Const-evaluate runtime alphabet mapping

Author: eldryoth

CHANGELOG.md

@@ -13,7 +13,11 @@
   from the static smoke-test document.
 - Made `Alphabet::ENCODE` the sole encoding definition used by `Engine`, so
   hand-written, inconsistent, or stateful `Alphabet::encode` overrides cannot
-  produce API-, input-length-, or backend-dependent output.
+  produce API-, input-length-, or backend-dependent output. Standard-family
+  mapper selection is an associated compile-time constant rather than a
+  repeated scalar-call prefix scan.
+- Made the API-audit policy gate check stable semantic fragments instead of a
+  Markdown line-wrapping-sensitive sentence.
 - Added daily and manually dispatchable RustSec and cargo-deny advisory checks
   for the workspace and isolated dudect, fuzz, and performance lockfiles.
 - Updated async cleanup and release-evidence documentation.

README.md

@@ -61,8 +61,9 @@ the Chromium wasm smoke gate requires a success attribute created only by
 runtime execution rather than matching a token present in static HTML.
 Runtime encoding also treats `Alphabet::ENCODE` as its sole output definition,
 so custom `Alphabet::encode` overrides cannot create API-, input-length-, or
-backend-dependent output. A dedicated daily workflow checks all maintained
-lockfiles for newly published advisories.
+backend-dependent output. Standard-family mapper selection is compile-time and
+does not add a repeated prefix scan to scalar calls. A dedicated daily workflow
+checks all maintained lockfiles for newly published advisories.
 The stronger RISC-V RVV proof and admission review is scheduled for `1.3.9`;
 until then, RISC-V remains QEMU-tested scalar/fallback-only. The workspace
 crate family stays version-aligned at `1.3.8`.
@@ -708,8 +709,9 @@ assert_eq!(DotSlash::decode(b'.'), Some(0));
 For custom tables, `Engine` uses a deliberately conservative fixed 64-entry
 scan for every emitted Base64 byte to avoid secret-indexed table lookups.
 Standard and URL-safe table families use crate-owned optimized arithmetic
-mappers. For very large payloads and custom alphabets, benchmark this tradeoff
-before using them on untrusted high-volume traffic.
+mappers selected as an associated compile-time constant. For very large
+payloads and custom alphabets, benchmark this tradeoff before using them on
+untrusted high-volume traffic.
 
 If you implement `Alphabet` manually, `Engine` still treats `ENCODE` as the
 sole encoding definition and does not call an overridden `encode` method.

docs/API_AUDIT.md

@@ -252,7 +252,8 @@ Decision rationale:
   `Engine` APIs read that table through crate-owned mappers and never invoke a
   hand-written `Alphabet::encode` override. The method remains available as a
   low-level direct-call helper for API compatibility, but it cannot alter
-  `Engine` output.
+  `Engine` output. Standard-family mapper classification is evaluated as an
+  associated compile-time constant, not repeated for each scalar call.
 - Manual `Alphabet` implementations can override `encode` or `decode`. An
   `encode` override affects only direct calls to that low-level helper; a
   `decode` override affects the normal strict `Engine` path. The `ct` module

docs/CRATE_VERSION_MATRIX.md

@@ -13,11 +13,12 @@ guarded read-all vector growth and wipes every replaced allocation before
 deallocation. The Chromium-family wasm evidence gate now requires a
 runtime-created DOM success attribute that is proven absent from the static
 HTML source. Runtime encoding now uses `Alphabet::ENCODE` as its sole output
-definition, so custom overrides cannot create backend-dependent output, and
-scheduled advisory monitoring covers all maintained lockfiles. SIMD admission
-scope, unsafe boundaries, and the zero-dependency core posture remain
-unchanged. The stronger RISC-V RVV proof and backend-admission review moves to
-`1.3.9`.
+definition, so custom overrides cannot create backend-dependent output;
+standard-family mapper selection is compile-time rather than repeated per
+scalar call. Scheduled advisory monitoring covers all maintained lockfiles.
+SIMD admission scope, unsafe boundaries, and the zero-dependency core posture
+remain unchanged. The stronger RISC-V RVV proof and backend-admission review
+moves to `1.3.9`.
 
 | Crate | Version | Publish In 1.3.8 | Cargo |
 | --- | --- | --- | --- |

docs/PLAN.md

@@ -1178,7 +1178,10 @@ inside the `1.3.x` line if they remain evidence-gated and do not weaken the
 - Require Chromium-family wasm smoke evidence to contain a runtime-created DOM
   success attribute that is absent from the static test document.
 - Make `Alphabet::ENCODE` the sole encoding definition used by runtime and
-  const `Engine` APIs so custom overrides cannot affect output.
+  const `Engine` APIs so custom overrides cannot affect output, with
+  standard-family mapper selection evaluated at compile time.
+- Keep API-audit policy checks semantic and insensitive to Markdown line
+  wrapping.
 - Add daily and manually dispatchable advisory monitoring for workspace and
   isolated tool lockfiles.
 - Preserve core encode/decode behavior, SIMD admission scope, unsafe

release-crates.toml

@@ -7,7 +7,7 @@ previous_version = "1.3.7"
 version = "1.3.8"
 change = "code"
 publish = true
-reason = "Publishes the 1.3.8 security-hardening patch with guarded Tokio read-all growth, runtime-only browser wasm evidence, table-authoritative custom alphabet encoding, and scheduled advisory monitoring; the stronger RISC-V RVV review moves to 1.3.9."
+reason = "Publishes the 1.3.8 security-hardening patch with guarded Tokio read-all growth, runtime-only browser wasm evidence, compile-time-selected table-authoritative custom alphabet encoding, and scheduled advisory monitoring; the stronger RISC-V RVV review moves to 1.3.9."
 
 [crates."base64-ng-sanitization"]
 previous_version = "1.3.7"

release-notes/RELEASE_NOTES_1.3.8.md

@@ -13,7 +13,9 @@ the `base64-ng` workspace.
 - Hardened Chromium-family wasm runtime evidence so success requires a
   runtime-created DOM attribute that is absent from the static HTML source.
 - Made `Alphabet::ENCODE` the sole output definition used by `Engine`, so
-  hand-written or stateful `Alphabet::encode` overrides cannot alter output.
+  hand-written or stateful `Alphabet::encode` overrides cannot alter output;
+  standard-family mapper selection is evaluated at compile time.
+- Hardened the API-audit policy gate against harmless Markdown line wrapping.
 - Added daily and manually dispatchable RustSec and cargo-deny monitoring for
   the workspace and isolated tool lockfiles.
 - Updated async cleanup, release evidence, migration, and dependency examples.

scripts/validate-api-audit.sh

@@ -35,7 +35,8 @@ for required_text in \
     "try_into_exposed_string" \
     "Encode-to-back and decode-to-front contracts" \
     "define_alphabet!" \
-    "The \`ct\` module scans" \
+    "\`encode\` override affects only direct calls" \
+    "\`decode\` override affects the normal strict \`Engine\` path" \
     "\`Alphabet::ENCODE\` directly" \
     "Keep the custom-alphabet timing contract documented" \
     "Padded \`DecoderReader\` stops after terminal padding" \

src/alphabet.rs

@@ -361,7 +361,7 @@ pub(crate) enum RuntimeEncodeMapper {
 }
 
 impl RuntimeEncodeMapper {
-    pub(crate) fn for_alphabet<A: Alphabet>() -> Self {
+    pub(crate) const fn for_alphabet<A: Alphabet>() -> Self {
         const STANDARD_PREFIX: [u8; 62] =
             *b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
 
@@ -393,6 +393,12 @@ impl RuntimeEncodeMapper {
     }
 }
 
+pub(crate) struct RuntimeEncodeMapperFor<A: Alphabet>(core::marker::PhantomData<A>);
+
+impl<A: Alphabet> RuntimeEncodeMapperFor<A> {
+    pub(crate) const VALUE: RuntimeEncodeMapper = RuntimeEncodeMapper::for_alphabet::<A>();
+}
+
 #[inline]
 const fn encode_alphabet_value(value: u8, encode: &[u8; 64]) -> u8 {
     let mut output = 0;

src/lib.rs

@@ -155,7 +155,7 @@ pub use alphabet::{
     Alphabet, AlphabetError, Bcrypt, Crypt, Standard, UrlSafe, decode_alphabet_byte,
     validate_alphabet,
 };
-pub(crate) use alphabet::{RuntimeEncodeMapper, encode_base64_value};
+pub(crate) use alphabet::{RuntimeEncodeMapperFor, encode_base64_value};
 pub use buffers::{DecodedBuffer, EncodedBuffer, ExposedDecodedArray, ExposedEncodedArray};
 #[cfg(feature = "alloc")]
 pub use buffers::{ExposedSecretString, ExposedSecretVec, SecretBuffer};