← snapshot

//! The privacy boundary's trait half: [`DigestSafe`].
//!
//! The rendezvous registry exists to notice that two organisations are
//! working on similar things — without ever holding either organisation's
//! content. That claim is enforced twice, by independent mechanisms:
//!
//! 1. **The dependency graph.** `cargo xtask boundary` proves the rendezvous-plane crate
//!    never transitively reaches a content-plane crate, so content types are not even
//!    *nameable* there.
//! 2. **This trait.** Registry payloads are constrained to types marked [`DigestSafe`].
//!    The marker is implemented for fixed-size opaque values only — digests, ids,
//!    timestamps, and the sketch newtypes in `jac-sketch` — and for nothing that can
//!    carry text or bytes.
//!
//! `String`, `Vec<u8>`, and every content-bearing type simply have no
//! implementation, and this crate offers no blanket impl to acquire one
//! through:
//!
//! ```compile_fail
//! fn crosses_the_boundary<T: jac_core::DigestSafe>(_: T) {}
//!
//! // A String is content. It does not cross.
//! crosses_the_boundary(String::from("the auth module's source"));
//! ```
//!
//! Whereas a digest-shaped value does:
//!
//! ```
//! fn crosses_the_boundary<T: jac_core::DigestSafe>(_: T) {}
//!
//! crosses_the_boundary(jac_core::Digest::of(b"anything"));
//! ```

use crate::digest::Digest;
use crate::id::{AgentId, HumanId, IntroductionId, OrgId, PublicationId};
use crate::oid::{AttestationId, BlobId, DecisionId, SnapshotId, TreeId};
use crate::time::Timestamp;

/// Marker for types whose *shape* permits crossing the rendezvous boundary.
///
/// An implementation is a claim reviewed like a trust decision: the type must
/// be a fixed-size opaque value from which no input content can be
/// recovered. Digests and ids qualify; anything holding text or bytes never
/// will.
///
/// What this marks is precisely *shape*, not semantics: a `DigestSafe` value
/// can still leak by resemblance (that is the registry's entire purpose), it
/// just cannot leak content.
pub trait DigestSafe {}

impl DigestSafe for Digest {}
impl DigestSafe for Timestamp {}

impl DigestSafe for HumanId {}
impl DigestSafe for AgentId {}
impl DigestSafe for OrgId {}
impl DigestSafe for PublicationId {}
impl DigestSafe for IntroductionId {}

impl DigestSafe for BlobId {}
impl DigestSafe for TreeId {}
impl DigestSafe for SnapshotId {}
impl DigestSafe for DecisionId {}
impl DigestSafe for AttestationId {}