use hax_lib as hax;

/// A simple verified function with preconditions and postconditions
#[hax::requires(x < 100 && y < 100)]
#[hax::ensures(|result| result == x + y && result > x && result > y)]
pub fn verified_add(x: u32, y: u32) -> u32 {
    // This is regular Rust code
    let result = x + y;
    
    // Add assertions to help the verifier
    hax::assert!(result > x);
    hax::assert!(result > y);
    
    result
}

use hax_lib as hax;
use hax_lib::int::Int;

/// Proven safe: cannot panic due to division by zero
#[hax::requires(divisor != 0)]
#[hax::ensures(|result| 
    Int::from(result) * Int::from(divisor) + Int::from(dividend % divisor) 
    == Int::from(dividend)
)]
pub fn safe_divide(dividend: u32, divisor: u32) -> u32 {
    dividend / divisor  // Provably safe due to precondition
}

/// Alternative: using Option for total functions
#[hax::ensures(|result| match result {
    Some(val) => divisor != 0 && 
                 Int::from(val) * Int::from(divisor) == Int::from(dividend),
    None => divisor == 0
})]
pub fn checked_divide(dividend: u32, divisor: u32) -> Option<u32> {
    dividend.checked_div(divisor)
}

use hax_lib::int::{Int, ToInt};

/// Verify correctness using mathematical integers
#[hax::requires(
    Int::from(x) + Int::from(y) <= Int::from(u32::MAX) &&
    Int::from(x) + Int::from(y) >= Int::from(u32::MIN)
)]
#[hax::ensures(|result| Int::from(result) == Int::from(x) + Int::from(y))]
pub fn overflow_safe_add(x: u32, y: u32) -> u32 {
    // The preconditions prove this operation is safe
    x + y
}

/// Alternative: using Int directly in specifications
fn demonstrate_int_arithmetic() {
    // Create mathematical integers (unbounded)
    let a = hax::int!(1_000_000_000_000);
    let b = hax::int!(2_000_000_000_000);
    let c = a + b;  // No overflow in mathematical integers
    
    hax::assert!(c == hax::int!(3_000_000_000_000));
    
    // Convert back to machine integers (with bounds checking)
    let concrete: u64 = c.concretize();  // Verified to fit
}

use hax_lib as hax;

/// A non-zero integer type
#[hax::refinement_type]
pub struct NonZero {
    #[hax::refinement]
    value: i32,
}

impl hax::Refinement for NonZero {
    type InnerType = i32;
    
    /// The invariant: value must not be zero
    fn invariant(value: i32) -> hax::Prop {
        hax::Prop::from(value != 0)
    }
}

/// This function is provably safe from division by zero
/// just from the type signature!
pub fn divide_by_nonzero(dividend: i32, divisor: NonZero) -> i32 {
    // The type system guarantees *divisor != 0
    dividend / *divisor
}

/// Smart constructor with runtime check
impl NonZero {
    #[hax::ensures(|result| match result {
        Some(nz) => *nz == value && value != 0,
        None => value == 0
    })]
    pub fn new(value: i32) -> Option<Self> {
        if value != 0 {
            Some(NonZero { value })
        } else {
            None
        }
    }
}

/// Mark this function as opaque to verifier
#[hax::opaque]
#[hax::requires(n > 0)]
#[hax::ensures(|result| result > 0)]
fn expensive_computation(n: u32) -> u32 {
    // Complex implementation that's verified once
    // Callers only see the contract, not the implementation
    // This makes verification much faster
    (0..n).sum()
}

/// This function's verification doesn't need to re-verify
/// expensive_computation's implementation
fn caller(x: u32) -> u32 {
    if x > 0 {
        let result = expensive_computation(x);
        hax::assert!(result > 0);  // Follows from contract
        result
    } else {
        1
    }
}

// ✅ GOOD: Normal Rust with added specifications
#[hax::requires(v.len() > 0)]
pub fn first_element(v: &[u32]) -> u32 {
    v[0]  // Normal array indexing
}

// ❌ BAD: Inventing special verification syntax
// (This is what other tools might do, but hax avoids it)
pub fn first_element(v: &[u32]) -> u32 {
    get_verified_element(v, 0)  // No special functions needed
}

/// Returns the maximum element in the array.
/// 
/// # Specification
/// - Requires: The array is non-empty
/// - Ensures: Result is greater than or equal to all elements
/// - Ensures: Result is equal to at least one element
#[hax::requires(arr.len() > 0)]
#[hax::ensures(|result| 
    forall(|i: usize| implies(i < arr.len(), arr[i] <= result)) &&
    exists(|i: usize| i < arr.len() && arr[i] == result)
)]
pub fn find_max(arr: &[u32]) -> u32 {
    // Implementation...
}

// Level 1: Basic implementation
pub fn safe_add(x: u32, y: u32) -> Option<u32> {
    x.checked_add(y)
}

// Level 2: Add type-level specification
use hax_lib::int::Int;

#[hax::ensures(|result| match result {
    Some(sum) => Int::from(sum) == Int::from(x) + Int::from(y),
    None => Int::from(x) + Int::from(y) > Int::from(u32::MAX)
})]
pub fn safe_add(x: u32, y: u32) -> Option<u32> {
    x.checked_add(y)
}

// Level 3: Add overflow-free variant
#[hax::requires(Int::from(x) + Int::from(y) <= Int::from(u32::MAX))]
#[hax::ensures(|result| Int::from(result) == Int::from(x) + Int::from(y))]
pub fn guaranteed_add(x: u32, y: u32) -> u32 {
    x + y
}

// Verify complex function once
#[hax::opaque]
#[hax::ensures(|result| result >= input)]
fn complex_transform(input: u32) -> u32 {
    // 1000 lines of complex logic
    // Verified once with all its details
    // ...
}

// Use it many times without reverification cost
fn client_code_1(x: u32) -> u32 {
    let y = complex_transform(x);
    hax::assert!(y >= x);  // Fast: uses contract only
    y + 1
}

fn client_code_2(x: u32) -> u32 {
    let y = complex_transform(x);
    hax::assert!(y >= x);  // Fast: uses contract only
    y * 2
}

// Core module organization
pub mod hax_lib {
    // Main types
    pub use int::Int;              // Mathematical integers
    pub use props::Prop;           // Logical propositions
    
    // Abstraction system
    pub use abstraction::{
        Abstraction,               // Trait for lifting to abstract types
        Concretization,           // Trait for lowering to concrete types
        RefineAs,                 // Refinement conversion
    };
    
    // Refinement types
    pub use refinement::Refinement;
    
    // Declarative macros
    pub use macros::{
        assert,                   // Proof obligation
        assume,                   // Unsafe assumption
        assert_prop,             // Logical proposition assertion
        forall,                  // Universal quantifier
        exists,                  // Existential quantifier
        implies,                 // Implication
        int,                     // Int literal
    };
    
    // Procedural macros (re-exported from hax-lib-macros)
    pub use hax_lib_macros::{
        requires,                 // Precondition attribute
        ensures,                  // Postcondition attribute
        loop_invariant,          // Loop invariant
        decreases,               // Termination measure
        opaque,                  // Opacity marker
        lemma,                   // Lemma designation
        refinement_type,         // Refinement type macro
        // ... more macros
    };
    
    // Backend-specific modules
    pub mod fstar;               // F* helpers
    pub mod lean;                // Lean helpers
    pub mod coq;                 // Coq helpers
}

// In normal compilation (cargo build):
// - Int operations are no-ops or simple wrappers
// - Assertions compile to debug_assert! or nothing
// - Specifications are ignored

pub fn example(x: u32) -> u32 {
    hax::assert!(x < 100);  // No-op in release, debug_assert! in debug
    x + 1
}

// In hax extraction (cargo hax into fstar):
// - Int is unbounded mathematical integer
// - Assertions become proof obligations
// - Specifications are extracted as formal contracts

// Generated F*:
// val example (x: u32) : Pure u32
//   (requires x <. 100ul)
//   (ensures fun result -> result >. x)

// 1. FUNCTION CONTRACTS
#[requires(precondition)]      // Preconditions
#[ensures(|result| postcondition)]  // Postconditions
#[lemma]                       // Mark as lemma

// 2. LOOP SPECIFICATIONS  
#[loop_invariant(property)]    // Invariant preserved
#[loop_decreases(measure)]     // Termination measure

// 3. TYPE SPECIFICATIONS
#[refinement_type]             // Create refinement type
#[refinement]                  // Mark refinement field

// 4. VISIBILITY AND EXTRACTION
#[opaque]                      // Hide implementation
#[exclude]                     // Don't extract
#[include]                     // Force extraction

// 5. BACKEND-SPECIFIC
#[fstar::options("...")]       // F* options
#[fstar::verification_status(lax)]  // Skip verification
#[lean::type("...")]           // Lean type override

// 6. PROTOCOL (ProVerif)
#[protocol_messages]           // Define protocol messages
#[pv_constructor]              // ProVerif constructor
#[process_init]                // Process definition

// Rust input
match option {
    Some(x) => x + 1,
    None => 0,
}

// Simplified representation
let __match_tmp = option;
if is_some(__match_tmp) {
    let x = unwrap(__match_tmp);
    x + 1
} else {
    0
}

// Rust input
fn generic<T: Add>(x: T, y: T) -> T {
    x + y
}

// After monomorphization
fn generic_u32(x: u32, y: u32) -> u32 {
    U32::add(x, y)  // Explicit trait call
}

// Rust input with loop_invariant
#[loop_invariant(sum <= i * MAX)]
for i in 0..n {
    sum += arr[i];
}

// Transformed representation (conceptual)
let mut i = 0;
assert!(sum <= i * MAX);  // Initial invariant
while i < n {
    let old_i = i;
    let old_sum = sum;
    
    sum += arr[i];
    i += 1;
    
    assert!(sum <= i * MAX);  // Preserved invariant
}

// src/lib.rs or src/main.rs
// Add to existing code
use hax_lib as hax;

// Gradually add specifications to existing functions
#[hax::requires(input.len() > 0)]
pub fn existing_function(input: &[u8]) -> u8 {
    // Your existing implementation
    input[0]
}

// src/lib.rs
use hax_lib as hax;
use hax_lib::int::{Int, ToInt};

/// Adds two numbers if the result fits in u32, otherwise returns None
/// 
/// # Specification
/// - If the sum fits in u32, returns Some(x + y)
/// - If the sum would overflow, returns None
/// - The function never panics
pub fn bounded_add(x: u32, y: u32) -> Option<u32> {
    x.checked_add(y)
}

use hax_lib as hax;
use hax_lib::int::{Int, ToInt};

/// Adds two numbers if the result fits in u32, otherwise returns None
#[hax::ensures(|result| match result {
    Some(sum) => {
        // If we return Some, the sum is correct
        Int::from(sum) == Int::from(x) + Int::from(y) &&
        // And it fits in u32
        Int::from(sum) <= Int::from(u32::MAX)
    },
    None => {
        // If we return None, the sum would overflow
        Int::from(x) + Int::from(y) > Int::from(u32::MAX)
    }
})]
pub fn bounded_add(x: u32, y: u32) -> Option<u32> {
    x.checked_add(y)
}

#[cfg(test)]
mod tests {
    use super::*;
    
    #[test]
    fn test_no_overflow() {
        assert_eq!(bounded_add(10, 20), Some(30));
        assert_eq!(bounded_add(0, 0), Some(0));
        assert_eq!(bounded_add(u32::MAX - 1, 1), Some(u32::MAX));
    }
    
    #[test]
    fn test_overflow() {
        assert_eq!(bounded_add(u32::MAX, 1), None);
        assert_eq!(bounded_add(u32::MAX, u32::MAX), None);
        assert_eq!(bounded_add(u32::MAX - 1, 2), None);
    }
}

// Rust's u32 wraps around
let x: u32 = u32::MAX;
let y: u32 = 1;
let z = x + y;  // z == 0 (wraps around!)

// This makes reasoning difficult:
// x + y < x  (true due to wrapping!)

use hax_lib::int::Int;

// Mathematical integers never wrap
let x = Int::from(u32::MAX);
let y = Int::from(1u32);
let z = x + y;  // z == 2^32 (mathematical result)

// Reasoning is straightforward:
// x + y > x  (always true for positive y)

use hax_lib as hax;
use hax_lib::int::{Int, ToInt};

fn int_creation_examples() {
    // Method 1: Using int! macro (for literals)
    let a = hax::int!(42);
    let b = hax::int!(1_000_000_000_000);  // Arbitrary size
    
    // Method 2: Using Int::from (for variables)
    let x: u32 = 42;
    let a = Int::from(x);
    
    // Method 3: Using .to_int() or .lift() trait method
    let x: u32 = 42;
    let a = x.to_int();  // or x.lift()
    
    // Method 4: From expressions
    let x: u32 = 10;
    let y: u32 = 20;
    let sum_concrete = x + y;
    let sum_math = Int::from(sum_concrete);
    
    // All methods create the same mathematical integer
    hax::assert!(a == hax::int!(42));
}

use hax_lib as hax;
use hax_lib::int::{Int, ToInt};

fn int_operations() {
    let x = hax::int!(10);
    let y = hax::int!(20);
    
    // ARITHMETIC OPERATIONS
    let sum = x + y;           // Addition: 30
    let diff = x - y;          // Subtraction: -10
    let product = x * y;       // Multiplication: 200
    let quotient = x / y;      // Division: 0 (truncated)
    let negation = x.neg();    // Negation: -10
    
    // COMPARISON
    hax::assert!(x < y);       // Less than
    hax::assert!(x <= y);      // Less than or equal
    hax::assert!(y > x);       // Greater than
    hax::assert!(y >= x);      // Greater than or equal
    hax::assert!(x != y);      // Not equal
    
    // SPECIAL OPERATIONS
    let power = x.pow(3);      // Exponentiation: 1000
    let abs = diff.abs();      // Absolute value: 10
    
    // Euclidean remainder (always non-negative)
    let rem = x.rem_euclid(3); // 10 % 3 = 1
    
    // Check if representable in concrete type
    hax::assert!(sum.in_bounds::<u32>());
}

use hax_lib::int::{Int, ToInt};

fn concretization_examples(x: u32, y: u32) {
    let math_sum = Int::from(x) + Int::from(y);
    
    // Method 1: concretize() - requires proof that value fits
    let concrete: u32 = math_sum.concretize();
    // This will fail verification if math_sum might be > u32::MAX
    
    // Method 2: Safe conversion with precondition
    if math_sum <= Int::from(u32::MAX) {
        let concrete: u32 = math_sum.concretize();
        // Now provably safe
    }
    
    // Method 3: Checked conversion
    if let Some(concrete) = try_concretize::<u32>(math_sum) {
        // Use concrete value
    }
}

// Helper for safe concretization
fn try_concretize<T: TryFrom<Int>>(value: Int) -> Option<T> {
    value.try_into().ok()
}

use hax_lib::int::{Int, ToInt};

#[hax::requires(Int::from(x) + Int::from(y) <= Int::from(u32::MAX))]
#[hax::ensures(|result| Int::from(result) == Int::from(x) + Int::from(y))]
pub fn safe_add(x: u32, y: u32) -> u32 {
    // The precondition proves this won't overflow
    x + y
}

// Usage
fn caller() {
    let a = 100u32;
    let b = 200u32;
    
    // Must prove the precondition holds
    hax::assert!(Int::from(a) + Int::from(b) <= Int::from(u32::MAX));
    let c = safe_add(a, b);
}

use hax_lib::int::{Int, ToInt};

/// Computes n! (factorial)
#[hax::decreases(n)]
#[hax::ensures(|result| Int::from(result) == math_factorial(n.to_int()))]
pub fn factorial(n: u32) -> u64 {
    if n == 0 {
        1
    } else {
        n as u64 * factorial(n - 1)
    }
}

// Specification function (not extracted, only for verification)
#[hax::exclude]
fn math_factorial(n: Int) -> Int {
    if n <= hax::int!(0) {
        hax::int!(1)
    } else {
        n * math_factorial(n - hax::int!(1))
    }
}

use hax_lib::int::{Int, ToInt};

fn sum_array(arr: &[u32]) -> u64 {
    let mut sum = 0u64;
    let mut i = 0usize;
    
    #[hax::loop_invariant(
        // sum equals the mathematical sum of first i elements
        Int::from(sum) == array_sum(arr, i)
    )]
    #[hax::loop_decreases(arr.len() - i)]
    while i < arr.len() {
        sum += arr[i] as u64;
        i += 1;
    }
    
    sum
}

// Specification: mathematical sum of first n elements
#[hax::exclude]
fn array_sum(arr: &[u32], n: usize) -> Int {
    if n == 0 {
        hax::int!(0)
    } else {
        Int::from(arr[n-1]) + array_sum(arr, n-1)
    }
}

use hax_lib::{Prop, forall, exists, implies};

fn proposition_examples() {
    // From boolean expressions
    let p = Prop::from(true);
    let q = Prop::from(1 < 2);
    
    // From quantifiers
    let all_positive = forall(|x: u32| x >= 0);
    let has_zero = exists(|x: i32| x == 0);
    
    // From implications
    let imp = implies(Prop::from(true), Prop::from(true));
}

use hax_lib::Prop;

fn prop_operations(x: bool, y: bool) {
    let p = Prop::from(x);
    let q = Prop::from(y);
    
    // LOGICAL OPERATIONS
    let conjunction = p.and(q);      // p ∧ q
    let disjunction = p.or(q);       // p ∨ q
    let negation = p.not();          // ¬p
    let implication = p.implies(q);  // p → q
    
    // COMPARISONS
    let equal = p.eq(q);             // p ≡ q
    let not_equal = p.ne(q);         // p ≠ q
}

use hax_lib as hax;

fn using_propositions(arr: &[u32], target: u32) -> bool {
    // Assert a proposition
    hax::assert_prop!(forall(|i: usize| {
        implies(i < arr.len(), arr[i] <= u32::MAX)
    }));
    
    // Check if target exists in array
    let exists_target = exists(|i: usize| {
        i < arr.len() && arr[i] == target
    });
    
    // We can't evaluate propositions directly,
    // but we can use them in specifications
    unimplemented!("Prop is for specifications only")
}

pub trait Abstraction {
    /// The abstract representation of this type
    type AbstractType;
    
    /// Convert from concrete to abstract
    fn lift(self) -> Self::AbstractType;
}

// Example implementations
impl Abstraction for u32 {
    type AbstractType = Int;
    
    fn lift(self) -> Int {
        Int::from(self)
    }
}

impl Abstraction for bool {
    type AbstractType = Prop;
    
    fn lift(self) -> Prop {
        Prop::from(self)
    }
}

pub trait Concretization<T> {
    /// Convert from abstract to concrete
    /// May fail if the abstract value doesn't fit in the concrete type
    fn concretize(self) -> T;
}

// Example implementation
impl Concretization<u32> for Int {
    fn concretize(self) -> u32 {
        // Verification will fail if self > u32::MAX
        u32::try_from(self).unwrap()
    }
}

use hax_lib::int::{Int, ToInt};

fn abstraction_example(x: u32) -> u32 {
    // Lift to Int
    let abstract_x: Int = x.lift();  // or x.to_int()
    
    // Work in abstract domain
    let abstract_result = abstract_x * hax::int!(2);
    
    // Prove result fits in u32
    hax::assert!(abstract_result <= Int::from(u32::MAX));
    
    // Concretize back to u32
    let concrete_result: u32 = abstract_result.concretize();
    
    concrete_result
}

#[hax::ensures(|result| result > x)]  // Automatically lifts to Int
pub fn increment(x: u32) -> u32 {
    x + 1
}

// Equivalent to:
#[hax::ensures(|result| Int::from(result) > Int::from(x))]
pub fn increment(x: u32) -> u32 {
    x + 1
}

use hax_lib::int::{Int, ToInt};

#[hax::ensures(|result| 
    Int::from(result) == Int::from(x) + Int::from(y)
)]
pub fn add(x: u32, y: u32) -> u32 {
    x.wrapping_add(y)  // Even wrapping_add can be specified!
}

use hax_lib::int::Int;

/// Convert u32 to i64, proving no overflow
#[hax::ensures(|result| Int::from(result) == Int::from(x))]
pub fn u32_to_i64(x: u32) -> i64 {
    x as i64  // Safe because u32::MAX < i64::MAX
}

/// Saturating subtraction specification
#[hax::ensures(|result| {
    if Int::from(x) >= Int::from(y) {
        Int::from(result) == Int::from(x) - Int::from(y)
    } else {
        result == 0
    }
})]
pub fn saturating_sub(x: u32, y: u32) -> u32 {
    x.saturating_sub(y)
}

use hax_lib as hax;

pub fn simple_assert(x: u32) {
    // The verifier must prove x < u32::MAX
    hax::assert!(x < u32::MAX);
    
    // This always holds for u32
    // Verification succeeds
}

pub fn failing_assert(x: u32, y: u32) {
    // The verifier must prove x + y never overflows
    hax::assert!(x + y > x);
    
    // This might not hold (overflow)
    // Verification fails without more context
}

use hax_lib as hax;

pub fn assertion_runtime() {
    hax::assert!(true);   // No-op in release builds
                          // debug_assert! in debug builds
    
    hax::assert!(false);  // Panics in debug builds
                          // No-op in release builds
                          // Verification fails
}

use hax_lib as hax;

/// Use assert! to help the verifier prove postconditions
#[hax::ensures(|result| result > x)]
pub fn increment(x: u32) -> u32 {
    let result = x + 1;
    
    // Help the verifier by asserting intermediate steps
    hax::assert!(result > x);
    
    result
}

/// Use assert! to document assumptions about code
pub fn process_array(arr: &[u32]) {
    hax::assert!(arr.len() <= 1000);  // Document size assumption
    
    for i in 0..arr.len() {
        // Process elements
        hax::assert!(i < arr.len());  // Bounds check proof
    }
}

/// Use assert! to break down complex proofs
pub fn complex_computation(x: u32, y: u32) -> u32 {
    hax::assert!(x < 100);  // Step 1
    hax::assert!(y < 100);  // Step 2
    
    let sum = x + y;
    hax::assert!(sum < 200);  // Step 3: follows from 1 and 2
    
    sum
}

use hax_lib as hax;

pub fn unsafe_assumption(x: u32, y: u32) -> u32 {
    // Tell the verifier to trust that y != 0
    // WITHOUT PROOF
    hax::assume!(y != 0);
    
    // Now the division is "proven" safe
    // But this is unsound if y could actually be 0!
    x / y
}

use hax_lib as hax;

/// External function we can't verify
#[hax::exclude]
extern "C" {
    fn external_function(x: u32) -> u32;
}

pub fn call_external(x: u32) -> u32 {
    let result = unsafe { external_function(x) };
    
    // We trust (but can't prove) that external_function
    // never returns 0
    hax::assume!(result != 0);
    
    100 / result
}

use hax_lib as hax;

pub fn mutually_recursive_a(x: u32) -> u32 {
    if x > 0 {
        mutually_recursive_b(x - 1)
    } else {
        0
    }
}

pub fn mutually_recursive_b(x: u32) -> u32 {
    if x > 0 {
        mutually_recursive_a(x - 1)
    } else {
        // Assume termination (trust)
        hax::assume!(x == 0);
        1
    }
}

use hax_lib as hax;

pub fn prime_theorem(n: u32) -> bool {
    // Assume the prime number theorem
    hax::assume!(prime_density_bound(n));
    
    // Use this assumption in further proofs
    is_prime(n)
}

#[hax::exclude]
fn prime_density_bound(n: u32) -> bool {
    // Mathematical property we trust
    true
}

use hax_lib as hax;

/// ⚠️ DANGER: Unsound proof!
pub fn unsound_example(x: u32) -> u32 {
    // This is FALSE but we assume it
    hax::assume!(x > 100);
    
    // Now we can "prove" anything
    hax::assert!(x > 50);   // "Verified" but wrong!
    
    // This code could panic at runtime
    x - 50
}

/// The verifier thinks this is safe, but it can crash!
fn caller() {
    let result = unsound_example(10);  // PANIC! 10 - 50 underflows
}

use hax_lib as hax;

pub fn prop_assertion(arr: &[u32]) {
    // Assert a property over all array elements
    hax::assert_prop!(forall(|i: usize| {
        implies(i < arr.len(), arr[i] >= 0)
    }));
    
    // This always holds for u32 (always non-negative)
    // Verification succeeds
}

use hax_lib as hax;

pub fn complex_proposition(arr: &[i32], target: i32) {
    // Existential quantification
    hax::assert_prop!(exists(|i: usize| {
        i < arr.len() && arr[i] == target
    }));
    
    // Universal with implication
    hax::assert_prop!(forall(|i: usize| {
        implies(i < arr.len() && arr[i] == target, i < 100)
    }));
    
    // Nested quantifiers
    hax::assert_prop!(forall(|i: usize| {
        implies(i < arr.len(),
            forall(|j: usize| {
                implies(j < arr.len() && i != j, arr[i] != arr[j])
            })
        )
    }));
}

use hax_lib as hax;

fn comparison(x: u32) {
    // assert! - for concrete, computable conditions
    hax::assert!(x < 100);  // Can evaluate at runtime
    
    // assert_prop! - for logical, possibly non-computable propositions
    hax::assert_prop!(forall(|y: u32| y >= 0));  // Can't evaluate at runtime
}

use hax_lib as hax;

pub fn debugging_example(x: u32) -> u32 {
    // This is ONLY for runtime debugging
    // Generates NO proof obligation
    debug_assert!(expensive_check(x));
    
    // hax doesn't see this assertion at all
    x + 1
}

fn expensive_check(x: u32) -> bool {
    // Expensive computation for testing
    (0..x).all(|i| i < 1000)
}

pub fn use_debug_assert(arr: &[u32]) {
    // Use debug_assert! for:
    
    // 1. Expensive runtime checks
    debug_assert!(arr.iter().all(|&x| is_valid(x)));
    
    // 2. Checks that are redundant with verification
    for i in 0..arr.len() {
        hax::assert!(i < arr.len());  // Verified
        debug_assert!(i < arr.len()); // Runtime check (redundant)
    }
    
    // 3. Development/testing assertions
    debug_assert_eq!(arr.len(), expected_len());
}

#[hax::exclude]
fn is_valid(x: u32) -> bool { x < 1000 }

#[hax::exclude]
fn expected_len() -> usize { 10 }

use hax_lib as hax;

pub fn choosing_assertions(x: u32, arr: &[u32]) {
    // Use assert! for simple, provable facts
    hax::assert!(x < u32::MAX);
    
    // Use assert_prop! for logical properties
    hax::assert_prop!(forall(|i: usize| {
        implies(i < arr.len(), arr[i] < 1000)
    }));
    
    // Use assume! ONLY when necessary (rare!)
    #[cfg(feature = "unsafe_trust")]
    {
        hax::assume!(x > 100);  // Trust external invariant
    }
    
    // Use debug_assert! for expensive runtime checks
    debug_assert!(complex_property_holds(x, arr));
}

#[hax::exclude]
fn complex_property_holds(x: u32, arr: &[u32]) -> bool {
    // Expensive check
    true
}

use hax_lib as hax;

/// ❌ WRONG: Using assume! instead of proving
pub fn wrong_division(x: u32, y: u32) -> u32 {
    hax::assume!(y != 0);  // Lazy! Should prove this
    x / y
}

/// ✅ CORRECT: Prove with precondition
#[hax::requires(y != 0)]
pub fn correct_division(x: u32, y: u32) -> u32 {
    x / y
}

/// ❌ WRONG: Asserting unprovable facts
pub fn wrong_assert(x: u32) {
    hax::assert!(x == 42);  // Can't prove this for arbitrary x!
}

/// ✅ CORRECT: Only assert provable facts
#[hax::requires(x == 42)]
pub fn correct_assert(x: u32) {
    hax::assert!(x == 42);  // Now provable from precondition
}

use hax_lib::{forall, implies};

fn forall_examples() {
    // All u32 values are non-negative
    let prop1 = forall(|x: u32| x >= 0);
    
    // All array indices are in bounds
    let prop2 = forall(|i: usize| 
        implies(i < arr.len(), arr[i] <= u32::MAX)
    );
    
    // All pairs satisfy a relation
    let prop3 = forall(|x: u32| forall(|y: u32| 
        x + y >= x
    ));
}

use hax_lib as hax;

/// Ensure all array elements are positive
#[hax::requires(forall(|i: usize| 
    implies(i < arr.len(), arr[i] > 0)
))]
pub fn all_positive(arr: &[u32]) {
    // We can assume all elements are positive
    for i in 0..arr.len() {
        hax::assert!(arr[i] > 0);
    }
}

/// Find minimum element
#[hax::requires(arr.len() > 0)]
#[hax::ensures(|result| 
    forall(|i: usize| implies(i < arr.len(), result <= arr[i])) &&
    exists(|i: usize| i < arr.len() && result == arr[i])
)]
pub fn find_min(arr: &[u32]) -> u32 {
    let mut min = arr[0];
    for i in 1..arr.len() {
        if arr[i] < min {
            min = arr[i];
        }
    }
    min
}

use hax_lib as hax;

/// Matrix property: all rows have equal length
#[hax::requires(
    forall(|i: usize| forall(|j: usize| 
        implies(
            i < matrix.len() && j < matrix.len(),
            matrix[i].len() == matrix[j].len()
        )
    ))
)]
pub fn rectangular_matrix(matrix: &[Vec<u32>]) {
    // Can assume all rows have same length
    if matrix.len() > 0 {
        let width = matrix[0].len();
        for i in 0..matrix.len() {
            hax::assert!(matrix[i].len() == width);
        }
    }
}

use hax_lib::exists;

fn exists_examples(arr: &[u32], target: u32) {
    // There exists a zero in the array
    let prop1 = exists(|i: usize| 
        i < arr.len() && arr[i] == 0
    );
    
    // There exists an element equal to target
    let prop2 = exists(|i: usize|
        i < arr.len() && arr[i] == target
    );
    
    // There exist two different indices with same value
    let prop3 = exists(|i: usize| exists(|j: usize|
        i < arr.len() && j < arr.len() && i != j && arr[i] == arr[j]
    ));
}

use hax_lib as hax;

/// Search for target in array
#[hax::ensures(|result| match result {
    Some(idx) => idx < arr.len() && arr[idx] == target,
    None => forall(|i: usize| 
        implies(i < arr.len(), arr[i] != target)
    )
})]
pub fn search(arr: &[u32], target: u32) -> Option<usize> {
    for i in 0..arr.len() {
        if arr[i] == target {
            return Some(i);
        }
    }
    None
}

/// Check if array contains duplicates
#[hax::ensures(|result| 
    result == exists(|i: usize| exists(|j: usize|
        i < arr.len() && j < arr.len() && i < j && arr[i] == arr[j]
    ))
)]
pub fn has_duplicates(arr: &[u32]) -> bool {
    for i in 0..arr.len() {
        for j in (i+1)..arr.len() {
            if arr[i] == arr[j] {
                return true;
            }
        }
    }
    false
}

use hax_lib::implies;

fn implies_examples(x: u32) {
    // If x > 10, then x > 5
    let prop1 = implies(x > 10, x > 5);
    
    // If x is even, then x % 2 == 0
    let prop2 = implies(x % 2 == 0, is_even(x));
    
    // Chained implications
    let prop3 = implies(x > 100, implies(x > 50, x > 25));
}

fn is_even(x: u32) -> bool {
    x % 2 == 0
}

use hax_lib as hax;

/// Bounded array property
#[hax::requires(forall(|i: usize| 
    implies(i < arr.len(), arr[i] <= bound)
))]
#[hax::ensures(|result| result <= bound)]
pub fn max_bounded(arr: &[u32], bound: u32) -> u32 {
    let mut max = 0;
    for i in 0..arr.len() {
        // From precondition: arr[i] <= bound
        hax::assert!(implies(i < arr.len(), arr[i] <= bound));
        
        if arr[i] > max {
            max = arr[i];
        }
    }
    max
}

/// Conditional property
#[hax::ensures(|result| 
    implies(result, forall(|i: usize| 
        implies(i < arr.len(), arr[i] > 0)
    ))
)]
pub fn all_positive_check(arr: &[u32]) -> bool {
    for i in 0..arr.len() {
        if arr[i] == 0 {
            return false;
        }
    }
    true
}

use hax_lib::Prop;

fn conjunction_example(x: u32, y: u32) -> Prop {
    let p = Prop::from(x > 0);
    let q = Prop::from(y > 0);
    
    // Both x and y are positive
    p.and(q)
}

/// Function with multiple requirements
#[hax::requires(x > 0 && y > 0 && x < 100 && y < 100)]
pub fn both_positive(x: u32, y: u32) -> u32 {
    x + y
}

use hax_lib::Prop;

fn disjunction_example(x: u32) -> Prop {
    let p = Prop::from(x == 0);
    let q = Prop::from(x > 0);
    
    // x is either zero or positive
    p.or(q)
}

/// At least one positive
#[hax::requires(x > 0 || y > 0)]
pub fn at_least_one_positive(x: u32, y: u32) -> bool {
    x > 0 || y > 0
}

use hax_lib::Prop;

fn negation_example(x: u32) -> Prop {
    let p = Prop::from(x == 0);
    
    // x is not zero
    p.not()
}

/// x is non-zero
#[hax::requires(x != 0)]
pub fn non_zero(x: u32) -> u32 {
    100 / x
}

use hax_lib as hax;

/// Check if array is sorted
#[hax::ensures(|result|
    result == forall(|i: usize| forall(|j: usize|
        implies(
            i < arr.len() && j < arr.len() && i < j,
            arr[i] <= arr[j]
        )
    ))
)]
pub fn is_sorted(arr: &[u32]) -> bool {
    for i in 0..(arr.len().saturating_sub(1)) {
        if arr[i] > arr[i + 1] {
            return false;
        }
    }
    true
}

use hax_lib as hax;

/// Partition array around pivot
#[hax::ensures(|pivot_idx|
    // All elements before pivot are <= pivot value
    forall(|i: usize| implies(
        i < pivot_idx,
        arr[i] <= arr[pivot_idx]
    )) &&
    // All elements after pivot are >= pivot value
    forall(|j: usize| implies(
        j >= pivot_idx && j < arr.len(),
        arr[j] >= arr[pivot_idx]
    ))
)]
pub fn partition(arr: &mut [u32]) -> usize {
    // Implementation...
    0
}

use hax_lib as hax;

/// Sort array (produces permutation of input)
#[hax::ensures(|_|
    // Output is sorted
    forall(|i: usize| forall(|j: usize|
        implies(i < j && j < arr.len(), arr[i] <= arr[j])
    )) &&
    // Output is permutation (same multiset)
    forall(|val: u32|
        count_occurrences(arr, val) == count_occurrences(hax::old(arr), val)
    )
)]
pub fn sort(arr: &mut [u32]) {
    // Implementation...
}

#[hax::exclude]
fn count_occurrences(arr: &[u32], val: u32) -> usize {
    arr.iter().filter(|&&x| x == val).count()
}

pub trait Refinement {
    /// The underlying concrete type
    type InnerType;
    
    /// The logical invariant that must hold
    fn invariant(value: Self::InnerType) -> Prop;
    
    /// Construct from inner value (unchecked, for internal use)
    fn new(value: Self::InnerType) -> Self;
    
    /// Extract inner value
    fn get(self) -> Self::InnerType;
    
    /// Get mutable reference to inner value
    fn get_mut(&mut self) -> &mut Self::InnerType;
}

use hax_lib as hax;

/// A non-zero integer
#[hax::refinement_type]
pub struct NonZero {
    #[hax::refinement]
    value: i32,
}

impl hax::Refinement for NonZero {
    type InnerType = i32;
    
    fn invariant(value: i32) -> hax::Prop {
        hax::Prop::from(value != 0)
    }
}

/// Smart constructor with validation
impl NonZero {
    #[hax::ensures(|result| match result {
        Some(nz) => *nz == value && value != 0,
        None => value == 0
    })]
    pub fn new(value: i32) -> Option<Self> {
        if value != 0 {
            Some(NonZero { value })
        } else {
            None
        }
    }
}

/// Usage: Division is provably safe
pub fn safe_divide(x: i32, divisor: NonZero) -> i32 {
    // The type guarantees *divisor != 0
    x / *divisor
}

use hax_lib as hax;

/// An integer in the range [MIN, MAX]
#[hax::refinement_type]
pub struct BoundedU32<const MIN: u32, const MAX: u32> {
    #[hax::refinement]
    value: u32,
}

impl<const MIN: u32, const MAX: u32> hax::Refinement for BoundedU32<MIN, MAX> {
    type InnerType = u32;
    
    fn invariant(value: u32) -> hax::Prop {
        hax::Prop::from(value >= MIN && value <= MAX)
    }
}

/// Smart constructor
impl<const MIN: u32, const MAX: u32> BoundedU32<MIN, MAX> {
    pub fn new(value: u32) -> Option<Self> {
        if value >= MIN && value <= MAX {
            Some(BoundedU32 { value })
        } else {
            None
        }
    }
}

/// Type alias for common case
pub type Percentage = BoundedU32<0, 100>;

/// Usage
pub fn scale_by_percentage(value: u32, percent: Percentage) -> u32 {
    // percent is guaranteed to be 0-100
    (value * (*percent)) / 100
}

use hax_lib as hax;

/// A vector that is guaranteed non-empty
#[hax::refinement_type]
pub struct NonEmptyVec<T> {
    #[hax::refinement]
    data: Vec<T>,
}

impl<T> hax::Refinement for NonEmptyVec<T> {
    type InnerType = Vec<T>;
    
    fn invariant(data: Vec<T>) -> hax::Prop {
        hax::Prop::from(data.len() > 0)
    }
}

impl<T> NonEmptyVec<T> {
    pub fn new(data: Vec<T>) -> Option<Self> {
        if data.is_empty() {
            None
        } else {
            Some(NonEmptyVec { data })
        }
    }
    
    /// Safe first element access (no panic possible)
    pub fn first(&self) -> &T {
        // The refinement guarantees len() > 0
        &self.data[0]
    }
    
    /// Safe pop (always returns Some)
    pub fn pop(&mut self) -> Option<T> {
        if self.data.len() == 1 {
            // Would violate invariant
            None
        } else {
            self.data.pop()
        }
    }
}

use hax_lib as hax;

#[hax::refinement_type]
pub struct ValidEmail {
    #[hax::refinement]
    email: String,
}

impl hax::Refinement for ValidEmail {
    type InnerType = String;
    
    fn invariant(email: String) -> hax::Prop {
        hax::Prop::from(is_valid_email(&email))
    }
}

#[hax::exclude]
fn is_valid_email(email: &str) -> bool {
    email.contains('@') && email.contains('.')
}

impl ValidEmail {
    pub fn parse(input: String) -> Result<Self, String> {
        if is_valid_email(&input) {
            Ok(ValidEmail { email: input })
        } else {
            Err("Invalid email".to_string())
        }
    }
}

/// Functions can require validated input
pub fn send_email(to: ValidEmail, message: &str) {
    // Guaranteed that `to` is a valid email
    // No runtime validation needed
}

use hax_lib as hax;

mod states {
    pub struct Open;
    pub struct Closed;
}

#[hax::refinement_type]
pub struct File<State> {
    #[hax::refinement]
    handle: FileHandle,
    _state: PhantomData<State>,
}

impl File<states::Closed> {
    pub fn open(path: &str) -> Result<File<states::Open>, Error> {
        let handle = open_file(path)?;
        Ok(File { handle, _state: PhantomData })
    }
}

impl File<states::Open> {
    pub fn write(&mut self, data: &[u8]) -> Result<(), Error> {
        write_to_file(&self.handle, data)
    }
    
    pub fn close(self) -> File<states::Closed> {
        close_file(&self.handle);
        File { handle: self.handle, _state: PhantomData }
    }
}

// Can't write to closed file (type error)
// Can't close already closed file (type error)

use hax_lib as hax;

/// Positive integer
#[hax::refinement_type]
pub struct Positive {
    #[hax::refinement]
    value: i32,
}

impl hax::Refinement for Positive {
    type InnerType = i32;
    fn invariant(value: i32) -> hax::Prop {
        hax::Prop::from(value > 0)
    }
}

/// Even integer
#[hax::refinement_type]
pub struct Even {
    #[hax::refinement]
    value: i32,
}

impl hax::Refinement for Even {
    type InnerType = i32;
    fn invariant(value: i32) -> hax::Prop {
        hax::Prop::from(value % 2 == 0)
    }
}

/// Positive and even integer
#[hax::refinement_type]
pub struct PositiveEven {
    #[hax::refinement]
    value: i32,
}

impl hax::Refinement for PositiveEven {
    type InnerType = i32;
    fn invariant(value: i32) -> hax::Prop {
        hax::Prop::from(value > 0 && value % 2 == 0)
    }
}

/// Convert from stricter to less strict
impl From<PositiveEven> for Positive {
    fn from(pe: PositiveEven) -> Positive {
        Positive { value: *pe }
    }
}

impl From<PositiveEven> for Even {
    fn from(pe: PositiveEven) -> Even {
        Even { value: *pe }
    }
}

use hax_lib as hax;

/// Array with known size
#[hax::refinement_type]
pub struct SizedArray<T, const N: usize> {
    #[hax::refinement]
    data: Vec<T>,
}

impl<T, const N: usize> hax::Refinement for SizedArray<T, N> {
    type InnerType = Vec<T>;
    
    fn invariant(data: Vec<T>) -> hax::Prop {
        hax::Prop::from(data.len() == N)
    }
}

impl<T, const N: usize> SizedArray<T, N> {
    /// Safe indexing without bounds checks
    pub fn get(&self, index: usize) -> Option<&T> {
        if index < N {
            Some(&self.data[index])  // Provably safe
        } else {
            None
        }
    }
}