// Combine validators without modification
let validator = Age::validate
  .and_then(|age| Email::validate)
  .and_then(|email| Username::validate);

// Each validator has different interface
if !age_is_valid(&age) { return Err(...); }
match email_is_valid(&email) {
  Ok(_) => ...,
  Err(e) => return Err(convert_email_error(e)), // Adaptation needed!
}
// More validators with different interfaces

"User must be age 18-120. Email must be valid. Username must be 3-20 alphanumeric chars."

// Impossible to create invalid age
#[derive(Clone, Copy, Debug)]
pub struct Age(u8);

impl Age {
    pub fn new(val: u8) -> Result<Self, AgeError> {
        match val {
            18..=120 => Ok(Age(val)),
            _ => Err(AgeError::OutOfRange(val)),
        }
    }
    pub fn get(&self) -> u8 { self.0 }
}

// Once you have Age, it MUST be valid. No checks needed later.
fn process_user(age: Age) {
    // Age is proven valid at type level. No runtime checks.
    let years_until_100 = 100 - age.get();
}

// Email type ensures validity
#[derive(Clone, Debug)]
pub struct Email(String);

impl Email {
    pub fn new(s: &str) -> Result<Self, EmailError> {
        if is_valid_email(s) {
            Ok(Email(s.to_string()))
        } else {
            Err(EmailError::InvalidFormat)
        }
    }
}

// Vec<ValidUser> = ALL elements are proven valid
pub struct ValidUser {
    age: Age,
    email: Email,
    username: Username,
}

fn process_users(users: Vec<ValidUser>) {
    // Every user in this vec is proven valid
    // No runtime validation needed
    for user in users {
        println!("{} is {}", user.email, user.age.get());
    }
}

// BOUNDARY: User input
pub fn create_user(age_str: &str, email_str: &str) -> Result<ValidUser, Error> {
    let age = Age::new(age_str.parse()?)?;      // Validate here
    let email = Email::new(email_str)?;          // Validate here
    let username = Username::new("alice")?;      // Validate here

    Ok(ValidUser { age, email, username })      // Once created: proven valid
}

// INTERIOR: All operations on ValidUser never validate
fn update_profile(mut user: ValidUser) {
    // These operations are SAFE because ValidUser proves invariants
    user.age = Age::new(25)?;  // Wait, we're still validating?
    // Better pattern: types with validated constructors, like below
}

// Types constructed at boundary, never mutated
pub struct ValidUser {
    age: Age,
    email: Email,
    username: Username,
}

fn process_user(user: &ValidUser) {
    // Age is proven valid. No checks.
    if user.age.get() > 50 { println!("Over 50"); }
}

// Instead of: fn process(score: i32) { ... }
// Use: fn process(score: Score) { ... }

#[derive(Clone, Copy)]
pub struct Score(i32);

impl Score {
    pub fn new(val: i32) -> Result<Self, ScoreError> {
        match val {
            0..=100 => Ok(Score(val)),
            _ => Err(ScoreError::OutOfRange),
        }
    }
}

use std::marker::PhantomData;
use typenum::Unsigned;

// "Cache with max 10,000 entries" enforced at type level
#[derive(Default)]
pub struct Cache<T, N: Unsigned> {
    data: Vec<T>,
    _phantom: PhantomData<N>,
}

impl<T, N: Unsigned> Cache<T, N> {
    pub fn push(&mut self, item: T) -> Result<(), CacheError> {
        if self.data.len() < N::USIZE {
            self.data.push(item);
            Ok(())
        } else {
            Err(CacheError::CapacityExceeded)
        }
    }
}

// Usage: Type proves max capacity
type BoundedCache = Cache<Item, typenum::U10000>;

use std::marker::PhantomData;

#[derive(Clone)]
pub struct ValidPath<T>(PathBuf, PhantomData<T>);

pub struct Validated;

impl ValidPath<Validated> {
    pub fn new(path: &str) -> Result<Self, PathError> {
        // Check no directory traversal
        if path.contains("..") {
            return Err(PathError::TraversalDetected);
        }
        Ok(ValidPath(path.into(), PhantomData))
    }
}

// Only ValidPath<Validated> can reach this function
fn read_file(path: ValidPath<Validated>) -> Result<String> {
    // Path is PROVEN safe. No additional checks.
    std::fs::read_to_string(&path.0)
}

// Instead of: fn generate(path: &str) -> Result<()> { ... }
// Use:
#[derive(Clone)]
pub struct ProtectedPath { inner: PathBuf }

impl ProtectedPath {
    pub fn new(path: &str) -> Result<Self, PathError> {
        // Verify against ggen_cli_validation::PATH_PROTECTION_RULES
        validate_protected_paths(path)?;
        validate_regenerate_paths(path)?;
        Ok(ProtectedPath { inner: path.into() })
    }
}

// Function that receives ProtectedPath is PROVEN safe
fn generate(path: ProtectedPath) -> Result<GeneratedCode> {
    // No path validation here - type system proves it's safe
    std::fs::write(&path.inner, code)
}

// Specification proven valid at type level
#[derive(Clone)]
pub struct ValidRdfSpec {
    triples: Vec<Triple>,  // Proven valid RDF
}

impl ValidRdfSpec {
    pub fn load(ttl_path: &str) -> Result<Self> {
        let triples = parse_and_validate_ttl(ttl_path)?;
        // SPARQL queries verify SHACL constraints
        verify_shacl_shapes(&triples)?;
        Ok(ValidRdfSpec { triples })
    }
}

// Functions receiving ValidRdfSpec are proven safe
fn generate_from_spec(spec: ValidRdfSpec) -> Result<Code> {
    // Specification is proven valid. No validation needed.
}

// SPECIFICATION CLOSED → design chosen

// SINGLE-PASS IMPLEMENTATION
let spec = LoadedSpec::from_file("spec.ttl")?;  // Boundary validation
let design = compile_spec(&spec)?;               // Design to code
let generated = generate_code(&design)?;         // Code generation
let tests = generate_tests(&spec)?;              // Test generation
let validated = validate_output(&generated)?;   // Final validation

// DONE. No iteration needed.

// Vague spec → Try approach 1 → Doesn't work → Try approach 2 → Test fails → Refactor

// ❌ BAD: Runtime checks everywhere
fn process(age: i32) {
    if age < 18 { return Err(...); }
    if age > 120 { return Err(...); }
    // ... more checks later
    if age < 18 { return Err(...); }  // Redundant!
}

// ✅ GOOD: Check once at boundary
fn create_user(age_str: &str) -> Result<ValidUser> {
    let age = Age::new(age_str.parse()?)?;  // One check
    Ok(ValidUser { age })
}

fn process(user: ValidUser) {
    // Age is proven valid. No checks. No possibility of error.
}