hecks 5.0.0 → 6.0.0

data/rust/host/src/boot.rs

@@ -2,15 +2,17 @@
 //! HECKS_SERVE_MODE=1): boots Postgres/wasm state, then dispatches events.
 
 use crate::host::Host;
+use crate::ir::Backend;
 use crate::{
-    auth, extension, ir, journal, lambda_client, log, mint, rate_limit, secrets, server,
+    auth, aws_lambda_invoker, dispatch, extension, ir, ledger, log, rate_limit, secrets, server,
     storage_shape,
+    store::{journal_sql as journal, mint, MemoryStore, Store},
 };
 
 use lambda_runtime::{service_fn, Error, LambdaEvent};
+use rustls::pki_types::{pem::PemObject, CertificateDer};
 use std::path::PathBuf;
 use std::sync::Arc;
-use tokio::sync::Mutex;
 
 /// Boots the host: secrets, Postgres, wasm, era minting, then the Lambda runtime loop (or the
 /// long-lived server under HECKS_SERVE_MODE=1). Extensions are read from `extension::installed()`,
@@ -28,6 +30,17 @@ pub async fn run() -> Result<(), Error> {
     // than falling back silently at request time.
     auth::resolve_account_cookie(std::env::var("HECKS_SESSION_COOKIE").ok().as_deref())?;
 
+    ir::install(std::env::var("HECKS_IR_PATH").ok().as_deref());
+    ir::install_schemas(std::env::var("HECKS_IR_PATH").ok().as_deref());
+    dispatch::Enforcement::install(dispatch::Enforcement::parse(
+        std::env::var("HECKS_ROLE_ENFORCEMENT").ok().as_deref(),
+    ));
+    let ir = ir::ir().ok_or("HECKS_IR_PATH is not set or unreadable — this binary needs its own domain's ir.json sidecar")?;
+    let allow_memory = std::env::var(ir::ALLOW_MEMORY_STORE).as_deref() == Ok("1");
+    let backend = ir::select_backend(ir, allow_memory)?;
+    let my_hash = storage_shape::mint_hash(ir);
+    let my_label = storage_shape::mint_label(ir);
+
     // DB_SECRET_ARN: the password is fetched from Secrets Manager here,
     // at cold start, rather than trusted from a plaintext
     // Environment.Variables value, which any principal with
@@ -39,23 +52,9 @@ pub async fn run() -> Result<(), Error> {
     // The fetcher built here is reused below for GOOGLE_OAUTH_SECRET_ID
     // and SESSION_SECRET_ARN too.
     let secret_fetcher = secrets::AwsSecretFetcher::from_env().await;
-    let database_url = match std::env::var("DB_SECRET_ARN") {
-        Ok(secret_arn) => {
-            let db_host = std::env::var("DB_HOST")
-                .map_err(|_| "DB_HOST is required when DB_SECRET_ARN is set")?;
-            let db_name = std::env::var("DB_NAME")
-                .map_err(|_| "DB_NAME is required when DB_SECRET_ARN is set")?;
-            let secret_json = secret_fetcher
-                .fetch_secret_string(&secret_arn)
-                .await
-                .map_err(|e| format!("fetching DB_SECRET_ARN from Secrets Manager: {e:#}"))?;
-            // The user and port come from the secret too (a client sharing an instance logs in as
-            // its own role); the password goes in literal, since parse_database_url below never
-            // percent-decodes it.
-            secrets::database_url(&secret_json, &db_host, &db_name)?
-        }
-        Err(_) => std::env::var("DATABASE_URL")
-            .map_err(|_| "either DB_SECRET_ARN (+ DB_HOST/DB_NAME) or DATABASE_URL is required")?,
+    let database_url = match backend {
+        Backend::TokioPostgres => Some(database_url(&secret_fetcher).await?),
+        Backend::Memory => None,
     };
 
     // GOOGLE_OAUTH_SECRET_ID/SESSION_SECRET_ARN: the same
@@ -101,11 +100,267 @@ pub async fn run() -> Result<(), Error> {
         extension.boot_check(&domain)?;
     }
 
+    let (store, era) = open_store(
+        database_url.as_deref(),
+        schema.as_deref(),
+        &domain,
+        ir,
+        (&my_hash, &my_label),
+    )
+    .await?;
+    let store = Arc::new(store);
+
+    // The mirrored set is the IR's own capable list, by qualified name
+    // -- never "everything this kernel can mutate". A domain that binds
+    // everything to plain `Postgres` mirrors nothing.
+    let mirrored = ir::mirrored_aggregates(ir);
+    // A commit seals the lineage chain every so many rows (ledger.rs). The default holds unless
+    // the override says otherwise; a Memory store has no lineage and never reads it.
+    let seal_every = ledger::seal_every(std::env::var(ledger::SEAL_EVERY_VAR).ok().as_deref())?;
+    let lineage_config = Arc::new(journal::LineageConfig {
+        domain,
+        era,
+        mirrored: Some(mirrored),
+        seal_every,
+    });
+
+    let wasm_path = Arc::new(wasm_path);
+    // One invoker for this process's lifetime -- credentials/region
+    // resolve once at boot, not per invocation. See lambda_client.rs:
+    // the compiled `.wasm` module can't dispatch this itself (no
+    // network inside that sandbox).
+    let invoker = Arc::new(aws_lambda_invoker::AwsLambdaInvoker::from_env().await);
+
+    // `role` is optional, mirroring `args`: an absent key means no
+    // caller asserted a role, and `dispatch::handle`'s `check_role`
+    // stays on its unchecked path. Read by `server::dispatch_body` below.
+    let limits = Arc::new(rate_limit::RateLimits::from_env());
+    if serve_mode {
+        log::info(
+            "boot",
+            serde_json::json!({ "mode": "serve", "domain": &lineage_config.domain, "era": &my_label, "boot_ms": boot_started.elapsed().as_millis() as u64 }),
+        );
+        let version = server::version_body(
+            &my_label,
+            &my_hash,
+            std::env::var("HECKS_BUILD").ok().as_deref(),
+        );
+        let state = server::ServerState {
+            store,
+            wasm_path,
+            lineage_config,
+            invoker,
+            limits,
+        };
+        return server::serve(state, version).await;
+    }
+
+    lambda_runtime::run(service_fn(move |event: LambdaEvent<serde_json::Value>| {
+        let store = Arc::clone(&store);
+        let wasm_path = Arc::clone(&wasm_path);
+        let lineage_config = Arc::clone(&lineage_config);
+        let invoker = Arc::clone(&invoker);
+        let limits = Arc::clone(&limits);
+        async move {
+            let (body, _context) = event.into_parts();
+            if let Some(refusal) = server::lambda_rate_limited(&limits, &body) {
+                return Ok(refusal);
+            }
+            server::dispatch_body(
+                body,
+                Host::new(&store, &wasm_path, &lineage_config, invoker.as_ref()),
+            )
+            .await
+        }
+    }))
+    .await
+}
+
+// Parses `postgres://user:password@host:port/db` without treating it
+// as a URI -- an RDS/Aurora auto-generated password can contain
+// `?`/`#`, which a strict URI parser would treat as delimiters.
+fn parse_database_url(url: &str) -> Result<tokio_postgres::Config, String> {
+    let rest = url
+        .strip_prefix("postgres://")
+        .or_else(|| url.strip_prefix("postgresql://"))
+        .ok_or_else(|| {
+            "DATABASE_URL doesn't start with postgres:// or postgresql://".to_string()
+        })?;
+
+    let (authority, db_and_query) = rest
+        .split_once('/')
+        .ok_or_else(|| "DATABASE_URL has no '/' separating host from database name".to_string())?;
+    let dbname = db_and_query
+        .split(['?', '#'])
+        .next()
+        .unwrap_or(db_and_query);
+
+    let (credentials, host_and_port) = match authority.rsplit_once('@') {
+        Some((credentials, host_and_port)) => (Some(credentials), host_and_port),
+        None => (None, authority),
+    };
+    let (host, port) = match host_and_port.rsplit_once(':') {
+        Some((host, port)) => {
+            let port: u16 = port
+                .parse()
+                .map_err(|e| format!("DATABASE_URL's port {port:?} isn't a valid number: {e}"))?;
+            (host, port)
+        }
+        None => (host_and_port, 5432),
+    };
+
+    let mut config = tokio_postgres::Config::new();
+    config.host(host).port(port).dbname(dbname);
+    if let Some(credentials) = credentials {
+        match credentials.split_once(':') {
+            Some((user, password)) => {
+                config.user(user).password(password);
+            }
+            None => {
+                config.user(credentials);
+            }
+        }
+    }
+    Ok(config)
+}
+
+fn database_url_is_local(config: &tokio_postgres::Config) -> bool {
+    use tokio_postgres::config::Host;
+    config.get_hosts().iter().any(|host| match host {
+        Host::Tcp(name) => name == "localhost" || name == "127.0.0.1" || name == "::1",
+        Host::Unix(_) => false,
+    })
+}
+
+/// The Postgres connection string: fetched from Secrets Manager when `DB_SECRET_ARN` names a
+/// secret, else `DATABASE_URL` as given.
+async fn database_url(secret_fetcher: &secrets::AwsSecretFetcher) -> Result<String, Error> {
+    Ok(match std::env::var("DB_SECRET_ARN") {
+        Ok(secret_arn) => {
+            let db_host = std::env::var("DB_HOST")
+                .map_err(|_| "DB_HOST is required when DB_SECRET_ARN is set")?;
+            let db_name = std::env::var("DB_NAME")
+                .map_err(|_| "DB_NAME is required when DB_SECRET_ARN is set")?;
+            let secret_json = secret_fetcher
+                .fetch_secret_string(&secret_arn)
+                .await
+                .map_err(|e| format!("fetching DB_SECRET_ARN from Secrets Manager: {e:#}"))?;
+            // The user and port come from the secret too (a client sharing an instance logs in as
+            // its own role); the password goes in literal, since parse_database_url below never
+            // percent-decodes it.
+            secrets::database_url(&secret_json, &db_host, &db_name)?
+        }
+        Err(_) => std::env::var("DATABASE_URL")
+            .map_err(|_| "either DB_SECRET_ARN (+ DB_HOST/DB_NAME) or DATABASE_URL is required")?,
+    })
+}
+
+/// The aggregates the lineage subsystem keeps heads for: the declared lineage-capable ones, plus
+/// the membership aggregate when a bluebook `provides "membership"` (it can be vendored, so it
+/// may be missing from the capable list, and Google sign-in reads its head).
+fn lineage_aggregates(ir: &serde_json::Value) -> Vec<mint::Aggregate> {
+    let mut aggregates: Vec<mint::Aggregate> = ir::lineage_capable_aggregates(ir)
+        .into_iter()
+        .map(|(qualified, storage_name)| {
+            let name = qualified
+                .rsplit("::")
+                .next()
+                .unwrap_or(&qualified)
+                .to_string();
+            mint::Aggregate { name, storage_name }
+        })
+        .collect();
+    // A bluebook that `provides "membership"` names who may sign in; that
+    // aggregate can be vendored, so it may be missing from this domain's
+    // lineage-capable list. Mint its head anyway for Google-auth to read.
+    if let Some(membership) = ir::membership_provider(ir) {
+        let name = membership
+            .aggregate
+            .rsplit("::")
+            .next()
+            .unwrap_or(&membership.aggregate)
+            .to_string();
+        let storage_name = journal::snake(&name);
+        if !aggregates.iter().any(|a| a.storage_name == storage_name) {
+            aggregates.push(mint::Aggregate { name, storage_name });
+        }
+    }
+    aggregates
+}
+
+/// Whether the domain needs the era-partitioned lineage subsystem at all: a lineage-capable
+/// aggregate, or Google sign-in configured (ADR 0034 requires it for Member sessions either way).
+const fn needs_lineage(aggregates: &[mint::Aggregate], google_auth: bool) -> bool {
+    !aggregates.is_empty() || google_auth
+}
+
+/// Whether Google sign-in is configured for this process.
+fn google_auth_configured() -> bool {
+    secrets::var("GOOGLE_CLIENT_ID").is_ok()
+}
+
+/// Resolves the era a Memory store boots at, the way Postgres does: the held era naming this
+/// shape, or era 1 when none is held. A Memory store has no translation edges, so a process that
+/// boots a second shape against the same store is refused rather than guessed at.
+fn boot_memory_era(
+    memory: &MemoryStore,
+    domain: &str,
+    ir: &serde_json::Value,
+    my_label: &str,
+    google_auth: bool,
+) -> Result<Option<i32>, Error> {
+    if !needs_lineage(&lineage_aggregates(ir), google_auth) {
+        return Ok(None);
+    }
+    match mint::decide_boot_action(&memory.eras_of(domain), my_label) {
+        mint::BootDecision::UseExisting { ordinal } => Ok(Some(ordinal)),
+        mint::BootDecision::HoldFirst => Ok(Some(memory.hold_era(domain, my_label))),
+        mint::BootDecision::Mint { from_ordinal, .. } => Err(format!(
+            "cannot boot {domain}: the memory store holds era {from_ordinal} of a different shape \
+             and keeps no translation edges to walk from it -- start a fresh process, or boot \
+             against Postgres"
+        )
+        .into()),
+        mint::BootDecision::LatestUnnamed { ordinal } => Err(format!(
+            "cannot boot {domain}: the memory store's era {ordinal} has no name"
+        )
+        .into()),
+    }
+}
+
+/// Opens the store the selected backend names: Postgres when a connection URL was resolved,
+/// otherwise the in-memory store, which holds its eras in process and skips every Postgres step.
+async fn open_store(
+    database_url: Option<&str>,
+    schema: Option<&str>,
+    domain: &str,
+    ir: &serde_json::Value,
+    (my_hash, my_label): (&str, &str),
+) -> Result<(Store, Option<i32>), Error> {
+    if let Some(url) = database_url {
+        return boot_postgres(url, schema, domain, ir, my_hash, my_label).await;
+    }
+    let memory = MemoryStore::open(domain, schema);
+    let era = boot_memory_era(&memory, domain, ir, my_label, google_auth_configured())?;
+    Ok((Store::memory(memory), era))
+}
+
+/// Connects to Postgres as the host does in production: TLS against AWS's RDS certificate
+/// authority, except for a loopback server, which takes none.
+///
+/// The one place a connection to the domain's database is made, so an operator tool such as
+/// `ledger` reaches the database the way a dispatch does.
+///
+/// # Errors
+///
+/// Returns an error if the URL cannot be read, the certificate bundle cannot be parsed, or the
+/// server refuses the connection.
+pub async fn connect_postgres(database_url: &str) -> Result<tokio_postgres::Client, Error> {
     // RDS refuses a plain NoTls connection by default and needs AWS's
-    // own RDS CA specifically, not a generic public bundle (see
+    // own RDS certificate authority specifically, not a generic public bundle (see
     // Cargo.toml).
     let mut roots = rustls::RootCertStore::empty();
-    for cert in rustls_pemfile::certs(&mut include_bytes!("../rds-ca-bundle.pem").as_slice()) {
+    for cert in CertificateDer::pem_slice_iter(include_bytes!("../rds-ca-bundle.pem")) {
         roots.add(cert.map_err(|e| format!("parsing rds-ca-bundle.pem: {e}"))?)?;
     }
     let tls_config = rustls::ClientConfig::builder()
@@ -115,9 +370,9 @@ pub async fn run() -> Result<(), Error> {
     // Not tokio_postgres::connect(url, tls) -- that treats DATABASE_URL
     // as a strict URI, and RDS-generated passwords can contain
     // URI-reserved `?`/`#` that CloudFormation never percent-encodes.
-    let mut config = parse_database_url(&database_url)?;
+    let mut config = parse_database_url(database_url)?;
     // RDS requires TLS (rds-ca-bundle.pem); local Postgres over loopback
-    // can't be verified against the RDS CA, so localhost uses NoTls.
+    // can't be verified against the RDS authority, so localhost uses NoTls.
     let local_postgres = database_url_is_local(&config);
     if !local_postgres {
         config.ssl_mode(tokio_postgres::config::SslMode::Require);
@@ -151,6 +406,20 @@ pub async fn run() -> Result<(), Error> {
     };
 
     connect_phase.end();
+    Ok(client)
+}
+
+/// Connects to Postgres, provisions the journal tables and resolves the era this binary runs
+/// at, for a domain that binds a Postgres adapter.
+async fn boot_postgres(
+    database_url: &str,
+    schema: Option<&str>,
+    domain: &str,
+    ir: &serde_json::Value,
+    my_hash: &str,
+    my_label: &str,
+) -> Result<(Store, Option<i32>), Error> {
+    let client = connect_postgres(database_url).await?;
 
     // Every unqualified table/view reference this binary issues
     // resolves through search_path, so this is what makes a shared
@@ -185,49 +454,19 @@ pub async fn run() -> Result<(), Error> {
         .map_err(|e| format!("provisioning hecks_lambda_journal: {e:#}"))?;
     phase.end();
 
-    let ir = ir::ir().ok_or("HECKS_IR_PATH is not set or unreadable — this binary needs its own domain's ir.json sidecar")?;
-    ir::refuse_unsupported_persistence_adapters(ir)?;
-    let my_hash = storage_shape::mint_hash(ir);
-    let my_label = storage_shape::mint_label(ir);
-
-    let mut aggregates: Vec<mint::Aggregate> = ir::lineage_capable_aggregates(ir)
-        .into_iter()
-        .map(|(qualified, storage_name)| {
-            let name = qualified
-                .rsplit("::")
-                .next()
-                .unwrap_or(&qualified)
-                .to_string();
-            mint::Aggregate { name, storage_name }
-        })
-        .collect();
-    // A chapter that `provides "membership"` names who may sign in; that
-    // aggregate can be vendored, so it may be missing from this domain's
-    // lineage-capable list. Mint its head anyway for Google-auth to read.
-    if let Some(membership) = ir::membership_provider(ir) {
-        let name = membership
-            .aggregate
-            .rsplit("::")
-            .next()
-            .unwrap_or(&membership.aggregate)
-            .to_string();
-        let storage_name = journal::snake(&name);
-        if !aggregates.iter().any(|a| a.storage_name == storage_name) {
-            aggregates.push(mint::Aggregate { name, storage_name });
-        }
-    }
+    let aggregates = lineage_aggregates(ir);
 
     // The era-partitioned lineage subsystem is provisioned only when
     // something needs it: a lineage-capable aggregate, or Google auth
     // configured (ADR 0034 requires it for Member sessions either way).
-    let needs_lineage = !aggregates.is_empty() || secrets::var("GOOGLE_CLIENT_ID").is_ok();
+    let needs_lineage = needs_lineage(&aggregates, google_auth_configured());
 
     let era: Option<i32> = if needs_lineage {
         // Idempotent (gated by `provisioner?`); must run before the
         // first `journal::held_eras` call, since `hecks_eras` doesn't
         // exist yet on a truly fresh Postgres instance.
         let phase = log::phase("ensure_base");
-        mint::ensure_base(&client, &domain)
+        mint::ensure_base(&client, domain)
             .await
             .map_err(|e| format!("provisioning hecks_eras for {domain}: {e:#}"))?;
         phase.end();
@@ -239,14 +478,14 @@ pub async fn run() -> Result<(), Error> {
         // `hecks scaffold_translation` (no edge covers it) or
         // `hecks audit_translation --approve` (needs review) otherwise.
         let era_phase = log::phase("era_resolve");
-        let held = journal::held_eras(&client, &domain)
+        let held = journal::held_eras(&client, domain)
             .await
             .map_err(|e| format!("checking hecks_eras for {domain}: {e:#}"))?;
 
         // The decision itself is a pure, unit-tested function
         // (`mint::decide_boot_action`); everything below just carries
         // out whichever of its four outcomes came back.
-        let decision = mint::decide_boot_action(&held, &my_label);
+        let decision = mint::decide_boot_action(&held, my_label);
         era_phase
             .end_with(serde_json::json!({ "held_eras": held.len(), "decision": decision.name() }));
         let ordinal: i32 = match decision {
@@ -259,7 +498,7 @@ pub async fn run() -> Result<(), Error> {
                     "adopt_head_snapshots",
                     serde_json::json!({ "era": ordinal }),
                 );
-                mint::adopt_head_snapshots(&client, &domain, &aggregates, ordinal)
+                mint::adopt_head_snapshots(&client, domain, &aggregates, ordinal)
                     .await
                     .map_err(|e| format!("adopting era {ordinal} of {domain}: {e:#}"))?;
                 phase.end();
@@ -271,7 +510,7 @@ pub async fn run() -> Result<(), Error> {
                     .and_then(serde_json::Value::as_str)
                     .ok_or("ir.json is missing source_text — regenerate with hecks project_rust")?;
                 let phase = log::phase_with("hold_first", serde_json::json!({ "era": 1 }));
-                mint::hold_first(&client, &domain, source_text, ir, &aggregates, None)
+                mint::hold_first(&client, domain, source_text, ir, &aggregates, None)
                     .await
                     .map_err(|e| format!("minting era 1 of {domain}: {e:#}"))?;
                 phase.end();
@@ -294,8 +533,8 @@ pub async fn run() -> Result<(), Error> {
                     .iter()
                     .map(|held_era| held_era.label.clone().unwrap_or_default())
                     .collect();
-                labels.push(my_label.clone());
-                let edges = mint::parse_edges(ir, &domain);
+                labels.push(my_label.to_string());
+                let edges = mint::parse_edges(ir, domain);
                 let chain = mint::edge_chain(&edges, &labels).map_err(|e| {
                     format!(
                         "cannot boot: {domain} has drifted from era {from_ordinal} ({from_label}) to a shape \
@@ -324,7 +563,7 @@ pub async fn run() -> Result<(), Error> {
                 );
                 mint::audit_before_mint(
                     &client,
-                    &domain,
+                    domain,
                     ir,
                     &aggregates,
                     ordinal,
@@ -346,10 +585,10 @@ pub async fn run() -> Result<(), Error> {
                 );
                 mint::mint_era(
                     &client,
-                    &domain,
+                    domain,
                     ordinal,
-                    &my_hash,
-                    &my_label,
+                    my_hash,
+                    my_label,
                     held_text,
                     &aggregates,
                     &chain,
@@ -367,127 +606,179 @@ pub async fn run() -> Result<(), Error> {
         None
     };
 
-    // The mirrored set is the IR's own capable list, by qualified name
-    // -- never "everything this kernel can mutate". A domain that binds
-    // everything to plain `Postgres` mirrors nothing.
-    let mirrored = ir::mirrored_aggregates(ir);
-    let lineage_config = Arc::new(journal::LineageConfig {
-        domain,
-        era,
-        mirrored: Some(mirrored),
-    });
+    Ok((crate::store::postgres_store(client), era))
+}
 
-    // Mutex, not a bare Arc<Client> -- dispatch::handle needs
-    // Client::transaction (&mut Client) to hold the advisory lock
-    // across the rehydrate-then-append sequence (see dispatch.rs).
-    let client = Arc::new(Mutex::new(client));
-    let wasm_path = Arc::new(wasm_path);
-    // One invoker for this process's lifetime -- credentials/region
-    // resolve once at boot, not per invocation. See lambda_client.rs:
-    // the compiled `.wasm` module can't dispatch this itself (no
-    // network inside that sandbox).
-    let invoker = Arc::new(lambda_client::AwsLambdaInvoker::from_env().await);
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[allow(unused_imports)]
+    use crate::store::{StoreExt, StoreFixtures};
+
+    // Distinct domain names per test: the memory store is shared process-wide by domain and schema.
+    fn open_memory(domain: &str, schema: Option<&str>) -> (Store, Option<i32>) {
+        let memory = MemoryStore::open(domain, schema);
+        let era = boot_memory_era(&memory, domain, &serde_json::json!({}), "label", false)
+            .expect("memory opens");
+        (Store::memory(memory), era)
+    }
 
-    // `role` is optional, mirroring `args`: an absent key means no
-    // caller asserted a role, and `dispatch::handle`'s `check_role`
-    // stays on its unchecked path. Read by `server::dispatch_body` below.
-    if serve_mode {
-        log::info(
-            "boot",
-            serde_json::json!({ "mode": "serve", "domain": &lineage_config.domain, "era": &my_label, "boot_ms": boot_started.elapsed().as_millis() as u64 }),
-        );
-        let version = server::version_body(
-            &my_label,
-            &my_hash,
-            std::env::var("HECKS_BUILD").ok().as_deref(),
-        );
-        let limits = Arc::new(rate_limit::RateLimits::from_env());
-        let state = server::ServerState {
-            client,
-            wasm_path,
-            lineage_config,
-            invoker,
-            limits,
+    async fn journal_one_step(store: &Store, domain: &str) {
+        let args = serde_json::json!({});
+        let accepted = crate::store::Accepted {
+            verb: "OpenAccount",
+            args: &args,
+            new_seed: serde_json::json!({}),
+            saga_upserts: Vec::new(),
+            saga_deletes: Vec::new(),
+            lineage: None,
         };
-        return server::serve(state, version).await;
+        store
+            .begin(domain)
+            .await
+            .expect("unit")
+            .commit(accepted)
+            .await
+            .expect("commit");
     }
 
-    lambda_runtime::run(service_fn(move |event: LambdaEvent<serde_json::Value>| {
-        let client = Arc::clone(&client);
-        let wasm_path = Arc::clone(&wasm_path);
-        let lineage_config = Arc::clone(&lineage_config);
-        let invoker = Arc::clone(&invoker);
-        async move {
-            let (body, _context) = event.into_parts();
-            server::dispatch_body(
-                body,
-                Host::new(&client, &wasm_path, &lineage_config, invoker.as_ref()),
-            )
+    #[tokio::test]
+    async fn without_a_database_url_the_store_is_memory_with_no_era_and_no_lineage() {
+        let (store, era) = open_memory("boot_memory_shape", None);
+
+        assert!(era.is_none());
+        assert!(store.lineage().is_none());
+    }
+
+    fn lineage_ir() -> serde_json::Value {
+        serde_json::json!({
+            "lineage": { "capable_aggregates": [{ "name": "Order", "storage_name": "order" }] }
+        })
+    }
+
+    fn open_memory_with(
+        domain: &str,
+        ir: &serde_json::Value,
+        label: &str,
+    ) -> Result<(Store, Option<i32>), Error> {
+        let memory = MemoryStore::open(domain, None);
+        let era = boot_memory_era(&memory, domain, ir, label, false)?;
+        Ok((Store::memory(memory), era))
+    }
+
+    #[tokio::test]
+    async fn a_memory_store_with_lineage_holds_era_one_and_reboots_at_it() {
+        let ir = lineage_ir();
+        let (store, era) =
+            open_memory_with("boot_memory_era", &ir, "shape-a").expect("memory opens");
+        assert_eq!(era, Some(1));
+        assert_eq!(store.current_era("boot_memory_era").await.unwrap(), Some(1));
+
+        let (_, again) = open_memory_with("boot_memory_era", &ir, "shape-a")
+            .expect("the same shape boots again");
+        assert_eq!(
+            again,
+            Some(1),
+            "the held era names this shape: no second era"
+        );
+        let held = store.held_eras("boot_memory_era").await.unwrap();
+        assert_eq!(held.len(), 1);
+        assert_eq!(held[0].label.as_deref(), Some("shape-a"));
+    }
+
+    #[tokio::test]
+    async fn a_memory_store_refuses_a_second_shape_it_has_no_edge_to() {
+        let ir = lineage_ir();
+        open_memory_with("boot_memory_second_shape", &ir, "shape-a").expect("memory opens");
+
+        let err = open_memory_with("boot_memory_second_shape", &ir, "shape-b")
+            .map(|_| ())
+            .unwrap_err();
+        assert!(err.to_string().contains("translation edges"), "{err}");
+    }
+
+    #[tokio::test]
+    async fn a_domain_without_lineage_holds_no_era_on_memory() {
+        let (store, era) = open_memory_with("boot_memory_no_lineage", &serde_json::json!({}), "x")
+            .expect("memory opens");
+        assert_eq!(era, None);
+        assert!(store
+            .held_eras("boot_memory_no_lineage")
             .await
-        }
-    }))
-    .await
-}
+            .unwrap()
+            .is_empty());
+    }
 
-// Parses `postgres://user:password@host:port/db` without treating it
-// as a URI -- an RDS/Aurora auto-generated password can contain
-// `?`/`#`, which a strict URI parser would treat as delimiters.
-fn parse_database_url(url: &str) -> Result<tokio_postgres::Config, String> {
-    let rest = url
-        .strip_prefix("postgres://")
-        .or_else(|| url.strip_prefix("postgresql://"))
-        .ok_or_else(|| {
-            "DATABASE_URL doesn't start with postgres:// or postgresql://".to_string()
-        })?;
+    #[tokio::test]
+    async fn google_sign_in_alone_gives_a_memory_store_an_era() {
+        let memory = MemoryStore::open("boot_memory_sign_in", None);
 
-    let (authority, db_and_query) = rest
-        .split_once('/')
-        .ok_or_else(|| "DATABASE_URL has no '/' separating host from database name".to_string())?;
-    let dbname = db_and_query
-        .split(['?', '#'])
-        .next()
-        .unwrap_or(db_and_query);
+        let era = boot_memory_era(
+            &memory,
+            "boot_memory_sign_in",
+            &serde_json::json!({}),
+            "shape-a",
+            true,
+        )
+        .expect("memory opens");
 
-    let (credentials, host_and_port) = match authority.rsplit_once('@') {
-        Some((credentials, host_and_port)) => (Some(credentials), host_and_port),
-        None => (None, authority),
-    };
-    let (host, port) = match host_and_port.rsplit_once(':') {
-        Some((host, port)) => {
-            let port: u16 = port
-                .parse()
-                .map_err(|e| format!("DATABASE_URL's port {port:?} isn't a valid number: {e}"))?;
-            (host, port)
-        }
-        None => (host_and_port, 5432),
-    };
+        assert_eq!(era, Some(1));
+    }
 
-    let mut config = tokio_postgres::Config::new();
-    config.host(host).port(port).dbname(dbname);
-    if let Some(credentials) = credentials {
-        match credentials.split_once(':') {
-            Some((user, password)) => {
-                config.user(user).password(password);
-            }
-            None => {
-                config.user(credentials);
-            }
-        }
+    #[tokio::test]
+    async fn a_memory_store_at_an_era_keeps_the_heads_a_step_mirrors() {
+        use crate::journal::{LineageConfig, Mutation};
+        let ir = lineage_ir();
+        let (store, era) =
+            open_memory_with("boot_memory_heads", &ir, "shape-a").expect("memory opens");
+        let config = LineageConfig {
+            domain: "boot_memory_heads".to_string(),
+            era,
+            mirrored: None,
+            seal_every: None,
+        };
+        let state = serde_json::json!({ "total": { "value": 3 } });
+        store
+            .put_head(
+                &config,
+                &Mutation {
+                    aggregate: "Order",
+                    id: "o-1",
+                    operation: "save",
+                    state: &state,
+                },
+            )
+            .await
+            .expect("an era is active, so the head is written");
+
+        let found = store
+            .head_by_id("boot_memory_heads", "order", "o-1")
+            .await
+            .unwrap();
+        assert_eq!(found, Some(state));
     }
-    Ok(config)
-}
 
-fn database_url_is_local(config: &tokio_postgres::Config) -> bool {
-    use tokio_postgres::config::Host;
-    config.get_hosts().iter().any(|host| match host {
-        Host::Tcp(name) => name == "localhost" || name == "127.0.0.1" || name == "::1",
-        Host::Unix(_) => false,
-    })
-}
+    #[tokio::test]
+    async fn a_memory_store_reopens_with_what_the_domain_journaled() {
+        let (store, _) = open_memory("boot_memory_reopen", None);
+        journal_one_step(&store, "boot_memory_reopen").await;
+        let (again, _) = open_memory("boot_memory_reopen", None);
 
-#[cfg(test)]
-mod tests {
-    use super::*;
+        assert_eq!(again.journal_steps().await.len(), 1);
+    }
+
+    #[tokio::test]
+    async fn memory_stores_of_other_domains_and_schemas_stay_apart() {
+        let (store, _) = open_memory("boot_memory_apart", Some("tenant_a"));
+        journal_one_step(&store, "boot_memory_apart").await;
+        let (other_schema, _) = open_memory("boot_memory_apart", Some("tenant_b"));
+        let (other_domain, _) = open_memory("boot_memory_apart_two", Some("tenant_a"));
+
+        assert_eq!(
+            other_schema.journal_steps().await.len() + other_domain.journal_steps().await.len(),
+            0
+        );
+    }
 
     #[test]
     fn parses_a_password_with_uri_reserved_characters() {