rocketsplash-formats 0.3.0

// <FILE>crates/rocketsplash-formats/src/fnc_read_splash.rs</FILE>
// <DESC>Hardened decode entry point for serialized Splash assets (.rss)</DESC>
// <VERS>VERSION: 1.0.0</VERS>
// <WCTX>Foundation crates 0.3.0 (RELEASE_PLAN D3 adversarial hardening)</WCTX>
// <CLOG>1.0.0: canonical size-capped, version-checked, validated decode path; consumers must not call rmp_serde on splash bytes directly.</CLOG>

use crate::col_peek_version::peek_version;
use crate::{FormatError, Splash, MAX_SERIALIZED_BYTES, SPLASH_MIN_SUPPORTED, SPLASH_VERSION};

/// Decode and validate a `Splash` from MessagePack bytes.
///
/// Enforces, in order: the serialized-size cap, the version window (peeked
/// from the header so future-version files fail with `UnsupportedVersion`,
/// not a decode error), and full structural validation (`limits.rs` bounds).
pub fn read_splash(bytes: &[u8]) -> Result<Splash, FormatError> {
    if bytes.len() > MAX_SERIALIZED_BYTES {
        return Err(FormatError::PayloadTooLarge {
            len: bytes.len(),
            max: MAX_SERIALIZED_BYTES,
        });
    }
    let version = peek_version(bytes);
    if let Some(found) = version {
        check_version(found)?;
    }
    let splash: Splash =
        rmp_serde::from_slice(bytes).map_err(|err| FormatError::Decode(err.to_string()))?;
    check_version(splash.version)?;
    splash.validate()?;
    Ok(splash)
}

fn check_version(found: u8) -> Result<(), FormatError> {
    if !(SPLASH_MIN_SUPPORTED..=SPLASH_VERSION).contains(&found) {
        return Err(FormatError::UnsupportedVersion {
            format: "splash",
            found,
            min_supported: SPLASH_MIN_SUPPORTED,
            current: SPLASH_VERSION,
        });
    }
    Ok(())
}

// <FILE>crates/rocketsplash-formats/src/fnc_read_splash.rs</FILE>
// <VERS>END OF VERSION: 1.0.0</VERS>