origin_macros/

lib.rs

//! # Origin Macros
//!
//! Proc-macros for the Origin boundary system.
//!
//! - `#[derive(BoundaryKind)]` — auto-implement the BoundaryKind trait
//! - `#[boundary_check]` — enforce boundary handling at compile time

use proc_macro::TokenStream;
use quote::quote;
use syn::{parse_macro_input, DeriveInput, ItemFn};
use syn::visit_mut::{self, VisitMut};
use syn::spanned::Spanned;

/// Derive the `BoundaryKind` trait for a struct or enum.
///
/// ```ignore
/// #[derive(Debug, Clone, BoundaryKind)]
/// pub enum InferBoundary {
///     LowConfidence { confidence: f64, threshold: f64 },
///     Hallucinated  { claim: String, evidence_score: f64 },
///     OutOfDomain   { distance: f64 },
/// }
/// ```
///
/// Use `#[boundary_kind(crate_path = "crate")]` when inside the origin crate itself.
#[proc_macro_derive(BoundaryKind, attributes(boundary_kind))]
pub fn derive_boundary_kind(input: TokenStream) -> TokenStream {
    let input = parse_macro_input!(input as DeriveInput);
    let name = &input.ident;
    let (impl_generics, ty_generics, where_clause) = input.generics.split_for_impl();

    // Check for #[boundary_kind(crate_path = "...")] to support internal use.
    let crate_path = input.attrs.iter()
        .find(|a| a.path().is_ident("boundary_kind"))
        .and_then(|a| {
            let mut path = None;
            let _ = a.parse_nested_meta(|meta| {
                if meta.path.is_ident("crate_path") {
                    let value = meta.value()?;
                    let lit: syn::LitStr = value.parse()?;
                    path = Some(lit.value());
                }
                Ok(())
            });
            path
        });

    let trait_path: syn::Path = match crate_path.as_deref() {
        Some("crate") => syn::parse_quote!(crate::BoundaryKind),
        Some(p) => syn::parse_str(&format!("{p}::BoundaryKind")).unwrap(),
        None => syn::parse_quote!(origin::BoundaryKind),
    };

    let expanded = quote! {
        impl #impl_generics #trait_path for #name #ty_generics #where_clause {}
    };

    TokenStream::from(expanded)
}

/// Enforce boundary handling at compile time.
///
/// Within a `#[boundary_check]` function:
/// - `.unwrap()` is a compile error — handle the boundary explicitly
/// - Wildcard `Boundary { .. }` match arms are a compile error —
///   each boundary kind deserves its own handler
///
/// ```ignore
/// #[boundary_check]
/// fn safe_pipeline(x: f64) -> Value<f64, DivisionByZero> {
///     let a = divide(10.0, x);
///     // a.unwrap()  — compile error!
///     a.or(0.0)      // explicit fallback — allowed
/// }
/// ```
#[proc_macro_attribute]
pub fn boundary_check(_attr: TokenStream, item: TokenStream) -> TokenStream {
    let mut func = parse_macro_input!(item as ItemFn);

    let mut checker = BoundaryChecker;
    checker.visit_item_fn_mut(&mut func);

    TokenStream::from(quote! { #func })
}

/// AST visitor that enforces boundary discipline.
struct BoundaryChecker;

impl VisitMut for BoundaryChecker {
    fn visit_expr_method_call_mut(&mut self, node: &mut syn::ExprMethodCall) {
        // Recurse first so nested calls are checked.
        visit_mut::visit_expr_method_call_mut(self, node);

        if (node.method == "unwrap" && node.args.is_empty())
            || (node.method == "expect" && node.args.len() == 1)
        {
            let span = node.method.span();
            let error = syn::parse_quote_spanned! { span =>
                compile_error!(
                    "boundary not handled: `.unwrap()` bypasses boundary checking\n\
                     \n\
                     A Value<T> may be at a boundary. Handle it explicitly:\n\
                     \n\
                     \x20 match value {\n\
                     \x20     Value::Contents(v) => /* safe to use */,\n\
                     \x20     Value::Boundary { reason, last } => /* crossed edge, has context */,\n\
                     \x20     Value::Origin(reason) => /* absolute boundary, no value */,\n\
                     \x20 }\n\
                     \n\
                     or use `.or(fallback)` to provide a default value"
                )
            };
            *node.receiver = error;
        }
    }

    fn visit_expr_match_mut(&mut self, node: &mut syn::ExprMatch) {
        // Recurse into match arms first.
        visit_mut::visit_expr_match_mut(self, node);

        // Look for wildcard Boundary arms: `Value::Boundary { .. } =>`
        // These dodge the point of boundary checking — each kind deserves its own arm.
        for arm in &mut node.arms {
            if is_wildcard_boundary_arm(&arm.pat) {
                let span = arm.pat.span();
                let error: syn::Expr = syn::parse_quote_spanned! { span =>
                    compile_error!(
                        "boundary kind ignored: wildcard `Boundary { .. }` catches all boundary kinds\n\
                         \n\
                         Each boundary kind exists for a reason. Handle them individually:\n\
                         \n\
                         \x20 Value::Contents(v) => /* safe to use */,\n\
                         \x20 Value::Boundary { reason: Kind::LowConfidence { .. }, last } => /* refer */,\n\
                         \x20 Value::Boundary { reason: Kind::Hallucinated { .. }, .. }   => /* refuse */,\n\
                         \x20 Value::Origin(reason) => /* absolute boundary, no value */,\n\
                         \n\
                         A wildcard boundary arm is the new `.unwrap()` — it acknowledges\n\
                         the boundary exists and then ignores what it means"
                    )
                };
                arm.body = Box::new(error);
            }
        }
    }
}

use syn::Pat;

/// Detect patterns that wildcard over the Boundary variant.
///
/// Catches:
/// - `Value::Boundary { .. }` — struct wildcard
/// - `Value::Boundary { reason: _, .. }` — reason wildcarded
/// - `_` — bare wildcard catches everything including Boundary
/// - `x` — bare binding catches everything including Boundary
fn is_wildcard_boundary_arm(pat: &Pat) -> bool {
    match pat {
        // Value::Boundary { .. } or Value::Boundary { reason: _, .. }
        Pat::Struct(ps) => {
            let path_str = path_to_string(&ps.path);
            if !path_str.ends_with("Boundary") {
                return false;
            }
            // If the `reason` field is present but is a wildcard `_`, that's a dodge.
            // If `..` covers reason entirely, that's also a dodge.
            let reason_field = ps.fields.iter().find(|f| {
                f.member == syn::Member::Named(syn::Ident::new("reason", proc_macro2::Span::call_site()))
            });
            match reason_field {
                None => true, // `..` covers reason — wildcard
                Some(f) => matches!(*f.pat, Pat::Wild(_)), // `reason: _`
            }
        }
        // Bare `_` wildcard catches everything including Boundary
        Pat::Wild(_) => true,
        // Bare binding `x` without subpattern catches everything
        Pat::Ident(pi) => pi.subpat.is_none(),
        _ => false,
    }
}

fn path_to_string(path: &syn::Path) -> String {
    path.segments.iter()
        .map(|s| s.ident.to_string())
        .collect::<Vec<_>>()
        .join("::")
}