val mk_carrier_inj (#elt: Type) (len offset: nat) (s1 s2: Seq.seq elt) (p1 p2: P.perm)
    : Lemma
      (requires
        (mk_carrier len offset s1 p1 == mk_carrier len offset s2 p2 /\ offset + Seq.length s1 <= len /\
          offset + Seq.length s2 <= len))
      (ensures (s1 `Seq.equal` s2 /\ (Seq.length s1 > 0 ==> p1 == p2)))
let mk_carrier_inj
  (#elt: Type)
  (len: nat)
  (offset: nat)
  (s1 s2: Seq.seq elt)
  (p1 p2: P.perm)
: Lemma
  (requires (
    mk_carrier len offset s1 p1 == mk_carrier len offset s2 p2 /\
    offset + Seq.length s1 <= len /\
    offset + Seq.length s2 <= len
  ))
  (ensures (
    s1 `Seq.equal` s2 /\
    (Seq.length s1 > 0 ==> p1 == p2)
  ))
= assert (forall (i: nat) . i < Seq.length s1 ==>
    (M.sel (mk_carrier len offset s1 p1) (offset + i) == Some (Seq.index s1 i, p1)));
  assert (forall (i: nat) . i < Seq.length s2 ==>
     M.sel (mk_carrier len offset s2 p2) (offset + i) == Some (Seq.index s2 i, p2))
val mk_carrier_inj (#elt: Type) (len offset: nat) (s1 s2: Seq.seq elt) (p1 p2: P.perm)
    : Lemma
      (requires
        (mk_carrier len offset s1 p1 == mk_carrier len offset s2 p2 /\ offset + Seq.length s1 <= len /\
          offset + Seq.length s2 <= len))
      (ensures (s1 `Seq.equal` s2 /\ (Seq.length s1 > 0 ==> p1 == p2)))
let mk_carrier_inj (#elt: Type) (len offset: nat) (s1 s2: Seq.seq elt) (p1 p2: P.perm)
    : Lemma
      (requires
        (mk_carrier len offset s1 p1 == mk_carrier len offset s2 p2 /\ offset + Seq.length s1 <= len /\
          offset + Seq.length s2 <= len))
      (ensures (s1 `Seq.equal` s2 /\ (Seq.length s1 > 0 ==> p1 == p2))) =
assert (forall (i: nat).
      i < Seq.length s1 ==>
      (M.sel (mk_carrier len offset s1 p1) (offset + i) == Some (Seq.index s1 i, p1)));
assert (forall (i: nat).
      i < Seq.length s2 ==>
      M.sel (mk_carrier len offset s2 p2) (offset + i) == Some (Seq.index s2 i, p2))
Steel.ST.HigherArray.fst.checked
Steel.ST.PCMReference.fsti.checked Steel.ST.Loops.fsti.checked Steel.PCMMap.fst.checked Steel.PCMFrac.fst.checked Steel.Memory.fsti.checked prims.fst.checked FStar.SizeT.fsti.checked FStar.Seq.fst.checked FStar.Real.fsti.checked FStar.Pervasives.Native.fst.checked FStar.Pervasives.fsti.checked FStar.Map.fsti.checked FStar.Ghost.fsti.checked FStar.Classical.fsti.checked
Steel.ST.HigherArray.fst
Prims.nat FStar.Seq.Base.seq Steel.FractionalPermission.perm Prims._assert Prims.l_Forall Prims.l_imp Prims.b2t Prims.op_LessThan FStar.Seq.Base.length Prims.eq2 FStar.Pervasives.Native.option FStar.Pervasives.Native.tuple2 FStar.Map.sel Steel.ST.HigherArray.index_t FStar.Ghost.hide Steel.PCMFrac.fractional Steel.ST.HigherArray.mk_carrier Prims.op_Addition FStar.Pervasives.Native.Some FStar.Pervasives.Native.Mktuple2 FStar.Seq.Base.index Prims.unit Prims.l_and Steel.ST.HigherArray.carrier Prims.op_LessThanOrEqual Prims.squash FStar.Seq.Base.equal Prims.op_GreaterThan Prims.Nil FStar.Pervasives.pattern
(*
   Copyright 2022 Microsoft Research

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
*)

module Steel.ST.HigherArray

module P = Steel.PCMFrac
module R = Steel.ST.PCMReference
module M = FStar.Map
module PM = Steel.PCMMap

[@@noextract_to "krml"]
let index_t (len: Ghost.erased nat) : Tot Type0 =
  (i: nat { i < len })

[@@noextract_to "krml"]
let carrier (elt: Type u#a) (len: Ghost.erased nat) : Tot Type =
  PM.map (index_t len) (P.fractional elt)

[@@noextract_to "krml"]
let pcm (elt: Type u#a) (len: Ghost.erased nat) : Tot (P.pcm (carrier elt len)) =
  PM.pointwise (index_t len) (P.pcm_frac #elt)

[@@noextract_to "krml"]
let one (#elt: Type) (#len: Ghost.erased nat) = (pcm elt len).P.p.P.one
let composable (#elt: Type) (#len: Ghost.erased nat) = (pcm elt len).P.p.P.composable
[@@noextract_to "krml"]
let compose (#elt: Type) (#len: Ghost.erased nat) = (pcm elt len).P.p.P.op

[@@noextract_to "krml"]
let mk_carrier
  (#elt: Type)
  (len: nat)
  (offset: nat)
  (s: Seq.seq elt)
  (p: P.perm)
: Tot (carrier elt len)
= let f (i: nat) : Tot (P.fractional elt) =
    if offset + Seq.length s > len || i < offset || i >= offset + Seq.length s
    then None
    else Some (Seq.index s (i - offset), p)
  in
  M.map_literal f

let mk_carrier_inj
  (#elt: Type)
  (len: nat)
  (offset: nat)
  (s1 s2: Seq.seq elt)
  (p1 p2: P.perm)
: Lemma
  (requires (
    mk_carrier len offset s1 p1 == mk_carrier len offset s2 p2 /\
    offset + Seq.length s1 <= len /\
    offset + Seq.length s2 <= len
  ))
  (ensures (
    s1 `Seq.equal` s2 /\
    (Seq.length s1 > 0 ==> p1 == p2)
val mk_carrier_inj (#elt: Type) (len offset: nat) (s1 s2: Seq.seq elt) (p1 p2: P.perm)
    : Lemma
      (requires
        (mk_carrier len offset s1 p1 == mk_carrier len offset s2 p2 /\ offset + Seq.length s1 <= len /\
          offset + Seq.length s2 <= len))
      (ensures (s1 `Seq.equal` s2 /\ (Seq.length s1 > 0 ==> p1 == p2)))

    len: Prims.nat ->
    offset: Prims.nat ->
    s1: FStar.Seq.Base.seq elt ->
    s2: FStar.Seq.Base.seq elt ->
    p1: Steel.FractionalPermission.perm ->
    p2: Steel.FractionalPermission.perm
  -> FStar.Pervasives.Lemma
      (requires
        Steel.ST.HigherArray.mk_carrier len offset s1 p1 ==
        Steel.ST.HigherArray.mk_carrier len offset s2 p2 /\ offset + FStar.Seq.Base.length s1 <= len /\
        offset + FStar.Seq.Base.length s2 <= len)
      (ensures FStar.Seq.Base.equal s1 s2 /\ (FStar.Seq.Base.length s1 > 0 ==> p1 == p2))