lemmascript 0.5.7 → 0.5.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lemmascript",
-  "version": "0.5.7",
+  "version": "0.5.8",
   "description": "A verification toolchain for TypeScript — generates Lean 4 or Dafny from annotated TS",
   "type": "module",
   "engines": {

package/tools/dist/dafny-emit.js

@@ -19,7 +19,11 @@ function tyToDafny(ty) {
         }
         case "user": return ty.name;
         case "fn": return `(${ty.params.map(tyToDafny).join(", ")}) -> ${tyToDafny(ty.result)}`;
-        case "unknown": return "int";
+        // Out-of-subset (`any`/`unknown`); opaque so real ops on it fail loudly
+        // rather than silently verify as `int`. Mirrors the Lean backend's `_`.
+        case "unknown":
+            needPreamble("UnknownType");
+            return "Unknown";
     }
 }
 // ── Dafny keyword escaping ──────────────────────────────────
@@ -159,8 +163,14 @@ function emitExpr(e) {
                 }
                 if (e.method === "push")
                     return `(${obj} + [${args.join(", ")}])`;
+                if (e.method === "unshift")
+                    return `([${args.join(", ")}] + ${obj})`;
                 if (e.method === "concat")
                     return `(${obj} + [${args.join(", ")}])`;
+                if (e.method === "sort") {
+                    needPreamble("SeqSortBy");
+                    return `SeqSortBy(${obj}, ${args[0]})`;
+                }
                 // No-arg slice is a full copy; Dafny seq is an immutable value type, so
                 // the copy is just the seq itself (the idiom for "copy then mutate").
                 if (e.method === "slice" && args.length === 0)
@@ -671,7 +681,8 @@ function emitDecl(d) {
             return `datatype ${d.name}${tp} = ${ctors.join(" | ")}`;
         }
         case "structure": {
-            return `datatype ${d.name} = ${d.name}(${paramList(d.fields)})`;
+            const tp = d.typeParams?.length ? `<${d.typeParams.join(", ")}>` : "";
+            return `datatype ${d.name}${tp} = ${d.name}(${paramList(d.fields)})`;
         }
         case "type-alias": {
             return `type ${d.name} = ${tyToDafny(d.target)}`;
@@ -964,6 +975,17 @@ const STRING_SPLIT = `function {:axiom} StringSplit(s: string, d: string): seq<s
   ensures |StringSplit(s, d)| >= 1
   ensures |StringSplit(s, d)| <= |s| + 1
   ensures forall k :: 0 <= k < |StringSplit(s, d)| ==> |StringSplit(s, d)[k]| <= |s|`;
+// `xs.sort(cmp)` in TS sorts in place by a comparator (negative ⟺ a before b).
+// Modeled here as an axiom returning a permutation sorted by cmp. The `requires`
+// is the soundness condition — cmp must be a total preorder, otherwise no sorted
+// permutation exists and the axiom would be vacuous. Callers discharge it (e.g.
+// `(a,b) => a.k - b.k` is total + transitive by linear arithmetic).
+const SEQ_SORT_BY = `function {:axiom} SeqSortBy<T(==,!new)>(s: seq<T>, cmp: (T, T) -> int): seq<T>
+  requires forall a: T, b: T :: cmp(a, b) <= 0 || cmp(b, a) <= 0
+  requires forall a: T, b: T, c: T :: cmp(a, b) <= 0 && cmp(b, c) <= 0 ==> cmp(a, c) <= 0
+  ensures multiset(SeqSortBy(s, cmp)) == multiset(s)
+  ensures |SeqSortBy(s, cmp)| == |s|
+  ensures forall i: int, j: int :: 0 <= i <= j < |SeqSortBy(s, cmp)| ==> cmp(SeqSortBy(s, cmp)[i], SeqSortBy(s, cmp)[j]) <= 0`;
 const STRING_TRIM = `function StringTrimLeft(s: string): string
   ensures |StringTrimLeft(s)| <= |s|
   ensures StringTrimLeft(s) == "" || (|StringTrimLeft(s)| > 0 && StringTrimLeft(s)[0] != ' ')
@@ -1095,6 +1117,9 @@ const SET_TO_SEQ = `method SetToSeq<T>(s: set<T>) returns (res: seq<T>)
 /** Preamble code keyed by name. Emitted in this order when needed. */
 const PREAMBLE_CODE = [
     ["OptionType", "datatype Option<T> = None | Some(value: T)"],
+    // Opaque carrier for `unknown`-typed values. `(==)` for compare/map-key/match;
+    // `(0)` (auto-init ⇒ nonempty) so `havoc` (`:= *`) is well-formed.
+    ["UnknownType", "type Unknown(==, 0)"],
     ["SetToSeq", SET_TO_SEQ],
     ["Pow2", POW2],
     ["BitAnd", BIT_AND],
@@ -1114,6 +1139,7 @@ const PREAMBLE_CODE = [
     ["SafeSlice", SAFE_SLICE],
     ["StringIndexOf", STRING_INDEX_OF],
     ["StringSplit", STRING_SPLIT],
+    ["SeqSortBy", SEQ_SORT_BY],
     ["StringTrim", STRING_TRIM],
     ["StringToLower", STRING_TO_LOWER],
     ["StringToUpper", STRING_TO_UPPER],
@@ -1202,6 +1228,23 @@ export function emitDafnyFile(file, tsFileName, opts) {
     // Track successfully emitted pure defs — method wrappers are only
     // skipped when the corresponding pure def was actually emitted.
     const emittedPureDefs = new Set();
+    // Emit a decl, rolling back any preamble requirements it registered if it
+    // throws. A skipped decl must contribute neither text nor preambles — else a
+    // side-effecting `needPreamble` from a half-emitted decl leaves an unused
+    // preamble (e.g. `type Unknown` from a skipped const whose head is
+    // `unknown`-typed but whose value expr is unsupported).
+    const emitDeclTx = (d) => {
+        const saved = new Set(_neededPreambles);
+        try {
+            return emitDecl(d);
+        }
+        catch (e) {
+            _neededPreambles.clear();
+            for (const k of saved)
+                _neededPreambles.add(k);
+            throw e;
+        }
+    };
     // Emit declarations
     const declLines = [];
     const skipped = [];
@@ -1214,7 +1257,7 @@ export function emitDafnyFile(file, tsFileName, opts) {
             for (const inner of decl.decls) {
                 try {
                     declLines.push("");
-                    declLines.push(emitDecl(inner));
+                    declLines.push(emitDeclTx(inner));
                     if (inner.kind === "def")
                         emittedPureDefs.add(inner.name);
                 }
@@ -1230,7 +1273,7 @@ export function emitDafnyFile(file, tsFileName, opts) {
         }
         try {
             declLines.push("");
-            declLines.push(emitDecl(decl));
+            declLines.push(emitDeclTx(decl));
             if (decl.kind === "def-by-method")
                 emittedPureDefs.add(decl.name);
         }

package/tools/dist/emit.js

@@ -0,0 +1,253 @@
+/**
+ * Lean IR → text. Trivial pretty-printer.
+ * No logic, no type decisions — just serialization.
+ */
+// ── Lean keyword escaping ────────────────────────────────────
+const LEAN_KEYWORDS = new Set([
+    "def", "theorem", "lemma", "example", "structure", "class", "instance",
+    "inductive", "where", "match", "with", "if", "then", "else", "do",
+    "let", "mut", "return", "for", "in", "while", "break", "continue",
+    "import", "open", "section", "namespace", "end", "set_option",
+    "variable", "axiom", "constant", "private", "protected", "noncomputable",
+    "partial", "unsafe", "macro", "syntax", "by", "fun", "have", "show",
+    "at", "from", "to", "deriving", "extends", "true", "false",
+]);
+function escapeName(name) {
+    return LEAN_KEYWORDS.has(name) ? `«${name}»` : name;
+}
+// ── Operator precedence (for parenthesization) ──────────────
+const PREC = {
+    "→": 1, "∨": 2, "∧": 3,
+    "=": 4, "≠": 4, "≥": 4, "≤": 4, ">": 4, "<": 4,
+    "+": 5, "-": 5, "*": 6, "/": 6, "%": 6,
+};
+function prec(op) { return PREC[op] ?? 10; }
+// ── Expression emission ─────────────────────────────────────
+function emitExpr(e, parentPrec) {
+    switch (e.kind) {
+        case "var": return escapeName(e.name);
+        case "num": return `${e.value}`;
+        case "bool": return e.value ? "true" : "false";
+        case "str": return `"${e.value}"`;
+        case "constructor": return `.${e.name}`;
+        case "arrayLiteral":
+            if (e.elems.length === 0)
+                return `#[]`;
+            return `#[${e.elems.map(el => emitExpr(el)).join(", ")}]`;
+        case "dotCall": {
+            const obj = emitExpr(e.obj);
+            const wrap = e.obj.kind === "binop" || e.obj.kind === "app" || e.obj.kind === "dotCall";
+            const receiver = wrap ? `(${obj})` : obj;
+            const args = e.args.map(a => (a.kind === "binop" || a.kind === "unop" || a.kind === "implies" || a.kind === "app") ? `(${emitExpr(a)})` : emitExpr(a));
+            return args.length > 0 ? `${receiver}.${e.method} ${args.join(" ")}` : `${receiver}.${e.method}`;
+        }
+        case "lambda": {
+            const params = e.params.map(p => p.name).join(" ");
+            // Single return statement → expression lambda
+            if (e.body.length === 1 && e.body[0].kind === "return") {
+                return `(fun ${params} => ${emitExpr(e.body[0].value)})`;
+            }
+            // Multi-statement → do block
+            return `(fun ${params} => do\n${emitStmts(e.body, 2)})`;
+        }
+        case "unop":
+            if (e.op === "¬")
+                return `¬(${emitExpr(e.expr)})`;
+            if (e.op === "-" && e.expr.kind === "num")
+                return `-${e.expr.value}`;
+            return `(-${emitExpr(e.expr)})`;
+        case "binop": {
+            const s = `${emitExpr(e.left, prec(e.op))} ${e.op} ${emitExpr(e.right, prec(e.op))}`;
+            return (parentPrec !== undefined && prec(e.op) < parentPrec) ? `(${s})` : s;
+        }
+        case "implies": {
+            const parts = [...e.premises.map(p => emitExpr(p)), emitExpr(e.conclusion)];
+            const s = parts.join(" → ");
+            return parentPrec !== undefined ? `(${s})` : s;
+        }
+        case "app": {
+            const args = e.args.map(a => (a.kind === "binop" || a.kind === "unop" || a.kind === "implies" || a.kind === "app") ? `(${emitExpr(a)})` : emitExpr(a));
+            return `${e.fn} ${args.join(" ")}`;
+        }
+        case "field": {
+            const obj = emitExpr(e.obj);
+            const wrap = e.obj.kind !== "var" && e.obj.kind !== "num" && e.obj.kind !== "bool";
+            return wrap ? `(${obj}).${escapeName(e.field)}` : `${obj}.${escapeName(e.field)}`;
+        }
+        case "toNat": {
+            const inner = emitExpr(e.expr);
+            const wrap = e.expr.kind !== "var" && e.expr.kind !== "num";
+            return wrap ? `(${inner}).toNat` : `${inner}.toNat`;
+        }
+        case "index":
+            return `${emitExpr(e.arr)}[${emitExpr(e.idx)}]!`;
+        case "record": {
+            const fields = e.fields.map(f => `${escapeName(f.name)} := ${emitExpr(f.value)}`);
+            if (e.spread)
+                return `{ ${emitExpr(e.spread)} with ${fields.join(", ")} }`;
+            return `{ ${fields.join(", ")} }`;
+        }
+        case "if":
+            return `if ${emitExpr(e.cond)} then ${emitExpr(e.then)} else ${emitExpr(e.else)}`;
+        case "match": {
+            const arms = e.arms.map(a => `| ${a.pattern} => ${emitExpr(a.body)}`);
+            return `match ${e.scrutinee} with ${arms.join(" ")}`;
+        }
+        case "forall": return `∀ ${e.var} : ${e.type}, ${emitExpr(e.body)}`;
+        case "exists": return `∃ ${e.var} : ${e.type}, ${emitExpr(e.body)}`;
+        case "let": return `let ${e.name} := ${emitExpr(e.value)}\n${emitExpr(e.body)}`;
+    }
+}
+// ── Statement emission ──────────────────────────────────────
+function emitStmts(stmts, indent) {
+    const pad = "  ".repeat(indent);
+    return stmts.map(s => emitStmt(s, indent)).join("\n");
+}
+function emitStmt(s, indent) {
+    const pad = "  ".repeat(indent);
+    switch (s.kind) {
+        case "let":
+            return s.mutable
+                ? `${pad}let mut ${escapeName(s.name)} : ${s.type} := ${emitExpr(s.value)}`
+                : `${pad}let ${escapeName(s.name)} := ${emitExpr(s.value)}`;
+        case "assign": return `${pad}${escapeName(s.target)} := ${emitExpr(s.value)}`;
+        case "bind": return `${pad}${escapeName(s.target)} ← ${emitExpr(s.value)}`;
+        case "let-bind": return `${pad}let ${s.name} ← ${emitExpr(s.value)}`;
+        case "return": return `${pad}return ${emitExpr(s.value)}`;
+        case "break": return `${pad}break`;
+        case "continue": return `${pad}continue`;
+        case "if": {
+            let out = `${pad}if ${emitExpr(s.cond)} then\n${emitStmts(s.then, indent + 1)}`;
+            if (s.else.length > 0) {
+                if (s.else.length === 1 && s.else[0].kind === "if") {
+                    const ei = s.else[0];
+                    out += `\n${pad}else if ${emitExpr(ei.cond)} then\n${emitStmts(ei.then, indent + 1)}`;
+                    if (ei.else.length > 0)
+                        out += `\n${pad}else\n${emitStmts(ei.else, indent + 1)}`;
+                }
+                else {
+                    out += `\n${pad}else\n${emitStmts(s.else, indent + 1)}`;
+                }
+            }
+            return out;
+        }
+        case "match": {
+            const lines = [`${pad}match ${s.scrutinee} with`];
+            for (const arm of s.arms) {
+                lines.push(`${pad}| ${arm.pattern} =>`);
+                lines.push(emitStmts(arm.body, indent + 1));
+            }
+            return lines.join("\n");
+        }
+        case "while": {
+            const lines = [`${pad}while ${emitExpr(s.cond)}`];
+            for (const inv of s.invariants)
+                lines.push(`${pad}  invariant ${emitExpr(inv)}`);
+            if (s.doneWith)
+                lines.push(`${pad}  done_with ${emitExpr(s.doneWith)}`);
+            if (s.decreasing)
+                lines.push(`${pad}  decreasing ${emitExpr(s.decreasing)}`);
+            lines.push(`${pad}do`);
+            lines.push(emitStmts(s.body, indent + 1));
+            return lines.join("\n");
+        }
+        case "forin": {
+            const lines = [`${pad}for ${s.idx} in [:${emitExpr(s.bound)}]`];
+            for (const inv of s.invariants)
+                lines.push(`${pad}  invariant ${emitExpr(inv)}`);
+            lines.push(`${pad}do`);
+            lines.push(emitStmts(s.body, indent + 1));
+            return lines.join("\n");
+        }
+    }
+}
+// ── Declaration emission ─────────────────────────────────────
+function emitDecl(d) {
+    switch (d.kind) {
+        case "inductive": {
+            const lines = [`inductive ${d.name} where`];
+            for (const c of d.constructors) {
+                if (c.fields.length === 0) {
+                    lines.push(`  | ${c.name} : ${d.name}`);
+                }
+                else {
+                    const params = c.fields.map(f => `(${escapeName(f.name)} : ${f.type})`).join(" ");
+                    lines.push(`  | ${c.name} ${params} : ${d.name}`);
+                }
+            }
+            if (d.deriving.length > 0)
+                lines.push(`deriving ${d.deriving.join(", ")}`);
+            return lines.join("\n");
+        }
+        case "structure": {
+            const lines = [`structure ${d.name} where`];
+            for (const f of d.fields)
+                lines.push(`  ${escapeName(f.name)} : ${f.type}`);
+            if (d.deriving.length > 0)
+                lines.push(`deriving ${d.deriving.join(", ")}`);
+            return lines.join("\n");
+        }
+        case "def": {
+            const params = d.params.map(p => `(${escapeName(p.name)} : ${p.type})`).join(" ");
+            return `def ${d.name} ${params} : ${d.returnType} :=\n${emitPureExpr(d.body, 1)}`;
+        }
+        case "method": {
+            const params = d.params.map(p => `(${escapeName(p.name)} : ${p.type})`).join(" ");
+            const lines = [`method ${d.name} ${params} return (res : ${d.returnType})`];
+            for (const r of d.requires)
+                lines.push(`  require ${emitExpr(r)}`);
+            for (const e of d.ensures)
+                lines.push(`  ensures ${emitExpr(e)}`);
+            lines.push("  do");
+            lines.push(emitStmts(d.body, 2));
+            return lines.join("\n");
+        }
+        case "namespace": {
+            const lines = [`namespace ${d.name}`];
+            for (const inner of d.decls)
+                lines.push("", emitDecl(inner));
+            lines.push("", `end ${d.name}`);
+            return lines.join("\n");
+        }
+    }
+}
+/** Emit a pure expression with indented if/match blocks. */
+function emitPureExpr(e, indent) {
+    const pad = "  ".repeat(indent);
+    switch (e.kind) {
+        case "if":
+            return `${pad}if ${emitExpr(e.cond)} then\n${emitPureExpr(e.then, indent + 1)}\n${pad}else\n${emitPureExpr(e.else, indent + 1)}`;
+        case "match": {
+            const lines = [`${pad}match ${e.scrutinee} with`];
+            for (const arm of e.arms) {
+                lines.push(`${pad}| ${arm.pattern} =>`);
+                lines.push(emitPureExpr(arm.body, indent + 1));
+            }
+            return lines.join("\n");
+        }
+        case "let":
+            return `${pad}let ${e.name} := ${emitExpr(e.value)}\n${emitPureExpr(e.body, indent)}`;
+        default:
+            return `${pad}${emitExpr(e)}`;
+    }
+}
+// ── File emission ────────────────────────────────────────────
+export function emitFile(file) {
+    const lines = [];
+    if (file.comment) {
+        lines.push("/-");
+        lines.push(file.comment);
+        lines.push("-/");
+    }
+    for (const imp of file.imports)
+        lines.push(`import ${imp}`);
+    if (file.options.length > 0)
+        lines.push("");
+    for (const opt of file.options)
+        lines.push(`set_option ${opt.key} ${opt.value}`);
+    for (const decl of file.decls) {
+        lines.push("");
+        lines.push(emitDecl(decl));
+    }
+    return lines.join("\n") + "\n";
+}

package/tools/dist/extract.js

@@ -487,9 +487,9 @@ function extractExpr(node) {
     }
     // Object literal: { res: true, done: false } or { ...obj, res: true }
     if (Node.isObjectLiteralExpression(node)) {
-        // Fold properties in source order: a later spread overrides everything before
-        // it, a named field is a record-update on the accumulator, a computed key is a
-        // map `.set`. Order matters: if `a` has `k`, `{ k: v, ...a }` is `a`, not `a.(k := v)`.
+        // Fold properties in source order: a spread on top of existing content is a
+        // field-wise merge (resolve expands it against the result type), a named field
+        // is a record-update on the accumulator, a computed key is a map `.set`.
         let acc = null;
         const update = (name, value) => {
             acc = acc && acc.kind === "record"
@@ -498,7 +498,8 @@ function extractExpr(node) {
         };
         for (const prop of node.getProperties()) {
             if (Node.isSpreadAssignment(prop)) {
-                acc = extractExpr(prop.getExpression());
+                const s = extractExpr(prop.getExpression());
+                acc = acc === null ? s : { kind: "recordMerge", base: acc, override: s };
             }
             else if (Node.isShorthandPropertyAssignment(prop)) {
                 const name = prop.getName();
@@ -985,6 +986,14 @@ function forCounterRename(decl, forStmt) {
     const scopeRoot = fnLike ?? forStmt.getSourceFile();
     const isScope = (a) => Node.isBlock(a) || Node.isSourceFile(a) ||
         Node.isForStatement(a) || Node.isForOfStatement(a) || Node.isForInStatement(a);
+    // A counting-`for` counter is hoisted out of its `for`, so its real scope is
+    // the nearest enclosing block, not the `for` itself.
+    const hoistScope = (d) => {
+        const owner = d.getParent()?.getParent();
+        return owner && Node.isForStatement(owner) && owner.getInitializer() === d.getParent()
+            ? d.getFirstAncestor(a => Node.isBlock(a) || Node.isSourceFile(a))
+            : undefined;
+    };
     // Scopes that enclose this loop — its counter, once hoisted, lives in one of
     // these, so a same-named binding scoped here would collide.
     const enclosing = new Set(forStmt.getAncestors());
@@ -992,6 +1001,11 @@ function forCounterRename(decl, forStmt) {
     const declClash = scopeRoot.getDescendantsOfKind(SyntaxKind.VariableDeclaration).some(d => {
         if (d === decl || d.getName() !== name)
             return false;
+        // Two sibling for-counters hoisting into the same block: rename only the
+        // later loop, so the first keeps its name. Any other clash (e.g. a `let`) yields.
+        const counterScope = hoistScope(d);
+        if (counterScope)
+            return enclosing.has(counterScope) && d.getStart() < decl.getStart();
         const scope = d.getFirstAncestor(isScope);
         return !!scope && enclosing.has(scope);
     });
@@ -1027,6 +1041,7 @@ function renameRawExpr(e, from, to) {
         case "index": return { ...e, obj: r(e.obj), idx: r(e.idx) };
         case "field": return { ...e, obj: r(e.obj) };
         case "record": return { ...e, spread: e.spread ? r(e.spread) : null, fields: e.fields.map(f => ({ ...f, value: r(f.value) })) };
+        case "recordMerge": return { ...e, base: r(e.base), override: r(e.override) };
         case "arrayLiteral": return { ...e, elems: e.elems.map(r) };
         case "conditional": return { ...e, cond: r(e.cond), then: r(e.then), else: r(e.else) };
         case "nullish": return { ...e, left: r(e.left), right: r(e.right) };
@@ -1567,32 +1582,38 @@ function extractStmts(stmts) {
             //      nested loop stays put.
             const stripExitBreaks = (b) => b.filter(st => st.kind !== "break");
             const isExit = (st) => !!st && ["break", "return", "throw", "continue"].includes(st.kind);
-            let fallthrough = [];
-            for (const clause of s.getClauses()) {
-                if (Node.isCaseClause(clause)) {
-                    const label = clause.getExpression().getText().replace(/^["']|["']$/g, "");
-                    if (clause.getStatements().length === 0) {
-                        fallthrough.push(label);
-                        continue;
-                    }
-                    const raw = extractStmts(clause.getStatements());
-                    if (!isExit(raw[raw.length - 1]))
-                        throw new Error(`switch case "${label}" at line ${line}: a non-empty case must end with break/return/throw; fall-through into the next case is not supported`);
-                    const body = stripExitBreaks(raw);
-                    for (const l of fallthrough)
-                        cases.push({ label: l, body });
-                    cases.push({ label, body });
-                    fallthrough = [];
-                }
-                else {
-                    defaultBody = stripExitBreaks(extractStmts(clause.getStatements()));
-                    for (const l of fallthrough)
-                        cases.push({ label: l, body: defaultBody });
-                    fallthrough = [];
+            // Resolve JS fall-through positionally: a clause's effective body is its
+            // own statements concatenated with each following clause's statements up
+            // to and including the first clause that ends in break/return/throw (or
+            // the switch end). This covers both empty stacked labels (`case A: case
+            // B: body`) and a *non-empty* case that falls through (`case A: sA; case
+            // B: ...`) — the stripped breaks are the switch exits.
+            const clauseInfos = s.getClauses().map(clause => {
+                const stmts = extractStmts(clause.getStatements());
+                return {
+                    label: Node.isCaseClause(clause)
+                        ? clause.getExpression().getText().replace(/^["']|["']$/g, "")
+                        : null,
+                    stmts,
+                    exits: isExit(stmts[stmts.length - 1]),
+                };
+            });
+            const fallThroughBody = (start) => {
+                let body = [];
+                for (let j = start; j < clauseInfos.length; j++) {
+                    body = body.concat(clauseInfos[j].stmts);
+                    if (clauseInfos[j].exits)
+                        break;
                 }
+                return stripExitBreaks(body);
+            };
+            for (let i = 0; i < clauseInfos.length; i++) {
+                const c = clauseInfos[i];
+                if (c.label === null)
+                    defaultBody = fallThroughBody(i);
+                else
+                    cases.push({ label: c.label, body: fallThroughBody(i) });
             }
-            for (const l of fallthrough)
-                cases.push({ label: l, body: [] });
             result.push({ kind: "switch", expr: switchExpr, discriminant, cases, defaultBody, line });
             continue;
         }
@@ -1692,17 +1713,21 @@ function extractFunction(fn, parentAnnotations) {
     }
 }
 function extractFunctionInner(fn, parentAnnotations) {
-    // Generic bounds erasure: <T extends Base> → substitute T with Base everywhere
-    // Unbounded type params are preserved as Dafny type parameters
+    // A `<T extends B>` bound is handled one of two ways. When B is a modelable
+    // type (a record/nominal), substitute T with B — a body that reads T's fields
+    // (e.g. `x.id`) then typechecks against B. When B is a union/intersection we
+    // can't model as one Dafny type (e.g. `string & {}` tricks), keep T as a Dafny
+    // type param instead; such a T must be phantom (any field read won't typecheck).
     _typeParamMap = new Map();
     _reservedForCounterNames = new Set();
-    const unboundedTypeParams = [];
+    const typeParams = [];
     for (const tp of fn.getTypeParameters?.() ?? []) {
         const constraint = tp.getConstraint();
-        if (constraint)
+        const ct = constraint?.getType();
+        if (constraint && !ct?.isUnion() && !ct?.isIntersection())
             _typeParamMap.set(tp.getName(), constraint.getText());
         else
-            unboundedTypeParams.push(tp.getName());
+            typeParams.push(tp.getName());
     }
     const body = fn.getBody();
     // Expression-body arrow: wrap in implicit return
@@ -1731,7 +1756,7 @@ function extractFunctionInner(fn, parentAnnotations) {
     return {
         name: fn.getName?.() ?? "<anonymous>",
         exported: false, // set in extractModule against the source file's export surface
-        typeParams: unboundedTypeParams,
+        typeParams,
         // Original TS parameter grouping, before the flatten below loses it. `defaults` carries
         // each bound name's default initializer text (omitted when none) for TS-targeting consumers.
         tsParams: fn.getParameters().map(p => {
@@ -1759,10 +1784,20 @@ function extractFunctionInner(fn, parentAnnotations) {
             const nameNode = p.getNameNode();
             if (Node.isObjectBindingPattern(nameNode)) {
                 const type = p.getType();
+                // `//@ declare-type` types are invisible to the TS checker, so
+                // `type.getProperty` finds nothing for them and the bindings would
+                // collapse to `unknown`. Fall back to the declared record's field types.
+                const declTypeName = p.getTypeNode()?.getText();
+                const declFields = declTypeName
+                    ? _synthArrayUnions?.find(d => d.name === declTypeName && d.kind === "record")?.fields
+                    : undefined;
                 return nameNode.getElements().map(el => {
                     const name = el.getName();
                     const propType = type.getProperty(name)?.getTypeAtLocation(p);
-                    return { name, tsType: propType ? typeToString(propType) : "unknown" };
+                    if (propType)
+                        return { name, tsType: typeToString(propType) };
+                    const declTy = declFields?.find(f => f.name === name)?.tsType;
+                    return { name, tsType: declTy ?? "unknown" };
                 });
             }
             // Syntactic union nodes go through _tsTypeFromUnionNode so synth fires
@@ -1843,15 +1878,17 @@ export function extractModule(sourceFile) {
     // `//@ declare-type Name { f1: T1, ... }` — record form.
     // `//@ declare-type Name = TsType`         — alias form (e.g. `Ruleset = Rule[]`).
     function parseDeclareType(body) {
-        const recordMatch = body.match(/^(\w+)\s*\{(.+)\}$/);
+        const recordMatch = body.match(/^(\w+)\s*(?:<([^>]+)>)?\s*\{(.+)\}$/);
         if (recordMatch) {
             const name = recordMatch[1];
-            const fields = recordMatch[2].split(",").map(f => f.trim()).filter(Boolean).map(f => {
+            // `<T extends B>` → bare `T`: a Dafny type param, like the def path.
+            const typeParams = recordMatch[2]?.split(",").map(s => s.trim().split(/\s+extends\s+/)[0].trim()).filter(Boolean);
+            const fields = recordMatch[3].split(",").map(f => f.trim()).filter(Boolean).map(f => {
                 const [fname, ftype] = f.split(":").map(s => s.trim());
                 const synth = _synthFromTsTypeString(ftype);
                 return { name: fname, tsType: synth ?? ftype };
             });
-            typeDecls.push({ name, kind: "record", fields });
+            typeDecls.push({ name, kind: "record", fields, ...(typeParams?.length ? { typeParams } : {}) });
             return;
         }
         const aliasMatch = body.match(/^(\w+)\s*=\s*(.+)$/);
@@ -2052,7 +2089,8 @@ export function extractModule(sourceFile) {
         const sig = f.node.getType().getCallSignatures()[0];
         if (!sig)
             continue;
-        const typeParams = sig.getTypeParameters().map(tp => tp.getText());
+        // Bare names, dropping `extends B` — same as the def path.
+        const typeParams = sig.getTypeParameters().map(tp => tp.getText().split(/\s+extends\s+/)[0].trim());
         // Normalize via typeToString (not raw getText): resolves declare-type
         // shadows and yields bare names, so a param typed by an unreachable import
         // becomes `AgentMessage`, not `import("/abs/path").AgentMessage`.
@@ -2297,6 +2335,10 @@ export function extractModule(sourceFile) {
                     collectNamesExpr(e.spread);
                 e.fields.forEach(f => collectNamesExpr(f.value));
             }
+            if (e.kind === "recordMerge") {
+                collectNamesExpr(e.base);
+                collectNamesExpr(e.override);
+            }
             if (e.kind === "arrayLiteral") {
                 e.elems.forEach(collectNamesExpr);
             }
@@ -2305,6 +2347,31 @@ export function extractModule(sourceFile) {
                 collectNamesExpr(e.then);
                 collectNamesExpr(e.else);
             }
+            if (e.kind === "nullish") {
+                collectNamesExpr(e.left);
+                collectNamesExpr(e.right);
+            }
+            if (e.kind === "nonNull") {
+                collectNamesExpr(e.expr);
+            }
+            if (e.kind === "optChain") {
+                collectNamesExpr(e.obj);
+                for (const c of e.chain) {
+                    if (c.kind === "call")
+                        c.args.forEach(collectNamesExpr);
+                    if (c.kind === "index")
+                        collectNamesExpr(c.idx);
+                }
+            }
+            if (e.kind === "lambda") {
+                if (Array.isArray(e.body))
+                    collectNames(e.body);
+                else
+                    collectNamesExpr(e.body);
+            }
+            if (e.kind === "forall" || e.kind === "exists") {
+                collectNamesExpr(e.body);
+            }
         }
         // Signature types (params + return) get base-name stripping below; body /
         // spec references stay exact-match (so a body `let xs: Hunk[]` doesn't pull

package/tools/dist/narrow.js

@@ -100,7 +100,7 @@ const parseSimpleOptionalCheck = parseOptionalCheck;
 // ── Walkers ──────────────────────────────────────────────────
 function walkExpr(e) {
     const r = recurseExpr(e);
-    return ruleNullish(r) ?? ruleOptChain(r) ?? ruleImplOptional(r) ?? ruleImplArrayIsArray(r) ?? ruleConditionalArrayIsArray(r) ?? ruleConditionalAndArrayIsArray(r) ?? ruleConditionalAndOptional(r) ?? ruleConditionalOptionalSimple(r) ?? ruleConditionalInMap(r) ?? ruleConditionalOptionalTruthy(r) ?? r;
+    return ruleNullish(r) ?? ruleNullishIndex(r) ?? ruleOptChainIndex(r) ?? ruleOptChain(r) ?? ruleImplOptional(r) ?? ruleImplArrayIsArray(r) ?? ruleConditionalArrayIsArray(r) ?? ruleConditionalAndArrayIsArray(r) ?? ruleConditionalAndOptional(r) ?? ruleConditionalOptionalSimple(r) ?? ruleConditionalInMap(r) ?? ruleConditionalOptionalTruthy(r) ?? r;
 }
 function recurseExpr(e) {
     const re = walkExpr;
@@ -434,6 +434,61 @@ function ruleNullish(e) {
         ty: e.ty,
     };
 }
+/** Rule (expression): `arr[i] ?? right` — nullish coalescing on an array index.
+ *  Under noUncheckedIndexedAccess `arr[i]` is `T | undefined`, undefined exactly
+ *  when out of bounds, so → `(0 <= i && i < arr.length) ? arr[i] : right`. The
+ *  guarded `then` keeps the seq index in bounds for the backend. (Map index is
+ *  already optional-typed and handled by ruleNullish above; this is the array
+ *  case, whose element type stays non-optional in expression position.) */
+function ruleNullishIndex(e) {
+    if (e.kind !== "nullish")
+        return null;
+    if (e.left.kind !== "index")
+        return null;
+    if (e.left.obj.ty.kind !== "array")
+        return null;
+    const idx = e.left.idx;
+    const len = { kind: "field", obj: e.left.obj, field: "length", ty: { kind: "int" } };
+    const lo = { kind: "binop", op: "<=", left: { kind: "num", value: 0, ty: { kind: "int" } }, right: idx, ty: { kind: "bool" } };
+    const hi = { kind: "binop", op: "<", left: idx, right: len, ty: { kind: "bool" } };
+    const cond = { kind: "binop", op: "&&", left: lo, right: hi, ty: { kind: "bool" } };
+    return { kind: "conditional", cond, then: e.left, else: e.right, ty: e.ty };
+}
+/** Rule (expression): `arr[i]?.<chain>` — optional chaining on an array index,
+ *  the optChain sibling of ruleNullishIndex. `arr[i]` is `T | undefined`,
+ *  undefined exactly out of bounds, so → `(0 <= i && i < arr.length) ? <chain on
+ *  arr[i]> : undefined`. The conditional's optional type makes transform wrap the
+ *  in-bounds chain result in Some and the OOB branch in None — the same Option<…>
+ *  a directly-optional scrutinee yields via ruleOptChain, just bounds-guarded.
+ *  (ruleOptChain itself bails here: an array index is typed as the non-optional
+ *  element type, so its `?.` never reaches that rule.) */
+function ruleOptChainIndex(e) {
+    if (e.kind !== "optChain")
+        return null;
+    if (e.obj.kind !== "index")
+        return null;
+    if (e.obj.obj.ty.kind !== "array")
+        return null;
+    const idx = e.obj.idx;
+    const len = { kind: "field", obj: e.obj.obj, field: "length", ty: { kind: "int" } };
+    const lo = { kind: "binop", op: "<=", left: { kind: "num", value: 0, ty: { kind: "int" } }, right: idx, ty: { kind: "bool" } };
+    const hi = { kind: "binop", op: "<", left: idx, right: len, ty: { kind: "bool" } };
+    const cond = { kind: "binop", op: "&&", left: lo, right: hi, ty: { kind: "bool" } };
+    let body = e.obj; // arr[i] — in bounds under `cond`
+    for (const step of e.chain) {
+        if (step.kind === "field") {
+            body = { kind: "field", obj: body, field: step.name, ty: step.ty };
+        }
+        else if (step.kind === "index") {
+            body = { kind: "index", obj: body, idx: step.idx, ty: step.ty };
+        }
+        else {
+            body = { kind: "call", fn: body, args: step.args, ty: step.ty, callKind: step.callKind };
+        }
+    }
+    const undef = { kind: "var", name: "undefined", ty: { kind: "void" } };
+    return { kind: "conditional", cond, then: body, else: undef, ty: e.ty };
+}
 /** Rule (expression): `obj?.<chain>` — single-eval optional chain.
  *  → `someMatch obj { Some(_oc{N}_val) => apply(chain, _oc{N}_val), None => undefined }`.
  *  The someBody applies the chain to the binder directly (field/call/index),

package/tools/dist/resolve.js

@@ -5,7 +5,7 @@
  * No mutation — each let extends the chain, lookup walks it.
  */
 import { isBigInt } from "./typedir.js";
-import { parseTsType } from "./types.js";
+import { parseTsType, tyToCanonical } from "./types.js";
 import { parseExpr } from "./specparser.js";
 function lookup(env, name) {
     if (!env)
@@ -349,6 +349,14 @@ function isUnmodeledTy(ty, typeDecls) {
     }
     return false;
 }
+/** A `user` type that resolves to a string-union declare-type — runs as a plain
+ *  string at runtime, so it's a refinement of `string`, not an opaque blob. */
+function isStringUnionTy(ty, typeDecls) {
+    if (ty.kind !== "user")
+        return false;
+    const base = ty.name.includes("<") ? ty.name.slice(0, ty.name.indexOf("<")) : ty.name;
+    return typeDecls.some(d => d.name === base && d.kind === "string-union");
+}
 /** Infer quantifier variable type from usage in body.
  *  If the variable is used as a map/set key (e.g. map.has(k), map.get(k)),
  *  return the collection's key type. Otherwise return null (default to int). */
@@ -457,6 +465,16 @@ function tyToTsStr(ty) {
     return undefined;
 }
 function inferLambdaParamTypes(fn, rawArgs, ctx) {
+    // sort's comparator takes two params, both the element type.
+    if (fn.kind === "field" && fn.obj.ty.kind === "array" && fn.field === "sort" &&
+        rawArgs.length >= 1 && rawArgs[0].kind === "lambda" && rawArgs[0].params.length >= 1) {
+        const tsType = tyToTsStr(fn.obj.ty.elem);
+        if (tsType) {
+            const lam = rawArgs[0];
+            const updatedParams = lam.params.map(p => (p.tsType ? p : { ...p, tsType }));
+            return [{ ...lam, params: updatedParams }, ...rawArgs.slice(1)];
+        }
+    }
     if (fn.kind === "field" && fn.obj.ty.kind === "array" &&
         ["map", "filter", "every", "some", "find", "findLast", "findIndex"].includes(fn.field) &&
         rawArgs.length >= 1 && rawArgs[0].kind === "lambda" &&
@@ -573,7 +591,9 @@ function inferMethodReturnTy(fn, args, ctx) {
             return objTy.elem;
         if (fn.field === "pop")
             return { kind: "optional", inner: objTy.elem };
-        if (fn.field === "push" || fn.field === "concat")
+        if (fn.field === "push" || fn.field === "unshift" || fn.field === "concat")
+            return objTy;
+        if (fn.field === "sort")
             return objTy;
         if (fn.field === "filter")
             return objTy;
@@ -639,6 +659,106 @@ function lookupFieldTy(objTy, field, ctx) {
     return { ty: { kind: "unknown" }, isDiscriminant: false };
 }
 // ── Resolve expressions ──────────────────────────────────────
+// Fresh-binder counter for the someMatches synthesized by object-spread merge.
+let mergeBinder = 0;
+/** Expand `{ ...base, ...override }` into a faithful field-wise merge. Driven by
+ *  the result record type's fields: an override field wins when present, else the
+ *  base's field shows through. Optional fields decide presence at runtime
+ *  (`Some?`); an `Option`-typed override is the whole merge guarded by its tag. */
+function resolveRecordMerge(base, override, ctx) {
+    const tbase = resolveExpr(base, ctx);
+    const tover = resolveExpr(override, ctx);
+    const overInner = tover.ty.kind === "optional" ? tover.ty.inner : tover.ty;
+    // Result record type: prefer the override's (an optional override still merges
+    // into its inner type), else the base's.
+    const rTy = overInner.kind === "user" ? overInner
+        : tbase.ty.kind === "user" ? tbase.ty : null;
+    const decl = rTy ? ctx.typeDecls.find(d => d.name === rTy.name && d.kind === "record") : undefined;
+    if (!rTy || !decl?.fields) {
+        throw new Error(`object spread merge { ...a, ...b } needs a known record type for both operands ` +
+            `(base: ${tyToCanonical(tbase.ty)}, override: ${tyToCanonical(tover.ty)})`);
+    }
+    if (tbase.ty.kind === "optional") {
+        throw new Error(`object spread merge with an optional base operand is not supported (base: ${tyToCanonical(tbase.ty)})`);
+    }
+    const userTy = rTy;
+    const fields = decl.fields;
+    // Build the merged literal from concrete base/override values, both : userTy.
+    const merged = (bv, ov) => ({
+        kind: "record", spread: null, ty: userTy,
+        fields: fields.map(f => {
+            const ft = f.type;
+            const ovf = { kind: "field", obj: ov, field: f.name, ty: ft };
+            if (ft.kind !== "optional")
+                return { name: f.name, value: ovf }; // required: override always provides
+            // optional: override field wins iff present, else base's field
+            const bvf = { kind: "field", obj: bv, field: f.name, ty: ft };
+            const binder = `_m${mergeBinder++}`;
+            // someBody is the unwrapped present value; transform re-wraps each arm in
+            // the backend's Some constructor (Dafny `Some`, Lean `Option.some`).
+            return { name: f.name, value: {
+                    kind: "someMatch", scrutinee: ovf, binder, binderTy: ft.inner,
+                    someBody: { kind: "var", name: binder, ty: ft.inner }, noneBody: bvf, ty: ft,
+                } };
+        }),
+    });
+    if (tover.ty.kind === "optional") {
+        // override may be absent (undefined spreads nothing) → base unchanged
+        const binder = `_mo${mergeBinder++}`;
+        return {
+            kind: "someMatch", scrutinee: tover, binder, binderTy: userTy,
+            someBody: merged(tbase, { kind: "var", name: binder, ty: userTy }), noneBody: tbase, ty: userTy,
+        };
+    }
+    return merged(tbase, tover);
+}
+/** `rec[k]` where `rec` is a record and `k` an enum of its field names. A *named*
+ *  string-union key is a datatype → `match k { case f => rec.f }`; an *inline*
+ *  union (`"a" | "b"`, a bare string carrying its members) → an equality chain
+ *  `if k === "a" then rec.a else …`. Either way the chain/match covers exactly
+ *  the key's values, so a subset key stays sound. Returns null if the shape
+ *  doesn't apply (caller falls back to plain index). */
+function tryRecordIndexByEnum(obj, idx, ctx) {
+    const objTy = obj.ty, keyTy = idx.ty;
+    if (objTy.kind !== "user")
+        return null;
+    const rec = ctx.typeDecls.find(d => d.name === objTy.name && d.kind === "record");
+    if (!rec?.fields)
+        return null;
+    const fieldByName = new Map(rec.fields.map(f => [f.name, f]));
+    const fieldTy = (v) => fieldByName.get(v).type ?? { kind: "unknown" };
+    const field = (v) => ({ kind: "field", obj, field: v, ty: fieldTy(v) });
+    // The key's members, and whether it's a datatype (named) or a bare string (inline).
+    let values = null;
+    let datatype = null;
+    if (keyTy.kind === "user") {
+        const keyEnum = ctx.typeDecls.find(d => d.name === keyTy.name && d.kind === "string-union");
+        if (keyEnum?.values?.length) {
+            values = keyEnum.values;
+            datatype = keyEnum.name;
+        }
+    }
+    else if (keyTy.kind === "string" && keyTy.values?.length) {
+        values = keyTy.values;
+    }
+    if (!values || !values.every(v => fieldByName.has(v)))
+        return null; // key isn't a subset of fields
+    if (datatype) {
+        return {
+            kind: "tagMatch", scrutinee: idx, typeName: datatype,
+            cases: values.map(v => ({ variant: v, body: field(v) })), fallthrough: null, ty: fieldTy(values[0]),
+        };
+    }
+    // Inline union: fold right into an equality chain, last member as the bare else.
+    let expr = field(values[values.length - 1]);
+    for (let i = values.length - 2; i >= 0; i--) {
+        expr = {
+            kind: "conditional", ty: fieldTy(values[i]), then: field(values[i]), else: expr,
+            cond: { kind: "binop", op: "===", left: idx, right: { kind: "str", value: values[i], ty: { kind: "string" } }, ty: { kind: "bool" } },
+        };
+    }
+    return expr;
+}
 function resolveExpr(e, ctx) {
     switch (e.kind) {
         case "var":
@@ -812,6 +932,9 @@ function resolveExpr(e, ctx) {
                 idxTy = narrowed ? obj.ty.value : { kind: "optional", inner: obj.ty.value };
             }
             else {
+                const recIdx = tryRecordIndexByEnum(obj, idx, ctx);
+                if (recIdx)
+                    return recIdx;
                 idxTy = { kind: "unknown" };
             }
             return { kind: "index", obj, idx, ty: idxTy };
@@ -842,8 +965,10 @@ function resolveExpr(e, ctx) {
             // left ?? right — result type is left's inner (when left is optional)
             // or just left's type, unified with right's type.
             const left = resolveExpr(e.left, ctx);
-            const right = resolveExpr(e.right, ctx);
             const ty = left.ty.kind === "optional" ? left.ty.inner : left.ty;
+            // The default shares the result type, so coerce a string literal to a
+            // string-union enum (e.g. `availableLevels[0] ?? "off"`).
+            const right = coerceStr(resolveExpr(e.right, ctx), ty);
             return { kind: "nullish", left, right, ty };
         }
         case "optChain": {
@@ -944,6 +1069,8 @@ function resolveExpr(e, ctx) {
             });
             return { kind: "record", spread, fields, ty: recordTy ?? ty };
         }
+        case "recordMerge":
+            return resolveRecordMerge(e.base, e.override, ctx);
         case "result":
             // \result desugars to a regular var so all the variable-narrowing
             // machinery (env lookup, optional checks, path matching) just works.
@@ -967,8 +1094,14 @@ function resolveExpr(e, ctx) {
             // anonymous tuple (mirrors return-position and call-argument records, which
             // get their type via ctx.returnTy). Only narrow when the context type is an
             // array; otherwise leave ctx untouched.
-            const elemCtx = ctx.returnTy.kind === "array" ? { ...ctx, returnTy: ctx.returnTy.elem } : ctx;
-            const elems = e.elems.map(el => resolveExpr(el, elemCtx));
+            const expectedElem = ctx.returnTy.kind === "array" ? ctx.returnTy.elem : null;
+            const elemCtx = expectedElem ? { ...ctx, returnTy: expectedElem } : ctx;
+            const elems = e.elems.map(el => {
+                const r = resolveExpr(el, elemCtx);
+                // Coerce a bare string-literal element to a string-union enum (e.g.
+                // `["off", …]: ModelThinkingLevel[]`), like return/arg positions.
+                return expectedElem ? coerceStr(r, expectedElem) : r;
+            });
             const elemTy = elems.length > 0 ? elems[0].ty : { kind: "unknown" };
             return { kind: "arrayLiteral", elems, ty: { kind: "array", elem: elemTy } };
         }
@@ -1140,6 +1273,11 @@ function resolveStmt(s, ctx) {
                     ? { kind: "optional", inner: init.ty }
                     : init.ty;
             }
+            else if (declTy.kind === "string" && isStringUnionTy(init.ty, ctx.typeDecls) && !ctx.overrides.has(s.name)) {
+                // ts-morph widened a string-union to `string`; keep the initializer's
+                // datatype so `local === "lit"` lowers to a discriminant test.
+                ty = init.ty;
+            }
             else if ((declTy.kind === "int" || declTy.kind === "nat") && init.ty.kind === "real" && !ctx.overrides.has(s.name)) {
                 // TS infers `number` (→ int/nat) for an expression LS computes as `real`
                 // (e.g. `a / b`, now real division). `number` can't tell them apart, so
@@ -1332,6 +1470,10 @@ function collectCallsExpr(e, fns, out) {
             for (const f of e.fields)
                 collectCallsExpr(f.value, fns, out);
             return;
+        case "recordMerge":
+            collectCallsExpr(e.base, fns, out);
+            collectCallsExpr(e.override, fns, out);
+            return;
         case "arrayLiteral":
             for (const el of e.elems)
                 collectCallsExpr(el, fns, out);

package/tools/dist/transform.js

@@ -1359,7 +1359,7 @@ function transformStmt(s, typeDecls) {
                 const recv = s.expr.fn.obj;
                 const f = s.expr.fn.field;
                 const isMutating = ((recv.ty.kind === "map" || recv.ty.kind === "set") && (f === "set" || f === "add" || f === "delete")) ||
-                    (recv.ty.kind === "array" && f === "push");
+                    (recv.ty.kind === "array" && (f === "push" || f === "unshift" || f === "sort"));
                 if (isMutating && recv.kind === "var") {
                     const { binds, expr } = liftMethodCalls(s.expr);
                     return [...binds, { kind: "assign", target: recv.name, value: expr }];
@@ -1836,6 +1836,7 @@ function transformTypeDecl(d) {
     else {
         return {
             kind: "structure", name: d.name,
+            typeParams: d.typeParams,
             fields: d.fields.map(f => ({ name: f.name, type: f.type })),
             deriving: ["Repr", "Inhabited", "DecidableEq"],
         };
@@ -1854,7 +1855,7 @@ function findReassignedNames(stmts, names) {
             // Mutating collection calls: s.add(x), m.set(k,v), s.delete(x), arr.push(x)
             if (s.kind === "expr" && s.expr.kind === "call" && s.expr.fn.kind === "field" &&
                 s.expr.fn.obj.kind === "var" && names.has(s.expr.fn.obj.name) &&
-                ["add", "set", "delete", "push"].includes(s.expr.fn.field)) {
+                ["add", "set", "delete", "push", "unshift"].includes(s.expr.fn.field)) {
                 found.add(s.expr.fn.obj.name);
             }
             if (s.kind === "if") {

package/tools/dist/types.js

@@ -55,6 +55,20 @@ function tyFromTypeNode(tn) {
         if (normalized.length === 1 && "syntheticBool" in normalized[0])
             return { kind: "bool" };
         const nonNullish = normalized.filter(a => "syntheticBool" in a || !isNullish(a.node));
+        // Inline string-literal union (`"a" | "b"`, not a //@ declare-type): no datatype
+        // to resolve against, so lower to plain string (the arms are strings; == holds).
+        const isStrLit = (a) => !("syntheticBool" in a) && Node.isLiteralTypeNode(a.node) && a.node.getLiteral().getKind() === SyntaxKind.StringLiteral;
+        if (nonNullish.length >= 2 && nonNullish.every(isStrLit)) {
+            // Keep the literal members so `rec[k]` can lower to an equality chain.
+            const values = nonNullish.map(a => {
+                const lit = a.node;
+                const inner = Node.isLiteralTypeNode(lit) ? lit.getLiteral() : lit;
+                return Node.isStringLiteral(inner) ? inner.getLiteralValue() : inner.getText();
+            });
+            return normalized.some(a => !("syntheticBool" in a) && isNullish(a.node))
+                ? { kind: "optional", inner: { kind: "string", values } }
+                : { kind: "string", values };
+        }
         if (nonNullish.length === 1 && normalized.length >= 2) {
             const sole = nonNullish[0];
             const inner = "syntheticBool" in sole ? { kind: "bool" } : tyFromTypeNode(sole.node);

package/tools/dist/guard-command.js

@@ -1,238 +0,0 @@
-/**
- * `lsc guard` — emit a drop-in `<file>.guarded.ts` that enforces each verified
- * function's `//@ requires` at runtime.
- *
- * Backend-neutral (like `extract`/`info`): reads the Raw IR and re-parses each
- * `//@ requires` string with the specparser, then lowers the resulting RawExpr
- * back to executable TypeScript. The generated module re-exports every function
- * at its original signature, each guarded: on a violated clause it throws
- * `PreconditionError(fn, clause, clauseId, args, detail)`; a `can.*` namespace
- * exposes the same per-clause checks as booleans for render-time gating.
- *
- * Clauses naming a symbol that is not TS-resident (a ghost `.dfy` predicate, an
- * unbounded quantifier) cannot be lowered — they are SKIPPED with a warning,
- * never faked. Internal core-to-core calls stay raw (`__core.*`); the proof
- * covers those.
- */
-import { writeFileSync } from "fs";
-import * as path from "path";
-import { parseExpr } from "./specparser.js";
-class NotLowerable extends Error {
-}
-const GLOBALS = new Set(["Math", "Number", "undefined"]);
-// ── RawExpr → executable TS (throws NotLowerable on a non-TS-resident symbol) ──
-function lower(e, ctx) {
-    switch (e.kind) {
-        case "num": return String(e.value);
-        case "bool": return String(e.value);
-        case "str": return JSON.stringify(e.value);
-        case "var":
-            if (ctx.bound.has(e.name) || ctx.params.has(e.name) || GLOBALS.has(e.name))
-                return e.name;
-            if (ctx.fns.has(e.name))
-                return `__core.${e.name}`;
-            throw new NotLowerable(`unknown symbol '${e.name}' (not a param, bound var, or module function)`);
-        case "field": return `${lower(e.obj, ctx)}.${e.field}`;
-        case "index": return `${lower(e.obj, ctx)}[${lower(e.idx, ctx)}]`;
-        case "call": return `${lower(e.fn, ctx)}(${e.args.map((a) => lower(a, ctx)).join(", ")})`;
-        case "unop": return `(${e.op}${lower(e.expr, ctx)})`;
-        case "conditional":
-            return `(${lower(e.cond, ctx)} ? ${lower(e.then, ctx)} : ${lower(e.else, ctx)})`;
-        case "arrayLiteral": return `[${e.elems.map((x) => lower(x, ctx)).join(", ")}]`;
-        case "binop": {
-            const l = () => lower(e.left, ctx), r = () => lower(e.right, ctx);
-            if (e.op === "==>")
-                return `(!(${l()}) || (${r()}))`;
-            if (e.op === "<==>")
-                return `((${l()}) === (${r()}))`;
-            if (e.op === "in")
-                throw new NotLowerable("'in' membership not yet lowered");
-            return `(${l()} ${e.op} ${r()})`;
-        }
-        case "forall":
-        case "exists": {
-            const { lo, ubOp, ub } = quantRange(e, ctx);
-            const inner = { ...ctx, bound: new Set([...ctx.bound, e.var]) };
-            const body = lower(e.body, inner);
-            const hit = e.kind === "forall" ? `!(${body})` : `(${body})`;
-            const found = e.kind === "forall" ? "false" : "true";
-            const dflt = e.kind === "forall" ? "true" : "false";
-            return `(() => { for (let ${e.var} = ${lo}; ${e.var} ${ubOp} ${ub}; ${e.var}++) { if (${hit}) return ${found}; } return ${dflt}; })()`;
-        }
-        default: throw new NotLowerable(`unsupported expression kind '${e.kind}'`);
-    }
-}
-// Extract a sound finite iteration range [lo, ub) for the quantified var from a
-// `lo <= v && v < ub ==> P` antecedent. Both bounds must be found (or var is a
-// nat) — guessing would risk an unsound under-scan. Throws otherwise.
-function quantRange(q, ctx) {
-    if (q.body.kind !== "binop" || q.body.op !== "==>")
-        throw new NotLowerable(`quantifier over '${q.var}' has no bounding antecedent`);
-    const inner = { ...ctx, bound: new Set([...ctx.bound, q.var]) };
-    const isVar = (x) => x.kind === "var" && x.name === q.var;
-    const conj = (e) => e.kind === "binop" && e.op === "&&" ? [...conj(e.left), ...conj(e.right)] : [e];
-    let upper = null;
-    let lowerB = null;
-    for (const c of conj(q.body.left)) {
-        if (c.kind !== "binop")
-            continue;
-        if (isVar(c.left) && (c.op === "<" || c.op === "<="))
-            upper = { ub: lower(c.right, inner), strict: c.op === "<" };
-        else if (isVar(c.right) && (c.op === ">" || c.op === ">="))
-            upper = { ub: lower(c.left, inner), strict: c.op === ">" };
-        else if (isVar(c.right) && (c.op === "<" || c.op === "<="))
-            lowerB = { expr: lower(c.left, inner), strict: c.op === "<" };
-        else if (isVar(c.left) && (c.op === ">" || c.op === ">="))
-            lowerB = { expr: lower(c.right, inner), strict: c.op === ">" };
-    }
-    if (!upper)
-        throw new NotLowerable(`no upper bound found for '${q.var}'`);
-    let lo;
-    if (lowerB)
-        lo = lowerB.strict ? `(${lowerB.expr}) + 1` : lowerB.expr;
-    else if (q.varType === "nat")
-        lo = "0";
-    else
-        throw new NotLowerable(`no lower bound found for '${q.var}'`);
-    return { lo, ubOp: upper.strict ? "<" : "<=", ub: upper.ub };
-}
-// ── human-readable label for a sub-expression (spec text, bare names) ──
-function render(e) {
-    switch (e.kind) {
-        case "num": return String(e.value);
-        case "bool": return String(e.value);
-        case "str": return JSON.stringify(e.value);
-        case "var": return e.name;
-        case "field": return `${render(e.obj)}.${e.field}`;
-        case "index": return `${render(e.obj)}[${render(e.idx)}]`;
-        case "call": return `${render(e.fn)}(${e.args.map(render).join(", ")})`;
-        case "unop": return `${e.op}${render(e.expr)}`;
-        case "binop": return `${render(e.left)} ${e.op} ${render(e.right)}`;
-        case "conditional": return `${render(e.cond)} ? ${render(e.then)} : ${render(e.else)}`;
-        default: return "?";
-    }
-}
-// Maximal "notable" sub-expressions (calls / field / index / param vars) whose
-// runtime values explain a failure. Recurses through operators only.
-function collectNotable(e, ctx, out) {
-    switch (e.kind) {
-        case "call":
-        case "field":
-        case "index": {
-            try {
-                out.set(render(e), lower(e, ctx));
-            }
-            catch { /* skip unlowerable leaf */ }
-            return;
-        }
-        case "var":
-            if (ctx.params.has(e.name))
-                out.set(e.name, e.name);
-            return;
-        case "binop":
-            collectNotable(e.left, ctx, out);
-            collectNotable(e.right, ctx, out);
-            return;
-        case "unop":
-            collectNotable(e.expr, ctx, out);
-            return;
-        case "conditional":
-            collectNotable(e.cond, ctx, out);
-            collectNotable(e.then, ctx, out);
-            collectNotable(e.else, ctx, out);
-            return;
-        default: return;
-    }
-}
-// ── per-function check table ──────────────────────────────────────────
-function buildChecks(fn, ctx) {
-    const preamble = [], entries = [], skipped = [];
-    fn.requires.forEach((src, i) => {
-        const id = `${fn.name}#${i}`;
-        try {
-            const ast = parseExpr(src);
-            const clauseLit = JSON.stringify(src);
-            if (ast.kind === "forall") {
-                const { lo, ubOp, ub } = quantRange(ast, ctx);
-                const inner = { ...ctx, bound: new Set([...ctx.bound, ast.var]) };
-                const body = lower(ast.body, inner);
-                const w = `__w${i}`;
-                preamble.push(`  const ${w} = ((): number => { for (let ${ast.var} = ${lo}; ${ast.var} ${ubOp} ${ub}; ${ast.var}++) { if (!(${body})) return ${ast.var}; } return -1; })();`);
-                entries.push(`    __C(${JSON.stringify(id)}, ${clauseLit}, ${w} === -1, () => ({ ${JSON.stringify(ast.var)}: ${w} })),`);
-            }
-            else {
-                const ok = lower(ast, ctx);
-                const notes = new Map();
-                collectNotable(ast, ctx, notes);
-                const detail = `{ ${[...notes].map(([k, v]) => `${JSON.stringify(k)}: ${v}`).join(", ")} }`;
-                entries.push(`    __C(${JSON.stringify(id)}, ${clauseLit}, (${ok}), () => (${detail})),`);
-            }
-        }
-        catch (err) {
-            if (!(err instanceof NotLowerable))
-                throw err;
-            skipped.push(`  // SKIPPED ${id} (${err.message}): ${src}`);
-            console.warn(`  warning: ${fn.name} — unlowerable clause skipped (${err.message}): ${src}`);
-        }
-    });
-    return { preamble, entries, skipped };
-}
-function sig(fn) {
-    const tp = fn.typeParams.length ? `<${fn.typeParams.join(", ")}>` : "";
-    const params = fn.params.map((p) => `${p.name}: ${p.tsType}`).join(", ");
-    return `${tp}(${params}): ${fn.returnType}`;
-}
-const argList = (fn) => fn.params.map((p) => p.name).join(", ");
-function emitFunction(fn, ctx) {
-    const { preamble, entries, skipped } = buildChecks(fn, ctx);
-    const checksBody = [...skipped, ...preamble, `  return [`, ...entries, `  ];`].join("\n");
-    const args = argList(fn);
-    return [
-        `function checks_${fn.name}(${fn.params.map((p) => `${p.name}: ${p.tsType}`).join(", ")}): __Check[] {`,
-        checksBody,
-        `}`,
-        `export function ${fn.name}${sig(fn)} {`,
-        `  return __enforce(${JSON.stringify(fn.name)}, [${args}], checks_${fn.name}(${args}), () => __core.${fn.name}(${args}));`,
-        `}`,
-    ].join("\n");
-}
-export function runGuard(raw, outPath) {
-    const base = path.basename(raw.file, ".ts");
-    const fnNames = new Set(raw.functions.map((f) => f.name));
-    const blocks = raw.functions.map((fn) => {
-        const ctx = { params: new Set(fn.params.map((p) => p.name)), bound: new Set(), fns: fnNames };
-        return emitFunction(fn, ctx);
-    });
-    const canEntries = raw.functions.map((fn) => `  ${fn.name}: (${fn.params.map((p) => `${p.name}: ${p.tsType}`).join(", ")}): boolean => __holds(checks_${fn.name}(${argList(fn)})),`);
-    const header = [
-        `// ${base}.guarded.ts — GENERATED by \`lsc guard\`. Do not edit.`,
-        `// Drop-in for ${base}.ts: each function checks its //@ requires and throws`,
-        `// PreconditionError on violation; \`can.*\` runs the same checks as booleans.`,
-        ``,
-        `import * as __core from "./${base}";`,
-        ``,
-        `export class PreconditionError extends Error {`,
-        `  constructor(`,
-        `    readonly fn: string,`,
-        `    readonly clause: string,`,
-        `    readonly clauseId: string,`,
-        `    readonly args: unknown[],`,
-        `    readonly detail: unknown,`,
-        `  ) {`,
-        `    super(\`precondition failed in \${fn}: \${clause}\`);`,
-        `    this.name = "PreconditionError";`,
-        `  }`,
-        `}`,
-        ``,
-        `type __Check = { id: string; clause: string; ok: boolean; detail: () => unknown };`,
-        `const __C = (id: string, clause: string, ok: boolean, detail: () => unknown): __Check => ({ id, clause, ok, detail });`,
-        `function __enforce<R>(fn: string, args: unknown[], checks: __Check[], call: () => R): R {`,
-        `  for (const c of checks) if (!c.ok) throw new PreconditionError(fn, c.clause, c.id, args, c.detail());`,
-        `  return call();`,
-        `}`,
-        `const __holds = (checks: __Check[]): boolean => checks.every((c) => c.ok);`,
-    ].join("\n");
-    const text = [header, "", ...blocks, "", "export const can = {", ...canEntries, "};", ""].join("\n");
-    writeFileSync(outPath, text);
-    console.log(`Wrote ${outPath} (${raw.functions.length} functions guarded)`);
-}