hecks 3.9.1 → 3.11.0

data/rust/codegen/src/mutations.rs

@@ -176,10 +176,11 @@ pub fn append_field_source(source: &str) -> Literal {
     literal::read(source)
 }
 
-/// Whether any effect reads the record's own state, so the closure must bind `let pre`.
+/// Whether any effect reads the record's own state (a `state(:field)` source, or an expression that
+/// may name a field), so the closure must bind `let pre`.
 pub fn reads_pre_state(mutations: &[Json]) -> bool {
     mutations.iter().any(|m| match m.get("op").map(Json::to_s).unwrap_or_default().as_str() {
-        "set" => m.get("source").and_then(|s| s.get("kind")).map(Json::to_s).unwrap_or_default() == "state",
+        "set" => matches!(m.get("source").and_then(|s| s.get("kind")).map(Json::to_s).unwrap_or_default().as_str(), "state" | "expression"),
         "append" => match m.get("fields") {
             Some(Json::Object(pairs)) => pairs.iter().any(|(_, source)| source.to_s().starts_with("state(:")),
             _ => false,
@@ -251,6 +252,66 @@ pub fn state_source_problems(command: &Json, aggregate: &Json, value_objects_by_
         .collect()
 }
 
+/// Problems with `set` mutations sourced from arithmetic: the target must be a scalar
+/// (non-list) attribute typed by a single-field Integer or Float value object, the one shape the
+/// generated code can rebuild a computed number into.
+pub fn expression_source_problems(command: &Json, aggregate: &Json, value_objects_by_name: &HashMap<String, &Json>) -> Vec<String> {
+    let attrs = aggregate.get("attributes").map(Json::each).unwrap_or(&[]);
+    command
+        .get("mutations")
+        .map(Json::each)
+        .unwrap_or(&[])
+        .iter()
+        .filter(|m| m.get("op").map(Json::to_s).as_deref() == Some("set"))
+        .filter(|m| m.get("source").and_then(|s| s.get("kind")).map(Json::to_s).as_deref() == Some("expression"))
+        .filter_map(|m| {
+            let target = m.get("target").map(Json::to_s).unwrap_or_default();
+            let attr = attrs.iter().find(|a| crate::attr::name(a) == target);
+            match attr.and_then(|a| computed_field_type(a, value_objects_by_name)) {
+                Some(_) => None,
+                None => Some(format!("{target}: a computed value needs a scalar attribute typed by a single-field Integer or Float value object — not generated yet")),
+            }
+        })
+        .collect()
+}
+
+// The scalar type (`Integer` or `Float`) of the one field of a non-list, single-field value object.
+fn computed_field_type<'a>(attr: &Json, value_objects_by_name: &HashMap<String, &'a Json>) -> Option<(&'a Json, &'static str)> {
+    if crate::attr::list(attr) {
+        return None;
+    }
+    let vo = value_objects_by_name.get(crate::attr::type_name(attr)).copied()?;
+    let fields = vo.get("attributes").map(Json::each).unwrap_or(&[]);
+    if vo.get("closed_set").map(Json::as_bool).unwrap_or(false) || fields.len() != 1 || crate::attr::list(&fields[0]) {
+        return None;
+    }
+    match crate::attr::type_name(&fields[0]) {
+        "Integer" => Some((vo, "Integer")),
+        "Float" => Some((vo, "Float")),
+        _ => None,
+    }
+}
+
+/// Right-hand side for a `set` sourced from arithmetic: evaluates the expression through the
+/// kernel over the command's arguments and then the pre-dispatch record, and rebuilds the number
+/// into the target's single-field value object. A fault returns from the mutation closure.
+pub fn expression_set_rhs(source: &Json, target_attr: &Json, value_objects_by_name: &HashMap<String, &Json>) -> String {
+    let (vo, scalar) = computed_field_type(target_attr, value_objects_by_name).expect("expression_source_problems already confirmed the target");
+    let ast = source.get("ast").expect("an expression source carries its ast");
+    let field = naming::rust_ident_field(crate::attr::name(&vo.get("attributes").map(Json::each).unwrap_or(&[])[0]));
+    let vo_type = naming::rust_ident(crate::attr::type_name(target_attr));
+    let arms = if scalar == "Integer" {
+        "crate::kernel::Value::Int(number) => number,".to_string()
+    } else {
+        "crate::kernel::Value::Float(number) => number,\n            crate::kernel::Value::Int(number) => number as f64,".to_string()
+    };
+    let target = crate::attr::name(target_attr);
+    format!(
+        "{{\n            let number = match crate::kernel::interpret(&{}, &crate::kernel::EvalContext {{ args: &args, instance: &pre }})? {{\n            {arms}\n            other => return Err(crate::kernel::Refusal::TypeMismatch(format!(\"{target} expects a {scalar}, computed {{other:?}}\"))),\n            }};\n            {vo_type} {{ {field}: number }}\n        }}",
+        crate::expr_emitter::emit_ast(ast)
+    )
+}
+
 fn state_source_problem(label: &str, state_name: &str, aggregate: &Json, target_attr: Option<&Json>) -> Option<String> {
     let attrs = aggregate.get("attributes").map(Json::each).unwrap_or(&[]);
     let Some(state_attr) = attrs.iter().find(|a| crate::attr::name(a) == state_name) else {
@@ -455,6 +516,16 @@ pub fn lifecycle_transition_for(command: &Json, aggregate: &Json) -> Option<Tran
     Some(Transition { field, to_state, from_states, unconstrained })
 }
 
+/// Whether a `state(:field)` source reads an `Option` out of the pre-dispatch record: the field
+/// is declared optional, or the record holds every field as an `Option` (`record_optional`).
+/// Such a source already has the target's wrapping, so it must not be wrapped in `Some` again.
+fn state_source_is_option(source: Option<&Json>, aggregate: &Json, record_optional: bool) -> bool {
+    let Some(source) = source.filter(|s| s.get("kind").map(Json::to_s).unwrap_or_default() == "state") else { return false };
+    let name = source.get("name").map(Json::to_s).unwrap_or_default();
+    let attrs = aggregate.get("attributes").map(Json::each).unwrap_or(&[]);
+    record_optional || attrs.iter().any(|a| crate::attr::name(a) == name && crate::attr::optional(a))
+}
+
 /// Right-hand side for a `set`, coercing the source into the target attribute's declared type.
 ///
 /// `target_list` routes list-to-list sets through `list_value_rhs`; `value_rhs` is scalar-only.
@@ -712,8 +783,12 @@ fn emit_mutation_line_body(
             } else {
                 let attrs = aggregate.get("attributes").map(Json::each).unwrap_or(&[]);
                 let target_attr = attrs.iter().find(|a| crate::attr::name(a) == target_name).expect("set target must be a declared aggregate attribute");
-                let rhs = mutation_set_rhs(mutation.get("source").unwrap_or(&Json::Null), crate::attr::type_name(target_attr), command, value_objects_by_name, crate::attr::list(target_attr));
                 let source = mutation.get("source");
+                let rhs = if source.and_then(|s| s.get("kind")).map(Json::to_s).as_deref() == Some("expression") {
+                    expression_set_rhs(source.unwrap(), target_attr, value_objects_by_name)
+                } else {
+                    mutation_set_rhs(mutation.get("source").unwrap_or(&Json::Null), crate::attr::type_name(target_attr), command, value_objects_by_name, crate::attr::list(target_attr))
+                };
                 let source_attr = if source.map(|s| s.get("kind").map(Json::to_s).unwrap_or_default()) == Some("argument".to_string()) {
                     let name = source.unwrap().get("name").map(Json::to_s).unwrap_or_default();
                     let cmd_attrs = command.get("attributes").map(Json::each).unwrap_or(&[]);
@@ -731,7 +806,8 @@ fn emit_mutation_line_body(
                     let (guard, effective_rhs) = entity_list_replace_guard(aggregate, target_attr, &target_field, &rhs, value_objects_by_name);
                     format!("{guard}{}", exemplar.render("mutation_set_plain", &[("tmpl_field", target_field.to_string()), ("tmpl_rhs_placeholder2()", effective_rhs)]))
                 } else {
-                    let wrap = (optional || crate::attr::optional(target_attr)) && !source_attr.map(crate::attr::optional).unwrap_or(false);
+                    let source_is_option = source_attr.map(crate::attr::optional).unwrap_or(false) || state_source_is_option(source, aggregate, optional);
+                    let wrap = (optional || crate::attr::optional(target_attr)) && !source_is_option;
                     if wrap {
                         exemplar.render("mutation_set_wrapped", &[("tmpl_field", target_field.to_string()), ("tmpl_rhs_placeholder2()", rhs)])
                     } else {
@@ -851,3 +927,97 @@ mod transition_tests {
         assert_eq!(transition_check_arg(Some(&transition)), "None");
     }
 }
+
+#[cfg(test)]
+mod state_source_tests {
+    use super::*;
+
+    fn aggregate() -> Json {
+        Json::parse(r#"{"name":"Page","attributes":[{"name":"body","type":"Body"},{"name":"draft_body","type":"Body","optional":true}]}"#).unwrap()
+    }
+
+    fn state(name: &str) -> Json {
+        Json::parse(&format!(r#"{{"kind":"state","name":"{name}"}}"#)).unwrap()
+    }
+
+    #[test]
+    fn a_state_source_in_an_all_optional_record_is_already_an_option() {
+        assert!(state_source_is_option(Some(&state("body")), &aggregate(), true));
+    }
+
+    #[test]
+    fn a_state_source_reads_an_option_where_it_is_declared_optional() {
+        assert!(state_source_is_option(Some(&state("draft_body")), &aggregate(), false));
+    }
+
+    #[test]
+    fn a_required_state_source_in_a_plain_record_is_not_an_option() {
+        assert!(!state_source_is_option(Some(&state("body")), &aggregate(), false));
+    }
+
+    #[test]
+    fn an_argument_source_is_never_a_state_option() {
+        let argument = Json::parse(r#"{"kind":"argument","name":"draft_body"}"#).unwrap();
+        assert!(!state_source_is_option(Some(&argument), &aggregate(), true));
+    }
+}
+
+#[cfg(test)]
+mod expression_source_tests {
+    use super::*;
+
+    fn aggregate() -> Json {
+        Json::parse(r#"{"name":"Settlement","attributes":[
+            {"name":"paid","type":"Cents","list":false},
+            {"name":"refund","type":"Cents","list":false},
+            {"name":"note","type":"Note","list":false}]}"#)
+        .unwrap()
+    }
+
+    fn vos() -> Vec<Json> {
+        vec![
+            Json::parse(r#"{"name":"Cents","attributes":[{"name":"value","type":"Integer","list":false}]}"#).unwrap(),
+            Json::parse(r#"{"name":"Note","attributes":[{"name":"value","type":"String","list":false}]}"#).unwrap(),
+        ]
+    }
+
+    fn command(target: &str) -> Json {
+        let source = r#"{"kind":"expression","text":"paid * 2","ast":{"op":"mul","left":{"op":"lookup","path":["paid"]},"right":{"op":"int","value":2}}}"#;
+        Json::parse(&format!(r#"{{"mutations":[{{"target":"{target}","op":"set","source":{source}}}]}}"#)).unwrap()
+    }
+
+    fn by_name(vos: &[Json]) -> HashMap<String, &Json> {
+        vos.iter().map(|vo| (vo.get("name").map(Json::to_s).unwrap_or_default(), vo)).collect()
+    }
+
+    #[test]
+    fn an_expression_source_binds_the_pre_dispatch_record() {
+        assert!(reads_pre_state(command("refund").get("mutations").map(Json::each).unwrap_or(&[])));
+    }
+
+    #[test]
+    fn a_target_typed_by_an_integer_value_object_is_generated() {
+        let vos = vos();
+
+        assert!(expression_source_problems(&command("refund"), &aggregate(), &by_name(&vos)).is_empty());
+    }
+
+    #[test]
+    fn a_target_typed_by_a_text_value_object_is_not_generated_yet() {
+        let vos = vos();
+
+        assert_eq!(expression_source_problems(&command("note"), &aggregate(), &by_name(&vos)).len(), 1);
+    }
+
+    #[test]
+    fn the_right_hand_side_evaluates_through_the_kernel_and_rebuilds_the_value_object() {
+        let vos = vos();
+        let aggregate = aggregate();
+        let attrs = aggregate.get("attributes").map(Json::each).unwrap_or(&[]);
+        let source = command("refund").get("mutations").map(Json::each).unwrap_or(&[])[0].get("source").cloned().unwrap();
+
+        let rhs = expression_set_rhs(&source, &attrs[1], &by_name(&vos));
+
+        assert!(rhs.contains("crate::kernel::interpret(&Expr::Mul(") && rhs.contains("Cents { value: number }"));
+    }
+}

data/rust/codegen/src/naming.rs

@@ -70,6 +70,23 @@ pub fn dispatch_fn_name(cmd: &str) -> String {
 /// `hecks project_reserved_names` — the same tables `naming.rb` reads.
 pub use crate::reserved_names::{CARGO_RESERVED_DOMAIN_NAMES, RUST_KEYWORDS};
 
+/// The modules every generated chapter declares itself, beside its aggregates' modules: the
+/// sidecar `metadata`, the `registry` table, and the `merged` router. An aggregate whose
+/// downcased name is one of these would declare the module twice and overwrite the file.
+pub const CHAPTER_OWNED_MODULES: &[&str] = &["metadata", "registry", "merged"];
+
+/// The module (and file stem) one aggregate's generated Rust lives in: its downcased name, or
+/// `<name>_aggregate` when that name is one the chapter declares itself. A downcased name never
+/// holds an underscore, so the suffixed form cannot meet another aggregate's module.
+pub fn aggregate_module(name: &str) -> String {
+    let module = name.to_lowercase();
+    if CHAPTER_OWNED_MODULES.contains(&module.as_str()) {
+        format!("{module}_aggregate")
+    } else {
+        module
+    }
+}
+
 /// `/\A[a-z_][a-z0-9_]*\z/` — a plain lowercase Rust identifier.
 fn plain_lower_identifier(name: &str) -> bool {
     let mut chars = name.chars();
@@ -336,6 +353,19 @@ mod tests {
         assert_eq!(scalar_to_value("String", &deref_scalar("String", "v")).as_deref(), Some("Value::Str(v.clone())"));
     }
 
+    #[test]
+    fn an_aggregate_named_for_a_chapter_module_gets_a_suffixed_module() {
+        assert_eq!(aggregate_module("Metadata"), "metadata_aggregate");
+        assert_eq!(aggregate_module("Registry"), "registry_aggregate");
+        assert_eq!(aggregate_module("Merged"), "merged_aggregate");
+    }
+
+    #[test]
+    fn any_other_aggregate_keeps_its_downcased_module() {
+        assert_eq!(aggregate_module("LineItem"), "lineitem");
+        assert_eq!(aggregate_module("MetadataEntry"), "metadataentry");
+    }
+
     #[test]
     fn refuses_an_aggregate_whose_module_name_is_a_rust_keyword() {
         let refusal = reserved_name_refusal("shop", "shop", &["Pizza", "Match", "Type"]).expect("refused");

data/rust/codegen/src/queries.rs

@@ -313,8 +313,17 @@ pub fn query_skip_reason(query: &Json, aggregate: &Json, value_objects_by_name:
     // field itself is validated afterward by `declared_authorization_skip_reason`.
     let declared_tenant = query.get("authorization").and_then(|a| a.get("tenant")).is_some();
     let wheres = query.get("wheres").map(Json::each).unwrap_or(&[]);
-    if wheres.is_empty() && !declared_tenant {
-        return Some(skip("no_wheres", "declares no where clauses at all — nothing for filter_entries to bake in"));
+    // A query with no `where` answers every record, ordered and bounded as declared, as Ruby's
+    // `QueryInterpreter` does. Ruby refuses at boot one that takes arguments yet filters, orders
+    // and bounds nothing (`Registry::QueryVerification#derivable?`: it reads none of them), so no
+    // answer exists to generate for it.
+    let selects_nothing = query.get("order_by").is_none() && query.get("limit").is_none() && query.get("offset").is_none();
+    let takes_arguments = query.get("attributes").map(Json::each).is_some_and(|attributes| !attributes.is_empty());
+    if wheres.is_empty() && !declared_tenant && selects_nothing && takes_arguments {
+        return Some(skip(
+            "no_wheres",
+            "takes arguments but declares no where, order_by, limit or offset — it selects nothing, so Ruby refuses it at boot and there is no answer to generate",
+        ));
     }
 
     for where_clause in wheres {

data/rust/codegen/src/reactions.rs

@@ -60,7 +60,7 @@ fn where_fns(policies: &[Json]) -> Vec<String> {
 }
 
 fn local_policy_rows(domain_name: &str, policies: &[Json], aggregates: &[Json]) -> Vec<String> {
-    policies
+    crate::asks::resolve_asks(policies, aggregates)
         .iter()
         .filter_map(|policy| {
             let target_domain = policy.get("target_domain").map(Json::to_s).unwrap_or_else(|| domain_name.to_string());

data/rust/codegen/src/types.rs

@@ -26,15 +26,15 @@ pub fn emit_check_invariants(exemplar: &Exemplar, vo: &Json, value_objects_by_na
             continue;
         }
         let field = naming::rust_ident_field(crate::attr::name(attr));
-        if crate::attr::list(attr) {
-            body.push(format!("        for item in &self.{field} {{ item.check_invariants()?; }}"));
-        } else {
-            body.push(format!("        self.{field}.check_invariants()?;"));
-        }
+        body.push(nested_invariant_line(&field, crate::attr::list(attr), crate::attr::optional(attr)));
     }
 
     for attr in attributes {
         if crate::attr::list(attr) {
+            let field = format!("self.{}", naming::rust_ident_field(crate::attr::name(attr)));
+            if let Some(line) = crate::constraints::emit_list_pattern_check(exemplar, &field, attr, &name) {
+                body.push(format!("        {line}"));
+            }
             continue;
         }
         let field = format!("self.{}", naming::rust_ident_field(crate::attr::name(attr)));
@@ -64,6 +64,18 @@ pub fn emit_check_invariants(exemplar: &Exemplar, vo: &Json, value_objects_by_na
     format!("impl {name} {{\n    pub fn check_invariants(&self) -> Result<(), crate::kernel::Refusal> {{\n{}\n        Ok(())\n    }}\n}}\n", body.join("\n"))
 }
 
+/// The line that runs a nested value object's own invariants. An optional slot is an `Option` in
+/// the record, so its invariants run only when it is present, as Ruby validates only what it is
+/// given; a list's members each run theirs.
+fn nested_invariant_line(field: &str, list: bool, optional: bool) -> String {
+    match (list, optional) {
+        (true, true) => format!("        if let Some(items) = &self.{field} {{ for item in items {{ item.check_invariants()?; }} }}"),
+        (true, false) => format!("        for item in &self.{field} {{ item.check_invariants()?; }}"),
+        (false, true) => format!("        if let Some(value) = &self.{field} {{ value.check_invariants()?; }}"),
+        (false, false) => format!("        self.{field}.check_invariants()?;"),
+    }
+}
+
 pub fn emit_closed_set_table(exemplar: &Exemplar, vo: &Json) -> String {
     let name = naming::rust_ident(vo.get("name").and_then(Json::as_str).unwrap_or(""));
     let attributes = vo.get("attributes").map(Json::each).unwrap_or(&[]);
@@ -286,6 +298,83 @@ pub fn emit_record(exemplar: &Exemplar, aggregate: &Json, value_objects_by_name:
     format!("{struct_part}\n\n{fielded_part}")
 }
 
+/// Copy of `ir` whose every `projects` field also carries the `type` of the remote field it reads,
+/// so the projecting aggregate's pseudo-attribute and setter follow it (ADR 0025 addendum). A
+/// single-field value object resolves to its one attribute's type, a reference to `String`, and a
+/// field that resolves to nothing stays `String`.
+pub fn with_resolved_projection_types(ir: &Json) -> Json {
+    let mut resolved = ir.clone();
+    let aggregates: Vec<Json> = ir.get("aggregates").map(Json::each).unwrap_or(&[]).to_vec();
+    let Some(list) = resolved.get_mut("aggregates").and_then(Json::as_array_mut) else {
+        return resolved;
+    };
+    for (aggregate, original) in list.iter_mut().zip(aggregates.iter()) {
+        let Some(fields) = aggregate.get_mut("projected_fields").and_then(Json::as_array_mut) else {
+            continue;
+        };
+        for field in fields.iter_mut() {
+            let scalar = projected_scalar_type(&aggregates, original, field, 0);
+            field.set("type", Json::String(scalar));
+        }
+    }
+    resolved
+}
+
+const PROJECTION_CHAIN_LIMIT: usize = 8;
+
+// The scalar type a projection of `field` copies, following a chain of projections.
+fn projected_scalar_type(aggregates: &[Json], owner: &Json, field: &Json, depth: usize) -> String {
+    let reference = field.get("reference").and_then(Json::as_str).unwrap_or("");
+    let remote = field.get("remote_field").and_then(Json::as_str).unwrap_or("");
+    let target = owner
+        .get("attributes")
+        .map(Json::each)
+        .unwrap_or(&[])
+        .iter()
+        .find(|a| crate::attr::name(a) == reference)
+        .and_then(|a| naming::reference_target(crate::attr::type_name(a)))
+        .and_then(|name| aggregates.iter().find(|a| a.get("name").and_then(Json::as_str) == Some(name)));
+    target.map(|t| remote_scalar_type(aggregates, t, remote, depth)).unwrap_or_else(|| "String".to_string())
+}
+
+fn remote_scalar_type(aggregates: &[Json], target: &Json, remote: &str, depth: usize) -> String {
+    let declared = target.get("attributes").map(Json::each).unwrap_or(&[]).iter().find(|a| crate::attr::name(a) == remote);
+    if let Some(attr) = declared {
+        return unwrapped_scalar_type(target, crate::attr::type_name(attr));
+    }
+    let chained = target.get("projected_fields").map(Json::each).unwrap_or(&[]).iter().find(|f| f.get("name").and_then(Json::as_str) == Some(remote));
+    match chained {
+        Some(next) if depth < PROJECTION_CHAIN_LIMIT => projected_scalar_type(aggregates, target, next, depth + 1),
+        _ => "String".to_string(),
+    }
+}
+
+// A single-field value object reads as its one attribute's type; anything else as itself.
+fn unwrapped_scalar_type(aggregate: &Json, type_name: &str) -> String {
+    let sole = aggregate
+        .get("value_objects")
+        .map(Json::each)
+        .unwrap_or(&[])
+        .iter()
+        .find(|vo| vo.get("name").and_then(Json::as_str) == Some(type_name))
+        .map(|vo| vo.get("attributes").map(Json::each).unwrap_or(&[]))
+        .filter(|attrs| attrs.len() == 1 && !crate::attr::list(&attrs[0]))
+        .map(|attrs| crate::attr::type_name(&attrs[0]).to_string());
+    let resolved = sole.unwrap_or_else(|| type_name.to_string());
+    let resolved = if resolved == "Boolean" { "TrueClass".to_string() } else { resolved };
+    naming::effective_scalar_type(&resolved).unwrap_or("String").to_string()
+}
+
+// The `Value` reader a generated setter narrows with, by scalar type.
+fn projection_reader(scalar: &str) -> &'static str {
+    match scalar {
+        "Integer" => "into_i64",
+        "Float" => "into_f64",
+        "TrueClass" | "FalseClass" => "into_bool",
+        _ => "into_string",
+    }
+}
+
 /// Port of the retired Ruby generator's `types.rb#projected_field_pseudo_attributes` (ADR 0025).
 pub fn projected_field_pseudo_attributes(aggregate: &Json) -> Vec<Json> {
     aggregate
@@ -295,9 +384,10 @@ pub fn projected_field_pseudo_attributes(aggregate: &Json) -> Vec<Json> {
         .iter()
         .map(|field| {
             let name = field.get("name").and_then(Json::as_str).unwrap_or("").to_string();
+            let scalar = field.get("type").and_then(Json::as_str).unwrap_or("String").to_string();
             Json::Object(vec![
                 ("name".to_string(), Json::String(name)),
-                ("type".to_string(), Json::String("String".to_string())),
+                ("type".to_string(), Json::String(scalar)),
                 ("list".to_string(), Json::Bool(false)),
                 ("optional".to_string(), Json::Bool(true)),
             ])
@@ -329,11 +419,12 @@ pub fn emit_set_projected_field(aggregate: &Json) -> String {
         .map(|field| {
             let field_name = field.get("name").and_then(Json::as_str).unwrap_or("");
             let ident = naming::rust_ident_field(field_name);
-            format!("            {} => self.{} = value,", naming::ruby_inspect_string(field_name), ident)
+            let reader = projection_reader(field.get("type").and_then(Json::as_str).unwrap_or("String"));
+            format!("            {} => self.{} = value.and_then(crate::kernel::Value::{}),", naming::ruby_inspect_string(field_name), ident, reader)
         })
         .collect();
     format!(
-        "impl crate::kernel::SetProjectedField for {name} {{\n    fn set_projected_field(&mut self, name: &'static str, value: Option<String>) {{\n        match name {{\n{}\n            _ => {{}}\n        }}\n    }}\n}}\n",
+        "impl crate::kernel::SetProjectedField for {name} {{\n    fn set_projected_field(&mut self, name: &'static str, value: Option<crate::kernel::Value>) {{\n        match name {{\n{}\n            _ => {{}}\n        }}\n    }}\n}}\n",
         arms.join("\n")
     )
 }
@@ -404,4 +495,71 @@ mod tests {
         assert!(!from_json.contains("TrueClass::from_json"));
         assert!(to_json.contains("crate::kernel::Json::Bool(self.on)"));
     }
+
+    /// An Event whose `starts_at` is a single-field Integer value object, and a Booking projecting it.
+    fn event_and_booking() -> Json {
+        Json::parse(
+            r#"{"aggregates":[
+              {"name":"Event","attributes":[{"name":"starts_at","type":"StartsAt","list":false}],
+               "value_objects":[{"name":"StartsAt","attributes":[{"name":"value","type":"Integer","list":false}]}]},
+              {"name":"Booking","attributes":[{"name":"event","type":"Reference<Event>","list":false}],
+               "projected_fields":[{"name":"starts_at","reference":"event","remote_field":"starts_at"}]}
+            ]}"#,
+        )
+        .unwrap()
+    }
+
+    fn resolved_booking() -> Json {
+        with_resolved_projection_types(&event_and_booking()).get("aggregates").map(Json::each).unwrap_or(&[])[1].clone()
+    }
+
+    #[test]
+    fn a_projection_through_a_single_field_value_object_takes_its_scalar_type() {
+        let field = resolved_booking().get("projected_fields").map(Json::each).unwrap_or(&[])[0].clone();
+
+        assert_eq!(field.get("type").and_then(Json::as_str), Some("Integer"));
+    }
+
+    #[test]
+    fn the_projected_pseudo_attribute_follows_the_remote_type() {
+        let attrs = projected_field_pseudo_attributes(&resolved_booking());
+
+        assert_eq!(crate::attr::type_name(&attrs[0]), "Integer");
+    }
+
+    #[test]
+    fn the_projected_setter_narrows_with_the_remote_types_reader() {
+        let setter = emit_set_projected_field(&resolved_booking());
+
+        assert!(setter.contains("\"starts_at\" => self.starts_at = value.and_then(crate::kernel::Value::into_i64),"));
+    }
+
+    /// A value object holding a required and an optional value object, and a required and an
+    /// optional list of them.
+    fn holder_value_object() -> Json {
+        Json::parse(
+            r#"{
+              "name":"Holder",
+              "attributes":[
+                {"name":"required_note","type":"Note","list":false,"optional":false},
+                {"name":"note","type":"Note","list":false,"optional":true},
+                {"name":"required_notes","type":"Note","list":true,"optional":false},
+                {"name":"notes","type":"Note","list":true,"optional":true}
+              ]
+            }"#,
+        )
+        .unwrap()
+    }
+
+    #[test]
+    fn a_nested_value_object_checks_its_invariants_only_when_it_is_present() {
+        let note = Json::parse(r#"{"name":"Note","attributes":[{"name":"text","type":"String","list":false,"optional":false}]}"#).unwrap();
+        let by_name: HashMap<String, &Json> = HashMap::from([("Note".to_string(), &note)]);
+        let generated = emit_check_invariants(&Exemplar::load(), &holder_value_object(), &by_name, &HashMap::new());
+
+        assert!(generated.contains("self.required_note.check_invariants()?;"));
+        assert!(generated.contains("if let Some(value) = &self.note { value.check_invariants()?; }"));
+        assert!(generated.contains("for item in &self.required_notes { item.check_invariants()?; }"));
+        assert!(generated.contains("if let Some(items) = &self.notes { for item in items { item.check_invariants()?; } }"));
+    }
 }

data/rust/host/HECKS_RELEASE

@@ -1 +1 @@
-3.9.1
+3.11.0

data/rust/host/src/api.rs

@@ -1089,8 +1089,8 @@ mod tests {
     }
 
     #[test]
-    fn a_record_that_does_not_exist_refuses_with_json_doors_own_wording() {
-        // `JSON_DOOR.find!`'s own message, `id` inspected the way Ruby
+    fn a_record_that_does_not_exist_refuses_with_json_adapters_own_wording() {
+        // `JSON_ADAPTER.find!`'s own message, `id` inspected the way Ruby
         // inspects it.
         let refusal = not_found(&format!("no {} found for id {:?}", "Client", "acme"));
         assert_eq!(body(&refusal), json!({"error": "NotFound", "message": "no Client found for id \"acme\""}));
@@ -1365,7 +1365,7 @@ mod tests {
     fn every_state_styled() -> Value {
         json!({"states": {
             "Event": {"open": {"tone": "good"}, "closed": {"tone": "muted"}},
-            "Registration": {"active": {}, "archived": {"tone": "muted"}},
+            "Registration": {"active": {}, "archived": {"tone": "muted"}, "cancelled": {"tone": "muted"}},
             "PaymentConnection": {"connected": {}, "enabled": {}, "disconnected": {}, "paused": {}}
         }})
     }
@@ -1590,7 +1590,7 @@ mod tests {
         assert!(!refused["message"].as_str().expect("a message").is_empty(), "{refused}");
 
         // An unknown command, and an unknown record, both refuse the
-        // way JsonDoor refuses them.
+        // way Json refuses them.
         let unknown_command =
             command_route(&ir, "customers", "CUST-9001", "nope", "", &client, &wasm, &lineage, &invoker).await;
         assert_eq!(unknown_command["statusCode"], 404);

data/rust/host/src/bin/validate_harness.rs

@@ -0,0 +1,43 @@
+//! Rust side of the stored-value differential: runs the mint audit's structural layer
+//! (`reference_validate::validate`) over each `{aggregate, id, state}` case on stdin against one
+//! domain IR, and prints the violations of each. `spec/rust_host_reference_validate_conformance_spec.rb`
+//! holds those to the answers the Ruby runtime gives the same values.
+
+#[allow(dead_code)]
+#[path = "../expr_json.rs"]
+mod expr_json;
+#[allow(dead_code)]
+#[path = "../reference_validate.rs"]
+mod reference_validate;
+
+use serde_json::{json, Value};
+use std::io::Read;
+
+// Usage: `validate_harness < {"ir": <domain ir.json>, "cases": [{"aggregate": "Name", "id": "x", "state": {..}}, ..]}`.
+// Prints `{"results": [{"violations": [..]} | {"error": ".."}, ..]}`, one per case, in order.
+fn main() -> anyhow::Result<()> {
+    let mut input = String::new();
+    std::io::stdin().read_to_string(&mut input)?;
+    let request: Value = serde_json::from_str(&input)?;
+    let ir = request.get("ir").ok_or_else(|| anyhow::anyhow!("no \"ir\" on stdin"))?;
+    let cases = request.get("cases").and_then(Value::as_array).ok_or_else(|| anyhow::anyhow!("no \"cases\" array on stdin"))?;
+
+    let results: Vec<Value> = cases.iter().map(|case| answer(ir, case)).collect();
+    println!("{}", json!({ "results": results }));
+    Ok(())
+}
+
+fn answer(ir: &Value, case: &Value) -> Value {
+    let name = case.get("aggregate").and_then(Value::as_str).unwrap_or("");
+    let aggregate = ir
+        .get("aggregates")
+        .and_then(Value::as_array)
+        .and_then(|list| list.iter().find(|a| a.get("name").and_then(Value::as_str) == Some(name)));
+    match aggregate {
+        None => json!({ "error": format!("no aggregate {name:?} in the IR") }),
+        Some(aggregate) => {
+            let id = case.get("id").and_then(Value::as_str).unwrap_or("");
+            json!({ "violations": reference_validate::validate(ir, aggregate, id, &case["state"]) })
+        }
+    }
+}

data/rust/host/src/boundary_fuzz/expr_json.rs

@@ -8,7 +8,7 @@ use crate::fuzz_support::*;
 use serde_json::{json, Value};
 
 const BINARY: &[&str] = &["or", "and", "compare", "include", "add", "modulo"];
-const UNARY: &[&str] = &["not", "sign_test", "empty", "to_s", "size", "presence", "assignment", "first", "last", "split", "starts_with", "ends_with", "matches_regex"];
+const UNARY: &[&str] = &["not", "sign_test", "empty", "to_s", "size", "presence", "assignment", "first", "last", "split", "strip", "starts_with", "ends_with", "matches_regex"];
 
 const PATTERNS: &[&str] = &[
     "", "^$", "a", "(a*)*b", "(a|aa)+$", "[", "]", "[]", "[^]", "[a-", "(", ")", "(?", "(?P<x>", "\\", "\\d+", "\\D\\W\\S\\H", "\\Z", "[\\d]", "[\\Z]", "\\p{L}+", "\\p{Nope}",
@@ -43,7 +43,7 @@ fn node(rng: &mut Rng, depth: usize) -> Value {
         }
         4..=7 => {
             let op = *rng.pick(UNARY);
-            let mut value = json!({"op": op, "receiver": node(rng, depth + 1), "expr": node(rng, depth + 1), "negated": rng.chance(2), "separator": random_text(rng), "substring": random_text(rng), "pattern": *rng.pick(PATTERNS), "flags": *rng.pick(&["", "i", "m", "x", "imx", "z"])});
+            let mut value = json!({"op": op, "receiver": node(rng, depth + 1), "expr": node(rng, depth + 1), "negated": rng.chance(2), "separator": random_text(rng), "side": *rng.pick(&["both", "left", "right", "sideways"]), "substring": random_text(rng), "pattern": *rng.pick(PATTERNS), "flags": *rng.pick(&["", "i", "m", "x", "imx", "z"])});
             value["cmp"] = json!({"less_than": rng.chance(2), "equal": rng.chance(2), "negated": rng.chance(2)});
             value
         }

data/rust/host/src/boundary_fuzz/ir.rs

@@ -50,6 +50,7 @@ fn every_provider_reader_answers_any_ir_shape() {
                 let _ = newsletter_provider(&ir).map(|p| p.instance_prefix());
                 let _ = newsletter_issues_provider(&ir).map(|p| p.issue_prefix());
                 let _ = payments_provider(&ir).map(|p| p.instance_prefix());
+                let _ = checkout_windows(&ir);
                 if let Some(p) = registrations_provider(&ir) {
                     let _ = (p.event_prefix(), p.registration_prefix(), p.request_target());
                 }

data/rust/host/src/boundary_fuzz/server.rs

@@ -1,4 +1,4 @@
-//! Seeded fuzz of the HTTP front door (`admit`, `value_to_response`): hostile bodies, methods, URIs
+//! Seeded fuzz of the HTTP front entry point (`admit`, `value_to_response`): hostile bodies, methods, URIs
 //! and headers must be answered, never panic, and a refused request must leave no trace.
 //! Everything here is in-process: `admit` is the whole of what runs before dispatch, so none of
 //! it needs Postgres or wasm.