hecks 3.13.0 → 4.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e1a1eacc3bae3f940928e23269c95e0306f291ec5a2b6d62268e254f12f1902e
-  data.tar.gz: e4168d9e617dbad8912a65dbe10be8a3a32a6a08b18fd84542a05fa9803aeaef
+  metadata.gz: acccf4e21574d64b971cfbfe6a34f08f0bc86fdb8c74a8c58a472042138f01f1
+  data.tar.gz: 582d4e043a4b0145c25f6dfa8e223c47da7f55e60205fbef6485f6b406a2ffe2
 SHA512:
-  metadata.gz: a49c8992b247138d92232d00123dd73986be81040bb1356fc912f97905644bbb35a38af431a1d81475b9ce07c644ab8c2aab3370c3fabaf685c0f8a93a16bd70
-  data.tar.gz: 48ccea615a818989da2a01babb5c9d344a5a7c94fbe2eea47301a1437f29aa671134011a626f317c128bcaf1aaa912a21f056e30c8b133643123df129aa7a470
+  metadata.gz: 01f4db2b60db4d05aa7682fb7abdab6206abae36f45031656b9461fa064ec61236301b731f0b64c58cdee4d26624fe8a9d61042c379ae34f3274d036b31644ad
+  data.tar.gz: 9d1c2b9990aa214173c76634eda0dbe2f32651e80fe27e54c204d1cf0877a25e00334fc2784700754cf502196548b8e3a59549974f68789e5e31dd8defb5c0be

data/examples/pizzas/adapters/fake_processor.rb

@@ -0,0 +1,34 @@
+require "json"
+require "securerandom"
+require_relative "payment_signature"
+
+module PizzaShop
+  # A stand-in for the payment processor, for tests and a local run: it writes the delivery a
+  # Stripe-style processor would send when a payment succeeds, and signs it with the shared
+  # secret. It talks to no network and holds no real credentials.
+  #
+  # Only the processor is fake. `PaymentWebhook`, which receives the delivery, is the adapter a
+  # real deployment runs.
+  class FakeProcessor
+    # @param secret [String] the webhook signing secret this processor shares with the shop
+    def initialize(secret:)
+      @secret = secret
+    end
+
+    # Writes and signs the delivery for a payment that succeeded.
+    #
+    # @param pizza [String] the pizza's name, carried in `metadata` as the shop attached it
+    # @param customer_name [String] who paid, also carried in `metadata`
+    # @param cents [Integer] the amount the processor received, in cents
+    # @param at [Time] the moment the delivery is signed
+    # @return [Array(String, String)] the JSON body and its signature header value
+    def payment_succeeded(pizza:, customer_name:, cents:, at: Time.now)
+      body = JSON.generate(
+        id:   "evt_#{SecureRandom.hex(8)}",
+        type: PaymentWebhook::SUCCEEDED,
+        data: { object: { amount_received: cents, metadata: { pizza: pizza, customer_name: customer_name } } }
+      )
+      [body, PaymentSignature.sign(@secret, body, at: at)]
+    end
+  end
+end

data/examples/pizzas/adapters/payment_signature.rb

@@ -0,0 +1,66 @@
+require "openssl"
+require "rack/utils"
+
+module PizzaShop
+  # The signature a payment processor puts on each webhook delivery, in the timestamped scheme
+  # (`t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<body>">`) that Stripe-style processors use.
+  #
+  # Kept apart from `PaymentWebhook` so the same scheme signs a delivery (`FakeProcessor`) and
+  # checks one, and so the check can be read without the HTTP around it.
+  module PaymentSignature
+    # Raised for a delivery that cannot prove it came from the processor.
+    class Invalid < StandardError; end
+
+    # How far either side of now a delivery's timestamp may sit before it is refused as a
+    # replay, in seconds.
+    TOLERANCE = 300
+
+    module_function
+
+    # Signs a body the way the processor does.
+    #
+    # @param secret [String] the shared webhook signing secret
+    # @param body [String] the exact bytes of the delivery
+    # @param at [Time] the moment the delivery is signed
+    # @return [String] the header value, `t=<unix seconds>,v1=<hex digest>`
+    def sign(secret, body, at: Time.now)
+      stamp = at.to_i
+      "t=#{stamp},v1=#{digest(secret, stamp, body)}"
+    end
+
+    # Checks a delivery's signature header against its body.
+    #
+    # Compared in constant time: `==` leaks how many leading bytes of a forged digest matched.
+    #
+    # @param secret [String] the shared webhook signing secret
+    # @param header [String, nil] the delivery's signature header value
+    # @param body [String] the exact bytes of the delivery
+    # @param now [Time] the moment the delivery arrived
+    # @return [void]
+    # @raise [Invalid] if the header is missing or malformed, the timestamp is outside
+    #   `TOLERANCE`, or the digest does not match
+    def verify!(secret, header, body, now: Time.now)
+      stamp, signed = parts(header)
+      raise Invalid, "the signature is #{(now.to_i - stamp).abs}s old, past #{TOLERANCE}s" if stale?(stamp, now)
+      return if Rack::Utils.secure_compare(digest(secret, stamp, body), signed)
+
+      raise Invalid, "the signature does not match the body"
+    end
+
+    # @api private
+    def parts(header)
+      fields = header.to_s.split(",").to_h { |pair| pair.split("=", 2) }
+      raise Invalid, "no signature, or not in the t=…,v1=… form" unless fields["t"].to_s.match?(/\A\d+\z/) && fields["v1"]
+
+      [fields["t"].to_i, fields["v1"]]
+    end
+
+    # @api private
+    def stale?(stamp, now) = (now.to_i - stamp).abs > TOLERANCE
+
+    # @api private
+    def digest(secret, stamp, body)
+      OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new("sha256"), secret, "#{stamp}.#{body}")
+    end
+  end
+end

data/examples/pizzas/adapters/payment_webhook.rb

@@ -0,0 +1,87 @@
+require "json"
+require "rack"
+require_relative "payment_signature"
+
+module PizzaShop
+  # The driving adapter between a payment processor and Pizzas: a Rack app that verifies the
+  # processor's signed "payment succeeded" delivery and restates it in the domain's words through
+  # `Order.PaymentGateway.Receive`, the port `pizzas.hecksagon` declares.
+  #
+  # It does not decide whether the pizza sells. The port only emits `PizzaPaymentReceived`;
+  # `OnPizzaPaymentReceived` reaches `Purchase`, whose `given` rules decide. A payment the domain
+  # declines is still answered 200, saying why: the fact is true, and a non-2xx would only make
+  # the processor retry it.
+  class PaymentWebhook
+    # The header the processor signs each delivery in.
+    SIGNATURE_HEADER = "HTTP_STRIPE_SIGNATURE".freeze
+
+    # The processor's event type for money that arrived; every other type is acknowledged.
+    SUCCEEDED = "payment_intent.succeeded".freeze
+
+    # `secret:` has no default: a missing secret would silently accept anyone's delivery.
+    #
+    # @param runtime [Hecks::Runtime::Dispatcher] the booted Pizzas runtime the port is told on
+    # @param secret [String] the processor's webhook signing secret
+    # @param clock [#call] answers the current `Time`, so a test can sign in the past
+    # @raise [ArgumentError] if `secret` is nil or empty
+    def initialize(runtime:, secret:, clock: -> { Time.now })
+      raise ArgumentError, "no payment webhook secret configured" if secret.to_s.empty?
+
+      @runtime = runtime
+      @secret  = secret
+      @clock   = clock
+    end
+
+    # Answers one delivery from the processor.
+    #
+    # @param env [Hash{String => Object}] the Rack environment
+    # @return [Array(Integer, Hash{String => String}, Array<String>)] the Rack response: 405 for
+    #   anything but POST, 401 for a bad signature, 400 for a body that is not JSON, 422 for a
+    #   payment the domain cannot read, otherwise 200 with what happened as JSON
+    def call(env)
+      request = Rack::Request.new(env)
+      return respond(405, error: "MethodNotAllowed", message: "POST only") unless request.post?
+
+      body = request.body.read
+      PaymentSignature.verify!(@secret, request.get_header(SIGNATURE_HEADER), body, now: @clock.call)
+      route(JSON.parse(body))
+    rescue PaymentSignature::Invalid => e
+      respond(401, error: "InvalidSignature", message: e.message)
+    rescue JSON::ParserError => e
+      respond(400, error: "MalformedPayload", message: e.message)
+    end
+
+    private
+
+    def route(event)
+      return respond(200, ok: true, ignored: event["type"].to_s) unless event["type"] == SUCCEEDED
+
+      receive(event.dig("data", "object") || {})
+    end
+
+    def receive(payment)
+      pizza, customer = payment.fetch("metadata", {}).values_at("pizza", "customer_name")
+      return unreadable("metadata.pizza and metadata.customer_name name the order") unless pizza && customer
+
+      respond(200, ok: true, pizza: pizza, **tell(pizza, customer, payment["amount_received"]))
+    rescue *Hecks::Runtime::DOMAIN_REFUSALS => e
+      unreadable(e.message)
+    end
+
+    # Reads this delivery's reactions off the log by position, which assumes deliveries are
+    # handled one at a time, as the single-threaded development server does.
+    def tell(pizza, customer, cents)
+      before = @runtime.registry.reaction_log.size
+      result = @runtime.dispatch("Pizzas::Order.PaymentGateway.Receive",
+                                 to: pizza, with: { customer_name: { value: customer }, amount: { cents: cents } })
+      declined = @runtime.registry.reaction_log[before..].find { |reaction| !reaction[:delivered] }
+      { events: result.events.map(&:name), sold: declined.nil?, refused: declined&.dig(:reason) }.compact
+    end
+
+    def unreadable(message) = respond(422, error: "UnreadablePayment", message: message)
+
+    def respond(status, body)
+      [status, { "content-type" => "application/json" }, [JSON.generate(body)]]
+    end
+  end
+end

data/examples/pizzas/bluebook/pizzas.behaviors

@@ -45,6 +45,39 @@ Hecks.behaviors "Pizzas" do
     expect emits: ["PizzaPurchased"]
   end
 
+  test "Purchase refuses a payment that does not cover the price" do
+    tests "Purchase", on: "Order"
+    setup  "CreatePizza", name: "Underpaid", pizza: { price_cents: { cents: 1200 }, size: "large" }
+    setup  "AddTopping",  name: "Underpaid", topping: "Basil", amount: 1
+    input  name: "Underpaid", customer_name: "Chris", amount: { cents: 500 }
+    expect refused: "the payment covers the price"
+  end
+
+  # The processor's way in: the port only announces the payment, and OnPizzaPaymentReceived
+  # carries it to Purchase, whose rules decide whether the pizza sells.
+  test "a payment received through the gateway sells the pizza" do
+    tests "Pizzas::Order.PaymentGateway.Receive"
+    setup  "CreatePizza", name: "Paid For", pizza: { price_cents: { cents: 1200 }, size: "large" }
+    setup  "AddTopping",  name: "Paid For", topping: "Basil", amount: 1
+    input  to: "Paid For", with: { customer_name: { value: "Chris" }, amount: { cents: 1200 } }
+    expect emits: ["PizzaPaymentReceived", "PizzaPurchased"]
+  end
+
+  test "an underpayment through the gateway is recorded, but sells nothing" do
+    tests "Pizzas::Order.PaymentGateway.Receive"
+    setup  "CreatePizza", name: "Short", pizza: { price_cents: { cents: 1200 }, size: "large" }
+    setup  "AddTopping",  name: "Short", topping: "Basil", amount: 1
+    input  to: "Short", with: { customer_name: { value: "Chris" }, amount: { cents: 500 } }
+    expect emits: ["PizzaPaymentReceived"]
+  end
+
+  test "a payment through the gateway for a pizza with no toppings sells nothing" do
+    tests "Pizzas::Order.PaymentGateway.Receive"
+    setup  "CreatePizza", name: "Plain", pizza: { price_cents: { cents: 900 }, size: "small" }
+    input  to: "Plain", with: { customer_name: { value: "Chris" }, amount: { cents: 900 } }
+    expect emits: ["PizzaPaymentReceived"]
+  end
+
   test "a sold pizza is no longer Available" do
     tests "Available", on: "Order", kind: :query
     setup  "CreatePizza", name: "Fresh",     pizza: { price_cents: { cents: 1000 }, size: "small" }

data/examples/pizzas/bluebook/pizzas.bluebook

@@ -14,7 +14,7 @@ Hecks.bluebook "Pizzas" do
     identified_by :name
 
     value_object "PizzaName" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a pizza is named") { !value.to_s.empty? }
     end
@@ -26,13 +26,13 @@ Hecks.bluebook "Pizzas" do
     end
 
     value_object "CustomerName" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a customer is named") { !value.to_s.empty? }
     end
 
     value_object "ToppingName" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a topping is named") { !value.to_s.empty? }
       # The pattern lets a form feed through; `.strip` is what sees past it.
@@ -46,7 +46,7 @@ Hecks.bluebook "Pizzas" do
     end
 
     value_object "Topping" do
-      attribute :name,   String, pattern: '[^ \t\n\r]'
+      attribute :name,   String, matches: :present
       attribute :amount, Integer
     end
 

data/examples/pizzas/bluebook/pizzas.hecksagon

@@ -5,14 +5,16 @@ Hecks.hecksagon "Pizzas" do
   Pizzas::Order.persisted_by("Memory")
 
   # Every way in the example is named: the console (Ruby), `hecks run` (Cli), the forms and
-  # storehouse reader (Json) and `hecks mcp` (Mcp). An adapter left out would refuse the domain.
+  # storehouse reader (Json, served with the payment webhook by `examples/pizzas/config.ru`) and
+  # `hecks mcp` (Mcp). An adapter left out would refuse the domain.
   driven_by "Ruby"
   driven_by "Cli"
   driven_by "Json"
   driven_by "Mcp"
 
-  # The primary port: an outside adapter (a payment webhook) translates an external fact into
-  # our vocabulary; business rules stay on Purchase, reached via OnPizzaPaymentReceived.
+  # The primary port: an outside adapter (the payment webhook in
+  # `examples/pizzas/adapters/payment_webhook.rb`) translates an external fact into our
+  # vocabulary; business rules stay on Purchase, reached via OnPizzaPaymentReceived.
   Pizzas::Order.port "PaymentGateway" do
     operation "Receive" do
       attribute :customer_name, CustomerName

data/examples/pizzas/config.ru

@@ -0,0 +1,22 @@
+# The pizza shop on the web: both driving adapters in front of one booted Pizzas.
+#
+#   PAYMENT_WEBHOOK_SECRET=whsec_local bundle exec rackup examples/pizzas/config.ru -p 9292
+#
+# `/` is the forms app (the Json driving adapter `pizzas.hecksagon` admits): a page per command,
+# so a chef creates a pizza and adds toppings and a customer buys one. `/webhooks/payments` is
+# where the payment processor reports a payment, told to the domain through
+# `Order.PaymentGateway.Receive`. A development server: no sign-in and no CSRF protection.
+require "hecks"
+require "hecks/forms"
+require_relative "adapters/payment_webhook"
+
+runtime = Hecks.boot(__dir__)
+Hecks::Forms.configure("PizzaShop") { expose "Pizzas" }
+
+map "/webhooks/payments" do
+  run PizzaShop::PaymentWebhook.new(runtime: runtime, secret: ENV.fetch("PAYMENT_WEBHOOK_SECRET"))
+end
+
+map "/" do
+  run Hecks::Forms::App.for(registry: runtime.registry, app_name: "PizzaShop")
+end

data/lib/hecks/adapters/driven/prism.rb

@@ -4,8 +4,6 @@ require_relative "../../bluebook/expression/canonical_form"
 
 module Hecks
   module Adapters
-    class NotExtractable < StandardError; end
-
     # Extracts a `given`/`ensures`/invariant block's own source text via
     # `prism`, canonicalised into readable, comparable text (era diffing, docs).
     module Prism

data/lib/hecks/adapters/driven.rb

@@ -16,7 +16,6 @@ require_relative "driven/local_storage"
 require_relative "driven/prism"
 require_relative "driven/folder"
 require_relative "driven/d1"
-require_relative "driven/mock_stripe_adapter"
 require_relative "driven/tenant_provisioner"
 require_relative "driven/secure_random_identity"
 require_relative "driven/in_process_key_vault"
@@ -25,6 +24,5 @@ require_relative "driven/system_clock"
 # `identity_generation` adapter would make that port ambiguous for every boot.
 require_relative "driven/governance_authorization"
 require_relative "driven/identity_registry"
-require_relative "driven/google_authentication"
 require_relative "driven/claude_code"
 require_relative "driven/script_runner"

data/lib/hecks/adapters/driving/json.rb

@@ -81,13 +81,7 @@ module Hecks
         #   other value is a leaf
         # @return [Hash{Symbol => Object}, Array, Object] a new structure of the same shape
         #   with Symbol keys; a leaf is returned as it came
-        def deep_symbolize(value)
-          case value
-          when Hash  then value.to_h { |k, v| [k.to_sym, deep_symbolize(v)] }
-          when Array then value.map { |item| deep_symbolize(item) }
-          else value
-          end
-        end
+        def deep_symbolize(value) = Runtime::Value.deep_symbolize(value)
 
         # Unwraps a record, a query row, or any value holding `Runtime::Value`s into plain
         # Hashes, Arrays and scalars a JSON encoder can walk.

data/lib/hecks/bluebook/dsl/attribute_collector.rb

@@ -17,7 +17,7 @@ module Hecks
         private_constant :UNSET
 
         ATTRIBUTE_FIELD_OPTIONS = %i[default optional pattern admits].freeze
-        ATTRIBUTE_OPTIONS = [*ATTRIBUTE_FIELD_OPTIONS, :one_of].freeze
+        ATTRIBUTE_OPTIONS = [*ATTRIBUTE_FIELD_OPTIONS, :one_of, :matches].freeze
         private_constant :ATTRIBUTE_FIELD_OPTIONS, :ATTRIBUTE_OPTIONS
 
         # Returns the attributes declared so far, minting the accumulating list on first use.
@@ -34,12 +34,12 @@ module Hecks
         # Declares one field on the owning construct; the type is a bare constant (ADR 0025).
         #
         #   attribute :op, String, admits: "Vocabulary::QueryComparator"
-        # `admits:` names an already-declared closed set as qualified text, checked on read.
-        # `one_of:` declares an inline closed set, meaningful only inside a `value_object`.
+        # `admits:` names a declared closed set as qualified text. `one_of:` declares an inline one.
         #
         # @param name [Symbol] the field's name
         # @param type [Module, ListOf, OneOf] a bare constant or a wrapper
-        # @param options [Hash] `default:`, `optional:`, `pattern:`, `admits:` or `one_of:`
+        # @param options [Hash] `default:`, `optional:`, `pattern:`, `matches:` (a `NamedPattern`),
+        #   `admits:` or `one_of:`
         # @return [void]
         # @raise [Malformed] on a duplicate name, a missing or quoted type, a disallowed pattern
         # @raise [ArgumentError] on any other keyword
@@ -86,7 +86,17 @@ module Hecks
             raise ArgumentError, "unknown keyword#{"s" if unknown.size > 1}: #{unknown.map(&:inspect).join(", ")}"
           end
 
-          { default: nil, optional: false, pattern: nil, admits: nil, one_of: nil }.merge(options)
+          given = { default: nil, optional: false, pattern: nil, admits: nil, one_of: nil }.merge(options)
+          expand_matches(given)
+        end
+
+        # `matches: :name` stands for the pattern the language gives that name.
+        def expand_matches(given)
+          matches = given.delete(:matches)
+          return given unless matches
+          raise ArgumentError, "matches: and pattern: both state the pattern" if given[:pattern]
+
+          given.merge(pattern: NamedPattern.source(matches))
         end
 
         def typed_attribute(name, type, field_options)

data/lib/hecks/bluebook/dsl/bootstrap_table.rb

@@ -101,8 +101,8 @@ module Hecks
           ["TranslationAggregate", "move"] => :move_impl,
           ["TranslationAggregate", "convert"] => :convert_impl,
           ["TranslationAggregate", "retype"] => :retype_impl,
-          ["TranslationAggregate", "compute"] => :compute_impl,
-          ["TranslationAggregate", "rekey"] => :rekey_impl,
+          ["TranslationAggregate", "derive"] => :derive_impl,
+          ["TranslationAggregate", "rekey_to"] => :rekey_to_impl,
           ["TranslationAggregate", "backfill"] => :backfill_impl,
           ["TranslationAggregate", "unresolved"] => :unresolved_impl,
           ["Query", "limit"] => :limit_impl,

data/lib/hecks/bluebook/dsl/derivation_words.rb

@@ -0,0 +1,58 @@
+module Hecks
+  module Bluebook
+    module DSL
+      # The `derive` and `rekey_to` words of a `.translation` aggregate block: the two rules that
+      # compute from the record's own text and need no SQL.
+      module DerivationWords
+        # Declares a new field computed from the record's own text.
+        #
+        # The expression reads the held era's data, so it runs before any other rule and sees the
+        # fields exactly as they were stored. It changes nothing it reads: remove a source with
+        # `drop`. A record where the expression has no value (a field missing or not text) gets
+        # no new field.
+        #
+        # @param to [Symbol, String] the field's path in the destination era
+        # @param as [String] the expression, in `Bluebook::TranslationExpression`'s language
+        # @return [Array<Bluebook::TranslationDerive>] every derive declared so far, this one last
+        # @raise [Bluebook::DSL::Malformed] if `to` or `as` is empty, `to` is derived twice, or `as`
+        #   is not a well-formed expression
+        def derive_impl(to, as:)
+          raise Malformed, "a derive needs a destination path" if to.to_s.empty?
+          raise Malformed, "a derive needs its as: expression" if as.to_s.empty?
+          raise Malformed, "#{to} is derived twice" if derived?(to)
+
+          @derives << TranslationDerive.new(to.to_s, checked_expression(as))
+        end
+
+        # Declares that the aggregate's identity is the value of a field a `derive` computes.
+        #
+        # The id is that value for every record where the derive has a value, and stays what it was
+        # for the rest.
+        #
+        # @param to [Symbol, String] the destination field of a `derive` declared earlier
+        # @return [Array<Bluebook::TranslationRekey>] every rekey declared so far, this one last
+        # @raise [Bluebook::DSL::Malformed] if `to` is empty, no earlier `derive` writes it, or the
+        #   aggregate is already rekeyed
+        def rekey_to_impl(to)
+          raise Malformed, "a rekey_to needs the field to take the id from" if to.to_s.empty?
+          raise Malformed, "rekey_to #{to} needs a derive of #{to} declared before it" unless derived?(to)
+          raise Malformed, "an aggregate is rekeyed once" unless @rekeys.empty?
+
+          @rekeys << TranslationRekey.new(to.to_s)
+        end
+
+        private
+
+        def derived?(to) = @derives.any? { |derive| derive.to == to.to_s }
+
+        # The expression's text, once the language has accepted it.
+        def checked_expression(text)
+          TranslationExpression.parse(text)
+          text.to_s
+        rescue TranslationExpression::Refused => e
+          raise Malformed, "a derive's as: expression is refused: #{e.message}"
+        end
+      end
+    end
+  end
+end

data/lib/hecks/bluebook/dsl/translation_builder.rb

@@ -1,3 +1,4 @@
+require_relative "derivation_words"
 require_relative "word_gate"
 module Hecks
   module Bluebook
@@ -7,6 +8,7 @@ module Hecks
       class TranslationAggregateBuilder
         GRAMMAR_CONTEXT = "TranslationAggregate".freeze
 
+        include DerivationWords
         include WordGate
 
         # @param name [String, Symbol] the aggregate's name in the destination era
@@ -86,40 +88,6 @@ module Hecks
           @retypes << TranslationRetype.new(old_type.to_s, to.to_s)
         end
 
-        # Declares a field computed by a hand-written Postgres SQL expression.
-        #
-        # The scaffold never proposes one; a human writes it, and human-sampled review is
-        # its only verification.
-        #
-        # @param old_path [String, Symbol] the source field's path in the held era
-        # @param to [String, Symbol] the field's path in the destination era
-        # @param sql [String] the Postgres SQL expression computing the destination value
-        # @return [Array<Bluebook::TranslationCompute>] every compute declared so far, this one
-        #   last
-        # @raise [Bluebook::DSL::Malformed] if `old_path`, `to`, or `sql` is empty
-        def compute_impl(old_path, to:, sql:)
-          raise Malformed, "a compute needs a destination path (to:)" if to.to_s.empty?
-          raise Malformed, "a compute needs a source path" if old_path.to_s.empty?
-          raise Malformed, "a compute needs its sql: expression" if sql.to_s.empty?
-
-          @computes << TranslationCompute.new(old_path.to_s, to.to_s, sql.to_s)
-        end
-
-        # Declares a hand-written Postgres SQL expression that recomputes the aggregate's own
-        # identity.
-        #
-        # No path arguments, unlike the rules above: only the record's key is recomputed, not
-        # state moved into it. Verified the same human-reviewed-only way as `compute`.
-        #
-        # @param sql [String] the Postgres SQL expression computing the destination identity
-        # @return [Array<Bluebook::TranslationRekey>] every rekey declared so far, this one last
-        # @raise [Bluebook::DSL::Malformed] if `sql` is empty
-        def rekey_impl(sql:)
-          raise Malformed, "a rekey needs its sql: expression" if sql.to_s.empty?
-
-          @rekeys << TranslationRekey.new(sql.to_s)
-        end
-
         # Declares a newly added, required attribute and the default existing records read
         # until a real value is written.
         #
@@ -159,7 +127,8 @@ module Hecks
         def build
           TranslationAggregate.new(
             name: @name, was: @was, renames: @renames, moves: @moves, converts: @converts,
-            drops: @drops, retypes: @retypes, computes: @computes, rekeys: @rekeys, backfills: @backfills
+            drops: @drops, retypes: @retypes, derives: @derives, rekeys: @rekeys,
+            backfills: @backfills
           )
         end
 
@@ -171,7 +140,7 @@ module Hecks
           @converts  = []
           @drops     = []
           @retypes   = []
-          @computes  = []
+          @derives   = []
           @rekeys    = []
           @backfills = []
         end
@@ -182,7 +151,7 @@ module Hecks
           rendered = Array(candidates).map { |candidate| render_path(candidate) }
           if rendered.empty?
             "#{@name}'s translation leaves #{render_path(name)} unresolved (no candidate matched — " \
-              "consider drop, or compute on Postgres) — replace unresolved with a real rule before booting."
+              "consider drop) — replace unresolved with a real rule before booting."
           else
             "#{@name}'s translation leaves #{render_path(name)} unresolved (candidates: #{rendered.join(", ")}) — " \
               "replace unresolved with a rename, move, convert, or drop before booting."

data/lib/hecks/bluebook/expression/ast_json.rb

@@ -97,15 +97,6 @@ module Hecks
             "`value >= 100 && value <= 599` in place of `value.between?(100, 599)`"
         end
 
-        # Every name a rule resolves at its root: the first segment of each `lookup` path, unique.
-        def lookup_heads(ast)
-          heads = []
-          each_node(ast) do |node|
-            heads << node["path"].first.to_s if node["op"] == "lookup" && node["path"].is_a?(::Array)
-          end
-          heads.uniq
-        end
-
         # Visits `node` and every Hash nested inside it, depth-first.
         def each_node(node, &block)
           case node

data/lib/hecks/bluebook/hecksagon.rb

@@ -64,7 +64,7 @@ module Hecks
       attr_reader :domain, :binds, :subscriptions, :attachments, :translates, :driving
 
       # The driving adapters `driven_by` can name.
-      DRIVING_ADAPTERS = %w[Ruby Cli Json Mcp].freeze
+      DRIVING_ADAPTERS = %w[Ruby Cli Json Mcp Web].freeze
 
       # Every optional keyword and what it holds when the declaration omits it.
       FIELD_DEFAULTS = {

data/lib/hecks/bluebook/meta_validator/translation_judge/rules.rb

@@ -3,7 +3,7 @@ module Hecks
     module MetaValidator
       class TranslationJudge
         # Offers each rule collection of one translated aggregate: renames, moves, converts,
-        # drops, retypes, computes, rekeys and backfills.
+        # drops, retypes, derives, rekeys and backfills.
         module Rules
           private
 
@@ -44,19 +44,16 @@ module Hecks
             end
           end
 
-          def judge_computes(aggregate, name)
-            Array(aggregate.computes).each do |compute|
-              send_to("Translation::TranslationAggregate.AddCompute", name, to:   name,
-                                                                            with: { from: v(compute.from),
-                                                                                    to:   v(compute.to),
-                                                                                    sql:  v(compute.sql) })
+          def judge_derives(aggregate, name)
+            Array(aggregate.derives).each do |derive|
+              fields = { to: v(derive.to), expression: v(derive.expression) }
+              send_to("Translation::TranslationAggregate.AddDerive", name, to: name, with: fields)
             end
           end
 
           def judge_rekeys(aggregate, name)
-            Array(aggregate.rekeys).each do |rekey|
-              send_to("Translation::TranslationAggregate.AddRekey", name, to:   name,
-                                                                          with: { sql: v(rekey.sql) })
+            aggregate.rekeys.each do |rekey|
+              send_to("Translation::TranslationAggregate.AddRekeyTo", name, to: name, with: { to: v(rekey.to) })
             end
           end
 

data/lib/hecks/bluebook/meta_validator/translation_judge.rb

@@ -8,6 +8,9 @@ module Hecks
       class TranslationJudge
         include Rules
 
+        # The rule lists an aggregate carries, in the order they are offered to the language.
+        RULE_KINDS = %i[renames moves converts drops retypes derives rekeys backfills].freeze
+
         attr_reader :refusals
 
         # @param translation [Bluebook::Translation] the built translation to judge
@@ -67,14 +70,7 @@ module Hecks
           name = aggregate.name
           declare_aggregate(translation, aggregate, name)
 
-          judge_renames(aggregate, name)
-          judge_moves(aggregate, name)
-          judge_converts(aggregate, name)
-          judge_drops(aggregate, name)
-          judge_retypes(aggregate, name)
-          judge_computes(aggregate, name)
-          judge_rekeys(aggregate, name)
-          judge_backfills(aggregate, name)
+          RULE_KINDS.each { |kind| send("judge_#{kind}", aggregate, name) }
         end
 
         def declare_aggregate(translation, aggregate, name)