feat(protected): NonEmpty context wrapper checked once at construction

[coderdan]

Summary

Closes #291.

An AEAD associated-data value and a PRF context can both be empty; for callers that use one value to domain-separate fields (stack-encrypt), an empty one collapses that separation. Downstream currently rejects empties at runtime, per encrypt, by parsing vitaminc's PAE framing and mirroring private tag constants — which already produced a real false-rejection bug (cipherstash-suite#2147).

This moves the invariant upstream and into the type, without giving up the plain-string call site.

What's added (vitaminc-protected)

• IsEmpty — structural emptiness, decided on the source value before encoding. No parsing, no mirrored constants. (), "", b"", None, Some(""), ("", "") are empty; integers never are; a composite is empty only when it contributes no caller bytes at all (("", "email") is not empty).
• NonEmpty<T> — checked once at construction: NonEmpty::new(value) at runtime, nonempty!("users/email") / NonEmpty::from_static at compile time (an empty literal fails to compile).
• TryIntoNonEmpty — one bound satisfied by both a plain "users/email" (checked structurally, once) and an already-proven NonEmpty (no check). This is what keeps encrypt_into(&cipher, "users/email") compiling while still rejecting an empty runtime value.
• EmptyError.

vitaminc-prf / vitaminc-aead

• IntoPrfContext / IntoAad for NonEmpty<T> — byte-transparent, so opting in changes nothing on the wire.
• IsEmpty for PrfContext / Aad — an already-encoded value is judged on its bytes (documented caveat: framing makes most encoded empties non-empty; the check belongs before encoding).

Empty AAD remains legal for anyone who does not opt in.

Design notes

• A plain &'static str argument cannot be value-checked at compile time ("" and "users/email" are the same type), so literals and dynamic values take different paths that meet at the TryIntoNonEmpty bound.
• nonempty! expands to a named const item rather than an inline const {} block: inline-const panics are post-monomorphisation errors that cargo check — and therefore trybuild — never see.
• TryFrom<T> for NonEmpty<T> was left out: it conflicts with std's blanket impl since a downstream crate may legally add From<Local> for NonEmpty<Local>.
• Integers are never empty. 0u64.into_aad() happens to equal None.into_aad() (untagged u64 AAD leaf); that is an IntoAad encoding quirk, to be fixed separately.

Downstream follow-up (stack-encrypt)

Add TryIntoNonEmpty to the EncryptContext / DecryptContext supertraits, convert once per target, then delete require_context, is_degenerate_aad, is_degenerate_prf_context, parse_pae, the mirrored prf_framing constants, and both EmptyContext error variants. Call sites stay "users/email".

Test plan

• cargo test -p vitaminc-protected -p vitaminc-prf -p vitaminc-aead --all-features — unit tables mirroring downstream's pinned cases, quickcheck properties, trybuild compile-fail for nonempty!(""), doctests
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• RUSTDOCFLAGS=-D warnings cargo doc --no-deps
• cargo +1.85.1 check (MSRV)
• cargo fmt --all -- --check

https://claude.ai/code/session_01PWcS13jzUo9vjU7toeFhVY

[github-actions]

🧬 Mutation testing (cargo-mutants, --in-diff)

caught	missed	unviable	timeout
26	0	12	0

✅ Every mutant in the changed lines was caught by a test.

[github-actions]

✅ No CRAP threshold violations

556 function(s) analyzed · threshold 30