val pcm'_map_of_pcm (#a: _) (k: eqtype) (p: pcm a) : pcm' (map k a)
let pcm'_map_of_pcm (#a:_) (k:eqtype) (p:pcm a)
  : pcm' (map k a)
  = {
       composable = composable_maps p;
       op = compose_maps p;
       one = Map.const p.p.one
    }
val pcm'_map_of_pcm (#a: _) (k: eqtype) (p: pcm a) : pcm' (map k a)
let pcm'_map_of_pcm (#a: _) (k: eqtype) (p: pcm a) : pcm' (map k a) =
{ composable = composable_maps p; op = compose_maps p; one = Map.const p.p.one }
Steel.PCMMap.fst.checked
prims.fst.checked FStar.Set.fsti.checked FStar.Pervasives.fsti.checked FStar.PCM.fst.checked FStar.Map.fsti.checked FStar.Ghost.fsti.checked FStar.Classical.Sugar.fsti.checked
Steel.PCMMap.fst
Prims.eqtype FStar.PCM.pcm FStar.PCM.Mkpcm' Steel.PCMMap.map Steel.PCMMap.composable_maps Steel.PCMMap.compose_maps FStar.Map.const FStar.PCM.__proj__Mkpcm'__item__one FStar.PCM.__proj__Mkpcm__item__p FStar.PCM.pcm'
(*
   Copyright 2021 Microsoft Research

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.

   Author: N. Swamy
*)
module Steel.PCMMap
(** Given a PCM on [p:pcm a] and a key type [k:eqtype], this module
    builds a [pcm (map k a)] by lifting [p] pointwise. It also lifts
    frame-preserving updates on [p] to frame-preserving updates on
    entries of the map. **)
open FStar.Map
open FStar.PCM

/// The carrier type of our constructed PCM
///
/// -- FStar.Map comes with a notion of domain that we don't need here
///    So, we'll just worked with maps whose domain is always
///    universal.
let map (k:eqtype) (v:Type) =
  m:Map.t k v {
    Map.domain m `Set.equal` Set.complement Set.empty
  }

/// Maps are composable if they are composable pointwise
let composable_maps (#a:_)
                    (#k:eqtype)
                    (p:pcm a)
                    (m0 m1: map k a)
  : prop
  = forall k. Map.sel m0 k `composable p` Map.sel m1 k

/// Compose maps pointwise
let compose_maps (#a:_) (#k:eqtype)
                 (p:pcm a)
                 (m0:map k a)
                 (m1:map k a { composable_maps p m0 m1 })
  : map k a
  = Map.map_literal (fun k ->
                       Map.sel m0 k `op p` Map.sel m1 k)

/// Composability is commutative
let composable_maps_comm #k #a
                    (p:pcm a)
                    (m0 m1: map k a)
  : Lemma (composable_maps p m0 m1 <==>
           composable_maps p m1 m0)
  = ()

/// Composition is commutative
let compose_maps_comm #k #a
                    (p:pcm a)
                    (m0 m1: map k a)
  : Lemma
    (requires composable_maps p m0 m1)
    (ensures compose_maps p m0 m1 == compose_maps p m1 m0)
  = let m01 = compose_maps p m0 m1 in
    let m10 = compose_maps p m1 m0 in
    introduce forall key.
         Map.sel m01 key == Map.sel m10 key
    with ( p.comm (Map.sel m0 key) (Map.sel m1 key) );
    assert (Map.equal m01 m10)

/// Composability is left-associative
let composable_maps_assoc_l #k #a
                          (p:pcm a)
                          (m0 m1 m2: map k a)
  : Lemma
    (requires
      composable_maps p m1 m2 /\
      composable_maps p m0 (compose_maps p m1 m2))
    (ensures
      composable_maps p m0 m1 /\
      composable_maps p (compose_maps p m0 m1) m2 /\
      compose_maps p (compose_maps p m0 m1) m2 ==
      compose_maps p m0 (compose_maps p m1 m2))
  = introduce forall key.
      composable p (Map.sel m0 key) (Map.sel m1 key)
    with ( p.assoc (Map.sel m0 key) (Map.sel m1 key) (Map.sel m2 key) );
    let m01 = compose_maps p m0 m1 in
    introduce forall key.
      composable p (Map.sel m01 key) (Map.sel m2 key)
    with ( p.assoc (Map.sel m0 key) (Map.sel m1 key) (Map.sel m2 key) );
    let m012 = compose_maps p m01 m2 in
    let m012' = compose_maps p m0 (compose_maps p m1 m2) in
    introduce forall key.
      Map.sel m012 key == Map.sel m012' key
    with ( p.assoc (Map.sel m0 key) (Map.sel m1 key) (Map.sel m2 key) );
    assert (Map.equal
                 (compose_maps p (compose_maps p m0 m1) m2)
                 (compose_maps p m0 (compose_maps p m1 m2)))

/// Composability is right-associative
let composable_maps_assoc_r #k #a
                          (p:pcm a)
                          (m0 m1 m2: map k a)
  : Lemma
    (requires
      composable_maps p m0 m1 /\
      composable_maps p (compose_maps p m0 m1) m2)
    (ensures
      composable_maps p m1 m2 /\
      composable_maps p m0 (compose_maps p m1 m2) /\
      compose_maps p (compose_maps p m0 m1) m2 ==
      compose_maps p m0 (compose_maps p m1 m2))
  = introduce forall key.
      composable p (Map.sel m1 key) (Map.sel m2 key)
    with ( p.assoc_r (Map.sel m0 key) (Map.sel m1 key) (Map.sel m2 key) );
    let m12 = compose_maps p m1 m2 in
    introduce forall key.
      composable p (Map.sel m0 key) (Map.sel m12 key)
    with ( p.assoc_r (Map.sel m0 key) (Map.sel m1 key) (Map.sel m2 key) );
    let m012 = compose_maps p (compose_maps p m0 m1) m2 in
    let m012' = compose_maps p m0 (compose_maps p m1 m2) in
    introduce forall key.
      Map.sel m012 key == Map.sel m012' key
    with ( p.assoc_r (Map.sel m0 key) (Map.sel m1 key) (Map.sel m2 key) );
    assert (Map.equal m012 m012')

/// The core of the constructed PCM
///    The unit is just the pointwise unit
let pcm'_map_of_pcm (#a:_) (k:eqtype) (p:pcm a)
  : pcm' (map k a)
val pcm'_map_of_pcm (#a: _) (k: eqtype) (p: pcm a) : pcm' (map k a)
k: Prims.eqtype -> p: FStar.PCM.pcm a -> FStar.PCM.pcm' (Steel.PCMMap.map k a)