hecks 3.7.0 → 3.9.0

data/rust/host/src/ir.rs

@@ -132,300 +132,6 @@ pub fn identity_provider(domain_ir: &Value) -> Option<IdentityProvider> {
     })
 }
 
-/// The chapter that answers the guest newsletter signup, read from
-/// `ir.json`'s own `newsletter` key. `None` when nothing provides it.
-#[derive(Debug, Clone, PartialEq)]
-pub struct NewsletterProvider {
-    /// Chapter name, e.g. `Newsletter`.
-    pub provider: String,
-    /// Qualified subscribe command, e.g. `Newsletter::Subscriber.Subscribe`.
-    pub subscribe: String,
-    /// Qualified add-name command, e.g. `Newsletter::Subscriber.AddName`.
-    pub add_name: String,
-    /// Qualified confirm command, e.g. `Newsletter::Subscriber.Confirm`.
-    pub confirm: String,
-    /// Qualified unsubscribe command, e.g. `Newsletter::Subscriber.Unsubscribe`.
-    pub unsubscribe: String,
-    /// Qualified subscribing aggregate, e.g. `Newsletter::Subscriber`.
-    pub aggregate: String,
-}
-
-impl NewsletterProvider {
-    /// The prefix every subscriber's key in a `dispatch::read` `instances`
-    /// map starts with, e.g. `Newsletter::Subscriber#`.
-    pub fn instance_prefix(&self) -> String {
-        format!("{}#", self.aggregate)
-    }
-}
-
-/// Whether the domain's own `aggregate`'s `command` declares an argument
-/// named `field` — so a route only sends an argument the command declares.
-pub fn command_declares(domain_ir: &Value, aggregate: &str, command: &str, field: &str) -> bool {
-    let named = |value: &Value, name: &str| value.get("name").and_then(|n| n.as_str()) == Some(name);
-    let Some(aggregates) = domain_ir.get("aggregates").and_then(|a| a.as_array()) else {
-        return false;
-    };
-    aggregates
-        .iter()
-        .filter(|a| named(a, aggregate))
-        .filter_map(|a| a.get("commands").and_then(|c| c.as_array()))
-        .flatten()
-        .filter(|c| named(c, command))
-        .filter_map(|c| c.get("attributes").and_then(|a| a.as_array()))
-        .flatten()
-        .any(|attribute| named(attribute, field))
-}
-
-pub fn newsletter_provider(domain_ir: &Value) -> Option<NewsletterProvider> {
-    let fact = domain_ir.get("newsletter")?;
-    Some(NewsletterProvider {
-        provider: fact.get("provider")?.as_str()?.to_string(),
-        subscribe: fact.get("subscribe")?.as_str()?.to_string(),
-        add_name: fact.get("add_name")?.as_str()?.to_string(),
-        confirm: fact.get("confirm")?.as_str()?.to_string(),
-        unsubscribe: fact.get("unsubscribe")?.as_str()?.to_string(),
-        aggregate: fact.get("aggregate")?.as_str()?.to_string(),
-    })
-}
-
-/// The chapter that declares `provides "newsletter_issues"`, read from
-/// `ir.json`'s own `newsletter_issues` key. Omitted when nothing declares it.
-#[derive(Debug, Clone, PartialEq)]
-pub struct NewsletterIssuesProvider {
-    /// Qualified send command, e.g. `Newsletter::Issue.Send`.
-    pub send_issue: String,
-    /// Qualified delivery-record command, e.g. `Newsletter::Delivery.Record`.
-    pub record_delivery: String,
-    /// Qualified issue aggregate, e.g. `Newsletter::Issue`.
-    pub issue_aggregate: String,
-}
-
-impl NewsletterIssuesProvider {
-    /// The prefix every issue's key in a `dispatch::read` `instances` map
-    /// starts with, e.g. `Newsletter::Issue#`.
-    pub fn issue_prefix(&self) -> String {
-        format!("{}#", self.issue_aggregate)
-    }
-}
-
-/// The declared issue-sending verbs, or `None` when the IR has no
-/// `newsletter_issues` key.
-pub fn newsletter_issues_provider(domain_ir: &Value) -> Option<NewsletterIssuesProvider> {
-    let fact = domain_ir.get("newsletter_issues")?;
-    Some(NewsletterIssuesProvider {
-        send_issue: fact.get("send_issue")?.as_str()?.to_string(),
-        record_delivery: fact.get("record_delivery")?.as_str()?.to_string(),
-        issue_aggregate: fact.get("issue_aggregate")?.as_str()?.to_string(),
-    })
-}
-
-
-/// The chapter that takes payments, read from `ir.json`'s own `payments`
-/// key. `None` when nothing provides it.
-#[derive(Debug, Clone, PartialEq)]
-pub struct PaymentsProvider {
-    /// Chapter name, e.g. `Payments`.
-    pub provider: String,
-    /// Qualified initiate command, e.g. `Payments::Payment.Initiate`.
-    pub initiate: String,
-    /// Qualified port operation the processor's success report dispatches,
-    /// e.g. `Payments::Payment.PaymentGateway.Succeeded`.
-    pub succeeded: String,
-    /// Qualified port operation the processor's failure report dispatches,
-    /// e.g. `Payments::Payment.PaymentGateway.Failed`.
-    pub failed: String,
-    /// Qualified paying aggregate, e.g. `Payments::Payment`.
-    pub aggregate: String,
-}
-
-impl PaymentsProvider {
-    /// The prefix every payment's key in a `dispatch::read` `instances` map
-    /// starts with, e.g. `Payments::Payment#`.
-    pub fn instance_prefix(&self) -> String {
-        format!("{}#", self.aggregate)
-    }
-}
-
-pub fn payments_provider(domain_ir: &Value) -> Option<PaymentsProvider> {
-    let fact = domain_ir.get("payments")?;
-    Some(PaymentsProvider {
-        provider: fact.get("provider")?.as_str()?.to_string(),
-        initiate: fact.get("initiate")?.as_str()?.to_string(),
-        succeeded: fact.get("succeeded")?.as_str()?.to_string(),
-        failed: fact.get("failed")?.as_str()?.to_string(),
-        aggregate: fact.get("aggregate")?.as_str()?.to_string(),
-    })
-}
-
-/// The chapter that answers scheduling sessions and taking registrations,
-/// read from `ir.json`'s own `registrations` key. `None` when nothing provides it.
-#[derive(Debug, Clone, PartialEq)]
-pub struct RegistrationsProvider {
-    /// Chapter name, e.g. `Studio`.
-    pub provider: String,
-    /// Qualified schedule command, e.g. `Studio::Event.Schedule`.
-    pub schedule: String,
-    /// Qualified request command, e.g. `Studio::Registration.Request`.
-    pub request: String,
-    /// Qualified event aggregate, e.g. `Studio::Event`.
-    pub event_aggregate: String,
-    /// Qualified registration aggregate, e.g. `Studio::Registration`.
-    pub registration_aggregate: String,
-}
-
-impl RegistrationsProvider {
-    /// The conventional names for a domain that declares no
-    /// `provides "registrations"` — `Event`/`Registration` under the domain itself.
-    pub fn conventional(domain: &str) -> Self {
-        Self {
-            provider: domain.to_string(),
-            schedule: format!("{domain}::Event.Schedule"),
-            request: format!("{domain}::Registration.Request"),
-            event_aggregate: format!("{domain}::Event"),
-            registration_aggregate: format!("{domain}::Registration"),
-        }
-    }
-
-    /// The prefix every event's key in a `dispatch::read` `instances` map
-    /// starts with, e.g. `Studio::Event#`.
-    pub fn event_prefix(&self) -> String {
-        format!("{}#", self.event_aggregate)
-    }
-
-    /// The prefix every registration's key starts with, e.g.
-    /// `Studio::Registration#`.
-    pub fn registration_prefix(&self) -> String {
-        format!("{}#", self.registration_aggregate)
-    }
-
-    /// The request command's own aggregate and command name without the
-    /// chapter qualifier, e.g. `("Registration", "Request")`, as `command_declares` expects.
-    pub fn request_target(&self) -> Option<(&str, &str)> {
-        self.request.rsplit("::").next()?.split_once('.')
-    }
-}
-
-pub fn registrations_provider(domain_ir: &Value) -> Option<RegistrationsProvider> {
-    let fact = domain_ir.get("registrations")?;
-    Some(RegistrationsProvider {
-        provider: fact.get("provider")?.as_str()?.to_string(),
-        schedule: fact.get("schedule")?.as_str()?.to_string(),
-        request: fact.get("request")?.as_str()?.to_string(),
-        event_aggregate: fact.get("event_aggregate")?.as_str()?.to_string(),
-        registration_aggregate: fact.get("registration_aggregate")?.as_str()?.to_string(),
-    })
-}
-
-/// The registrations binding of the IR this host loaded, or the
-/// conventional names for `domain` when the IR declares none.
-pub fn registrations_binding(domain: &str) -> RegistrationsProvider {
-    ir().and_then(registrations_provider).unwrap_or_else(|| RegistrationsProvider::conventional(domain))
-}
-
-/// One command of the payment-processor connection, by the role it plays —
-/// resolved through `PaymentConnectionProvider::verb`.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum ConnectionVerb {
-    Connect,
-    Reconnect,
-    Disconnect,
-    Suspend,
-    Resume,
-    Enable,
-    Disable,
-}
-
-/// The chapter that owns the business's payment-processor connection, read
-/// from `ir.json`'s own `payment_connection` key. `None` when nothing provides it.
-#[derive(Debug, Clone, PartialEq)]
-pub struct PaymentConnectionProvider {
-    /// Chapter name, e.g. `Studio`.
-    pub provider: String,
-    pub connect: String,
-    pub reconnect: String,
-    pub disconnect: String,
-    pub suspend: String,
-    pub resume: String,
-    pub enable: String,
-    pub disable: String,
-    /// Qualified connection aggregate, e.g. `Studio::PaymentConnection`.
-    pub aggregate: String,
-}
-
-impl PaymentConnectionProvider {
-    /// The conventional names for a domain that declares no
-    /// `provides "payment_connection"` — `PaymentConnection` under the domain itself.
-    pub fn conventional(domain: &str) -> Self {
-        let qualified = |command: &str| format!("{domain}::PaymentConnection.{command}");
-        Self {
-            provider: domain.to_string(),
-            connect: qualified("Connect"),
-            reconnect: qualified("Reconnect"),
-            disconnect: qualified("Disconnect"),
-            suspend: qualified("Suspend"),
-            resume: qualified("Resume"),
-            enable: qualified("EnablePayments"),
-            disable: qualified("DisablePayments"),
-            aggregate: format!("{domain}::PaymentConnection"),
-        }
-    }
-
-    /// The prefix every connection's key in a `dispatch::read` `instances`
-    /// map starts with, e.g. `Studio::PaymentConnection#`.
-    pub fn instance_prefix(&self) -> String {
-        format!("{}#", self.aggregate)
-    }
-
-    /// The qualified command that plays `which`.
-    pub fn verb(&self, which: ConnectionVerb) -> &str {
-        match which {
-            ConnectionVerb::Connect => &self.connect,
-            ConnectionVerb::Reconnect => &self.reconnect,
-            ConnectionVerb::Disconnect => &self.disconnect,
-            ConnectionVerb::Suspend => &self.suspend,
-            ConnectionVerb::Resume => &self.resume,
-            ConnectionVerb::Enable => &self.enable,
-            ConnectionVerb::Disable => &self.disable,
-        }
-    }
-}
-
-pub fn payment_connection_provider(domain_ir: &Value) -> Option<PaymentConnectionProvider> {
-    let fact = domain_ir.get("payment_connection")?;
-    let text = |key: &str| Some(fact.get(key)?.as_str()?.to_string());
-    Some(PaymentConnectionProvider {
-        provider: text("provider")?,
-        connect: text("connect")?,
-        reconnect: text("reconnect")?,
-        disconnect: text("disconnect")?,
-        suspend: text("suspend")?,
-        resume: text("resume")?,
-        enable: text("enable")?,
-        disable: text("disable")?,
-        aggregate: text("aggregate")?,
-    })
-}
-
-/// The payment-connection binding of the IR this host loaded, or the
-/// conventional names for `domain` when the IR declares none.
-pub fn payment_connection_binding(domain: &str) -> PaymentConnectionProvider {
-    ir().and_then(payment_connection_provider).unwrap_or_else(|| PaymentConnectionProvider::conventional(domain))
-}
-
-/// The checkout fixture's own payments binding, read from its committed
-/// `ir.json` — what the checkout routes' tests dispatch against.
-#[cfg(test)]
-pub fn fixture_ir() -> Value {
-    let path = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../src/generated/checkout_fixture/ir.json");
-    serde_json::from_str(&std::fs::read_to_string(path).expect("checkout_fixture ir.json")).expect("valid json")
-}
-
-/// The checkout fixture's own payments binding.
-#[cfg(test)]
-pub fn fixture_payments() -> PaymentsProvider {
-    payments_provider(&fixture_ir()).expect("the checkout fixture provides payments")
-}
-
 /// Refuses at boot rather than silently building a second, disjoint history
 /// nothing but this runtime reads while the real state lives elsewhere.
 pub fn refuse_unsupported_persistence_adapters(domain_ir: &Value) -> Result<(), String> {
@@ -570,160 +276,6 @@ mod tests {
         assert!(identity_provider(&serde_json::json!({ "name": "Pizzas" })).is_none());
     }
 
-    #[test]
-    fn newsletter_provider_reads_the_declared_capability() {
-        let ir = serde_json::json!({
-            "name": "Studio",
-            "newsletter": {
-                "provider": "Newsletter",
-                "subscribe": "Newsletter::Subscriber.Subscribe",
-                "add_name": "Newsletter::Subscriber.AddName",
-                "confirm": "Newsletter::Subscriber.Confirm",
-                "unsubscribe": "Newsletter::Subscriber.Unsubscribe",
-                "aggregate": "Newsletter::Subscriber"
-            }
-        });
-        let provider = newsletter_provider(&ir).expect("should find newsletter");
-        assert_eq!(provider.provider, "Newsletter");
-        assert_eq!(provider.subscribe, "Newsletter::Subscriber.Subscribe");
-        assert_eq!(provider.add_name, "Newsletter::Subscriber.AddName");
-        assert_eq!(provider.confirm, "Newsletter::Subscriber.Confirm");
-        assert_eq!(provider.unsubscribe, "Newsletter::Subscriber.Unsubscribe");
-        assert_eq!(provider.instance_prefix(), "Newsletter::Subscriber#");
-        assert!(newsletter_provider(&serde_json::json!({ "name": "Pizzas" })).is_none());
-    }
-
-    #[test]
-    fn newsletter_issues_provider_reads_the_declared_capability() {
-        let ir = serde_json::json!({
-            "name": "Studio",
-            "newsletter_issues": {
-                "provider": "Newsletter",
-                "send_issue": "Newsletter::Issue.Send",
-                "record_delivery": "Newsletter::Delivery.Record",
-                "issue_aggregate": "Newsletter::Issue",
-                "delivery_aggregate": "Newsletter::Delivery"
-            }
-        });
-        let provider = newsletter_issues_provider(&ir).expect("should find newsletter_issues");
-        assert_eq!(provider.send_issue, "Newsletter::Issue.Send");
-        assert_eq!(provider.record_delivery, "Newsletter::Delivery.Record");
-        assert_eq!(provider.issue_prefix(), "Newsletter::Issue#");
-        assert!(newsletter_issues_provider(&serde_json::json!({ "name": "Pizzas" })).is_none());
-    }
-
-    #[test]
-    fn payments_provider_reads_the_declared_capability() {
-        let ir = serde_json::json!({
-            "name": "Studio",
-            "payments": {
-                "provider": "Payments",
-                "initiate": "Payments::Payment.Initiate",
-                "succeeded": "Payments::Payment.PaymentGateway.Succeeded",
-                "failed": "Payments::Payment.PaymentGateway.Failed",
-                "aggregate": "Payments::Payment"
-            }
-        });
-        let provider = payments_provider(&ir).expect("should find payments");
-        assert_eq!(provider.provider, "Payments");
-        assert_eq!(provider.initiate, "Payments::Payment.Initiate");
-        assert_eq!(provider.succeeded, "Payments::Payment.PaymentGateway.Succeeded");
-        assert_eq!(provider.failed, "Payments::Payment.PaymentGateway.Failed");
-        assert_eq!(provider.instance_prefix(), "Payments::Payment#");
-        assert!(payments_provider(&serde_json::json!({ "name": "Pizzas" })).is_none());
-    }
-
-    #[test]
-    fn registrations_provider_reads_the_declared_capability() {
-        let provider = registrations_provider(&fixture_ir()).expect("the checkout fixture provides registrations");
-        assert_eq!(provider.schedule, "CheckoutFixture::Event.Schedule");
-        assert_eq!(provider.request, "CheckoutFixture::Registration.Request");
-        assert_eq!(provider.event_prefix(), "CheckoutFixture::Event#");
-        assert_eq!(provider.registration_prefix(), "CheckoutFixture::Registration#");
-        assert_eq!(provider.request_target(), Some(("Registration", "Request")));
-    }
-
-    #[test]
-    fn the_conventional_registrations_names_match_what_the_fixture_declares() {
-        assert_eq!(registrations_provider(&fixture_ir()), Some(RegistrationsProvider::conventional("CheckoutFixture")));
-    }
-
-    #[test]
-    fn a_declared_registrations_binding_names_whatever_the_chapter_calls_things() {
-        let ir = serde_json::json!({"registrations": {
-            "provider": "Bookings",
-            "schedule": "Bookings::Session.Plan",
-            "request": "Bookings::Seat.Claim",
-            "event_aggregate": "Bookings::Session",
-            "registration_aggregate": "Bookings::Seat"
-        }});
-        let provider = registrations_provider(&ir).expect("declared");
-        assert_eq!(provider.event_prefix(), "Bookings::Session#");
-        assert_eq!(provider.registration_prefix(), "Bookings::Seat#");
-        assert_eq!(provider.request_target(), Some(("Seat", "Claim")));
-    }
-
-    #[test]
-    fn registrations_provider_is_none_without_the_key() {
-        assert_eq!(registrations_provider(&serde_json::json!({"name": "Pizzas"})), None);
-    }
-
-    #[test]
-    fn registrations_binding_falls_back_to_the_conventional_names_when_no_ir_is_loaded() {
-        assert_eq!(registrations_binding("Shop"), RegistrationsProvider::conventional("Shop"));
-    }
-
-    #[test]
-    fn payment_connection_provider_reads_the_declared_capability() {
-        let provider = payment_connection_provider(&fixture_ir()).expect("the checkout fixture provides payment_connection");
-        assert_eq!(provider.verb(ConnectionVerb::Connect), "CheckoutFixture::PaymentConnection.Connect");
-        assert_eq!(provider.verb(ConnectionVerb::Enable), "CheckoutFixture::PaymentConnection.EnablePayments");
-        assert_eq!(provider.verb(ConnectionVerb::Disable), "CheckoutFixture::PaymentConnection.DisablePayments");
-        assert_eq!(provider.instance_prefix(), "CheckoutFixture::PaymentConnection#");
-    }
-
-    #[test]
-    fn the_conventional_payment_connection_names_match_what_the_fixture_declares() {
-        assert_eq!(payment_connection_provider(&fixture_ir()), Some(PaymentConnectionProvider::conventional("CheckoutFixture")));
-    }
-
-    #[test]
-    fn a_declared_payment_connection_binding_names_whatever_the_chapter_calls_things() {
-        let ir = serde_json::json!({"payment_connection": {
-            "provider": "Billing",
-            "connect": "Billing::Link.Open", "reconnect": "Billing::Link.Reopen",
-            "disconnect": "Billing::Link.Close", "suspend": "Billing::Link.Pause",
-            "resume": "Billing::Link.Unpause", "enable": "Billing::Link.TurnOn",
-            "disable": "Billing::Link.TurnOff", "aggregate": "Billing::Link"
-        }});
-        let provider = payment_connection_provider(&ir).expect("declared");
-        assert_eq!(provider.verb(ConnectionVerb::Suspend), "Billing::Link.Pause");
-        assert_eq!(provider.verb(ConnectionVerb::Resume), "Billing::Link.Unpause");
-        assert_eq!(provider.instance_prefix(), "Billing::Link#");
-    }
-
-    #[test]
-    fn payment_connection_binding_falls_back_to_the_conventional_names_when_no_ir_is_loaded() {
-        assert_eq!(payment_connection_binding("Shop"), PaymentConnectionProvider::conventional("Shop"));
-    }
-
-    #[test]
-    fn command_declares_finds_an_argument_on_the_named_command_only() {
-        let ir = serde_json::json!({
-            "aggregates": [
-                {"name": "Registration", "commands": [
-                    {"name": "Request", "attributes": [{"name": "email"}, {"name": "news_signup"}]},
-                    {"name": "Cancel", "attributes": [{"name": "reason"}]}
-                ]},
-                {"name": "Event", "commands": [{"name": "Request", "attributes": [{"name": "slug"}]}]}
-            ]
-        });
-        assert!(command_declares(&ir, "Registration", "Request", "news_signup"));
-        assert!(!command_declares(&ir, "Registration", "Cancel", "news_signup"));
-        assert!(!command_declares(&ir, "Event", "Request", "news_signup"));
-        assert!(!command_declares(&ir, "Registration", "Request", "phone"));
-        assert!(!command_declares(&serde_json::json!({"name": "Pizzas"}), "Registration", "Request", "news_signup"));
-    }
 
     #[test]
     fn refuse_unsupported_persistence_adapters_passes_a_domain_with_no_persistence_key() {

data/rust/host/src/journal.rs

@@ -334,7 +334,7 @@ fn storage_name(qualified_aggregate: &str) -> String {
 
 /// Quotes a Postgres identifier `PG::Connection.quote_ident`-style —
 /// needed since table names can't be bound as query parameters.
-pub(crate) fn quote_ident(name: &str) -> String {
+pub fn quote_ident(name: &str) -> String {
     format!("\"{}\"", name.replace('"', "\"\""))
 }
 

data/rust/host/src/lib.rs

@@ -0,0 +1,39 @@
+//! The host as a library: the modules the `bootstrap` binary boots, plus the harness binaries' shared code.
+//! Commerce (payments, checkout, newsletter, registrations, mail) plugs in through [`extension::HostExtension`].
+
+pub mod api;
+pub mod approval;
+pub mod auth;
+pub mod checkout;
+pub mod commerce_ir;
+pub mod dispatch;
+pub mod expr_json;
+pub mod extension;
+pub mod field_hints;
+#[cfg(test)]
+pub mod fuzz_support;
+#[cfg(test)]
+#[path = "boundary_fuzz/expr_json.rs"]
+pub mod expr_json_fuzz;
+pub mod ir;
+pub mod journal;
+pub mod lambda_client;
+pub mod log;
+pub mod mint;
+pub mod needs;
+pub mod payments;
+pub mod presentation;
+pub mod presentation_write;
+pub mod query_step;
+pub mod rate_limit;
+pub mod reference_transform;
+pub mod reference_validate;
+pub mod resend;
+pub mod secrets;
+pub mod server;
+pub mod storage_shape;
+#[cfg(test)]
+pub mod test_pg;
+pub mod ui_schema;
+pub mod wasm_runner;
+pub mod web;

data/rust/host/src/main.rs

@@ -1,40 +1,7 @@
 //! Lambda custom-runtime entry point (or a long-lived server under
 //! HECKS_SERVE_MODE=1): boots Postgres/wasm state, then dispatches events.
 
-mod api;
-mod approval;
-mod auth;
-mod checkout;
-mod dispatch;
-mod expr_json;
-mod field_hints;
-#[cfg(test)]
-mod fuzz_support;
-#[cfg(test)]
-#[path = "boundary_fuzz/expr_json.rs"]
-mod expr_json_fuzz;
-mod ir;
-mod journal;
-mod lambda_client;
-mod log;
-mod mint;
-mod needs;
-mod payments;
-mod presentation;
-mod presentation_write;
-mod query_step;
-mod rate_limit;
-mod reference_transform;
-mod reference_validate;
-mod resend;
-mod secrets;
-mod server;
-mod storage_shape;
-#[cfg(test)]
-mod test_pg;
-mod ui_schema;
-mod wasm_runner;
-mod web;
+use rust_host::{approval, auth, extension, ir, journal, lambda_client, log, mint, rate_limit, secrets, server, storage_shape};
 
 use lambda_runtime::{service_fn, Error, LambdaEvent};
 use std::path::PathBuf;
@@ -113,16 +80,8 @@ async fn main() -> Result<(), Error> {
             std::env::set_var("SESSION_SECRET", session_secret);
         }
     }
-    // RESEND_SECRET_ID: fetched the same way, but a failed fetch only
-    // logs -- mail is optional, and a missing secret must not stop the
-    // host from serving everything else (resend.rs answers 503 without
-    // a key).
-    if let Ok(resend_secret_id) = std::env::var("RESEND_SECRET_ID") {
-        let fetched = secret_fetcher.fetch_secret_string(&resend_secret_id).await.map_err(|e| format!("{e:#}"));
-        match fetched.and_then(|json| secrets::extract_field(&json, "api_key")) {
-            Ok(api_key) => unsafe { std::env::set_var("RESEND_API_KEY", api_key) },
-            Err(e) => eprintln!("RESEND_SECRET_ID could not be read, so email sending stays off: {e}"),
-        }
+    for extension in extension::installed() {
+        extension.boot_secrets(&secret_fetcher).await;
     }
     let wasm_path = PathBuf::from(
         std::env::var("HECKS_WASM_PATH").unwrap_or_else(|_| "banking.wasm".to_string()),
@@ -137,7 +96,9 @@ async fn main() -> Result<(), Error> {
     let schema = std::env::var("HECKS_SCHEMA").ok().filter(|s| !s.is_empty());
     // Checkout on AWS keeps the business's payment keys in a named Secrets
     // Manager secret; refuse before touching the database when none is named.
-    payments::check_boot(web::checkout_enabled(std::env::var("HECKS_CHECKOUT_DOMAIN").ok().as_deref(), &domain))?;
+    for extension in extension::installed() {
+        extension.boot_check(&domain)?;
+    }
 
     // RDS refuses a plain NoTls connection by default and needs AWS's
     // own RDS CA specifically, not a generic public bundle (see

data/rust/host/src/mint.rs

@@ -495,7 +495,7 @@ async fn table_exists<C: GenericClient>(client: &C, name: &str) -> anyhow::Resul
 
 /// No backfill: adopting an era means its history already exists elsewhere.
 /// Runs in its own transaction because `create_head_snapshot`'s SAVEPOINT needs one open.
-pub(crate) async fn adopt_head_snapshots<C: GenericClient>(
+pub async fn adopt_head_snapshots<C: GenericClient>(
     client: &C,
     domain: &str,
     aggregates: &[Aggregate],

data/rust/host/src/payments/tests.rs

@@ -300,7 +300,7 @@ impl Tenant {
     async fn register(&self, slug: &str) -> (u64, Value) {
         let body = json!({"event_slug": slug, "name": "Ada Lovelace", "email": "ada@example.com"}).to_string();
         let platform = self.platform_now().await;
-        let response = web::registrations_route(&body, &platform, &self.client, &self.wasm, &self.config, &NeverInvoker, &crate::ir::fixture_payments()).await;
+        let response = web::registrations_route(&body, &platform, &self.client, &self.wasm, &self.config, &NeverInvoker, &crate::commerce_ir::fixture_payments()).await;
         (response["statusCode"].as_u64().unwrap(), serde_json::from_str(response["body"].as_str().unwrap()).unwrap_or(Value::Null))
     }
 
@@ -314,14 +314,14 @@ impl Tenant {
         let now = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_secs() as i64;
         let header = sign(secret, now, &payload);
         let platform = self.platform_now().await;
-        let response = web::webhook_route(&payload, &header, &platform, &self.client, &self.wasm, &self.config, &NeverInvoker, &crate::ir::fixture_payments()).await;
+        let response = web::webhook_route(&payload, &header, &platform, &self.client, &self.wasm, &self.config, &NeverInvoker, &crate::commerce_ir::fixture_payments()).await;
         response["statusCode"].as_u64().unwrap()
     }
 
     // POST /registrations/:id/complete with a successful outcome (the mock
     // walkthrough's "Pay" button).
     async fn settle(&self, reference: &str) -> u64 {
-        let response = web::registration_complete_route(reference, r#"{"outcome":"succeeded"}"#, &self.client, &self.wasm, &self.config, &NeverInvoker, &crate::ir::fixture_payments()).await;
+        let response = web::registration_complete_route(reference, r#"{"outcome":"succeeded"}"#, &self.client, &self.wasm, &self.config, &NeverInvoker, &crate::commerce_ir::fixture_payments()).await;
         response["statusCode"].as_u64().unwrap()
     }
 
@@ -672,7 +672,7 @@ async fn a_declined_payment_frees_the_seat_and_a_paid_one_keeps_it() {
 
     let (_, body) = t.register("declined").await;
     let first = body["registration_id"].as_str().unwrap().to_string();
-    let response = web::registration_complete_route(&first, r#"{"outcome":"failed"}"#, &t.client, &t.wasm, &t.config, &NeverInvoker, &crate::ir::fixture_payments()).await;
+    let response = web::registration_complete_route(&first, r#"{"outcome":"failed"}"#, &t.client, &t.wasm, &t.config, &NeverInvoker, &crate::commerce_ir::fixture_payments()).await;
     assert_eq!(response["statusCode"].as_u64(), Some(200));
     assert_eq!(t.payment_status(&first).await, "failed");
 
@@ -714,7 +714,7 @@ async fn archiving_a_paid_registration_frees_its_seat_and_restoring_it_takes_the
     assert_eq!(registration_status(&t, &reference).await, "archived");
     assert_eq!(t.payment_status(&reference).await, "succeeded", "archiving never touches the Payment");
     let read = dispatch::read(&t.client, &t.wasm).await.unwrap();
-    assert_eq!(web::seats_left(&read, "CheckoutFixture", &crate::ir::fixture_payments(), "archive-me"), Some(1));
+    assert_eq!(web::seats_left(&read, "CheckoutFixture", &crate::commerce_ir::fixture_payments(), "archive-me"), Some(1));
 
     let (status, body) = t.register("archive-me").await;
     assert_eq!(status, 200, "the archived registration's seat is free again: {body}");
@@ -728,11 +728,11 @@ async fn archiving_a_paid_registration_frees_its_seat_and_restoring_it_takes_the
     assert_eq!(registration_status(&t, &reference).await, "active");
     let read = dispatch::read(&t.client, &t.wasm).await.unwrap();
     assert_eq!(
-        web::seats_taken(&read, "CheckoutFixture", &crate::ir::fixture_payments(), "archive-me"),
+        web::seats_taken(&read, "CheckoutFixture", &crate::commerce_ir::fixture_payments(), "archive-me"),
         2,
         "a restored registration counts again, even past capacity: the site refuses a restore with no seat"
     );
-    assert_eq!(web::seats_left(&read, "CheckoutFixture", &crate::ir::fixture_payments(), "archive-me"), Some(0));
+    assert_eq!(web::seats_left(&read, "CheckoutFixture", &crate::commerce_ir::fixture_payments(), "archive-me"), Some(0));
 }
 
 #[tokio::test]
@@ -876,7 +876,7 @@ async fn an_event_verified_only_by_the_public_mock_secret_is_refused_for_a_real_
     let payload = event.to_string();
     let now = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_secs() as i64;
     let header = sign(web::MOCK_STRIPE_WEBHOOK_SECRET, now, &payload);
-    let response = web::webhook_route(&payload, &header, &t.platform, &t.client, &t.wasm, &t.config, &NeverInvoker, &crate::ir::fixture_payments()).await;
+    let response = web::webhook_route(&payload, &header, &t.platform, &t.client, &t.wasm, &t.config, &NeverInvoker, &crate::commerce_ir::fixture_payments()).await;
     assert_eq!(response["statusCode"], 500, "{event}");
     assert_eq!(t.payment_status(&reference).await, "pending", "a forged completion must not settle a real payment");
 }