lemmascript 0.5.7 → 0.5.9

package/tools/dist/lean-emit.js

@@ -2,6 +2,7 @@
  * Lean emitter — IR → Lean text.
  * No logic, no type decisions — just serialization.
  */
+import { anyExpr } from "./ir.js";
 // ── Ty → Lean type string ──────────────────────────────────
 function tyToLean(ty) {
     switch (ty.kind) {
@@ -55,7 +56,14 @@ function tyToLean(ty) {
             const retStr = ret.includes(" ") ? `(${ret})` : ret;
             return [...params, retStr].join(" → ");
         }
-        case "unknown": return "_";
+        // Out-of-subset (`any`/`unknown`) — an opaque carrier, so unmodeled payloads
+        // (e.g. a `details` field never inspected by the verified code) pass through
+        // but real ops on them fail loudly. Mirrors the Dafny backend's
+        // `type Unknown(==, 0)`. The decl is emitted once, in the first file that
+        // needs it (the def file imports the types file, so no duplicate).
+        case "unknown":
+            _needsUnknown = true;
+            return "Unknown";
     }
 }
 // ── Lean keyword escaping ────────────────────────────────────
@@ -83,8 +91,119 @@ const PREC = {
     "+": 5, "-": 5, "++": 5, "arrayConcat": 5, "*": 6, "/": 6, "%": 6,
 };
 function prec(op) { return PREC[op] ?? 10; }
-// ── Method call → Lean syntax ───────────────────────────────
+const _unionCtors = new Map();
+// Types that transitively reference an `opaque` type can't derive `Repr` or
+// `DecidableEq` (the opaque type provides neither). `Inhabited` still derives
+// (via the empty array / first constructor), so only those two are dropped.
+// "Unknown" (the `any`/`unknown` carrier) is opaque by construction.
+const _opaqueNames = new Set(["Unknown"]);
+const _typeRefs = new Map();
+const _taintedTypes = new Set();
+function collectUserRefs(ty, into) {
+    switch (ty.kind) {
+        case "array":
+        case "set":
+            collectUserRefs(ty.elem, into);
+            break;
+        case "optional":
+            collectUserRefs(ty.inner, into);
+            break;
+        case "map":
+            collectUserRefs(ty.key, into);
+            collectUserRefs(ty.value, into);
+            break;
+        case "fn":
+            ty.params.forEach(p => collectUserRefs(p, into));
+            collectUserRefs(ty.result, into);
+            break;
+        case "user":
+            into.add(ty.name.includes("<") ? ty.name.slice(0, ty.name.indexOf("<")) : ty.name);
+            break;
+        case "unknown":
+            into.add("Unknown");
+            break;
+    }
+}
+function registerInductives(decls) {
+    for (const d of decls) {
+        if (d.kind === "inductive") {
+            _unionCtors.set(d.name, d.constructors);
+            const refs = new Set();
+            for (const c of d.constructors)
+                for (const f of c.fields)
+                    collectUserRefs(f.type, refs);
+            _typeRefs.set(d.name, refs);
+        }
+        else if (d.kind === "structure") {
+            const refs = new Set();
+            for (const f of d.fields)
+                collectUserRefs(f.type, refs);
+            _typeRefs.set(d.name, refs);
+        }
+        else if (d.kind === "opaque-type") {
+            _opaqueNames.add(d.name);
+        }
+    }
+    // Fixpoint: a type is tainted if it references an opaque or already-tainted type.
+    let changed = true;
+    while (changed) {
+        changed = false;
+        for (const [name, refs] of _typeRefs) {
+            if (_taintedTypes.has(name))
+                continue;
+            if ([...refs].some(r => _opaqueNames.has(r) || _taintedTypes.has(r))) {
+                _taintedTypes.add(name);
+                changed = true;
+            }
+        }
+    }
+}
+/** Deriving clause, dropping `Repr`/`DecidableEq` for opaque-tainted types. */
+function emitDeriving(name, deriving) {
+    const der = _taintedTypes.has(name) ? deriving.filter(x => x !== "Repr" && x !== "DecidableEq") : deriving;
+    return der.length > 0 ? `\nderiving ${der.join(", ")}` : "";
+}
 let _needsJSString = false;
+let _needsUnknown = false;
+let _unknownEmitted = false; // across files in one run — the def file imports the types file
+// Bool-vs-Prop context. Lean keeps `Bool` and `Prop` distinct; the IR uses the
+// Prop connectives (∧/∨/¬) uniformly. In a computational position the connectives
+// may need to be the Bool ones (&&/||/!). They are only *required* when a connective
+// has an operand that does not coerce Bool→Prop — see `needsBoolConnectives`. A body
+// built only from decidable atoms (comparisons, Bool-returning calls) coerces fine
+// and stays in the more proof-friendly Prop form.
+let _boolCtx = false;
+// A Bool-valued atom that does NOT coerce to Prop: an inlined union discriminator
+// (lowered to a match-bool `match x with | .C .. => true | _ => false`) or a raw
+// `match` used as a Bool — neither has a `Decidable` instance Lean can synthesize
+// through the `match`. Under a Prop connective (∧/∨/¬) such an operand is a type
+// error, so its presence forces the whole body to Bool connectives.
+function isNonCoercibleBoolAtom(e) {
+    if (e.kind === "match")
+        return true;
+    if (e.kind === "binop" && (e.op === "=" || e.op === "≠") && e.right.kind === "constructor") {
+        const rhs = e.right; // capture the narrowed node so it survives the closure below
+        const ctor = rhs.type ? _unionCtors.get(rhs.type)?.find(c => c.name === rhs.name) : undefined;
+        return !!ctor && ctor.fields.length > 0;
+    }
+    return false;
+}
+// A ∧/∨/¬ connective with a non-coercible operand — the specific node that would
+// fail to elaborate if emitted in Prop form.
+function connectiveHasNonCoercibleOperand(e) {
+    if (e.kind === "binop" && (e.op === "∧" || e.op === "∨"))
+        return isNonCoercibleBoolAtom(e.left) || isNonCoercibleBoolAtom(e.right);
+    if (e.kind === "unop" && e.op === "¬")
+        return isNonCoercibleBoolAtom(e.expr);
+    return false;
+}
+// True iff some ∧/∨/¬ connective in `e` has a non-coercible operand, i.e. emitting
+// the body with Prop connectives would fail to elaborate. (A decidable atom coerces,
+// so a body with no such operand stays Prop — this keeps arithmetic predicates like
+// `x ≥ 0 ∧ x < n` in `∧` form rather than forcing `&&`.)
+function needsBoolConnectives(e) {
+    return anyExpr(e, connectiveHasNonCoercibleOperand);
+}
 function emitMethodCall(tyKind, method, monadic, obj, args) {
     // Array methods
     if (tyKind === "array") {
@@ -100,10 +219,14 @@ function emitMethodCall(tyKind, method, monadic, obj, args) {
             return args.length > 1 ? `(${obj}.extract ${args[1]} ${obj}.size).contains ${args[0]}` : `${obj}.contains ${args[0]}`;
         if (method === "find")
             return `${obj}.find? ${args[0]}`;
+        if (method === "join")
+            return `(String.intercalate ${args[0]} ${obj}.toList)`;
         if (method === "with")
             return `${obj}.set! ${args[0]} ${args[1]}`;
         if (method === "push")
             return args.length === 1 ? `Array.push ${obj} ${args[0]}` : `${obj} ++ #[${args.join(", ")}]`;
+        if (method === "unshift")
+            return `(#[${args.join(", ")}] ++ ${obj})`;
         if (method === "concat")
             return args.length === 1 ? `Array.push ${obj} ${args[0]}` : `${obj} ++ #[${args.join(", ")}]`;
         // arr.slice → Array.extract. No-arg slice is a full copy (Array is a value
@@ -162,7 +285,8 @@ function wrapOperand(sub, parentPrec) {
 }
 function emitExpr(e, parentPrec) {
     switch (e.kind) {
-        case "var": return escapeName(e.name);
+        // `undefined` is the IR's spelling of the absent optional (mirrors dafny-emit's None)
+        case "var": return e.name === "undefined" ? "none" : escapeName(e.name);
         case "num": return `${e.value}`;
         case "bool": return e.value ? "true" : "false";
         case "str": return `"${e.value.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n')}"`;
@@ -183,6 +307,7 @@ function emitExpr(e, parentPrec) {
             return `#[${e.elems.map(el => emitExpr(el)).join(", ")}]`;
         case "emptyMap": return `Std.HashMap.empty`;
         case "emptySet": return `Std.HashSet.empty`;
+        case "default": return `(default : ${tyToLean(e.type)})`;
         case "methodCall": {
             const obj = emitExpr(e.obj);
             const wrap = e.obj.kind === "binop" || e.obj.kind === "app" || e.obj.kind === "methodCall" || e.obj.kind === "if" || e.obj.kind === "let";
@@ -201,11 +326,25 @@ function emitExpr(e, parentPrec) {
         }
         case "unop":
             if (e.op === "¬")
-                return `¬(${emitExpr(e.expr)})`;
+                return _boolCtx ? `!(${emitExpr(e.expr)})` : `¬(${emitExpr(e.expr)})`;
             if (e.op === "-" && e.expr.kind === "num")
                 return `-${e.expr.value}`;
             return `(-${emitExpr(e.expr)})`;
         case "binop": {
+            // Discriminator test against a constructor that carries fields:
+            // `x = .Ctor` → `(match x with | .Ctor .. => true | _ => false)`. A
+            // multi-field constructor is a function, not a value, so a bare
+            // `x = Type.Ctor` is ill-typed. The Bool result coerces to Prop in spec
+            // positions, mirroring how the backend already treats decidable atoms.
+            // Nullary constructors (enums) keep the cheap `DecidableEq` comparison.
+            if ((e.op === "=" || e.op === "≠") && e.right.kind === "constructor") {
+                const rhs = e.right; // capture the narrowed node so it survives into the closure below
+                const ctor = rhs.type ? _unionCtors.get(rhs.type)?.find(c => c.name === rhs.name) : undefined;
+                if (ctor && ctor.fields.length > 0) {
+                    const [yes, no] = e.op === "=" ? ["true", "false"] : ["false", "true"];
+                    return `(match ${emitExpr(e.left)} with | .${escapeName(rhs.name)} .. => ${yes} | _ => ${no})`;
+                }
+            }
             // `k in m` (map/set membership) → `m.contains k` in Lean. Dafny has
             // native `in`; Lean uses the method form for HashMap/HashSet.
             if (e.op === "in") {
@@ -213,7 +352,10 @@ function emitExpr(e, parentPrec) {
                 const wrap = e.right.kind === "binop" || e.right.kind === "app" || e.right.kind === "methodCall";
                 return `${wrap ? `(${recv})` : recv}.contains ${emitExpr(e.left)}`;
             }
-            const op = e.op === "arrayConcat" ? "++" : e.op;
+            const op = e.op === "arrayConcat" ? "++"
+                : _boolCtx && e.op === "∧" ? "&&"
+                    : _boolCtx && e.op === "∨" ? "||"
+                        : e.op;
             // ↔ does not chain in Lean — a nested iff operand needs parens.
             const childPrec = e.op === "↔" ? prec(e.op) + 1 : prec(e.op);
             // `-`, `/`, `%` are left-associative and non-associative, so an equal-
@@ -241,6 +383,12 @@ function emitExpr(e, parentPrec) {
             // the bare form, so its output is unaffected.)
             if (e.ctorOf)
                 return args.length ? `${e.ctorOf}.${e.fn} ${args.join(" ")}` : `${e.ctorOf}.${e.fn}`;
+            // Option constructors arrive Dafny-spelled from transform (`app "Some"`);
+            // Lean core exports the lowercase forms as top-level names.
+            if (e.fn === "Some" && args.length === 1)
+                return `some ${args[0]}`;
+            if (e.fn === "None" && args.length === 0)
+                return `none`;
             // SetToSeq → .toArray for Lean (HashSet has native toArray)
             if (e.fn === "SetToSeq" && args.length === 1)
                 return `${args[0]}.toArray`;
@@ -263,6 +411,24 @@ function emitExpr(e, parentPrec) {
             return `${e.fn} ${args.join(" ")}`;
         }
         case "field": {
+            // Union destructor (tagged by transform): `x.field` where x is a
+            // multi-constructor inductive. Lean has no projection there, so match the
+            // owning constructor, bind the field positionally, and ignore the rest.
+            // Other constructors fall to `default` — the source guards every such
+            // access with a discriminator test, so that branch is never reached.
+            if (e.fromUnion) {
+                const ctors = _unionCtors.get(e.fromUnion);
+                // Pin the owning ctor when given (field names repeat across variants);
+                // otherwise fall back to the sole variant carrying this field name.
+                const owner = (e.ctor ? ctors?.find(c => c.name === e.ctor) : undefined)
+                    ?? ctors?.find(c => c.fields.some(f => f.name === e.field));
+                if (owner) {
+                    const idx = owner.fields.findIndex(f => f.name === e.field);
+                    const pats = owner.fields.map((_, i) => (i === idx ? "_v" : "_")).join(" ");
+                    const fty = tyToLean(owner.fields[idx].type);
+                    return `(match ${emitExpr(e.obj)} with | .${escapeName(owner.name)} ${pats} => _v | _ => (default : ${fty}))`;
+                }
+            }
             const obj = emitExpr(e.obj);
             if (e.field === "collectionSize")
                 return `${obj}.size`;
@@ -328,10 +494,19 @@ function emitStmts(stmts, indent) {
 function emitStmt(s, indent) {
     const pad = "  ".repeat(indent);
     switch (s.kind) {
-        case "let":
-            return s.mutable
-                ? `${pad}let mut ${escapeName(s.name)} : ${tyToLean(s.type)} := ${emitExpr(s.value)}`
-                : `${pad}let ${escapeName(s.name)} := ${emitExpr(s.value)}`;
+        case "let": {
+            // `mut` lets always carry their type (assignments must re-elaborate at it).
+            // Immutable lets are ascribed only when the initializer is a `match` (the
+            // `??` / Option-unwrap lowerings): Velvet's WP elaboration runs *backwards*,
+            // so without the ascription the binding's type is a metavariable that a
+            // later use pins first — e.g. `lines.size ≤ maxLines` pins `maxLines : ℕ`
+            // and the ℤ-valued unwrap arms then fail to elaborate. Other initializer
+            // shapes determine their own type, and leaving them bare keeps previously
+            // generated (and proven) artifacts byte-stable.
+            const ascribe = s.mutable || s.value.kind === "match";
+            const ty = ascribe && s.type.kind !== "unknown" ? ` : ${tyToLean(s.type)}` : "";
+            return `${pad}let ${s.mutable ? "mut " : ""}${escapeName(s.name)}${ty} := ${emitExpr(s.value)}`;
+        }
         case "assign": return `${pad}${escapeName(s.target)} := ${emitExpr(s.value)}`;
         case "ghostLet":
             return `${pad}let mut ${escapeName(s.name)} : ${tyToLean(s.type)} := ${emitExpr(s.value)}`;
@@ -344,7 +519,10 @@ function emitStmt(s, indent) {
             // to WPGen.default, which drops the assertion. Coerce to Prop via `= true`.
             // Top-level Prop constructs (`=`, `<`, `∧`, `¬`, `∀`, `∃`, `→`) already
             // land in Prop — Lean auto-coerces inner Bools there.
+            const prevBoolCtx = _boolCtx;
+            _boolCtx = false; // assertions are Prop
             const inner = emitExpr(s.expr);
+            _boolCtx = prevBoolCtx;
             const wrapped = isPropValued(s.expr) ? inner : `(${inner}) = true`;
             return `${pad}assertGadget (${wrapped})`;
         }
@@ -411,21 +589,30 @@ function emitStmt(s, indent) {
             return lines.join("\n");
         }
         case "while": {
+            // Guard is computational (Bool); invariants / done_with are Prop.
             const lines = [`${pad}while ${emitExpr(s.cond)}`];
+            const prevBoolCtx = _boolCtx;
+            _boolCtx = false;
             for (const inv of s.invariants)
                 lines.push(`${pad}  invariant ${emitExpr(inv)}`);
+            // `done_with True` (the auto-supplied fact for breaking loops) is a Prop;
+            // the bool literal would need a coercion, so emit the Prop `True` directly.
             if (s.doneWith)
-                lines.push(`${pad}  done_with ${emitExpr(s.doneWith)}`);
+                lines.push(`${pad}  done_with ${s.doneWith.kind === "bool" && s.doneWith.value ? "True" : emitExpr(s.doneWith)}`);
             if (s.decreasing)
                 lines.push(`${pad}  decreasing ${emitExpr(s.decreasing)}`);
+            _boolCtx = prevBoolCtx;
             lines.push(`${pad}do`);
             lines.push(emitStmts(s.body, indent + 1));
             return lines.join("\n");
         }
         case "forin": {
             const lines = [`${pad}for ${s.idx} in [:${emitExpr(s.bound)}]`];
+            const prevBoolCtx = _boolCtx;
+            _boolCtx = false; // invariants are Prop
             for (const inv of s.invariants)
                 lines.push(`${pad}  invariant ${emitExpr(inv)}`);
+            _boolCtx = prevBoolCtx;
             lines.push(`${pad}do`);
             lines.push(emitStmts(s.body, indent + 1));
             return lines.join("\n");
@@ -446,17 +633,13 @@ function emitDecl(d) {
                     lines.push(`  | ${c.name} ${params} : ${d.name}`);
                 }
             }
-            if (d.deriving.length > 0)
-                lines.push(`deriving ${d.deriving.join(", ")}`);
-            return lines.join("\n");
+            return lines.join("\n") + emitDeriving(d.name, d.deriving);
         }
         case "structure": {
             const lines = [`structure ${d.name} where`];
             for (const f of d.fields)
                 lines.push(`  ${escapeName(f.name)} : ${tyToLean(f.type)}`);
-            if (d.deriving.length > 0)
-                lines.push(`deriving ${d.deriving.join(", ")}`);
-            return lines.join("\n");
+            return lines.join("\n") + emitDeriving(d.name, d.deriving);
         }
         case "type-alias": {
             return `abbrev ${d.name} := ${tyToLean(d.target)}`;
@@ -467,7 +650,17 @@ function emitDecl(d) {
         }
         case "def": {
             const params = d.params.map(p => `(${escapeName(p.name)} : ${tyToLean(p.type)})`).join(" ");
-            let out = `def ${d.name} ${params} : ${tyToLean(d.returnType)} :=\n${emitPureExpr(d.body, 1)}`;
+            // A Bool-returning pure function is a computation, not a proposition, so its
+            // connectives *may* need the Bool operators (&&/||/!) — but only when a
+            // connective has a non-coercible operand (e.g. an inlined union discriminator).
+            // A predicate built from decidable atoms (`x ≥ 0 ∧ x < n`) coerces to Bool as
+            // a whole and stays in the more proof-friendly Prop form. Other return types
+            // only have connectives inside (Decidable) conditions, where Prop is fine.
+            const prevBoolCtx = _boolCtx;
+            _boolCtx = tyToLean(d.returnType) === "Bool" && needsBoolConnectives(d.body);
+            const body = emitPureExpr(d.body, 1);
+            _boolCtx = prevBoolCtx;
+            let out = `def ${d.name} ${params} : ${tyToLean(d.returnType)} :=\n${body}`;
             // A `//@ decreases` on a pure function marks it recursive and names its
             // termination measure — emit it as Lean's `termination_by`. This is
             // required when the recursion is on `arr.slice(...)` (→ `Array.extract`,
@@ -484,13 +677,18 @@ function emitDecl(d) {
             throw new Error("function by method is not supported for Lean backend");
         case "method": {
             const params = d.params.map(p => `(${escapeName(p.name)} : ${tyToLean(p.type)})`).join(" ");
+            // Spec clauses are Prop; the `do` body is computational (Bool).
+            const prevBoolCtx = _boolCtx;
+            _boolCtx = false;
             const lines = [`method ${d.name} ${params} return (res : ${tyToLean(d.returnType)})`];
             for (const r of d.requires)
                 lines.push(`  require ${emitExpr(r)}`);
             for (const e of d.ensures)
                 lines.push(`  ensures ${emitExpr(e)}`);
             lines.push("  do");
+            _boolCtx = true;
             lines.push(emitStmts(d.body, 2));
+            _boolCtx = prevBoolCtx;
             return lines.join("\n");
         }
         case "namespace": {
@@ -504,10 +702,25 @@ function emitDecl(d) {
             throw new Error(`Lean class support not yet implemented: ${d.name}`);
         case "const":
             return `def ${escapeName(d.name)} : ${tyToLean(d.type)} := ${emitExpr(d.value)}`;
-        case "extern":
-            // Lean: emit an opaque function declaration. The user is expected to
-            // provide an axiomatic body or a stub in the companion spec file.
-            throw new Error(`Lean extern support not yet implemented: ${d.name}`);
+        case "extern": {
+            // Mirror Dafny's `function {:axiom}`: an uninterpreted total function.
+            // In Lean that is an `opaque` declaration (sound — it commits to no body,
+            // only to the type being inhabited). Any `requires`/`ensures` the source
+            // carried become a characterizing `axiom`; `\result` was already replaced
+            // by the call expression in the transform, so ensures reference `name args`.
+            const tp = d.typeParams.length > 0 ? ` {${d.typeParams.join(" ")} : Type}` : "";
+            const params = d.params.map(p => `(${escapeName(p.name)} : ${tyToLean(p.type)})`).join(" ");
+            const sig = `opaque ${escapeName(d.name)}${tp}${params ? ` ${params}` : ""} : ${tyToLean(d.returnType)}`;
+            if (d.requires.length === 0 && d.ensures.length === 0)
+                return sig;
+            // Spec axiom: ∀ params, req1 → … → (ens1 ∧ … ∧ ensN). Tagged `@[grind]` so
+            // the proof automation can use it, matching the ghost-function convention.
+            const hyps = d.requires.map(emitExpr);
+            const concl = d.ensures.map(emitExpr).join(" ∧ ");
+            const axBody = [...hyps, concl].join(" → ");
+            const axiom = `@[grind] axiom ${escapeName(d.name)}_spec${params ? ` ${params}` : ""} : ${axBody}`;
+            return `${sig}\n${axiom}`;
+        }
     }
 }
 /** Emit a pure expression with indented if/match blocks. */
@@ -533,12 +746,19 @@ function emitPureExpr(e, indent) {
 // ── File emission ────────────────────────────────────────────
 export function emitLeanFile(file) {
     _needsJSString = false;
-    // Emit declarations first so _needsJSString is set
+    _needsUnknown = false;
+    registerInductives(file.decls);
+    // Emit declarations first so _needsJSString / _needsUnknown are set
     const declLines = [];
     for (const decl of file.decls) {
         declLines.push("");
         declLines.push(emitDecl(decl));
     }
+    // The `unknown` carrier must precede every use (Lean is definition-before-use).
+    if (_needsUnknown && !_unknownEmitted) {
+        declLines.unshift("", "/-- Opaque carrier for `unknown`-typed values (mirrors Dafny's `type Unknown(==, 0)`). -/", "opaque Unknown : Type");
+        _unknownEmitted = true;
+    }
     const lines = [];
     if (file.comment) {
         lines.push("/-");

package/tools/dist/lsc.js

@@ -82,6 +82,13 @@ function main() {
     }
     // File-level directives consumed by the Dafny emitter.
     const safeSlice = /\/\/@ safe-slice\b/.test(fullText);
+    // `//@ lean-module <name>` overrides the Lean module base (default: file
+    // basename). Lean module names are flat/global, so two identically-named
+    // `.ts` files (e.g. an in-place fork's duplicated `compaction.ts`) would emit
+    // colliding `foo.types`/`foo.def` modules; this gives one a distinct base so
+    // both can be separate Lean libraries. Lean-only — Dafny is unaffected.
+    const leanModuleDirective = fullText.match(/\/\/@ lean-module ([A-Za-z0-9_.\-]+)/);
+    const leanModuleOverride = leanModuleDirective ? leanModuleDirective[1] : undefined;
     // Extract: ts-morph → Raw IR
     const raw = extractModule(sourceFile);
     if (cmd === "extract") {
@@ -140,15 +147,16 @@ function main() {
         process.exit(1);
     }
     // ── Lean backend ──────────────────────────────────────────
-    const specPath = path.join(dir, `${base}.spec.lean`);
-    const specImport = existsSync(specPath) ? `«${base}.spec»` : undefined;
-    let { typesFile, defFile } = transformModuleLean(typed, specImport);
+    const leanBase = leanModuleOverride ?? base;
+    const specPath = path.join(dir, `${leanBase}.spec.lean`);
+    const specImport = existsSync(specPath) ? `«${leanBase}.spec»` : undefined;
+    let { typesFile, defFile } = transformModuleLean(typed, specImport, leanModuleOverride);
     if (typesFile)
         typesFile = peepholeModule(typesFile, "lean");
     defFile = peepholeModule(defFile, "lean");
-    const typesPath = typesFile ? path.join(dir, `${base}.types.lean`) : null;
+    const typesPath = typesFile ? path.join(dir, `${leanBase}.types.lean`) : null;
     const typesText = typesFile ? emitLeanFile(typesFile) : null;
-    const defPath = path.join(dir, `${base}.def.lean`);
+    const defPath = path.join(dir, `${leanBase}.def.lean`);
     const defText = emitLeanFile(defFile);
     if (cmd === "gen") {
         leanGen(typesPath, defPath, typesText, defText);
@@ -156,7 +164,7 @@ function main() {
     }
     if (cmd === "check") {
         leanGen(typesPath, defPath, typesText, defText);
-        if (!leanCheck(dir, base))
+        if (!leanCheck(dir, leanBase))
             process.exit(1);
         return;
     }

package/tools/dist/narrow.js

@@ -100,7 +100,7 @@ const parseSimpleOptionalCheck = parseOptionalCheck;
 // ── Walkers ──────────────────────────────────────────────────
 function walkExpr(e) {
     const r = recurseExpr(e);
-    return ruleNullish(r) ?? ruleOptChain(r) ?? ruleImplOptional(r) ?? ruleImplArrayIsArray(r) ?? ruleConditionalArrayIsArray(r) ?? ruleConditionalAndArrayIsArray(r) ?? ruleConditionalAndOptional(r) ?? ruleConditionalOptionalSimple(r) ?? ruleConditionalInMap(r) ?? ruleConditionalOptionalTruthy(r) ?? r;
+    return ruleNullish(r) ?? ruleNullishIndex(r) ?? ruleOptChainIndex(r) ?? ruleOptChain(r) ?? ruleImplOptional(r) ?? ruleImplArrayIsArray(r) ?? ruleConditionalArrayIsArray(r) ?? ruleConditionalAndArrayIsArray(r) ?? ruleConditionalAndOptional(r) ?? ruleConditionalOptionalSimple(r) ?? ruleConditionalInMap(r) ?? ruleConditionalOptionalTruthy(r) ?? r;
 }
 function recurseExpr(e) {
     const re = walkExpr;
@@ -144,7 +144,7 @@ function walkStmt(s) {
     // array rule fires; independent narrows commute, so the order is harmless.)
     // && rules fire before the simple rule because they produce nested ifs whose
     // inner shape doesn't match the simple rule directly.
-    return ruleIfAndOptional(r) ?? ruleIfAndArrayIsArray(r) ?? ruleIfOptionalSimple(r) ?? r;
+    return ruleIfAndOptional(r) ?? ruleIfAndArrayIsArray(r) ?? ruleIfOptionalSimple(r) ?? ruleExprStmtAndOptional(r) ?? r;
 }
 function walkStmts(stmts) {
     const result = [];
@@ -434,6 +434,61 @@ function ruleNullish(e) {
         ty: e.ty,
     };
 }
+/** Rule (expression): `arr[i] ?? right` — nullish coalescing on an array index.
+ *  Under noUncheckedIndexedAccess `arr[i]` is `T | undefined`, undefined exactly
+ *  when out of bounds, so → `(0 <= i && i < arr.length) ? arr[i] : right`. The
+ *  guarded `then` keeps the seq index in bounds for the backend. (Map index is
+ *  already optional-typed and handled by ruleNullish above; this is the array
+ *  case, whose element type stays non-optional in expression position.) */
+function ruleNullishIndex(e) {
+    if (e.kind !== "nullish")
+        return null;
+    if (e.left.kind !== "index")
+        return null;
+    if (e.left.obj.ty.kind !== "array")
+        return null;
+    const idx = e.left.idx;
+    const len = { kind: "field", obj: e.left.obj, field: "length", ty: { kind: "int" } };
+    const lo = { kind: "binop", op: "<=", left: { kind: "num", value: 0, ty: { kind: "int" } }, right: idx, ty: { kind: "bool" } };
+    const hi = { kind: "binop", op: "<", left: idx, right: len, ty: { kind: "bool" } };
+    const cond = { kind: "binop", op: "&&", left: lo, right: hi, ty: { kind: "bool" } };
+    return { kind: "conditional", cond, then: e.left, else: e.right, ty: e.ty };
+}
+/** Rule (expression): `arr[i]?.<chain>` — optional chaining on an array index,
+ *  the optChain sibling of ruleNullishIndex. `arr[i]` is `T | undefined`,
+ *  undefined exactly out of bounds, so → `(0 <= i && i < arr.length) ? <chain on
+ *  arr[i]> : undefined`. The conditional's optional type makes transform wrap the
+ *  in-bounds chain result in Some and the OOB branch in None — the same Option<…>
+ *  a directly-optional scrutinee yields via ruleOptChain, just bounds-guarded.
+ *  (ruleOptChain itself bails here: an array index is typed as the non-optional
+ *  element type, so its `?.` never reaches that rule.) */
+function ruleOptChainIndex(e) {
+    if (e.kind !== "optChain")
+        return null;
+    if (e.obj.kind !== "index")
+        return null;
+    if (e.obj.obj.ty.kind !== "array")
+        return null;
+    const idx = e.obj.idx;
+    const len = { kind: "field", obj: e.obj.obj, field: "length", ty: { kind: "int" } };
+    const lo = { kind: "binop", op: "<=", left: { kind: "num", value: 0, ty: { kind: "int" } }, right: idx, ty: { kind: "bool" } };
+    const hi = { kind: "binop", op: "<", left: idx, right: len, ty: { kind: "bool" } };
+    const cond = { kind: "binop", op: "&&", left: lo, right: hi, ty: { kind: "bool" } };
+    let body = e.obj; // arr[i] — in bounds under `cond`
+    for (const step of e.chain) {
+        if (step.kind === "field") {
+            body = { kind: "field", obj: body, field: step.name, ty: step.ty };
+        }
+        else if (step.kind === "index") {
+            body = { kind: "index", obj: body, idx: step.idx, ty: step.ty };
+        }
+        else {
+            body = { kind: "call", fn: body, args: step.args, ty: step.ty, callKind: step.callKind };
+        }
+    }
+    const undef = { kind: "var", name: "undefined", ty: { kind: "void" } };
+    return { kind: "conditional", cond, then: body, else: undef, ty: e.ty };
+}
 /** Rule (expression): `obj?.<chain>` — single-eval optional chain.
  *  → `someMatch obj { Some(_oc{N}_val) => apply(chain, _oc{N}_val), None => undefined }`.
  *  The someBody applies the chain to the binder directly (field/call/index),
@@ -598,6 +653,38 @@ function ruleIfAndOptional(s) {
         noneBody: [],
     };
 }
+/** Rule: a bare expression statement `x !== undefined && rest` (the `if`-less
+ *  guard idiom, TS-equivalent to `if (x !== undefined) rest;`) where `x` is a
+ *  pure access path.
+ *  → `someMatch x { Some(_x_val) => rest;, None => {} }`.
+ *  Runs `rest` for effect inside the narrowed scope. Wrapping `rest` as an
+ *  expr-statement and walking it lets chained checks
+ *  (`a !== undefined && a.b !== undefined && a.b.f()`) nest into someMatches.
+ *  Unlike the ternary rule (`ruleConditionalAndOptional`), a method call in
+ *  `rest` is fine here: a statement-level someMatch arm keeps it in statement
+ *  position, so transform never ANF-lifts it out of the arm (which would drop
+ *  the guard and reference the un-narrowed optional). */
+function ruleExprStmtAndOptional(s) {
+    if (s.kind !== "expr")
+        return null;
+    if (s.expr.kind !== "binop" || s.expr.op !== "&&")
+        return null;
+    const extracted = extractLeftmostOptionalCheck(s.expr);
+    if (!extracted)
+        return null;
+    const { check, restCond } = extracted;
+    const innerStmt = { kind: "expr", expr: restCond };
+    const someBody = canBeFalsy(check)
+        ? [{ kind: "if", cond: bound(check), then: [walkStmt(innerStmt)], else: [] }]
+        : [walkStmt(innerStmt)];
+    return {
+        kind: "someMatch",
+        scrutinee: check.scrutinee, binderTy: check.innerTy,
+        binder: check.binderHint,
+        someBody,
+        noneBody: [],
+    };
+}
 // ── Discriminant narrowing ──────────────────────────────────
 /** Detect `Array.isArray(<path>)` where `<path>` is a var or a chain of
  *  field accesses rooted at a var, and the path's type is a synthesized

package/tools/dist/peephole.js

@@ -13,6 +13,7 @@ function mapExpr(e, f) {
         case "emptyMap":
         case "emptySet":
         case "havoc":
+        case "default":
         case "mapLiteral": return e;
         case "binop": return { ...e, left: r(e.left), right: r(e.right) };
         case "unop": return { ...e, expr: r(e.expr) };
@@ -358,6 +359,7 @@ function rewriteChildrenExpr(e) {
         case "emptyMap":
         case "emptySet":
         case "havoc":
+        case "default":
         case "mapLiteral": return e;
         case "binop": return { ...e, left: r(e.left), right: r(e.right) };
         case "unop": return { ...e, expr: r(e.expr) };