d.params.map(p => `(${escapeName(p.name)} : ${p.type})`).join(" ");
-            const lines = [`method ${d.name} ${params} return (res : ${d.returnType})`];
-            for (const r of d.requires)
-                lines.push(`  require ${emitExpr(r)}`);
-            for (const e of d.ensures)
-                lines.push(`  ensures ${emitExpr(e)}`);
-            lines.push("  do");
-            lines.push(emitStmts(d.body, 2));
-            return lines.join("\n");
-        }
-        case "namespace": {
-            const lines = [`namespace ${d.name}`];
-            for (const inner of d.decls)
-                lines.push("", emitDecl(inner));
-            lines.push("", `end ${d.name}`);
-            return lines.join("\n");
-        }
-    }
-}
-/** Emit a pure expression with indented if/match blocks. */
-function emitPureExpr(e, indent) {
-    const pad = "  ".repeat(indent);
-    switch (e.kind) {
-        case "if":
-            return `${pad}if ${emitExpr(e.cond)} then\n${emitPureExpr(e.then, indent + 1)}\n${pad}else\n${emitPureExpr(e.else, indent + 1)}`;
-        case "match": {
-            const lines = [`${pad}match ${e.scrutinee} with`];
-            for (const arm of e.arms) {
-                lines.push(`${pad}| ${arm.pattern} =>`);
-                lines.push(emitPureExpr(arm.body, indent + 1));
-            }
-            return lines.join("\n");
-        }
-        case "let":
-            return `${pad}let ${e.name} := ${emitExpr(e.value)}\n${emitPureExpr(e.body, indent)}`;
-        default:
-            return `${pad}${emitExpr(e)}`;
-    }
-}
-// ── File emission ────────────────────────────────────────────
-export function emitFile(file) {
-    const lines = [];
-    if (file.comment) {
-        lines.push("/-");
-        lines.push(file.comment);
-        lines.push("-/");
-    }
-    for (const imp of file.imports)
-        lines.push(`import ${imp}`);
-    if (file.options.length > 0)
-        lines.push("");
-    for (const opt of file.options)
-        lines.push(`set_option ${opt.key} ${opt.value}`);
-    for (const decl of file.decls) {
-        lines.push("");
-        lines.push(emitDecl(decl));
-    }
-    return lines.join("\n") + "\n";
-}