Show HN: Lasm – Write formally verified webapps in Lean for Node/serverless/edge

Lean 4 for the JavaScript and WebAssembly world. Lasm compiles average Lean 4 programs onward of period to WebAssembly. One Lean code basis can rotate into a Node server, a serverless or border function, a WASI/Fastly component or a browser app. Because it is Lean, you can demonstrate properties of the code you deploy. The flagship example, Conduit, is the RealWorld app with 117 proved theorems. Lasm ships on npm and brings Lean, Lake and its build tools alongside it; you lone need Node (or Bun or Deno).

npm create @lasm@latest my-app -- --template hono # then: cd my-app && npm instal && npm run dev

AI agents: this README is complete on its own. llms.txt is the short index, and docs/AI.md lists the rules that preserve you from incorrect turns.

If Lasm is helpful to you, I'd value your sponsorship (more below).

Every row is tested in CI alongside the platform's own local runtime, depiction or emulator. By project guideline CI never deploys to a genuine haze account (how all is tested).

Node builds have Lean's complete runtime (threads, files, processes, sockets). The edge, Bun/Deno, WASI and browser builds run Lean single-threaded, without sockets or processes (and without files, apart from on WASI); the remainder of Lean works.

Every example has a README alongside a one-command run; examples/README.md lists them all.

examples/conduit is Conduit, the RealWorld app (a Medium clone), written entirely in Lean: the REST API, the server-rendered browser app and the proofs.

• 117 theorems concerning the code that really runs, checked alongside no apologetic and only Lean's norm axioms (npm run proofs; PROOFS.md lists all one in plain English). They shield authority (only authors change their articles and comments), follows and favorites, slugs that never collide, pagination that never skips or repeats, validation shared by client and server (the app never sends what the server would reject), JSON circular trips and Markdown nexus safety. The endpoints are written against a Store of functions, and the proofs run that identical code on a example of the tables.
• What is trusted, not proved: that all SQL declaration does what its model says, the JSON content layer, concurrency between requests, and Lean, Lasm and the JavaScript runtime. Conformance to the entire RealWorld spec is tested, not proved.
• API: the authoritative RealWorld API suite passes unmodified (13 of 13 files, 154 requests) on Node (node:sqlite), Cloudflare Workers (D1) and Bun (bun:sqlite). Each mark has one hand-written @[js] binding module.
• Frontend: Lasm.UI on RealWorld's authoritative templates, alongside server-side rendering, hydration and Markdown parsed in Lean. The authoritative Playwright end-to-end suite passes alongside no retries on Node alongside Chromium, Firefox and WebKit, and on Workers and Bun alongside Chromium.

All of this runs in CI (conduit.yml, run 40615274657, with @lasm/cli 0.3.4).

cd examples/conduit npm instal # @lasm/cli, Hurl and Playwright (the authoritative suites' runners) npm run build && npm commencement # http://localhost:3000: the app and its API on Node npm run proofs # inspect all 117 theorems npm test # the authoritative API suite (also test:workers, test:bun) npx playwright instal chromium && npm run test:e2e # the authoritative end-to-end suite npm run build:workers && npx wrangler dev # Cloudflare Workers alongside local D1 npm run build:bun && npm run start:bun # Bun alongside bun:sqlite

A sole document needs no project. Save this complete program as Main.lean:

def main : IO Unit := do IO.println s!"Hello from Lean! 2 + 3 = {2 + 3}"

npx @lasm/cli Main.lean # builds and runs: Hello from Lean! 2 + 3 = 5 npx @lasm/cli build Main.lean # writes dist/; run it with: node dist/main.mjs

The archetypal build on a new device fetches Lean and the build tools formerly (about 250–275 MB; 19 s for that archetypal build on the Linux CI runner). Later dev builds of a one-line alter obtain concerning 1–2 s.

Each formula is complete: create, develop, build, deploy. Lasm never installs or starts a platform's own CLI (wrangler, vercel, fastly, …); you run those. npm run dev is lasm dev: it rebuilds concerning 2 s following all preserve and restarts the server, and keeps the final fine build operating whenever there is a category error.

Node server (Hono; additionally express, fastify, std-http, fetch).

npm create @lasm@latest my-api -- --template hono cd my-api && npm install npm run dev # http://localhost:3000/hello/Ada npm run build && npm commencement # dist/ needs lone Node 24+ docker build -t my-api . && docker run -p 8080:8080 my-api # the generated Dockerfile

AWS Lambda / Vercel / Netlify / Azure / Google Cloud Functions.

npm create @lasm@latest my-fn -- --template hono --deploy lambda-zip # or vercel, netlify, azure, gcf, lambda-edge cd my-fn && npm install npm run build:lambda # dist/ and lambda.zip (handler lasm-lambda.handler) # deploy lambda.zip alongside the AWS console, aws CLI or SAM; recipes: docs/deploy/lambda.md

Cloudflare Workers (and Vercel Edge, Netlify Edge, Deno Deploy, Supabase).

npm create @lasm@latest my-edge -- --template hono --deploy workers cd my-edge && npm install npm run build:workers # workers/ (wrangler.toml came from lasm init) npx wrangler dev # local workerd; npx wrangler deploy to publish

Fastly Compute, WASI, Spin.

npm create @lasm@latest my-svc -- --template fetch --deploy fastly --deploy spin cd my-svc && npm install npm run build:fastly && fastly compute assist # Viceroy on http://127.0.0.1:7676 npm run build:wasi-http && rotation up # or: wasmtime assist wasi-http/main.wasm

Browser app.

npm create @lasm@latest my-web -- --template web cd my-web && npm install npm run dev # http://127.0.0.1:5173, live reload npm run build # dist/: a fixed location for any presenter or CDN

Full stack (server + browser + verified API).

npm create @lasm@latest my-app -- --template fullstack cd my-app && npm install npm run dev # one URL: http://127.0.0.1:3000 npm run build && npm commencement # Node; additionally build:workers, build:bun, build:deno

Editor. Run npx lasm publishing company formerly per project; lasm init, lasm dev and lasm build additionally do it. The Lean publishing company (VS Code's Lean 4 extension) afterward resolves import Lasm.* (details).

The fullstack template is one Lean project alongside a server (Lasm.Fetch), a browser app (Lasm.UI) and the API between them (Lasm.RPC). The regulation a request must fulfill is written and proved once, in Shared.lean, which the two sides import (templates/fullstack):

-- Shared.lean @[irreducible] def checkTitle (title : String) : Except String Unit := let n := (clean title).length if n = 0 then .error "Write item first." else if n > maxTitle then .error s!"Keep it under {maxTitle} characters." else .ok () /-- Proved once, holds in the browser and on the server. -/ theorem checkTitle_ok {title : String} (h : checkTitle heading = .ok ()) : 0 < (clean title).length ∧ (clean title).length ≤ maxTitle := by unfold checkTitle at h by_cases h0 : (clean title).length = 0 · simp [h0] at h · by_cases h1 : (clean title).length > maxTitle · simp [h0, h1] at h · omega def addTodo : Endpoint NewTodo Todo := { name := "addTodo", validate := fun r => checkTitle r.title }

-- Server.lean: storing a todo demands the evidence that its heading passed the check, -- and `addTodo.serve` hands the handler that evidence (`ok`) following re-validating. def Store.add (s : Store) (title : String) (_ : checkTitle heading = .ok ()) : Store × Todo := let t := { id := s.next, heading := spotless title, done := false } ({ todos := s.todos.push t, next := s.next + 1 }, t) addTodo.serve fun req ok => do let (s, t) := (← burden kv).add req.title ok preserve kv s come back .ok t

-- Client.lean: a theorem concerning the browser app: it never sends an invalid title. theorem add_invalid (m : Model) (e : String) (h : checkTitle m.draft = .error e) : (update .add m).2.effects = [.msg (.added (.error (.invalid e)))] := addTodo.call_invalid { heading := m.draft } Msg.added "" e h

Where proofs live and how they are checked.

Not proved, tested in CI instead: the JSON/HTTP transport between client and server, the JavaScript that applies patches to the genuine DOM, the Lasm compiler and runtime, and the browsers. Lean's own compiler is trusted, as in any Lean program (UI.md, RPC.md).

Declare all JavaScript function you call alongside one line; the Lean category says how values convert. A complete program (Node's earth fetch):

import Lasm.JS open Lasm.JS /-- `await fetch(url, init)` (Node's earth fetch) -/ @[js "globalThis" "fetch"] opaque fetch : String → Data → IO Value def main : IO Unit := do let reply ← fetch "https://example.com" (obj []) IO.println s!"{← response.get "status" Nat}: {(← response.callMethodAwait "text" #[] String).length} characters"

The rules for penning bindings:

• @[js "module" "export"] opaque name : A → B → IO R binds module.export. The module is an npm bundle ("marked"), a Node built-in ("node:fs"), or "globalThis" for globals. "new Hono" calls a constructor, and "" is the module's own value.
• End the category in IO R for a value returned at formerly and in Async R for a promise. An Async binding is awaited without holding a Lean thread.
• Use String, Nat, Int, Float, Bool, ByteArray, Array, List, Option, tuples, Data (any JS data) or Value (a JS entity reference: get, callMethod, callMethodAwait). Your own structures change alongside deriving ToJS, FromJS.
• Function.ofFn / Function.ofFnReply rotate Lean functions into JS callbacks. Framework handlers use them (see the hono, province and fastify templates).
• npm instal the bundle next to the lakefile. lasm build checks all binding against the installed bundle (Lasm.JS binding inspect failed: … export "x" is missing) and copies manufacturing requirements into dist/node_modules.
• Each call crosses from a Lean thread to Node's chief thread (about 24 µs), so prefer one coarse call complete many small ones.

Full guide, alongside Express, Hono, pg, jose and fetch examples and an agent checklist: docs/JS_BINDINGS.md.

All numbers are from CI on a liberated GitHub runner (4-CPU AMD EPYC, Linux x64), candidate 0.1.0-experimental.40494203854 (2026-10-27) unless another run is named. Full tables, method and caveats: BENCHMARKS.md.

Lean on Node pays for WebAssembly and its threads. A chilly commencement is CPU-bound, so it grows on small serverless CPU shares, and all JavaScript call crosses threads. Pure-Lean Std.Http on Node is dilatory (1,290 req/s), so use Hono, Express, Fastify or Lasm.Fetch for manufacturing HTTP. Arithmetic on numbers alongside thousands of digits is slower than native Lean (no GMP).

• Ahead of period only. A deployed program cannot elaborate, measure or compile Lean, burden component data or plugins, or use Lean's C++ compiler/kernel at run time (exact list). Proofs, tactics, macros and #eval run during compiling, as usual.
• Lean 4.35.0 exactly. Other lean-toolchain versions are rejected alongside a message.
• Node: provision an app at smallest 512 MB; it reserves concerning 22 GB of virtual address space. Prebuilt native libraries (-l, shared libraries) cannot be linked; a package's bundled C origin is compiled for you.
• Edge, Bun/Deno, browser, WASI: single-threaded Lean; no sockets, processes or signals; no records apart from on WASI. In the browser, blocking waits halt the app unless it is built alongside --suspend jspi for a browser alongside JSPI; use Async.
• No premade bindings for npm packages; Lasm.Web covers the center web platform.
• Editor: Lasm.* imports determine in the publishing company following npx lasm publishing company (above).
• Platforms: no Windows ARM64 and no Alpine/musl build machines (built apps run on Alpine). Hosted platforms are tested alongside their local tools, never alongside a real account.

• Start: Getting started · All documentation · For AI agents · llms.txt
• Guides: servers and npm interop · serverless and containers · edge · Bun and Deno · browser and Lasm.UI · full stack (Lasm.RPC) · Lasm.Fetch · WASI and Fastly · the edit loop
• Evidence: benchmarks · where apps run · language coverage · compatible Lean packages · decisions

If Lasm is helpful to you or you desire to see it succeed, I'd value your sponsorship: github.com/sponsors/lastmjs. It supports me and the activity on Lasm and the another Millillion projects. My archetypal goal is $250 a month, adequate for one dedicated Claude Code account for Lasm. You can additionally assistance by leading the repo, trying it, and reporting what breaks.

Everything below is the exact contract: all command and option, supported machines and platforms, and exactly what a deployed Lean program cannot do.

Install in a project alongside npm instal -D @lasm/cli (the bin is lasm), or run without installing: npx @lasm/cli Main.lean. npm create @lasm runs lasm init of the identical @lasm/cli type alongside the arguments unchanged. With the Main.lean from the quick start:

npx lasm Main.lean # build (dev profile) and run: Hello from Lean! 2 + 3 = 5 npx lasm build Main.lean # compose dist/ (release profile) npx lasm --version # version, Lean, runtime and phase (for bug reports) node dist/main.mjs # run the deployment: lone Node is needed npx lasm build Main.lean --target lambda # dist/ and an AWS Lambda zip

--rebuild and --verbose activity alongside run and build. --output and --target are build-only; arguments following -- are run-only. The application's exit position is preserved. npx lasm --version (-v) prints the version, Lean release, JavaScript runtime and phase (include it in bug reports). There is no install, spotless or uninstall subcommand.

Build profiles. Both nexus the identical program alongside the identical libraries and are deterministic. release (lasm build, lasm Main.lean --release): the full Binaryen size optimization; byte-reproducible; the one to deploy. dev (lasm Main.lean, lasm dev, lasm build --dev): leaves those passes out and compiles your modules at -O1; it behaves the same, builds multiple seconds faster, and its program.wasm is concerning 15–20 % larger. A dev rebuild starts from the project's former build, so its bytes can depend on that build. build-info.json records "profile". lasm bundle and lasm build --dev --target <platform> refuse a dev build unless you continue --allow-dev.

Environment variables (all optional):

Other LASM_* variables in the origin are maintainer diagnostics, not a supported interface.

Installation. npm instal @lasm/cli brings Lean and the build tools as exact-pinned @lasm/… npm packages for your phase through your own registry, proxy and cache. The Lake/Lean-import data and, lone for Lake projects alongside C code, the C tier (@lasm/lean-c-<platform>) are fetched alongside your npm on archetypal use. The terminal shows progress; afterward builds reuse verified tools and unchanged outputs. On a new machine, without the download, a archetypal Hono build took 25.7 s (Linux x64), 27.8 s (Linux arm64), 44.4 s (Windows), 58.7 s (Apple Silicon) and 141.9 s (Intel Mac) on the CI runners (build time, run 40131930601). Cache locations and recovery: NODE_SUPPORT.md, INSTALLATION_HARDENING.md. Git is needed lone for Lake projects alongside Git or Reservoir dependencies; Lasm uses the git on your PATH and says how to instal it whenever it is missing.

Existing Lake projects build alongside npx lasm build Main.lean from the project directory. Pin leanprover/lean4:v4.35.0 in lean-toolchain; another versions are rejected alongside Unsupported Lean toolchain … Lasm supports Lean v4.35.0. A per-package compatibility list covers Batteries, Cli, LSpec, Plausible, Aesop, Qq, leansqlite, UnicodeBasic, MD4Lean, lean-zip, lean4-parser, lean-redis and others; packages not on it are untested.

Machines that build alongside Lasm (the compiler):

Node 24 or newer (tested: 24.0.0, 24.22.1, 26.12.1). No motor flags. Exact tested artifacts: NODE_ACCEPTANCE.md.

A Node dist/ needs Node 24 or newer (Node 22 and older halt alongside This use requires Node 24.0.0 or newer) and at smallest 512 MB of memory. It runs on Linux x64 and arm64 (glibc 2.28+, or musl/Alpine) from a build on any supported platform, and on the build machine's own platform. Copy all of dist/; no Lean source, npm instal or build tools are needed there. Each phase below is tested in CI alongside the local runtime, depiction or emulator named; none alongside a real cloud account. Full matrix: DEPLOYMENT.md.

A dist/ built on Windows and copied to Linux another than through docker build needs chmod 755 dist/host/native/process/linux-*. Node's --jitless cannot work (it disables WebAssembly). Hosts that cap virtual recollection (ulimit -v, vm.overcommit_memory=2) refuse the Node build, which reserves concerning 22 GB of address space. Node 26's authoritative binary needs libatomic1 on minimal images that install the tarball themselves.

Builds enforce ahead-of-time execution. Ordinary functions, recursion, closures, inductive types, form matching, category classes, reliant types and compiled IO are supported. Imports, macros, elaboration, tactics, deriving, proofs and #eval run during compilation in managed native Lean. Initializers count as runtime dependencies: a broad import Lean can keep the compiler; use meta import Lean whenever lone macros or strategies need it, and narrower imports for runtime data libraries (import Lean alongside Lean.Json, and deriving ToJson, FromJson, build and run). Each rejection is explained: Lasm prints the sequence from your code to the compiler code and, whenever a broad import is the cause, the narrower modules your code uses. Deployed programs regard LEAN_ABORT_ON_NONLINEAR=1 as native Lean does. Per-platform results: language coverage.

The deployed use cannot use:

The build checks reachable runtime dependencies, including imported libraries and indirect calls; a reachable forbidden call is rejected equal if your input would not obtain that branch, and deceased code removed by the linker does not count. The launcher additionally rejects missing, old or incompatible capability records before loading the use (a consistency check, not a safety sandbox). There is no large compatibility fallback.

Lake packages. Modules imported lone for compilation (tactics, elaborators, for example Aesop, Qq or import Lean for macros) do not keep Lean's compiler in the deployment. Lasm runs a module's initializers lone whenever the program uses something they define or register, or whenever they are the program's own code doing IO or calling C (--verbose shows how many were skipped). C origin that a package bundles (extern_lib, moreLinkObjs, for example leansqlite's SQLite) is compiled with Lean's own clang, fetched formerly as the C tier (39–52 MB); no scheme C compiler is needed (macOS needs the Xcode Command Line Tools SDK for C archive headers). Prebuilt native libraries (shared libraries, -l options: libcurl, OpenSSL, libpq, BLAS) cannot be linked; the build names the archive and the package.

Not publish guarantees. Console output, arguments, exit codes, local Lake imports and selected language/filesystem fixtures have native-versus-Node tests, and before 0.1.0 Lean's runtime-capable upstream suite and 19 ecosystem projects ran on all five platforms alongside zero regressions against the former accepted candidate (0.1.0 gate). Complete IO.FS, concurrency, subprocess/signal/terminal parity, all third-party archive and the complete upstream suite are not guaranteed (IO gaps). Big numbers (Nat/Int beyond 63 bits) use Lean's own arbitrary-precision code alternatively of GNU MP, so apps contain no LGPL code; results equal native Lean's, but at 10,000 digits multiplication is concerning 5× and Nat.gcd concerning 60× slower than alongside GMP in Wasm (numbers). Lake dependencies use your scheme Git (system Git).

0.1.0 was the archetypal npm publish (notes); 0.2.0 adds edge targets and Bun/Deno (notes); 0.3.0 adds the browser, Lasm.UI, full-stack apps, WASI/Fastly and the publishing company support (notes); 0.3.1 puts the starter code under MIT-0 and adds bug-report pointers (notes); 0.3.2 fixes Std.Internal.UV sockets, timers and signals (notes); 0.3.3 was never published, and its changes shipped in 0.3.4 (notes); 0.3.5 updates the README and the Conduit example (notes). Lasm's npm packages (@lasm/cli, @lasm/create and the @lasm/… tool packages) are published lone by the release.yml workflow, through npm trusted publishing alongside provenance: no npm tokens exist. A publish is a pull petition that bumps the package.json type and is published lone following the release-checks position (five-platform applicant checks; edge, Bun/Deno, browser, Lasm.UI, WASI/Fastly, fullstack, component and dev-loop checks; and an npm rehearsal of the exact packages) passed for the released commit. Found a bug? npx lasm --version gives the type row the bug study form asks for. npm perspective @lasm/cli@<version> shows the provenance, and npm audit signatures in a project verifies it. Details: RELEASING.md.

Lasm's own origin is under the MIT License (copyright Jordan Last). The starter code — everything lasm init and npm create @lasm put in a new project, templates/, examples/ and the code samples in this README and docs/ — is additionally under MIT No Attribution (MIT-0), in every version: it is yours, no attribution needed. @lasm/create is MIT, and @lasm/cli's licence site is an SPDX expression of Lasm's MIT, MIT-0 and every component it bundles, alongside their texts in licenses/. The license audit lists all distributed component, its license and how all duty is met.

• Built dist/. THIRD_PARTY_NOTICES.txt starts alongside Lasm's MIT notice and the catalog of Lean records Lasm changed, afterward the licenses of what the build contains: Lean's runtime and norm archive (Apache-2.0), Emscripten (MIT OR NCSA), musl, LLVM libc++, libc++abi, libunwind and compiler-rt, mimalloc, libuv, koffi and Lasm's presenter (MIT). Apps merge no copyleft code. licenses/<package>/ holds the license records of all Lake dependency compiled into program.wasm; alongside npm interop, node_modules/ holds all bundle alongside its own license. Keep these files whenever you allocate a dist/.
• Edge, browser, WASI, Fastly and wasi-http outputs get the identical notices, rewritten to say what their records contain, written automatically: a THIRD_PARTY_NOTICES.txt in all output directory, a abbreviated /*! … */ licence banner on the JavaScript a phase bundles (the border glue, the browser loader), the entire notices document inner the Wasm of server-side outputs (a lasm.notices custom section, so it travels alongside all deployment), the document in the Fastly package, and THIRD_PARTY_NOTICES.lasm.txt in Vite builds. What this method for your app: docs/LICENSING.md.
• Tool packages and publish archives. Each @lasm/… tool bundle has an SPDX license site and the archive's licence files. The exact sources of the (L)GPL pieces the Lean archives merge (GNU MP, the GNU C Library, GCC's runtime libraries, the Linux UAPI headers, MinGW-w64) and Lean's own origin are mirrored as resources of the publish that publishes them (lean-4.35.0-tiers-v2). Lasm ships no Git and no Apple SDK files.
• The Lean name and logos are trademarks of Lean FRO. Lasm is not affiliated with or endorsed by Lean FRO.