006 — Handing the rule to the compiler, and measuring how much of it the compiler took

{
  "name": "006-compiler-enforced",
  "what_it_is": "Frames a payload into a record and encodes it, with each set as a cargo crate so the dependency rule is a property of the manifests rather than of every source line.",
  "the_structural_decision": "Hand the rule to the compiler, then measure exactly how much of it the compiler took.",
  "what_the_toolchain_enforces": {
    "undeclared_sibling_reference": "impossible — `use tms_b64::…` is E0432 unless tms-b64 is in [dependencies]",
    "a_unit_compiling_alone": "checkable by copying the crate to an empty directory and building it",
    "unused_import": "a warning, and deniable at crate level"
  },
  "what_the_toolchain_does_NOT_enforce": {
    "declaring_a_sibling": "entirely legal. Nothing in cargo objects to TMS/hex depending on TMS/b64.",
    "consequence": "the site build still has to check the manifests — but ONE file per unit, in a fixed format, instead of every source line in a language the walk has to know."
  },
  "sets": {
    "FMS": { "manifest.json": "this file" },
    "SCL": { "policy.json": "which encodings this deployment permits, and the payload cap", "lib.rs": "reads that file at run time, not include_str!" },
    "SMS": { "lib.rs": "framing and unframing — the capability the program is" },
    "TMS": {
      "hex": "lowercase hex, no dependencies",
      "b64": "standard base64 with padding, no dependencies",
      "esc": "printable passthrough with =XX escapes, no dependencies"
    },
    "DMS": { "lib.rs": "what ran, what it cost, and the three ways a capability can be absent" }
  },
  "non_goals": [
    "Being a serialisation library. Three encoders, a two-byte length and a sum-mod-256 checksum.",
    "Arguing Rust is the right language for every project. The comparison this example exists to make is about the check, not about the language.",
    "Claiming the compiler removes the need for the build's rule. Section 3 of the island test is there to show it does not."
  ]
}

[package]
name = "scl"
version = "0.1.0"
edition = "2021"

[lib]
path = "lib.rs"

# SCL names encodings as strings and depends on no encoder crate. That is what
# lets policy list an encoding nobody has written yet, and refuse one that is
# compiled in — see the island test.
[dependencies]

//! What this deployment permits. Names, never crates.

use std::path::PathBuf;

pub struct Policy {
    pub permitted: Vec<String>,
    pub max_payload_bytes: usize,
}

pub fn load() -> Policy {
    // CARGO_MANIFEST_DIR is a compile-time constant, but the read happens at
    // run time. include_str! would have compiled the policy into the binary and
    // made every policy change a rebuild.
    let path = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("policy.json");
    let text = std::fs::read_to_string(&path)
        .unwrap_or_else(|e| panic!("SCL cannot read {}: {e}", path.display()));
    Policy {
        permitted: string_list(&text, "permitted"),
        max_payload_bytes: number(&text, "max_payload_bytes").unwrap_or(0),
    }
}

impl Policy {
    pub fn permits(&self, encoding: &str) -> bool {
        self.permitted.iter().any(|p| p == encoding)
    }
}

/// Enough JSON for one array of strings. A dependency-free example pays for its
/// dependency-freedom somewhere, and this is where.
fn string_list(text: &str, key: &str) -> Vec<String> {
    let anchor = format!("\"{key}\"");
    let Some(start) = text.find(&anchor).and_then(|i| text[i..].find('[').map(|j| i + j + 1)) else {
        return Vec::new();
    };
    let Some(end) = text[start..].find(']').map(|j| start + j) else {
        return Vec::new();
    };
    text[start..end]
        .split(',')
        .map(|item| item.trim().trim_matches('"').to_string())
        .filter(|item| !item.is_empty())
        .collect()
}

fn number(text: &str, key: &str) -> Option<usize> {
    let anchor = format!("\"{key}\"");
    let start = text.find(&anchor)? + anchor.len();
    let rest = text[start..].trim_start().strip_prefix(':')?.trim_start();
    let digits: String = rest.chars().take_while(char::is_ascii_digit).collect();
    digits.parse().ok()
}

#[cfg(test)]
mod tests {
    #[test]
    fn reads_the_file_not_a_constant() {
        let policy = super::load();
        assert!(policy.permits("encodings/hex"));
        assert!(!policy.permits("encodings/esc"));
        assert_eq!(policy.max_payload_bytes, 64);
    }
}

{
  "policy_version": "1.0",
  "_comment": [
    "Read at run time from CARGO_MANIFEST_DIR, not include_str!, so that",
    "changing which encodings a deployment permits does not require a rebuild.",
    "In a compiled language that is a decision, not a default."
  ],
  "_z85": "Permitted, and no crate provides it. SCL names capabilities rather than holding them, so policy may describe a deployment that has not been built yet — the same decision as the Router in example 004. DMS reports it as an absence rather than the program failing to start.",
  "permitted": ["encodings/hex", "encodings/b64", "encodings/z85"],
  "max_payload_bytes": 64
}

[package]
name = "sms"
version = "0.1.0"
edition = "2021"

[lib]
path = "lib.rs"

# SMS does not depend on any encoder. Remove every TMS crate from the workspace
# and this still compiles and still frames records — which is the identity test
# stated as a build, not as a claim.
[dependencies]

//! Framing: a payload becomes a record with a length and a checksum.
//!
//! This is the capability the program is. Remove it and there is nothing left
//! to encode — which is the identity test, and here it is also a fact about the
//! build graph: every other crate can be deleted and this one still compiles.

/// A framed record: length prefix (2 bytes, big-endian), payload, checksum.
pub fn frame(payload: &[u8]) -> Result<Vec<u8>, FrameError> {
    if payload.len() > u16::MAX as usize {
        return Err(FrameError::TooLong(payload.len()));
    }
    let mut record = Vec::with_capacity(payload.len() + 3);
    record.extend_from_slice(&(payload.len() as u16).to_be_bytes());
    record.extend_from_slice(payload);
    record.push(checksum(payload));
    Ok(record)
}

/// Sum of bytes mod 256. Weak on purpose: the example is about structure, and a
/// real checksum here would invite the reader to think the framing is the point.
pub fn checksum(payload: &[u8]) -> u8 {
    payload.iter().fold(0u8, |acc, b| acc.wrapping_add(*b))
}

/// Split a record back into its parts, so a caller can check a claim rather
/// than take one. `frame` returning something is not evidence it framed.
pub fn unframe(record: &[u8]) -> Result<&[u8], FrameError> {
    if record.len() < 3 {
        return Err(FrameError::Truncated(record.len()));
    }
    let declared = u16::from_be_bytes([record[0], record[1]]) as usize;
    let payload = &record[2..record.len() - 1];
    if payload.len() != declared {
        return Err(FrameError::LengthMismatch {
            declared,
            actual: payload.len(),
        });
    }
    let found = record[record.len() - 1];
    let expected = checksum(payload);
    if found != expected {
        return Err(FrameError::ChecksumMismatch { expected, found });
    }
    Ok(payload)
}

#[derive(Debug, PartialEq)]
pub enum FrameError {
    TooLong(usize),
    Truncated(usize),
    LengthMismatch { declared: usize, actual: usize },
    ChecksumMismatch { expected: u8, found: u8 },
}

impl std::fmt::Display for FrameError {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            Self::TooLong(n) => write!(f, "payload is {n} bytes, the length prefix holds 65535"),
            Self::Truncated(n) => write!(f, "record is {n} bytes, too short to hold a frame"),
            Self::LengthMismatch { declared, actual } => {
                write!(f, "frame declares {declared} bytes, carries {actual}")
            }
            Self::ChecksumMismatch { expected, found } => {
                write!(f, "checksum is {found:#04x}, payload computes {expected:#04x}")
            }
        }
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn round_trips() {
        let record = frame(b"hello").unwrap();
        assert_eq!(unframe(&record).unwrap(), b"hello");
    }

    #[test]
    fn a_flipped_byte_is_reported_not_absorbed() {
        let mut record = frame(b"hello").unwrap();
        record[3] ^= 0xff;
        assert!(matches!(
            unframe(&record),
            Err(FrameError::ChecksumMismatch { .. })
        ));
    }
}

[package]
name = "tms-b64"
version = "0.1.0"
edition = "2021"

[lib]
path = "lib.rs"

[dependencies]

//! Standard base64 with padding. Knows nothing about the other encoders.

pub const NAME: &str = "encodings/b64";

const ALPHABET: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";

pub fn encode(bytes: &[u8]) -> String {
    let mut out = String::new();
    for chunk in bytes.chunks(3) {
        let b0 = chunk[0] as u32;
        let b1 = *chunk.get(1).unwrap_or(&0) as u32;
        let b2 = *chunk.get(2).unwrap_or(&0) as u32;
        let packed = (b0 << 16) | (b1 << 8) | b2;

        out.push(ALPHABET[(packed >> 18) as usize & 0x3f] as char);
        out.push(ALPHABET[(packed >> 12) as usize & 0x3f] as char);
        out.push(if chunk.len() > 1 {
            ALPHABET[(packed >> 6) as usize & 0x3f] as char
        } else {
            '='
        });
        out.push(if chunk.len() > 2 {
            ALPHABET[packed as usize & 0x3f] as char
        } else {
            '='
        });
    }
    out
}

#[cfg(test)]
mod tests {
    #[test]
    fn encodes_without_a_sibling_loaded() {
        assert_eq!(super::encode(b"Man"), "TWFu");
        assert_eq!(super::encode(b"Ma"), "TWE=");
        assert_eq!(super::encode(b"M"), "TQ==");
    }
}

[package]
name = "tms-esc"
version = "0.1.0"
edition = "2021"

[lib]
path = "lib.rs"

[dependencies]

//! Printable bytes pass through; everything else becomes =XX.
//!
//! Included because it is the encoder whose output length depends on the
//! payload, so DMS has something to report that is not arithmetic.

pub const NAME: &str = "encodings/esc";

pub fn encode(bytes: &[u8]) -> String {
    let mut out = String::new();
    for &byte in bytes {
        if (0x20..0x7f).contains(&byte) && byte != b'=' {
            out.push(byte as char);
        } else {
            out.push('=');
            out.push(upper_nibble(byte >> 4));
            out.push(upper_nibble(byte & 0x0f));
        }
    }
    out
}

fn upper_nibble(value: u8) -> char {
    match value {
        0..=9 => (b'0' + value) as char,
        _ => (b'A' + value - 10) as char,
    }
}

#[cfg(test)]
mod tests {
    #[test]
    fn encodes_without_a_sibling_loaded() {
        assert_eq!(super::encode(b"ok"), "ok");
        assert_eq!(super::encode(&[0x0a]), "=0A");
        assert_eq!(super::encode(b"="), "=3D");
    }
}

[package]
name = "tms-hex"
version = "0.1.0"
edition = "2021"

[lib]
path = "lib.rs"

# No dependencies. Not "we chose not to add any" — this crate cannot name a
# sibling encoder even by accident, because `use tms_b64::…` does not compile
# unless tms-b64 appears above this line.
[dependencies]

//! Lowercase hex. Two characters per byte, no padding rules, no state.

pub const NAME: &str = "encodings/hex";

pub fn encode(bytes: &[u8]) -> String {
    let mut out = String::with_capacity(bytes.len() * 2);
    for byte in bytes {
        out.push(nibble(byte >> 4));
        out.push(nibble(byte & 0x0f));
    }
    out
}

fn nibble(value: u8) -> char {
    match value {
        0..=9 => (b'0' + value) as char,
        _ => (b'a' + value - 10) as char,
    }
}

#[cfg(test)]
mod tests {
    #[test]
    fn encodes_without_a_sibling_loaded() {
        assert_eq!(super::encode(&[0x00, 0x0f, 0xff]), "000fff");
    }
}

[package]
name = "dms"
version = "0.1.0"
edition = "2021"

[lib]
path = "lib.rs"

# DMS takes plain values. It depends on no encoder, so it cannot report on one
# by reaching for it — everything it prints has to be handed to it by the code
# that actually ran.
[dependencies]

//! What actually happened, including what did not.

pub struct Run {
    pub payload_bytes: usize,
    pub record_bytes: usize,
    pub encoding: String,
    pub encoded_chars: usize,
    /// Compiled in, permitted, and never called on this run. Loaded-and-correct
    /// and never-exercised are different states, and a report that cannot tell
    /// them apart is the one 改良點 7 exists to forbid.
    pub compiled_but_unused: Vec<String>,
    /// Permitted by policy with no crate behind it. Not an error: policy is
    /// allowed to describe a deployment that has not been built yet.
    pub permitted_without_a_crate: Vec<String>,
    /// Compiled in and refused by policy.
    pub compiled_but_refused: Vec<String>,
    pub verified: Result<(), String>,
}

pub fn render(run: &Run) -> String {
    let mut out = String::new();
    out.push_str("\n== record\n");
    out.push_str(&format!("  payload            {} bytes\n", run.payload_bytes));
    out.push_str(&format!(
        "  framed             {} bytes  (+{} for length and checksum)\n",
        run.record_bytes,
        run.record_bytes - run.payload_bytes
    ));
    out.push_str(&format!(
        "  {:<18} {} chars  ({:.2}x the record)\n",
        run.encoding,
        run.encoded_chars,
        run.encoded_chars as f64 / run.record_bytes as f64
    ));

    out.push_str("\n  round trip         ");
    match &run.verified {
        Ok(()) => out.push_str("unframed back to the original payload\n"),
        Err(why) => out.push_str(&format!("FAILED — {why}\n")),
    }

    out.push_str("\n== what this run does not say\n");
    section(&mut out, "compiled in, permitted, never called", &run.compiled_but_unused);
    section(&mut out, "permitted, no crate behind it", &run.permitted_without_a_crate);
    section(&mut out, "compiled in, refused by policy", &run.compiled_but_refused);
    out
}

fn section(out: &mut String, label: &str, items: &[String]) {
    if items.is_empty() {
        out.push_str(&format!("  {label:<38} none\n"));
        return;
    }
    out.push_str(&format!("  {label:<38} {}\n", items.join(", ")));
}

# This file is automatically @generated by Cargo.
# It is not intended for manual editing.
version = 4

[[package]]
name = "dms"
version = "0.1.0"

[[package]]
name = "island-test"
version = "0.1.0"

[[package]]
name = "report"
version = "0.1.0"
dependencies = [
 "dms",
 "scl",
 "sms",
 "tms-b64",
 "tms-esc",
 "tms-hex",
]

[[package]]
name = "scl"
version = "0.1.0"

[[package]]
name = "sms"
version = "0.1.0"

[[package]]
name = "tms-b64"
version = "0.1.0"

[[package]]
name = "tms-esc"
version = "0.1.0"

[[package]]
name = "tms-hex"
version = "0.1.0"

[workspace]
resolver = "2"
members = [
    "SCL",
    "SMS",
    "DMS",
    "TMS/hex",
    "TMS/b64",
    "TMS/esc",
    "main",
    "island-test",
]

# The dependency graph this file admits to is the dependency graph cargo builds.
# There is no second place where a unit can reach a sibling, which is the whole
# point of the example: the rule "no TMS depends on a sibling TMS" is a property
# of the manifests, checkable in one place, rather than a property of every
# `use` line in every file.

[package]
name = "island-test"
version = "0.1.0"
edition = "2021"

[[bin]]
name = "island-test"
path = "main.rs"

# The island test depends on NOTHING. It copies crates to a temp directory and
# asks cargo. A test that imported the units it is testing would be asserting
# from inside the thing it claims to be outside of.
[dependencies]

//! The island test, asked of the compiler instead of of a grep.
//!
//!   cargo run --offline -q -p island-test
//!
//! Sections 2 and 3 are the reason this example is in Rust: one requires cargo
//! to REFUSE, the other requires it to accept — and the gap between them is
//! exactly what the site build has to check, because the compiler will not.

use std::fs;
use std::path::{Path, PathBuf};
use std::process::Command;

fn main() {
    let src = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
        .parent()
        .unwrap()
        .to_path_buf();
    let scratch = std::env::temp_dir().join("mssp-006-island");
    let _ = fs::remove_dir_all(&scratch);
    fs::create_dir_all(&scratch).unwrap();

    let mut failures: Vec<String> = Vec::new();

    println!("\n== 1. each TMS crate compiles alone, with no sibling on disk");
    for unit in ["hex", "b64", "esc"] {
        let solo = scratch.join(format!("solo-{unit}"));
        copy_crate(&src.join("TMS").join(unit), &solo, Detach::Yes);
        let (ok, _) = cargo(&solo, &["build", "--offline", "-q"]);
        report(
            &mut failures,
            &format!("TMS/{unit} builds with nothing else present"),
            ok,
            &format!("copied alone to {}", solo.display()),
        );

        let (tests_ok, _) = cargo(&solo, &["test", "--offline", "-q"]);
        report(
            &mut failures,
            &format!("TMS/{unit} passes its own tests alone"),
            tests_ok,
            "",
        );
    }

    println!("\n== 2. a sibling reference the manifest does not declare CANNOT compile");
    {
        let sneak = scratch.join("sneak");
        copy_crate(&src.join("TMS").join("hex"), &sneak, Detach::Yes);
        // The sibling is physically present, so the failure cannot be "file not
        // found" — it has to be cargo refusing an undeclared crate.
        copy_crate(&src.join("TMS").join("b64"), &scratch.join("sneak-b64"), Detach::No);
        add_sibling_use(&sneak.join("lib.rs"));

        let (ok, output) = cargo(&sneak, &["build", "--offline", "-q"]);
        report(
            &mut failures,
            "cargo refuses `use tms_b64` with no dependency declared",
            !ok,
            &first_error(&output),
        );
        // The first version of this check accepted any failure whose text
        // mentioned tms_b64, and it passed while cargo was actually rejecting a
        // `use` line accidentally placed above the module doc comment
        // (E0753). It was green without ever testing an undeclared crate.
        report(
            &mut failures,
            "and it refuses for the stated reason: an unresolved crate",
            !ok && (output.contains("E0432") || output.contains("can't find crate")),
            "E0432 / can't find crate — not a syntax error that happens to mention it",
        );
    }

    println!("\n== 3. …and DOES compile once the manifest declares it");
    {
        let declared = scratch.join("declared");
        copy_crate(&src.join("TMS").join("hex"), &declared, Detach::Yes);
        // Not nested inside the crate: a copied sibling carrying its own
        // [workspace] under a crate that also has one is two workspace roots,
        // and cargo stops before it ever reaches the question being asked.
        copy_crate(&src.join("TMS").join("b64"), &scratch.join("declared-b64"), Detach::No);
        add_sibling_use(&declared.join("lib.rs"));

        let manifest = declared.join("Cargo.toml");
        let text = fs::read_to_string(&manifest).unwrap();
        fs::write(
            &manifest,
            text.replace(
                "[dependencies]",
                "[dependencies]\ntms-b64 = { path = \"../declared-b64\" }",
            ),
        )
        .unwrap();

        let (ok, output) = cargo(&declared, &["build", "--offline", "-q"]);
        report(
            &mut failures,
            "declaring the sibling makes it compile",
            ok,
            &if ok { String::new() } else { first_error(&output) },
        );
        report(
            &mut failures,
            "so the compiler is not the thing forbidding a sibling dependency",
            ok,
            "it forbids an UNDECLARED one — declaring it is legal and is what the site build checks",
        );
    }

    println!("\n== 4. the build's rule, applied here to the manifests");
    {
        let mut offenders = Vec::new();
        for unit in ["hex", "b64", "esc"] {
            let manifest = src.join("TMS").join(unit).join("Cargo.toml");
            let text = fs::read_to_string(&manifest).unwrap();
            if text.contains("path = \"../") {
                offenders.push(unit.to_string());
            }
        }
        report(
            &mut failures,
            "no TMS crate declares a path dependency at all",
            offenders.is_empty(),
            &format!("checked 3 manifests, offenders: {:?}", offenders),
        );

        // The check above must be able to fail, or it is decorative.
        let planted = "[dependencies]\ntms-b64 = { path = \"../b64\" }\n";
        report(
            &mut failures,
            "and that check detects a planted sibling dependency",
            planted.contains("path = \"../"),
            "the failing case, evaluated rather than asserted",
        );
    }

    println!("\n== 5. SCL names encodings it has no crate for, and refuses one it has");
    {
        let policy = fs::read_to_string(src.join("SCL").join("policy.json")).unwrap();
        report(
            &mut failures,
            "policy refuses an encoding that IS compiled in",
            !policy.contains("encodings/esc"),
            "encodings/esc has a crate and is not permitted",
        );
        let (ok, output) = cargo(&src, &["run", "--offline", "-q", "-p", "report", "--", "--esc"]);
        report(
            &mut failures,
            "and the program exits non-zero rather than encoding anyway",
            !ok && output.contains("refuses"),
            output.lines().next().unwrap_or("").trim(),
        );
    }

    println!();
    if failures.is_empty() {
        println!("  island test passed");
    } else {
        println!("  {} check(s) failed:", failures.len());
        for f in &failures {
            println!("    - {f}");
        }
        std::process::exit(1);
    }
}

fn report(failures: &mut Vec<String>, label: &str, ok: bool, detail: &str) {
    let suffix = if detail.is_empty() {
        String::new()
    } else {
        format!(" - {detail}")
    };
    println!("  {}  {label}{suffix}", if ok { "PASS" } else { "FAIL" });
    if !ok {
        failures.push(label.to_string());
    }
}

#[derive(PartialEq)]
enum Detach {
    /// Give the copy its own `[workspace]`, so cargo treats it as a package
    /// standing on its own rather than a member of whatever is above it.
    Yes,
    /// Leave it alone: a crate that will be a path dependency of another copy
    /// must not declare a workspace, or there are two roots and cargo refuses
    /// before reaching the question.
    No,
}

/// Copy a crate's own files (not its subdirectories).
fn copy_crate(from: &Path, to: &Path, detach: Detach) {
    fs::create_dir_all(to).unwrap();
    for entry in fs::read_dir(from).unwrap() {
        let entry = entry.unwrap();
        if entry.file_type().unwrap().is_file() {
            fs::copy(entry.path(), to.join(entry.file_name())).unwrap();
        }
    }
    if detach == Detach::No {
        return;
    }
    let manifest = to.join("Cargo.toml");
    let text = fs::read_to_string(&manifest).unwrap();
    if !text.contains("[workspace]") {
        fs::write(&manifest, format!("{text}\n[workspace]\n")).unwrap();
    }
}

/// Add a sibling `use` AFTER the module doc comment. Inserting at byte 0 puts
/// it above `//!`, which is E0753 — a syntax error, and a crate that fails to
/// parse never gets as far as resolving the import the test is about.
fn add_sibling_use(lib: &Path) {
    let source = fs::read_to_string(lib).unwrap();
    let body_starts = source
        .lines()
        .position(|line| !line.starts_with("//!") && !line.trim().is_empty())
        .unwrap_or(0);
    let mut lines: Vec<String> = source.lines().map(str::to_string).collect();
    lines.insert(body_starts, "use tms_b64::encode as sibling;".to_string());
    lines.insert(
        body_starts + 1,
        "pub fn leak(b: &[u8]) -> String { sibling(b) }".to_string(),
    );
    fs::write(lib, lines.join("\n")).unwrap();
}

fn cargo(dir: &Path, args: &[&str]) -> (bool, String) {
    let out = Command::new("cargo")
        .args(args)
        .current_dir(dir)
        // A separate target directory: the parent cargo holds a lock on its own.
        .env("CARGO_TARGET_DIR", std::env::temp_dir().join("mssp-006-target"))
        .output()
        .expect("cargo is not on PATH");
    let text = format!(
        "{}{}",
        String::from_utf8_lossy(&out.stdout),
        String::from_utf8_lossy(&out.stderr)
    );
    (out.status.success(), text)
}

fn first_error(output: &str) -> String {
    output
        .lines()
        .find(|l| l.trim_start().starts_with("error"))
        .unwrap_or("")
        .trim()
        .chars()
        .take(90)
        .collect()
}

[package]
name = "report"
version = "0.1.0"
edition = "2021"

[[bin]]
name = "report"
path = "main.rs"

# The entry point is the ONE crate allowed to depend on more than one encoder,
# because composing them is what it is for. Every dependency below is visible
# here and nowhere else — which is the property the whole example rests on.
[dependencies]
scl = { path = "../SCL" }
sms = { path = "../SMS" }
dms = { path = "../DMS" }
tms-hex = { path = "../TMS/hex" }
tms-b64 = { path = "../TMS/b64" }
tms-esc = { path = "../TMS/esc" }

//! Frame a payload and encode it with whichever encoding policy permits.
//!
//!   cargo run --offline -q -p report -- [--b64 | --hex | --esc] [text]

fn main() {
    let args: Vec<String> = std::env::args().skip(1).collect();
    let policy = scl::load();

    // Every encoder compiled into this binary, as (name, function). This list
    // is the one place the entry point knows more than one encoder exists.
    let compiled: Vec<(&str, fn(&[u8]) -> String)> = vec![
        (tms_hex::NAME, tms_hex::encode),
        (tms_b64::NAME, tms_b64::encode),
        (tms_esc::NAME, tms_esc::encode),
    ];

    // Which one to run comes from the flag if there is one, otherwise from the
    // first encoding policy permits that is also compiled in. No branch per
    // encoder — that is the seam example 005 caught me leaving in.
    let asked = args
        .iter()
        .find(|a| a.starts_with("--"))
        .map(|a| format!("encodings/{}", &a[2..]));
    let chosen = match asked {
        Some(name) => name,
        None => compiled
            .iter()
            .map(|(name, _)| name.to_string())
            .find(|name| policy.permits(name))
            .unwrap_or_else(|| "encodings/hex".to_string()),
    };

    if !policy.permits(&chosen) {
        eprintln!("SCL refuses {chosen}: this deployment permits {:?}", policy.permitted);
        std::process::exit(2);
    }
    let Some((_, encode)) = compiled.iter().find(|(name, _)| *name == chosen) else {
        eprintln!("{chosen} is permitted by policy but no crate provides it");
        std::process::exit(3);
    };

    let payload: Vec<u8> = args
        .iter()
        .find(|a| !a.starts_with("--"))
        .map(|s| s.as_bytes().to_vec())
        .unwrap_or_else(|| b"the quick brown fox\n".to_vec());

    if payload.len() > policy.max_payload_bytes {
        eprintln!(
            "SCL refuses a {}-byte payload: this deployment caps it at {}",
            payload.len(),
            policy.max_payload_bytes
        );
        std::process::exit(2);
    }

    let record = match sms::frame(&payload) {
        Ok(record) => record,
        Err(why) => {
            eprintln!("framing failed: {why}");
            std::process::exit(1);
        }
    };
    let encoded = encode(&record);

    let run = dms::Run {
        payload_bytes: payload.len(),
        record_bytes: record.len(),
        encoding: chosen.clone(),
        encoded_chars: encoded.chars().count(),
        compiled_but_unused: compiled
            .iter()
            .map(|(name, _)| name.to_string())
            .filter(|name| *name != chosen && policy.permits(name))
            .collect(),
        permitted_without_a_crate: policy
            .permitted
            .iter()
            .filter(|name| !compiled.iter().any(|(c, _)| c == *name))
            .cloned()
            .collect(),
        compiled_but_refused: compiled
            .iter()
            .map(|(name, _)| name.to_string())
            .filter(|name| !policy.permits(name))
            .collect(),
        // Verified by taking the record apart again, not by trusting that
        // frame() returning Ok means it framed.
        verified: match sms::unframe(&record) {
            Ok(back) if back == payload.as_slice() => Ok(()),
            Ok(_) => Err("unframed to different bytes".to_string()),
            Err(why) => Err(why.to_string()),
        },
    };

    print!("{}", dms::render(&run));
    println!("\n  {encoded}");
}