hecks 3.14.0 → 4.0.0

data/rust/host/src/platform_signin/attack_tests.rs

@@ -303,7 +303,7 @@ fn rejects_a_tampered_signature_one_bit_flipped_and_every_wrong_length() {
             wrong.len()
         );
     }
-    let mut longer = bytes.clone();
+    let mut longer = bytes;
     longer.extend_from_slice(&[0, 0]);
     assert_eq!(
         raw_token_reason(Some(&format!(
@@ -441,11 +441,11 @@ fn rejects_claims_of_the_wrong_json_type() {
         Reason::Malformed
     );
     assert_eq!(
-        refused_with(|s| set(s, "exp", json!(1800000060.0))),
+        refused_with(|s| set(s, "exp", json!(1_800_000_060.0))),
         Reason::Malformed
     );
     assert_eq!(
-        refused_with(|s| set(s, "iat", json!(1800000000.5))),
+        refused_with(|s| set(s, "iat", json!(1_800_000_000.5))),
         Reason::Malformed
     );
     assert_eq!(
@@ -911,7 +911,7 @@ fn bad_env(s: &mut Scenario) {
     set(s, "env", json!("staging"));
 }
 fn float_exp(s: &mut Scenario) {
-    set(s, "exp", json!(1800000060.5));
+    set(s, "exp", json!(1_800_000_060.5));
 }
 fn not_yet_valid(s: &mut Scenario) {
     set(s, "nbf", json!(NOW + 100));
@@ -1048,7 +1048,7 @@ fn every_single_character_mutation_of_a_good_token_is_answered_without_panicking
                 continue;
             }
             let mut mutated = good.clone();
-            mutated.replace_range(position..position + 1, &replacement.to_string());
+            mutated.replace_range(position..=position, &replacement.to_string());
             let request = SigninRequest {
                 token: Some(&mutated),
                 state: Some(STATE),

data/rust/host/src/platform_signin/config.rs

@@ -62,19 +62,19 @@ pub enum ConfigProblem {
 }
 
 impl ConfigProblem {
-    fn describe(self) -> &'static str {
+    const fn describe(self) -> &'static str {
         match self {
-            ConfigProblem::Missing => "is not set",
-            ConfigProblem::NotHttps => "must be an https URL",
-            ConfigProblem::CredentialsInUrl => "must not carry credentials",
-            ConfigProblem::PathQueryOrFragment => {
+            Self::Missing => "is not set",
+            Self::NotHttps => "must be an https URL",
+            Self::CredentialsInUrl => "must not carry credentials",
+            Self::PathQueryOrFragment => {
                 "must not carry a path, query or fragment (no trailing slash)"
             }
-            ConfigProblem::BadHost => "must name a plain lowercase host and an optional port",
-            ConfigProblem::UpperCase => "must be lowercase",
-            ConfigProblem::BadShape => "has an invalid shape",
-            ConfigProblem::WrongHostForIssuer => "must be on the issuer's host",
-            ConfigProblem::NotAnEnvironment => "must be production or staging",
+            Self::BadHost => "must name a plain lowercase host and an optional port",
+            Self::UpperCase => "must be lowercase",
+            Self::BadShape => "has an invalid shape",
+            Self::WrongHostForIssuer => "must be on the issuer's host",
+            Self::NotAnEnvironment => "must be production or staging",
         }
     }
 }
@@ -135,7 +135,7 @@ impl PlatformSigninConfig {
     }
 }
 
-fn fail(variable: &'static str, problem: ConfigProblem) -> ConfigError {
+const fn fail(variable: &'static str, problem: ConfigProblem) -> ConfigError {
     ConfigError { variable, problem }
 }
 

data/rust/host/src/platform_signin/cookie.rs

@@ -101,7 +101,7 @@ fn parse_value(value: &str) -> Option<SigninCookie> {
     })
 }
 
-fn is_url_safe(byte: u8) -> bool {
+const fn is_url_safe(byte: u8) -> bool {
     byte.is_ascii_alphanumeric() || byte == b'-' || byte == b'_'
 }
 
@@ -121,7 +121,7 @@ mod tests {
     }
 
     fn pairs(items: &[&str]) -> Vec<String> {
-        items.iter().map(|s| s.to_string()).collect()
+        items.iter().map(std::string::ToString::to_string).collect()
     }
 
     #[test]

data/rust/host/src/platform_signin/extension.rs

@@ -50,7 +50,7 @@ pub struct PlatformSignin {
 
 impl PlatformSignin {
     /// Wraps a handler that is already built.
-    pub fn new(handler: SigninHandler) -> Self {
+    pub const fn new(handler: SigninHandler) -> Self {
         Self { handler }
     }
 
@@ -181,6 +181,7 @@ impl HostExtension for RefusedSettings {
 
 /// The extensions that platform sign-in contributes for these settings: none when it is off, the
 /// flow when it is on, and a boot refusal when the settings are wrong.
+#[allow(clippy::implicit_hasher)] // reason: the settings map always comes from this crate's own default-hashed env reader
 pub fn extensions_for(vars: &HashMap<String, String>) -> Vec<Arc<dyn HostExtension>> {
     match PlatformSignin::from_env_map(vars) {
         Ok(None) => Vec::new(),

data/rust/host/src/platform_signin/handler.rs

@@ -16,6 +16,7 @@
 //! The token, the nonce, the state and the cookie are never written to a log, and an email only as
 //! a short hash. A refusal logs its stable code.
 
+use std::fmt::Write;
 use std::sync::Arc;
 
 use serde_json::{json, Value};
@@ -38,7 +39,7 @@ pub trait TokenVerifier: Send + Sync {
 
 impl<K: KeySource + Send + Sync> TokenVerifier for Verifier<K> {
     fn verify(&self, request: &SigninRequest<'_>, now: i64) -> Result<VerifiedClaims, Refusal> {
-        Verifier::verify(self, request, now)
+        Self::verify(self, request, now)
     }
 }
 
@@ -72,10 +73,7 @@ pub fn fresh_value() -> String {
 
 /// Reads the system clock.
 pub fn system_clock() -> i64 {
-    std::time::SystemTime::now()
-        .duration_since(std::time::UNIX_EPOCH)
-        .map(|elapsed| elapsed.as_secs() as i64)
-        .unwrap_or(0)
+    crate::clock::unix_now()
 }
 
 /// What a callback request carried, already separated from any headers.
@@ -125,7 +123,7 @@ impl SigninHandler {
     }
 
     /// Returns the validated settings.
-    pub fn settings(&self) -> &SigninSettings {
+    pub const fn settings(&self) -> &SigninSettings {
         &self.settings
     }
 
@@ -235,7 +233,7 @@ impl SigninHandler {
 
 /// The page a verifier refusal earns: the browser's own cookie and state are told apart, the rest
 /// share one answer so the page teaches nothing about which later check failed.
-fn failure_for(reason: Reason) -> Failure {
+const fn failure_for(reason: Reason) -> Failure {
     match reason {
         Reason::MissingCookie => Failure::Cookie,
         Reason::StateMismatch => Failure::State,
@@ -246,6 +244,9 @@ fn failure_for(reason: Reason) -> Failure {
 /// The first four bytes of the lowercased email's SHA-256, enough to tell people apart in a log.
 fn short_hash(email: &str) -> String {
     let digest = Sha256::digest(email.to_lowercase().as_bytes());
-    let hex: String = digest.iter().take(4).map(|b| format!("{b:02x}")).collect();
+    let hex = digest.iter().take(4).fold(String::new(), |mut hex, b| {
+        let _ = write!(hex, "{b:02x}"); // writing to a String cannot fail
+        hex
+    });
     format!("h:{hex}")
 }

data/rust/host/src/platform_signin/jti.rs

@@ -63,7 +63,7 @@ impl JtiStore {
         // forever would be a lock-out, so a poisoned lock is simply taken over.
         self.seen
             .lock()
-            .unwrap_or_else(|poisoned| poisoned.into_inner())
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
     }
 
     /// Counts the identifiers still remembered at `now`; expired ones are not counted.
@@ -176,7 +176,9 @@ mod tests {
                     })
                 })
                 .collect();
-            handles.into_iter().for_each(|h| h.join().unwrap());
+            for handle in handles {
+                handle.join().unwrap();
+            }
             assert_eq!(winners.load(Ordering::SeqCst), 1, "round {round}");
         }
     }

data/rust/host/src/platform_signin/jwks.rs

@@ -201,7 +201,7 @@ impl<F: JwksFetcher> JwksCache<F> {
         // The state is only ever replaced whole, so a panic elsewhere cannot leave it half-written.
         self.state
             .lock()
-            .unwrap_or_else(|poisoned| poisoned.into_inner())
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
     }
 
     fn is_stale(&self, state: &CacheState, now: i64) -> bool {
@@ -445,6 +445,7 @@ mod tests {
         (JwksCache::new(fetcher), calls)
     }
 
+    #[allow(clippy::unnecessary_wraps)] // reason: a scripted fetch answer has the fetcher's Result type
     fn one_key(x: &str) -> Result<String, FetchFailed> {
         Ok(document(&[format!(
             r#"{{"kty":"OKP","crv":"Ed25519","x":"{x}"}}"#

data/rust/host/src/platform_signin/jws.rs

@@ -14,22 +14,9 @@
 
 use super::strict_json::{self, JsonObject};
 
-const ALPHABET: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
-
 /// Encodes bytes as unpadded base64url (RFC 4648 section 5).
 pub fn encode_base64url(bytes: &[u8]) -> String {
-    let mut out = String::with_capacity(bytes.len().div_ceil(3) * 4);
-    for chunk in bytes.chunks(3) {
-        let word = chunk
-            .iter()
-            .enumerate()
-            .fold(0u32, |acc, (i, b)| acc | (*b as u32) << (16 - 8 * i));
-        let characters = chunk.len() + 1;
-        for i in 0..characters {
-            out.push(ALPHABET[((word >> (18 - 6 * i)) & 0x3f) as usize] as char);
-        }
-    }
-    out
+    crate::b64::url_encode(bytes)
 }
 
 /// Decodes canonical unpadded base64url.
@@ -37,29 +24,7 @@ pub fn encode_base64url(bytes: &[u8]) -> String {
 /// Returns `None` for padding, any character outside the URL-safe alphabet, a length that no byte
 /// string encodes to, and spare trailing bits that are not zero.
 pub fn decode_base64url(text: &str) -> Option<Vec<u8>> {
-    if text.len() % 4 == 1 {
-        return None;
-    }
-    let mut out = Vec::with_capacity(text.len() / 4 * 3 + 2);
-    let (mut accumulator, mut bits) = (0u32, 0u32);
-    for byte in text.bytes() {
-        accumulator = accumulator << 6 | sextet(byte)?;
-        bits += 6;
-        if bits >= 8 {
-            bits -= 8;
-            out.push((accumulator >> bits) as u8);
-            accumulator &= (1 << bits) - 1;
-        }
-    }
-    // Spare bits must be zero, or a second spelling would decode to the same bytes.
-    (accumulator == 0).then_some(out)
-}
-
-fn sextet(byte: u8) -> Option<u32> {
-    ALPHABET
-        .iter()
-        .position(|candidate| *candidate == byte)
-        .map(|index| index as u32)
+    crate::b64::url_decode(text)
 }
 
 /// Why a token text was refused before any claim was read.

data/rust/host/src/platform_signin/known_answer_tests.rs

@@ -32,7 +32,11 @@ fn document() -> Value {
 }
 
 fn hex(digest: &[u8]) -> String {
-    digest.iter().map(|b| format!("{b:02x}")).collect()
+    use std::fmt::Write;
+    digest.iter().fold(String::new(), |mut out, b| {
+        let _ = write!(out, "{b:02x}"); // writing to a String cannot fail
+        out
+    })
 }
 
 fn text<'a>(value: &'a Value, name: &str) -> &'a str {

data/rust/host/src/platform_signin/mode_tests.rs

@@ -69,13 +69,14 @@ fn an_unset_switch_installs_nothing() {
     let mut vars = env_map("alongside");
     vars.remove("PLATFORM_SIGNIN");
     assert!(extensions_for(&vars).is_empty());
-    assert!(extensions_for(&Default::default()).is_empty());
+    assert!(extensions_for(&std::collections::HashMap::default()).is_empty());
     assert!(PlatformSignin::from_env_map(&vars).unwrap().is_none());
 }
 
 #[test]
 fn the_default_extension_list_is_unchanged_when_the_switch_is_unset() {
-    let installed = crate::extension::default_extensions_from(&Default::default());
+    let installed =
+        crate::extension::default_extensions_from(&std::collections::HashMap::default());
     assert_eq!(installed.len(), 1);
     assert!(installed[0]
         .rate_rules()
@@ -95,7 +96,8 @@ fn a_switched_on_site_adds_exactly_one_extension() {
 async fn off_means_the_new_paths_reach_the_hosts_own_handling() {
     // With no extension installed the loop in `web::render` finds nobody; this pins what a
     // request for the new path meets instead: the hosts own routes, which know nothing of it.
-    let installed = crate::extension::default_extensions_from(&Default::default());
+    let installed =
+        crate::extension::default_extensions_from(&std::collections::HashMap::default());
     assert_eq!(installed.len(), 1);
     assert!(installed
         .iter()

data/rust/host/src/platform_signin/pages.rs

@@ -28,40 +28,40 @@ pub enum Failure {
 
 impl Failure {
     /// Every code the flow can show, in a fixed order.
-    pub const ALL: [Failure; 6] = [
-        Failure::Cookie,
-        Failure::State,
-        Failure::Params,
-        Failure::Token,
-        Failure::Unlinked,
-        Failure::Unavailable,
+    pub const ALL: [Self; 6] = [
+        Self::Cookie,
+        Self::State,
+        Self::Params,
+        Self::Token,
+        Self::Unlinked,
+        Self::Unavailable,
     ];
 
     /// Returns the stable code shown on the page and logged.
-    pub fn code(self) -> &'static str {
+    pub const fn code(self) -> &'static str {
         match self {
-            Failure::Cookie => "platform_cookie",
-            Failure::State => "platform_state",
-            Failure::Params => "platform_params",
-            Failure::Token => "platform_token",
-            Failure::Unlinked => "google_unlinked",
-            Failure::Unavailable => "platform_unavailable",
+            Self::Cookie => "platform_cookie",
+            Self::State => "platform_state",
+            Self::Params => "platform_params",
+            Self::Token => "platform_token",
+            Self::Unlinked => "google_unlinked",
+            Self::Unavailable => "platform_unavailable",
         }
     }
 
     /// Returns the HTTP status.
-    pub fn status(self) -> u16 {
+    pub const fn status(self) -> u16 {
         match self {
-            Failure::Unlinked => 403,
-            Failure::Unavailable => 500,
+            Self::Unlinked => 403,
+            Self::Unavailable => 500,
             _ => 400,
         }
     }
 
-    fn message(self) -> &'static str {
+    const fn message(self) -> &'static str {
         match self {
-            Failure::Unlinked => "This account does not have access to this site.",
-            Failure::Unavailable => "Sign-in is unavailable. Please try again later.",
+            Self::Unlinked => "This account does not have access to this site.",
+            Self::Unavailable => "Sign-in is unavailable. Please try again later.",
             _ => "This sign-in link is not valid or has expired. Please start again from the site you came from.",
         }
     }

data/rust/host/src/platform_signin/session.rs

@@ -123,7 +123,14 @@ pub struct HostMembers<'a> {
 #[async_trait]
 impl MemberDirectory for HostMembers<'_> {
     async fn identity_for(&self, issuer: &str, subject: &str) -> anyhow::Result<Option<String>> {
-        auth::resolve_identity_anywhere(self.client, self.wasm_path, self.domain_ir, issuer, subject).await
+        auth::resolve_identity_anywhere(
+            self.client,
+            self.wasm_path,
+            self.domain_ir,
+            issuer,
+            subject,
+        )
+        .await
     }
 
     async fn session_for_identity(&self, identity_id: &str) -> anyhow::Result<Option<Session>> {

data/rust/host/src/platform_signin/settings.rs

@@ -74,8 +74,8 @@ pub enum SettingsError {
 impl fmt::Display for SettingsError {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self {
-            SettingsError::Config(error) => write!(f, "{error}"),
-            SettingsError::Setting { variable, problem } => write!(f, "{variable} {problem}"),
+            Self::Config(error) => write!(f, "{error}"),
+            Self::Setting { variable, problem } => write!(f, "{variable} {problem}"),
         }
     }
 }
@@ -84,10 +84,10 @@ impl std::error::Error for SettingsError {}
 
 impl SettingsError {
     /// Returns the name of the variable at fault.
-    pub fn variable(&self) -> &'static str {
+    pub const fn variable(&self) -> &'static str {
         match self {
-            SettingsError::Config(error) => error.variable,
-            SettingsError::Setting { variable, .. } => variable,
+            Self::Config(error) => error.variable,
+            Self::Setting { variable, .. } => variable,
         }
     }
 }
@@ -117,7 +117,7 @@ impl SigninSettings {
     }
 }
 
-fn setting(variable: &'static str, problem: &'static str) -> SettingsError {
+const fn setting(variable: &'static str, problem: &'static str) -> SettingsError {
     SettingsError::Setting { variable, problem }
 }
 

data/rust/host/src/platform_signin/strict_json.rs

@@ -19,7 +19,7 @@ pub enum Json {
     /// Any number that is not an integer literal (a fraction or an exponent).
     Number,
     Str(String),
-    Array(Vec<Json>),
+    Array(Vec<Self>),
     Object(JsonObject),
 }
 
@@ -258,21 +258,24 @@ impl Parser<'_> {
             self.digits()?;
         }
         let integer_end = self.at;
-        let mut integral = true;
-        if self.peek() == Some(b'.') {
+        let has_fraction = if self.peek() == Some(b'.') {
             self.at += 1;
             self.digits()?;
-            integral = false;
-        }
-        if matches!(self.peek(), Some(b'e' | b'E')) {
+            true
+        } else {
+            false
+        };
+        let has_exponent = if matches!(self.peek(), Some(b'e' | b'E')) {
             self.at += 1;
             if matches!(self.peek(), Some(b'+' | b'-')) {
                 self.at += 1;
             }
             self.digits()?;
-            integral = false;
-        }
-        if !integral {
+            true
+        } else {
+            false
+        };
+        if has_fraction || has_exponent {
             return Some(Json::Number);
         }
         let text = std::str::from_utf8(&self.bytes[integer_start..integer_end]).ok()?;

data/rust/host/src/platform_signin/verify.rs

@@ -74,53 +74,53 @@ pub enum Reason {
 
 impl Reason {
     /// Every reason, in the order the checks run.
-    pub const ALL: [Reason; 18] = [
-        Reason::MissingCookie,
-        Reason::StateMismatch,
-        Reason::TooLarge,
-        Reason::Malformed,
-        Reason::BadAlg,
-        Reason::UnknownKid,
-        Reason::BadSignature,
-        Reason::BadIss,
-        Reason::BadAud,
-        Reason::BadEnv,
-        Reason::MissingClaim,
-        Reason::NotYetValid,
-        Reason::Expired,
-        Reason::Lifetime,
-        Reason::NonceMismatch,
-        Reason::Replay,
-        Reason::EmailUnverified,
-        Reason::SubjectMismatch,
+    pub const ALL: [Self; 18] = [
+        Self::MissingCookie,
+        Self::StateMismatch,
+        Self::TooLarge,
+        Self::Malformed,
+        Self::BadAlg,
+        Self::UnknownKid,
+        Self::BadSignature,
+        Self::BadIss,
+        Self::BadAud,
+        Self::BadEnv,
+        Self::MissingClaim,
+        Self::NotYetValid,
+        Self::Expired,
+        Self::Lifetime,
+        Self::NonceMismatch,
+        Self::Replay,
+        Self::EmailUnverified,
+        Self::SubjectMismatch,
     ];
 
     /// Returns the stable lowercase code, such as `"bad_aud"`.
-    pub fn code(self) -> &'static str {
+    pub const fn code(self) -> &'static str {
         match self {
-            Reason::MissingCookie => "missing_cookie",
-            Reason::StateMismatch => "state_mismatch",
-            Reason::TooLarge => "too_large",
-            Reason::Malformed => "malformed",
-            Reason::BadAlg => "bad_alg",
-            Reason::UnknownKid => "unknown_kid",
-            Reason::BadSignature => "bad_signature",
-            Reason::BadIss => "bad_iss",
-            Reason::BadAud => "bad_aud",
-            Reason::BadEnv => "bad_env",
-            Reason::MissingClaim => "missing_claim",
-            Reason::NotYetValid => "not_yet_valid",
-            Reason::Expired => "expired",
-            Reason::Lifetime => "lifetime",
-            Reason::NonceMismatch => "nonce_mismatch",
-            Reason::Replay => "replay",
-            Reason::EmailUnverified => "email_unverified",
-            Reason::SubjectMismatch => "subject_mismatch",
+            Self::MissingCookie => "missing_cookie",
+            Self::StateMismatch => "state_mismatch",
+            Self::TooLarge => "too_large",
+            Self::Malformed => "malformed",
+            Self::BadAlg => "bad_alg",
+            Self::UnknownKid => "unknown_kid",
+            Self::BadSignature => "bad_signature",
+            Self::BadIss => "bad_iss",
+            Self::BadAud => "bad_aud",
+            Self::BadEnv => "bad_env",
+            Self::MissingClaim => "missing_claim",
+            Self::NotYetValid => "not_yet_valid",
+            Self::Expired => "expired",
+            Self::Lifetime => "lifetime",
+            Self::NonceMismatch => "nonce_mismatch",
+            Self::Replay => "replay",
+            Self::EmailUnverified => "email_unverified",
+            Self::SubjectMismatch => "subject_mismatch",
         }
     }
 
     /// Finds the reason that has this code.
-    pub fn from_code(code: &str) -> Option<Reason> {
+    pub fn from_code(code: &str) -> Option<Self> {
         Self::ALL.into_iter().find(|reason| reason.code() == code)
     }
 }
@@ -133,7 +133,7 @@ pub struct Refusal {
 
 impl Refusal {
     /// Returns the stable reason code.
-    pub fn code(&self) -> &'static str {
+    pub const fn code(&self) -> &'static str {
         self.reason.code()
     }
 }
@@ -221,7 +221,7 @@ impl<K: KeySource> Verifier<K> {
     }
 
     /// Exposes the single-use record, so a caller can share or inspect it.
-    pub fn jti_store(&self) -> &JtiStore {
+    pub const fn jti_store(&self) -> &JtiStore {
         &self.jti_store
     }
 

data/rust/host/src/platform_signin/wiring_support.rs

@@ -5,7 +5,7 @@ use std::collections::HashMap;
 use std::sync::{Arc, Mutex};
 
 use async_trait::async_trait;
-use serde_json::{json, Value};
+use serde_json::Value;
 
 use super::config::PlatformSigninConfig;
 use super::handler::{CallbackRequest, Random, SigninHandler, SigninLog};
@@ -235,17 +235,17 @@ pub fn request_for(step: &Value) -> CallbackRequest {
     if let Some(state) = step["state"].as_str() {
         query.push(format!("state={}", encode(state)));
     }
-    let cookie_pairs = match step.get("cookie").filter(|c| !c.is_null()) {
-        None => vec![],
-        Some(cookie) => {
-            let part = |n: &str| cookie.get(n).and_then(Value::as_str);
-            let value = match part("state") {
-                Some(state) => format!("{}.{state}", part("nonce").unwrap_or("")),
-                None => part("nonce").unwrap_or("").to_string(),
-            };
-            vec![format!("__Host-signin={value}")]
-        }
-    };
+    let cookie_pairs =
+        step.get("cookie")
+            .filter(|c| !c.is_null())
+            .map_or_else(Vec::new, |cookie| {
+                let part = |n: &str| cookie.get(n).and_then(Value::as_str);
+                let value = part("state").map_or_else(
+                    || part("nonce").unwrap_or("").to_string(),
+                    |state| format!("{}.{state}", part("nonce").unwrap_or("")),
+                );
+                vec![format!("__Host-signin={value}")]
+            });
     CallbackRequest {
         raw_query: query.join("&"),
         cookie_pairs,
@@ -257,7 +257,7 @@ pub fn scripted_random(values: &[&str]) -> Random {
     let queue = Mutex::new(
         values
             .iter()
-            .map(|v| v.to_string())
+            .map(std::string::ToString::to_string)
             .collect::<std::collections::VecDeque<_>>(),
     );
     Box::new(move || queue.lock().unwrap().pop_front().expect("a scripted value"))
@@ -312,8 +312,3 @@ pub fn single(doc: &Value, name: &str) -> Value {
         .unwrap_or_else(|| panic!("vector {name}"))
         .clone()
 }
-
-#[allow(dead_code)]
-fn _unused() -> Value {
-    json!({})
-}