//! DOC-CC2 — guards that this capability crate has zero
//! `maat-engine` runtime deps. If someone adds `maat-engine` to
//! `[dependencies]` (instead of `[dev-dependencies]`), this test
//! still compiles because tests build with dev-deps active — so
//! the check is shell-out: `cargo tree --edges normal -p
//! maat-capabilities-annotations` must not list `maat-engine`.

#[test]
fn capability_crate_has_zero_engine_runtime_deps() {
    let crate_name = env!("CARGO_PKG_NAME");
    let output = std::process::Command::new("cargo")
        .args(["tree", "--edges", "normal", "-p", crate_name])
        .output()
        .expect("cargo tree should run");
    assert!(
        output.status.success(),
        "cargo tree failed: {}",
        String::from_utf8_lossy(&output.stderr),
    );
    let tree = String::from_utf8_lossy(&output.stdout);
    assert!(
        !tree.lines().any(|line| line.contains("maat-engine")),
        "Layer violation: `{crate_name}` has `maat-engine` in its \
         runtime dep graph. Move it to `[dev-dependencies]` per the \
         CC-2 invariant.\n\nFull tree:\n{tree}",
    );
}
