Functional Programming, Formal Methods.
omitted it here. It is very clean, though, merely requiring you to access both views of the dependent intersection in the right moment and proving they are equivalent (the language also requires equality primitives, and implicit products, so that both views can be considered equal up to erasure).