hecks 3.12.0 → 3.14.0

data/rust/host/HECKS_RELEASE

@@ -1 +1 @@
-3.12.0
+3.14.0

data/rust/host/src/auth.rs

@@ -260,6 +260,43 @@ fn identity_id_from_state(state: &Value) -> Option<String> {
         })
 }
 
+/// Resolves an external identity the way the Google callback does: the PostgresEra head first,
+/// then the flat journal's `instances`. A domain whose Identity chapter keeps no head of its own
+/// (its heads cover its own aggregates and the membership aggregate) holds the link only there.
+///
+/// # Errors
+///
+/// Returns the flat journal's read error, except that a missing flat journal means no link there. A
+/// head that cannot be read is logged and skipped, as the Google callback does, so the flat journal
+/// still gets its turn.
+pub async fn resolve_identity_anywhere(
+    client: &Mutex<Client>,
+    wasm_path: &Path,
+    domain_ir: &Value,
+    issuer: &str,
+    subject: &str,
+) -> anyhow::Result<Option<String>> {
+    match resolve_identity_from_head(client, domain_ir, issuer, subject).await {
+        Ok(Some(found)) => return Ok(Some(found)),
+        Ok(None) => {}
+        Err(error) => eprintln!("resolve_identity: identity head: {error:#}"),
+    }
+    let read = match dispatch::read(client, wasm_path).await {
+        Ok(read) => read,
+        Err(error) if flat_journal_is_absent(&error) => return Ok(None),
+        Err(error) => return Err(error),
+    };
+    Ok(resolve_identity(read.get("instances").unwrap_or(&Value::Null), issuer, subject))
+}
+
+// A store with heads only has no flat journal to read; that is "no link there", not an outage.
+fn flat_journal_is_absent(error: &anyhow::Error) -> bool {
+    error
+        .chain()
+        .filter_map(|cause| cause.downcast_ref::<tokio_postgres::Error>())
+        .any(|db| db.code() == Some(&tokio_postgres::error::SqlState::UNDEFINED_TABLE))
+}
+
 /// Identity lives in the PostgresEra head, not `dispatch::read`'s
 /// `instances` — tries both the domain-qualified and the bare relation name.
 pub async fn resolve_identity_from_head(
@@ -1102,6 +1139,27 @@ mod tests {
         assert!(resolve_identity(&instances, "google", "nope").is_none());
     }
 
+    #[test]
+    fn resolve_identity_finds_a_link_that_only_the_flat_journal_holds() {
+        // The shape `ExternalIdentifier.Link` leaves in the flat snapshot of a domain whose Identity
+        // chapter has no head of its own; the key carries the issuer URL and the subject.
+        let instances = json!({
+            "Identity::ExternalIdentifier#https://accounts.google.com:111": {
+                "identity": "471ef402-8609-4fa4-9288-6372fc74650d",
+                "key": {"value": "https://accounts.google.com:111"},
+                "issuer": {"value": "https://accounts.google.com"},
+                "subject": {"value": "111"},
+            },
+        });
+        let read = json!({ "instances": instances });
+        assert_eq!(
+            resolve_identity(read.get("instances").unwrap_or(&Value::Null), "https://accounts.google.com", "111").as_deref(),
+            Some("471ef402-8609-4fa4-9288-6372fc74650d")
+        );
+        assert!(resolve_identity(read.get("instances").unwrap_or(&Value::Null), "https://accounts.google.com", "112").is_none());
+        assert!(resolve_identity(&Value::Null, "https://accounts.google.com", "111").is_none());
+    }
+
     #[test]
     fn resolve_identity_reads_the_2_0_identity_field() {
         let instances = json!({

data/rust/host/src/payments/roles.rs

@@ -0,0 +1,159 @@
+//! Which signed-in roles may manage a site's payments: a per-site setting, read once at boot.
+//!
+//! `HECKS_PAYMENTS_MANAGER_ROLES` is a comma-separated list of exact role names. Unset means
+//! `Owner`, which is what the host did before the setting existed. A set value must be a
+//! plausible list or the boot is refused; a refusal names the variable and the kind of mistake,
+//! never the value. A caller manages payments when their role is in the list, compared exactly:
+//! no case folding, no hierarchy, no wildcard.
+
+use std::sync::OnceLock;
+
+/// The variable that names the roles allowed to manage payments.
+pub const VARIABLE: &str = "HECKS_PAYMENTS_MANAGER_ROLES";
+/// The role that manages payments when the variable is unset.
+pub const DEFAULT_ROLE: &str = "Owner";
+/// The most roles one list may name.
+pub const MAX_ENTRIES: usize = 8;
+/// The longest role name, after trimming.
+pub const MAX_ENTRY_LENGTH: usize = 32;
+
+/// The roles that manage payments when nothing is configured.
+pub fn default_roles() -> Vec<String> {
+    vec![DEFAULT_ROLE.to_string()]
+}
+
+/// Parses the variable's value; `None` (unset) gives the default list.
+pub fn parse(raw: Option<&str>) -> Result<Vec<String>, String> {
+    let Some(raw) = raw else { return Ok(default_roles()) };
+    let refuse = |why: &str| Err(format!("{VARIABLE} is invalid: {why}"));
+    let entries: Vec<&str> = raw.split(',').map(str::trim).collect();
+    if entries.len() > MAX_ENTRIES {
+        return refuse(&format!("it names more than {MAX_ENTRIES} roles"));
+    }
+    for (index, entry) in entries.iter().enumerate() {
+        let position = index + 1;
+        if entry.is_empty() {
+            return refuse(&format!("entry {position} is empty; name at least one role and no blank entries"));
+        }
+        if entry.len() > MAX_ENTRY_LENGTH {
+            return refuse(&format!("entry {position} is longer than {MAX_ENTRY_LENGTH} characters"));
+        }
+        let starts_well = entry.starts_with(|c: char| c.is_ascii_alphanumeric());
+        if !starts_well || !entry.chars().all(|c| c.is_ascii_alphanumeric() || c == ' ' || c == '-') {
+            return refuse(&format!("entry {position} is not a role name: letters, digits, spaces and hyphens only, starting with a letter or digit"));
+        }
+    }
+    Ok(entries.into_iter().map(String::from).collect())
+}
+
+/// Reads the setting into `cell` the first time and never again, whatever the environment
+/// does afterwards. `read` stands for the environment lookup.
+pub fn read_once(cell: &OnceLock<Result<Vec<String>, String>>, read: impl FnOnce() -> Option<String>) -> &Result<Vec<String>, String> {
+    cell.get_or_init(|| parse(read().as_deref()))
+}
+
+/// This process's setting, read from the environment on first use (the boot check is the first).
+pub fn configured() -> &'static Result<Vec<String>, String> {
+    static CELL: OnceLock<Result<Vec<String>, String>> = OnceLock::new();
+    read_once(&CELL, || std::env::var(VARIABLE).ok())
+}
+
+/// Refuses the boot when this process's setting is invalid.
+pub fn check_boot() -> Result<(), String> {
+    configured().as_ref().map(|_| ()).map_err(Clone::clone)
+}
+
+/// The roles for a request. An invalid setting never gets here (the boot was refused); should it
+/// ever, only the default role manages, so a mistake narrows access instead of widening it.
+pub fn manager_roles() -> Vec<String> {
+    configured().clone().unwrap_or_else(|_| default_roles())
+}
+
+/// Whether `role` is one of `roles`, by exact string match.
+pub fn manages(roles: &[String], role: &str) -> bool {
+    roles.iter().any(|allowed| allowed == role)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn roles(raw: Option<&str>) -> Vec<String> {
+        parse(raw).unwrap()
+    }
+
+    #[test]
+    fn unset_means_owner_only() {
+        let list = roles(None);
+        assert_eq!(list, ["Owner"]);
+        assert!(manages(&list, "Owner"));
+        assert!(!manages(&list, "Admin"));
+        assert!(!manages(&list, "Member"));
+    }
+
+    #[test]
+    fn a_configured_list_admits_exactly_its_roles() {
+        let list = roles(Some("Owner,Admin"));
+        assert!(manages(&list, "Owner") && manages(&list, "Admin"));
+        assert!(!manages(&list, "Editor"));
+        assert!(!manages(&list, ""));
+    }
+
+    #[test]
+    fn whitespace_is_trimmed_and_case_is_exact() {
+        let list = roles(Some("  Owner , Account Admin  "));
+        assert_eq!(list, ["Owner", "Account Admin"]);
+        let lower = roles(Some("admin"));
+        assert!(manages(&lower, "admin"));
+        assert!(!manages(&lower, "Admin"), "no case folding");
+        assert!(!manages(&roles(Some("Admin")), "admin"));
+    }
+
+    #[test]
+    fn no_wildcard_and_no_hierarchy() {
+        assert!(parse(Some("*")).is_err());
+        assert!(!manages(&roles(Some("Admin")), "Owner"), "naming Admin does not admit Owner");
+    }
+
+    #[test]
+    fn an_invalid_setting_is_refused_naming_the_variable() {
+        let too_many = ["Role"; MAX_ENTRIES + 1].join(",");
+        let too_long = "A".repeat(MAX_ENTRY_LENGTH + 1);
+        for bad in ["", "   ", ",", "Owner,", ",Owner", "Owner,,Admin", "Own/er", "Owner\nAdmin", "Own\u{7}er", "Admin;Owner", "-Admin", "Ad_min", "Régisseur", too_many.as_str(), too_long.as_str()] {
+            let message = parse(Some(bad)).expect_err(bad);
+            assert!(message.starts_with(VARIABLE), "{message}");
+        }
+        assert!(parse(Some(&"A".repeat(MAX_ENTRY_LENGTH))).is_ok());
+        assert!(parse(Some(&["Role"; MAX_ENTRIES].join(","))).is_ok());
+    }
+
+    #[test]
+    fn a_refusal_never_echoes_the_value() {
+        let message = parse(Some("sk_live_SECRET/value")).unwrap_err();
+        assert!(!message.contains("sk_live"), "{message}");
+    }
+
+    #[test]
+    fn the_setting_is_read_once() {
+        let cell = OnceLock::new();
+        let reads = std::cell::Cell::new(0);
+        let first = read_once(&cell, || {
+            reads.set(reads.get() + 1);
+            Some("Owner,Admin".to_string())
+        });
+        assert_eq!(first.as_ref().unwrap(), &["Owner", "Admin"]);
+        let second = read_once(&cell, || {
+            reads.set(reads.get() + 1);
+            Some("Editor".to_string())
+        });
+        assert_eq!(second.as_ref().unwrap(), &["Owner", "Admin"]);
+        assert_eq!(reads.get(), 1);
+    }
+
+    #[test]
+    fn an_invalid_value_stays_refused_once_read() {
+        let cell = OnceLock::new();
+        assert!(read_once(&cell, || Some("a/b".to_string())).is_err());
+        assert!(read_once(&cell, || None).is_err());
+    }
+}

data/rust/host/src/payments/tests.rs

@@ -197,6 +197,7 @@ async fn tenant(name: &str) -> Tenant {
         direct_live_publishable_key: String::new(),
         webhook_secret: Some(WEBHOOK_SECRET.to_string()),
         operators: vec![OPERATOR.to_string()],
+        manager_roles: roles::default_roles(),
     };
     Tenant {
         client,
@@ -412,6 +413,30 @@ async fn only_an_owner_may_connect_or_disconnect_and_only_the_operator_may_enabl
     assert_eq!(t.status().await, "enabled");
 }
 
+#[tokio::test]
+async fn a_site_that_lists_admin_as_a_payments_manager_lets_an_admin_manage() {
+    let mut t = tenant("hecks_pay_test_manager_roles").await;
+    t.platform.manager_roles = vec!["Owner".to_string(), "Admin".to_string()];
+
+    let (status, body) = t.call("GET", "/payments/connection", json!({}), Some(ADMIN)).await;
+    assert_eq!((status, body["can_manage"].clone()), (200, json!(true)), "{body}");
+    t.connect().await;
+    assert_eq!(t.status().await, "connected");
+    let (status, _) = t.call("POST", "/payments/connection/disconnect", json!({}), Some(ADMIN)).await;
+    assert_eq!(status, 200);
+    assert_eq!(t.status().await, "disconnected");
+
+    // Enabling stays with the operator, and the Owner still manages.
+    let (status, body) = t.call("GET", "/payments/connection", json!({}), Some(OWNER)).await;
+    assert_eq!((status, body["can_manage"].clone()), (200, json!(true)), "{body}");
+    // Someone signed out, or not listed, is refused with today's message.
+    let (status, _) = t.call("GET", "/payments/connection", json!({}), None).await;
+    assert_eq!(status, 401);
+    t.platform.manager_roles = vec!["Editor".to_string()];
+    let (status, body) = t.call("POST", "/payments/connection/direct", json!({"mode": "test"}), Some(OWNER)).await;
+    assert_eq!((status, body["error"].as_str()), (403, Some("only an Owner can manage payments")));
+}
+
 #[tokio::test]
 async fn an_admin_granted_owner_passes_the_payments_gate_and_keeps_the_admin_gate() {
     let t = tenant("hecks_pay_test_owner_bootstrap").await;

data/rust/host/src/payments.rs

@@ -15,6 +15,8 @@ use tokio::sync::Mutex;
 use tokio_postgres::Client;
 
 mod keystore;
+/// Which member roles may manage payments (`HECKS_PAYMENTS_MANAGER_ROLES`).
+pub mod roles;
 use keystore::{KeyStore, StoredDocument, StoredKeys};
 
 const CONNECTION_SLUG: &str = "payments";
@@ -63,11 +65,16 @@ pub struct PlatformConfig {
     pub webhook_secret: Option<String>,
     /// Lower-cased emails allowed to enable or disable real payments.
     pub operators: Vec<String>,
+    /// The exact role names that may manage payments (`HECKS_PAYMENTS_MANAGER_ROLES`,
+    /// default `Owner`), read once at boot; see `roles`.
+    pub manager_roles: Vec<String>,
 }
 
-/// Refuses the boot on AWS when checkout is enabled but `PAYMENTS_ACCOUNT_SECRET_ID`
-/// names no secret; off AWS, or with checkout off, the host boots as usual.
+/// Refuses the boot when `HECKS_PAYMENTS_MANAGER_ROLES` is invalid, and on AWS when
+/// checkout is enabled but `PAYMENTS_ACCOUNT_SECRET_ID` names no secret; off AWS, or with
+/// checkout off, the host boots as usual.
 pub fn check_boot(checkout_enabled: bool) -> Result<(), String> {
+    roles::check_boot()?;
     keystore::check_boot(checkout_enabled)
 }
 
@@ -102,6 +109,7 @@ impl PlatformConfig {
                 .map(|email| email.trim().to_lowercase())
                 .filter(|email| !email.is_empty())
                 .collect(),
+            manager_roles: roles::manager_roles(),
         }
     }
 
@@ -276,7 +284,7 @@ fn refusal_message(refusal: &Value) -> String {
 }
 
 struct Caller {
-    owner: bool,
+    manager: bool,
     operator: bool,
 }
 
@@ -288,14 +296,14 @@ async fn caller(domain_ir: &Value, cookies: &HashMap<String, String>, secret: &s
         return Err(not_logged_in());
     };
     match auth::active_role(client, domain_ir, &email).await {
-        Ok(Some(role)) => Ok(Caller { owner: role == "Owner", operator: platform.is_operator(&email) }),
+        Ok(Some(role)) => Ok(Caller { manager: roles::manages(&platform.manager_roles, &role), operator: platform.is_operator(&email) }),
         Ok(None) => Err(not_logged_in()),
         Err(e) => Err(json_error(500, &format!("members lookup failed: {e}"))),
     }
 }
 
-fn require_owner(caller: &Caller) -> Result<(), Value> {
-    if caller.owner { Ok(()) } else { Err(json_error(403, "only an Owner can manage payments")) }
+fn require_manager(caller: &Caller) -> Result<(), Value> {
+    if caller.manager { Ok(()) } else { Err(json_error(403, "only an Owner can manage payments")) }
 }
 
 fn require_operator(caller: &Caller) -> Result<(), Value> {
@@ -322,7 +330,7 @@ fn connection_json(connection: Option<&Connection>, platform: &PlatformConfig, c
         "direct_modes": platform.direct_modes(),
         "direct": connection.is_some_and(Connection::is_direct),
         "can_save_keys": platform.can_save_keys(),
-        "can_manage": caller.owner,
+        "can_manage": caller.manager,
         "can_enable": caller.operator,
     })
 }
@@ -375,9 +383,9 @@ pub async fn route(
     })
 }
 
-// GET: readable by an Owner or the operator, nobody else.
+// GET: readable by a payments manager or the operator, nobody else.
 async fn show(caller: &Caller, platform: &PlatformConfig, client: &Mutex<Client>, wasm_path: &Path, config: &LineageConfig) -> Value {
-    if !caller.owner && !caller.operator {
+    if !caller.manager && !caller.operator {
         return json_error(403, "not permitted");
     }
     connection_response(caller, platform, client, wasm_path, config).await
@@ -429,7 +437,7 @@ async fn record_connection(
 // name), and the key itself is never stored or logged.
 #[allow(clippy::too_many_arguments)]
 async fn direct_route(caller: &Caller, raw_body: &str, platform: &PlatformConfig, client: &Mutex<Client>, wasm_path: &Path, config: &LineageConfig, invoker: &dyn LambdaInvoker) -> Value {
-    if let Err(response) = require_owner(caller) {
+    if let Err(response) = require_manager(caller) {
         return response;
     }
     let body = match parse_body(raw_body) {
@@ -462,7 +470,7 @@ async fn direct_route(caller: &Caller, raw_body: &str, platform: &PlatformConfig
 // guests have paid through this account. Disconnecting the business's own account
 // also removes its webhook and deletes the saved keys.
 async fn disconnect_route(caller: &Caller, platform: &PlatformConfig, client: &Mutex<Client>, wasm_path: &Path, config: &LineageConfig, invoker: &dyn LambdaInvoker) -> Value {
-    if let Err(response) = require_owner(caller) {
+    if let Err(response) = require_manager(caller) {
         return response;
     }
     let existing = match current_connection(client, wasm_path, config).await {
@@ -762,6 +770,7 @@ pub(crate) fn test_platform() -> PlatformConfig {
         direct_live_publishable_key: String::new(),
         webhook_secret: None,
         operators: Vec::new(),
+        manager_roles: roles::default_roles(),
     }
 }
 

data/rust/host/src/platform_signin/session.rs

@@ -123,7 +123,7 @@ pub struct HostMembers<'a> {
 #[async_trait]
 impl MemberDirectory for HostMembers<'_> {
     async fn identity_for(&self, issuer: &str, subject: &str) -> anyhow::Result<Option<String>> {
-        auth::resolve_identity_from_head(self.client, self.domain_ir, issuer, subject).await
+        auth::resolve_identity_anywhere(self.client, self.wasm_path, self.domain_ir, issuer, subject).await
     }
 
     async fn session_for_identity(&self, identity_id: &str) -> anyhow::Result<Option<Session>> {

data/rust/parser/src/build/mod.rs

@@ -4,6 +4,7 @@
 pub mod closed_sets;
 pub mod identity;
 pub mod naming;
+pub mod named_pattern;
 pub mod pattern_subset;
 pub mod query_derive;
 pub mod query_inference;

data/rust/parser/src/build/named_pattern.rs

@@ -0,0 +1,23 @@
+//! The patterns a bluebook names instead of spelling: `matches: :snake_name` stands for exactly
+//! its regex. Mirrors `Hecks::Bluebook::NamedPattern`; spec/named_pattern_spec.rb holds the two
+//! tables to each other.
+
+/// Name => the regex source it stands for.
+const TABLE: &[(&str, &str)] = &[
+    ("present", r"[^ \t\n\r]"),
+    ("not_empty", r"[^\t\n\r]"),
+    ("no_whitespace", r"^[^ \t\n\r]+$"),
+    ("snake_name", r"^[a-z][a-z0-9_]*$"),
+    ("git_sha", r"^[0-9a-fA-F]{7,40}$"),
+    ("digits", r"^[0-9]+$"),
+];
+
+/// The regex source `name` stands for, or `None` when the language gives no such name.
+pub fn source(name: &str) -> Option<&'static str> {
+    TABLE.iter().find(|(given, _)| *given == name).map(|(_, source)| *source)
+}
+
+/// Every name the language gives, in table order.
+pub fn names() -> Vec<&'static str> {
+    TABLE.iter().map(|(name, _)| *name).collect()
+}

data/rust/parser/src/keywords.rs

@@ -256,6 +256,7 @@ pub static ARGUMENTS: &[ArgumentRow] = &[
     ArgumentRow { keyword: "attribute", context: "Aggregate", at: "", named: "default", kind: "literal", required: "false", fills: "default", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "attribute", context: "Aggregate", at: "", named: "optional", kind: "flag", required: "false", fills: "optional", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "attribute", context: "Aggregate", at: "", named: "pattern", kind: "text", required: "false", fills: "pattern", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
+    ArgumentRow { keyword: "attribute", context: "Aggregate", at: "", named: "matches", kind: "symbol", required: "false", fills: "matches", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "attribute", context: "Aggregate", at: "", named: "admits", kind: "text", required: "false", fills: "admits", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "attribute", context: "Aggregate", at: "", named: "one_of", kind: "list", required: "false", fills: "one_of", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "invariant", context: "Aggregate", at: "1", named: "", kind: "text", required: "true", fills: "description", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
@@ -356,6 +357,7 @@ pub static ARGUMENTS: &[ArgumentRow] = &[
     ArgumentRow { keyword: "attribute", context: "Command", at: "", named: "default", kind: "literal", required: "false", fills: "default", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "attribute", context: "Command", at: "", named: "optional", kind: "flag", required: "false", fills: "optional", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "attribute", context: "Command", at: "", named: "pattern", kind: "text", required: "false", fills: "pattern", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
+    ArgumentRow { keyword: "attribute", context: "Command", at: "", named: "matches", kind: "symbol", required: "false", fills: "matches", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "attribute", context: "Command", at: "", named: "admits", kind: "text", required: "false", fills: "admits", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "attribute", context: "Command", at: "", named: "one_of", kind: "list", required: "false", fills: "one_of", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "corrects", context: "Command", at: "1", named: "", kind: "text", required: "true", fills: "target", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
@@ -380,6 +382,7 @@ pub static ARGUMENTS: &[ArgumentRow] = &[
     ArgumentRow { keyword: "attribute", context: "Entity", at: "", named: "default", kind: "literal", required: "false", fills: "default", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "attribute", context: "Entity", at: "", named: "optional", kind: "flag", required: "false", fills: "optional", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "attribute", context: "Entity", at: "", named: "pattern", kind: "text", required: "false", fills: "pattern", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
+    ArgumentRow { keyword: "attribute", context: "Entity", at: "", named: "matches", kind: "symbol", required: "false", fills: "matches", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "attribute", context: "Entity", at: "", named: "admits", kind: "text", required: "false", fills: "admits", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "attribute", context: "Entity", at: "", named: "one_of", kind: "list", required: "false", fills: "one_of", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "reference_to", context: "Entity", at: "1", named: "", kind: "constant", required: "true", fills: "type", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
@@ -446,6 +449,7 @@ pub static ARGUMENTS: &[ArgumentRow] = &[
     ArgumentRow { keyword: "attribute", context: "Query", at: "", named: "default", kind: "literal", required: "false", fills: "default", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "attribute", context: "Query", at: "", named: "optional", kind: "flag", required: "false", fills: "optional", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "attribute", context: "Query", at: "", named: "pattern", kind: "text", required: "false", fills: "pattern", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
+    ArgumentRow { keyword: "attribute", context: "Query", at: "", named: "matches", kind: "symbol", required: "false", fills: "matches", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "attribute", context: "Query", at: "", named: "admits", kind: "text", required: "false", fills: "admits", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "attribute", context: "Query", at: "", named: "one_of", kind: "list", required: "false", fills: "one_of", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "reference_to", context: "Query", at: "1", named: "", kind: "constant", required: "true", fills: "type", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
@@ -464,6 +468,7 @@ pub static ARGUMENTS: &[ArgumentRow] = &[
     ArgumentRow { keyword: "attribute", context: "ValueObject", at: "", named: "default", kind: "literal", required: "false", fills: "default", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "attribute", context: "ValueObject", at: "", named: "optional", kind: "flag", required: "false", fills: "optional", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "attribute", context: "ValueObject", at: "", named: "pattern", kind: "text", required: "false", fills: "pattern", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
+    ArgumentRow { keyword: "attribute", context: "ValueObject", at: "", named: "matches", kind: "symbol", required: "false", fills: "matches", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "attribute", context: "ValueObject", at: "", named: "admits", kind: "text", required: "false", fills: "admits", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "attribute", context: "ValueObject", at: "", named: "one_of", kind: "list", required: "false", fills: "one_of", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "invariant", context: "ValueObject", at: "1", named: "", kind: "text", required: "true", fills: "description", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
@@ -500,6 +505,7 @@ pub static ARGUMENTS: &[ArgumentRow] = &[
     ArgumentRow { keyword: "attribute", context: "PortOperation", at: "", named: "default", kind: "literal", required: "false", fills: "default", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "attribute", context: "PortOperation", at: "", named: "optional", kind: "flag", required: "false", fills: "optional", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "attribute", context: "PortOperation", at: "", named: "pattern", kind: "text", required: "false", fills: "pattern", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
+    ArgumentRow { keyword: "attribute", context: "PortOperation", at: "", named: "matches", kind: "symbol", required: "false", fills: "matches", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "attribute", context: "PortOperation", at: "", named: "admits", kind: "text", required: "false", fills: "admits", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "attribute", context: "PortOperation", at: "", named: "one_of", kind: "list", required: "false", fills: "one_of", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },
     ArgumentRow { keyword: "emits", context: "PortOperation", at: "1", named: "", kind: "text", required: "true", fills: "emits", selects: "", pair_key_fills: "", pair_value_fills: "", pairs_shape: "", status: "admitted", variadic: "", minimum: "" },

data/rust/parser/src/parse/mod.rs

@@ -1134,7 +1134,28 @@ pub(crate) fn build_attribute(
     let (type_name, list, closed_set) = resolve_type_expression(file, line, word, &name, text)?;
     let default = named_raw(args, "default").map(ruby_value::read);
     let optional = named_flag(args, "optional");
-    let pattern = named_text(args, "pattern");
+    // `matches: :name` is the pattern the language gives that name.
+    let pattern = match named_symbol(args, "matches") {
+        Some(given) => {
+            if named_text(args, "pattern").is_some() {
+                return Err(Diagnostic::new(file, line, "matches: and pattern: both state the pattern".to_string()));
+            }
+            match crate::build::named_pattern::source(&given) {
+                Some(source) => Some(source.to_string()),
+                None => {
+                    return Err(Diagnostic::new(
+                        file,
+                        line,
+                        format!(
+                            "matches: {given:?} is not a named pattern — the names are {}",
+                            crate::build::named_pattern::names().join(", ")
+                        ),
+                    ))
+                }
+            }
+        }
+        None => named_text(args, "pattern"),
+    };
     let admits = named_text(args, "admits");
     // Fail closed at declaration time on a pattern outside the shared subset, as Ruby does.
     if let Some(pat) = &pattern {

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: hecks
 version: !ruby/object:Gem::Version
-  version: 3.12.0
+  version: 3.14.0
 platform: ruby
 authors:
 - Chris Young
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-16 00:00:00.000000000 Z
+date: 2026-10-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: prism
@@ -97,6 +97,8 @@ files:
 - lib/hecks/adapters/driven/postgres_era.adapter
 - lib/hecks/adapters/driven/prism.adapter
 - lib/hecks/adapters/driven/prism.rb
+- lib/hecks/adapters/driven/script_runner.adapter
+- lib/hecks/adapters/driven/script_runner.rb
 - lib/hecks/adapters/driven/secure_random_identity.adapter
 - lib/hecks/adapters/driven/secure_random_identity.rb
 - lib/hecks/adapters/driven/sql_query_builder.rb
@@ -320,6 +322,7 @@ files:
 - lib/hecks/bluebook/model_check/reference_checks.rb
 - lib/hecks/bluebook/model_check/saga_checks.rb
 - lib/hecks/bluebook/model_check/verbs.rb
+- lib/hecks/bluebook/named_pattern.rb
 - lib/hecks/bluebook/pattern_subset.rb
 - lib/hecks/bluebook/pattern_subset/refusals.rb
 - lib/hecks/bluebook/pattern_subset/scan.rb
@@ -454,13 +457,21 @@ files:
 - lib/hecks/forms/value_object_shape.rb
 - lib/hecks/fqn.rb
 - lib/hecks/framework.rb
+- lib/hecks/framework/bluebook/change.behaviors
+- lib/hecks/framework/bluebook/change.bluebook
+- lib/hecks/framework/bluebook/change.hecksagon
 - lib/hecks/framework/bluebook/compliance.bluebook
 - lib/hecks/framework/bluebook/console_settings.bluebook
 - lib/hecks/framework/bluebook/framework.hecksagon
 - lib/hecks/framework/bluebook/governance.bluebook
 - lib/hecks/framework/bluebook/identity.bluebook
 - lib/hecks/framework/bluebook/privacy.bluebook
-- lib/hecks/framework/oidc.json
+- lib/hecks/framework/change.oidc.json
+- lib/hecks/framework/compliance.oidc.json
+- lib/hecks/framework/console_settings.oidc.json
+- lib/hecks/framework/governance.oidc.json
+- lib/hecks/framework/identity.oidc.json
+- lib/hecks/framework/privacy.oidc.json
 - lib/hecks/freezer.rb
 - lib/hecks/fuzzing.rb
 - lib/hecks/fuzzing/bounded_exhaustive_expressions.rb
@@ -574,11 +585,12 @@ files:
 - lib/hecks/grammar/evolve/keywords.rb
 - lib/hecks/grammar/evolve/seeds.rb
 - lib/hecks/grammar/expression.bluebook
+- lib/hecks/grammar/expression.oidc.json
 - lib/hecks/grammar/expression_operators.json
 - lib/hecks/grammar/grammar.hecksagon
-- lib/hecks/grammar/oidc.json
 - lib/hecks/grammar/operators.rb
 - lib/hecks/grammar/translation.bluebook
+- lib/hecks/grammar/translation.oidc.json
 - lib/hecks/hecks/adapters/bluebook_report.rb
 - lib/hecks/hecks/adapters/codebase/codemods.rb
 - lib/hecks/hecks/adapters/codebase/conformance.rb
@@ -1177,7 +1189,10 @@ files:
 - lib/hecks/projections/site/edge/behaviours.rb
 - lib/hecks/projections/site/edge/checks.rb
 - lib/hecks/projections/site/edge/findings.rb
+- lib/hecks/projections/site/edge/function_checks.rb
+- lib/hecks/projections/site/edge/function_code.rb
 - lib/hecks/projections/site/edge/pattern.rb
+- lib/hecks/projections/site/edge/redirect_host.js.tmpl
 - lib/hecks/projections/site/edge/route_checks.rb
 - lib/hecks/projections/site/edge/row_reader.rb
 - lib/hecks/projections/site/edge/rules.rb
@@ -1622,9 +1637,9 @@ files:
 - lib/rubocop/cop/hecks/symbol_string_key_mix.rb
 - lib/rubocop/cop/hecks/thread_shared_ivar_mutation.rb
 - lib/rubocop/cop/hecks/untyped_raise.rb
-- prebuilt/9ee54e2f0d4d6d3fe046827779b221e02de665fba911a048ae5dd8b8fbfb7d90.marshal
-- prebuilt/d74a00e996222c1d8b676d5959092effc46b4dc59e0555f3bf9554ac58e3094a.marshal
-- prebuilt/verdicts-df19f35868d3284a70f55e42dcef87ef4e65e6a678e5135f72e1f6cff4c1357b.json
+- prebuilt/1a6f596be124228be93eba1d86dbc9d2933190fa389b284331241cb9f27115a0.marshal
+- prebuilt/a883a7e568667aa5ac904c82daff356bdf9e996252a36af6def4a4a43efb967e.marshal
+- prebuilt/verdicts-872993b1aa26d73fe48f28251374b8585fed145d02aab42be0f00de386b6ff80.json
 - qa/settings.yml
 - rust/.cargo/config.toml
 - rust/.cargo/mutants.toml
@@ -1720,6 +1735,7 @@ files:
 - rust/host/src/needs.rs
 - rust/host/src/payments.rs
 - rust/host/src/payments/keystore.rs
+- rust/host/src/payments/roles.rs
 - rust/host/src/payments/tests.rs
 - rust/host/src/platform_signin/attack_tests.rs
 - rust/host/src/platform_signin/config.rs
@@ -1790,6 +1806,7 @@ files:
 - rust/parser/src/build/closed_sets.rs
 - rust/parser/src/build/identity.rs
 - rust/parser/src/build/mod.rs
+- rust/parser/src/build/named_pattern.rs
 - rust/parser/src/build/naming.rs
 - rust/parser/src/build/pattern_subset.rs
 - rust/parser/src/build/query_derive.rs