refactor(stack-encrypt)!: remove FfiValue

Nothing takes a value tree any more. A plaintext is a ValueFrame, one
value as its transport frame in a wiped buffer, and every control message
a binding sends or reads is a typed value read from, or written to, its
frame by serde (#1252, steps 1 to 3). The tests that still spelled values
as FfiValue trees were moved off it in the commits before this one, so
`dynamic::FfiValue` had no caller left.

Removed: `FfiValue`, `Utf8String`, the tree's sink types (`ValueSink`,
`ValueSeq`, `ValueMap`, `Put`, `Root`, `Element`, `Entry`),
`ValueKind::holds` and `FfiValue::kind`. `ValueKind` and
`ParseValueKindError` move into `dynamic::kind` and `FromFrameError` into
`dynamic::value_frame`; all three are still exported from `dynamic`,
unchanged. The doc examples that built an FfiValue now use Rust values
(`ValueFrame::of(34u32)`, a map) or a binding's frame bytes.

The trybuild snapshot for `plaintext_needs_encrypt` lists `&PassthroughFrame`
where it listed `&FfiValue`, the next implementor in rustc's list.

Stored records, terms and the frozen fixtures are byte for byte what they
were. Refs #1252.

BREAKING CHANGE: `stack_encrypt::dynamic::FfiValue` and the types above
are gone. Build a value as a Rust value (`ValueFrame::of`) or hand over
the frame bytes a binding sends.

Author: coderdan

.github/dependabot.yml

@@ -299,7 +299,7 @@ updates:
       - dependency-name: "recipher"
       - dependency-name: "cllw-ore"
       # vitaminc is pinned at 0.5.0 across the crates and the guests; the
-      # guests' `FfiValue: Decrypt` bound fails if two versions resolve.
+      # guests' `ValueFrame: Decrypt` bound fails if two versions resolve.
       - dependency-name: "vitaminc*"
       # Major bumps are reviewed and applied manually, not by Dependabot.
       - dependency-name: "*"

languages/golang/encrypt/guest/Cargo.toml

@@ -64,7 +64,7 @@ zerokms-protocol = "=0.12.31"
 # The transport frame and ciphertext codec, shared with vitaminc's own
 # guest — one codec, not a fork. Same vitaminc version stack-encrypt builds
 # against (see the comment in packages/stack-encrypt/Cargo.toml). A
-# different version here fails at the `FfiValue: Decrypt` bound, since the
+# different version here fails at the `ValueFrame: Decrypt` bound, since the
 # aead crate would be duplicated.
 vitaminc-aead-frame = { version = "0.6.1", features = ["serde"] }
 vitaminc-protected = "0.6.1"

packages/stack-encrypt/CHANGELOG.md

@@ -214,7 +214,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   is a decrypt target that writes what it opens straight into a frame
   (`Decrypt`). The plaintext paths walk frames:
   - `record::encrypt`, `encrypt_with` and `check_source` take the source as
-    any `Encrypt` (a `ValueFrame`, a `vitaminc_aead::Frame`, or an `FfiValue`
+    any `Encrypt` (a `ValueFrame`, a `vitaminc_aead::Frame`, or a Rust value
     a test spells), walk it once and write each field's value into a
     `ValueFrame` of its own, which is all the engine keeps of it. A value
     refused while the source is split names its field, with the reasons it
@@ -246,8 +246,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - `TargetResolver::encrypt` and `query` take a `ValueFrame`, and
     `decrypt` resolves to one.
 
-  `FfiValue` stays for now, in the control data not yet read with serde
-  (see the next entry).
+  `FfiValue` is gone (see the entry after next).
   Ciphertexts, terms and the cross-language fixtures are byte for byte what
   they were. The Go guest decodes plaintext as `ValueFrame`s and returns an
   opened record's frame as it is. Copies of an opened string that remain in
@@ -288,6 +287,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
     `to_value`, `OperatorEntry::new` replaces `operator_to_value`, and
     `Limit::rows` replaces `limit_to_value` (`None` writes null).
 
+- **`dynamic::FfiValue` is removed** (`dynamic` feature, #1252). Nothing
+  takes a value tree any more: a plaintext is a `ValueFrame`, and control
+  data is read from its frame by serde (above). Gone with it are
+  `Utf8String`, the tree's sink types (`ValueSink`, `ValueSeq`, `ValueMap`,
+  `Put`, `Root`, `Element`, `Entry`), `ValueKind::holds` and
+  `FfiValue::kind`. `ValueKind` and `ParseValueKindError` are unchanged and
+  still exported from `dynamic`, as is `FromFrameError`, now the error of
+  `ValueFrame::from_bytes` and `ValueFrame::check` alone. A value a test or
+  a caller spelled as an `FfiValue` is a Rust value instead
+  (`ValueFrame::of(34u32)`, `ValueFrame::of(&map)`), or the frame bytes a
+  binding sends. Stored records, terms and the frozen fixtures are byte for
+  byte what they were.
+
 - **A match value with no tokens is stored as the empty filter, so
   `KeysetCipher::match_terms` is no longer a query.** In 0.2.0 the same call
   served write time and query time, and refused text that cuts no token

packages/stack-encrypt/Cargo.toml

@@ -89,10 +89,10 @@ tokio = { workspace = true, features = ["rt", "macros"] }
 trybuild = "1"
 
 # The derive diagnostics are recorded with every feature on, as `test:unit`
-# and CI run them. They cannot hold under both feature sets — rustc lists a
-# trait's other implementors in its help, and the `dynamic` feature's
-# `FfiValue` joins one such list and pushes another entry off it — so the
-# test is only built with that feature rather than skipped at runtime.
+# and CI run them. They cannot be relied on to hold under both feature sets
+# — rustc lists a trait's other implementors in its help, and the `dynamic`
+# feature adds implementors (`ValueFrame`) that can join such a list — so
+# the test is only built with that feature rather than skipped at runtime.
 [[test]]
 name = "ui"
 required-features = ["dynamic"]