hecks 5.0.0 → 6.0.0

data/rust/host/src/boundary_fuzz/ir.rs

@@ -2,10 +2,11 @@
 //! boot, so a stale, hand-edited or truncated file must come back as `None` or a refusal, never
 //! a panic.
 
-use super::*;
 use crate::commerce_ir::*;
 use crate::fuzz_support::*;
+use crate::ir::*;
 use serde_json::json;
+use serde_json::Value;
 
 const KEYS: &[&str] = &[
     "name",
@@ -20,6 +21,7 @@ const KEYS: &[&str] = &[
     "authorization",
     "grant",
     "assignment_aggregate",
+    "live_assignments",
     "membership",
     "provider",
     "aggregate",
@@ -46,6 +48,9 @@ const KEYS: &[&str] = &[
     "registration_aggregate",
     "request",
     "payment_connection",
+    "checkout",
+    "provides",
+    "default",
     "commands",
     "attributes",
 ];
@@ -149,11 +154,11 @@ fn refusal(ir: &Value) -> String {
 #[test]
 fn an_unsupported_persistence_adapter_is_always_refused_at_boot() {
     // No `adapters` key (every deployed IR today): the old behaviour, byte for byte.
-    for adapter in ["Heki", "Memory", "Sqlite", "", "postgres", "Postgres "] {
+    for adapter in ["Heki", "memory", "Sqlite", "", "postgres", "Postgres "] {
         let message = refusal(&ir_binding(adapter, None));
-        assert!(message.starts_with("rust/host only has a backend for [\"Postgres\", \"PostgresEra\"] today; this domain also binds: A (persisted_by "), "{adapter:?}");
+        assert!(message.starts_with("rust/host only has a backend for [\"Postgres\", \"PostgresEra\", \"Memory\"] today; this domain also binds: A (persisted_by "), "{adapter:?}");
     }
-    for adapter in ["Postgres", "PostgresEra"] {
+    for adapter in ["Postgres", "PostgresEra", "Memory"] {
         assert!(refuse_unsupported_persistence_adapters(&ir_binding(adapter, None)).is_ok());
     }
 }
@@ -178,7 +183,7 @@ fn declared_supported_adapters_boot() {
 
 #[test]
 fn declared_but_unsupported_adapters_hit_the_backend_rule() {
-    for adapter in ["Heki", "Memory"] {
+    for adapter in ["Heki", "Sqlite"] {
         let ir = ir_binding(
             adapter,
             Some(json!([{"name": adapter, "port": "persistence"}])),

data/rust/host/src/boundary_fuzz/server.rs

@@ -337,19 +337,20 @@ fn invalid_utf8_and_oversized_bodies_are_answered() {
         400
     );
 
-    // A 16 MiB body of valid JSON is admitted as text (a size cap belongs to the listener, not here)
-    // and a 16 MiB run of openers is refused by the parser's depth limit rather than overflowing.
+    // A 16 MiB string in valid JSON is answered 413 by the string cap (`arg_limits`), and a 16 MiB
+    // run of openers is refused by the parser's depth limit rather than overflowing.
     guarded("large bodies", move || {
         let big_string = Bytes::from(format!("\"{}\"", "a".repeat(16 * 1024 * 1024)));
-        assert!(admit(
+        let oversized = admit(
             &limits,
             from,
             &Method::POST,
             &uri,
             &HeaderMap::new(),
-            &big_string
+            &big_string,
         )
-        .is_ok());
+        .expect_err("refused");
+        assert_eq!(status_of(&oversized), 413);
         let openers = Bytes::from("[".repeat(16 * 1024 * 1024));
         let refusal = admit(
             &limits,

data/rust/host/src/checkout.rs

@@ -104,6 +104,9 @@ pub fn mock_checkout_session(
 // Pinned: `embedded_page` needs this version line, not whatever the account defaults to.
 pub const STRIPE_API_VERSION: &str = "2026-04-22.dahlia";
 
+/// The currency every Checkout Session charges in, lower-case as Stripe writes it.
+pub const CURRENCY: &str = "usd";
+
 pub struct StripeAuth<'a> {
     pub api_key: &'a str,
     pub base_url: &'a str,
@@ -144,7 +147,7 @@ pub async fn create_checkout_session(
         ("ui_mode", "embedded_page"),
         ("redirect_on_completion", "never"),
         ("expires_at", expires_at.as_str()),
-        ("line_items[0][price_data][currency]", "usd"),
+        ("line_items[0][price_data][currency]", CURRENCY),
         (
             "line_items[0][price_data][unit_amount]",
             unit_amount.as_str(),