End R.
(** Wrapping in a dependent type *)
Definition t := { h: R.heap | R.bst h }.
(** Operations *)
Program Definition empty : t := R.Empty.
Program Definition insert (x: E.t) (h: t) : t := R.insert x h.
Next Obligation. apply R.insert_bst. apply proj2_sig. Qed.
Program Definition findMin (h: t) : option E.t := R.findMin h.
Program Definition deleteMin (h: t) : t := R.deleteMin h.
Next Obligation. apply R.deleteMin_bst. apply proj2_sig. Qed.
Program Definition findMax (h: t) : option E.t := R.findMax h.
Program Definition deleteMax (h: t) : t := R.deleteMax h.
Next Obligation. apply R.deleteMax_bst. apply proj2_sig. Qed.
(** Membership (for specification) *)
Program Definition In (x: E.t) (h: t) : Prop := R.In x h.
(** Properties of [empty] *)

(* Specifications: *)
Lemma In_empty: forall x, ~In x empty.
(** Properties of [insert] *)
Lemma In_insert:
forall x h y,
In y (insert x h) <-> E.eq y x \/ In y h.
Lemma In_empty: forall x, ~In x empty.
(** Properties of [insert] *)
Lemma In_insert:
forall x h y,
In y (insert x h) <-> E.eq y x \/ In y h.