(** * Properties of string length *)

(* Specifications: *)
Lemma valid_length (s : string) :
to_Z (length s) <= to_Z max_length.
Lemma length_spec_int (s : string) :
length s = of_Z (Z.of_nat (List.length (to_list s))).
Lemma length_spec_Z (s : string) :
to_Z (length s) = Z.of_nat (List.length (to_list s)).
Lemma make_length_spec (i : int) (c : char63) :
to_Z i <= to_Z max_length ->
length (make i c) = i.
Lemma sub_length_spec (s : string) (off len : int) :
to_Z off <= to_Z (length s) ->
to_Z len <= to_Z (length s) - to_Z off ->
length (sub s off len) = len.
Lemma cat_length_spec (s1 s2 : string) :
length (cat s1 s2) = Uint63.min max_length (length s1 + length s2)%uint63.
Lemma cat_length_spec_no_overflow (s1 s2 : string) :
to_Z (length s1) + to_Z (length s2) <= to_Z max_length ->
length (cat s1 s2) = (length s1 + length s2)%uint63.