@voxgig/sdkgen 4.29.0 → 4.30.1

package/project/.sdk/tm/rust/feature/secrets/sekreto/providers.rs

@@ -1,30 +1,6 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (rust/src/providers.rs)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (rust/src/providers.rs)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-//! What a provider is, what its declarative form looks like, how a
-//! provider kind becomes a voxgig/plugin definition - and the four
-//! BUILT-IN kinds.
-//!
-//! A provider answers one question: "do you have this secret?" It returns
-//! the value, or None to mean "ask the next one". Nothing else about a
-//! provider is visible to the caller - which is the point: an app reads
-//! `api.token` and never learns whether it came from the environment, a
-//! .env file, HashiCorp Vault, AWS, GCP, Azure or a boru vault.
-//!
-//! Two failure shapes, and they are never interchangeable. A store that
-//! does not hold the secret is a MISS (None) - the chain carries on. A
-//! store that could not answer - bad credentials, unreachable host,
-//! missing configuration - is an ERROR: falling through there would
-//! quietly reach for a weaker store.
-//!
-//! THIS CRATE LINKS NO TLS, NO SOCKET AND NO SUBPROCESS. What makes a
-//! kind built in is that it needs nothing of the platform beyond reading
-//! a local file; every kind that opens a socket, signs a request or
-//! spawns a process is a plugin in its own crate under `plugins/`, linked
-//! only by a binary that names it (docs/design/plugin-providers.md).
-//!
-//! A port of typescript/src/provider/support.ts and
-//! typescript/src/provider/builtin.ts, which are canonical.
 
 use std::collections::BTreeMap;
 use std::env;
@@ -41,12 +17,9 @@ use super::super::plugin::value::Value;
 
 use super::sekreto::{envkey, Answer, SekretoError};
 
-/// A source of secrets.
 pub trait Provider {
-    /// The value, or None if this provider does not have it.
     fn lookup(&self, name: &str) -> Answer<Option<String>>;
 
-    /// A short description, shown by `Sekreto::sources`.
     fn describe(&self) -> String;
 }
 
@@ -57,19 +30,13 @@ pub trait Provider {
 /// hand-written impl below.
 #[derive(Clone, Default)]
 pub struct AuthSpec {
-    /// `kubernetes` or `approle`.
     pub method: String,
-    /// The auth mount, defaulting to the method name.
     pub mount: String,
-    /// kubernetes: the Vault role to log in as.
     pub role: String,
     /// kubernetes: the service-account JWT itself (tests); None means the
     /// jwt file is read instead.
     pub jwt: Option<String>,
-    /// kubernetes: where the JWT lives; the conventional pod path by
-    /// default.
     pub jwtfile: String,
-    /// approle: the role and secret ids.
     pub roleid: String,
     pub secretid: String,
 }
@@ -82,41 +49,22 @@ pub struct AuthSpec {
 #[derive(Clone, Default)]
 pub struct ProviderSpec {
     pub kind: String,
-    /// The store name `Sekreto::getfrom` addresses. Defaults to `kind`.
     pub name: String,
     pub prefix: String,
-    /// dotenv: the file to read.
     pub file: String,
-    /// memory: literal values, keyed like environment variables.
     pub values: BTreeMap<String, String>,
-    /// file: the directory of one-secret-per-file entries.
     pub dir: String,
-    /// hashicorp / boru (wire) / gcp / 1password / doppler / infisical:
-    /// the base URL.
     pub addr: String,
-    /// hashicorp / boru (wire) / gcp / azure / 1password / doppler /
-    /// infisical: the access token.
     pub token: String,
-    /// hashicorp / boru (wire): the KV mount (default `secret`).
     pub mount: String,
-    /// hashicorp: KV engine version, 1 or 2 (0 means the default, 2).
     pub kv: u32,
-    /// hashicorp: Vault Enterprise namespace (X-Vault-Namespace).
     pub vaultnamespace: String,
     /// hashicorp: log in for a token instead of being handed one.
     pub auth: Option<AuthSpec>,
-    /// boru / secretspec: the executable to run (default: the kind's own
-    /// name).
     pub command: String,
-    /// boru: the namespace qualifying the alias.
     pub namespace: String,
-    /// boru: the vault home, passed as BORU_HOME.
     pub home: String,
-    /// secretspec: the profile to read (`--profile`).
     pub profile: String,
-    /// secretspec: which of ITS backends to read from (`--provider`),
-    /// e.g. `keyring` or `dotenv://.env`. Named `backend` because
-    /// `provider` already means a sekreto provider.
     pub backend: String,
     /// secretspec: the audit reason recorded for the read (`--reason`).
     /// SecretSpec refuses to read without one.
@@ -130,11 +78,7 @@ pub struct ProviderSpec {
     /// gcp / doppler / infisical: the project (GCP project id, Doppler
     /// project slug, Infisical workspace id).
     pub project: String,
-    /// azure: the Key Vault name or full URL. 1password: the vault name
-    /// or id.
     pub vault: String,
-    /// azure: client-credential login. infisical: universal-auth login
-    /// (tenant is Azure-only).
     pub tenant: String,
     pub clientid: String,
     pub clientsecret: String,
@@ -144,23 +88,16 @@ pub struct ProviderSpec {
     pub loginaddr: String,
     pub imdsaddr: String,
     pub metadataaddr: String,
-    /// azure: the Key Vault API version (default 7.4).
     pub apiversion: String,
-    /// doppler: the config slug (with `project`).
     pub config: String,
-    /// infisical: the environment slug and secret path.
     pub environment: String,
     pub path: String,
-    /// minivault: the passphrase that unwraps `vaultkey`.
     pub passphrase: String,
     /// minivault: which key in the vault file to open with, defaulting to
     /// `master`. Named apart from `key` and `keyid` because those already
     /// mean a secret name and an AWS access key id.
     pub vaultkey: String,
-    /// minivault: PBKDF2 rounds, used only when a key is created (0 means
-    /// the default).
     pub iterations: u32,
-    /// minivault: make the vault file if it is not there.
     pub create: bool,
 
     /// A provider already built, joining the chain as it is - `kind`
@@ -179,7 +116,6 @@ impl ProviderSpec {
 }
 
 
-/// Environment variables: `api.token` from `API_TOKEN`.
 pub struct EnvProvider {
     pub prefix: String,
 }
@@ -198,7 +134,6 @@ impl Provider for EnvProvider {
     }
 }
 
-/// A `.env` file, read once, keyed exactly like the environment.
 pub struct DotenvProvider {
     pub file: String,
     pub prefix: String,
@@ -278,14 +213,6 @@ impl Provider for MemoryProvider {
     }
 }
 
-/// A directory of one-secret-per-file entries, keyed like the
-/// environment: `api.token` reads `<dir>/API_TOKEN`.
-///
-/// This is the shape of a mounted Kubernetes Secret, a Docker or Swarm
-/// secret, and a systemd credentials directory, so those all work with no
-/// further configuration. One trailing newline is stripped - tools that
-/// write these files disagree about it, and a newline is never part of a
-/// secret on purpose.
 pub struct FileProvider {
     pub dir: String,
     pub prefix: String,
@@ -329,13 +256,6 @@ impl Provider for FileProvider {
     }
 }
 
-/// Printed without its credentials.
-///
-/// A derived `Debug` puts the Vault token, the AWS secret access key and
-/// the Azure client secret into whatever formatted it - and
-/// `tracing::error!(?spec, "chain build failed")` is exactly what someone
-/// writes when a chain will not build. Fields that hold a credential
-/// report whether they are set, never what they are.
 impl fmt::Debug for AuthSpec {
     fn fmt(&self, form: &mut fmt::Formatter<'_>) -> fmt::Result {
         form.debug_struct("AuthSpec")
@@ -364,7 +284,6 @@ impl fmt::Debug for ProviderSpec {
     }
 }
 
-/// What a credential field reports about itself.
 fn setornot(value: &str) -> &'static str {
     if value.is_empty() {
         "[unset]"
@@ -372,46 +291,13 @@ fn setornot(value: &str) -> &'static str {
         "[set]"
     }
 }
-// --- providers as voxgig/plugin definitions ----------------------------
 
 /// The export key under which a provider definition publishes the
 /// provider it built. `Sekreto::new` reads `<ref>/provider` off the host.
 pub const PROVIDER_EXPORT: &str = "provider";
 
-/// The voxgig/plugin error code a `SekretoError` travels under when a
-/// definition's `define` refuses.
-///
-/// plugin wraps a code-less error raised by a callback as
-/// `plugin_define_failed`, and keeps one that already carries a code. A
-/// provider that refuses its own configuration - `kv: 3`, a missing
-/// project - returns a `SekretoError`, and that message is pinned by the
-/// spec byte for byte, so it must come back out of the host exactly as it
-/// went in. `providerplugin` puts this code on; `Sekreto::new` takes it
-/// off. Nowhere else catches and rewraps.
 pub const ERROR_CODE: &str = "sekreto_error";
 
-/// A provider kind, as a voxgig/plugin definition.
-///
-/// This is the whole bridge between the two libraries. The definition's
-/// name is the `kind` a `ProviderSpec` names; its `define` reads the spec
-/// back off the instance's options, builds the provider with `make`, and
-/// exports it. Nothing runs at activate: a provider opens nothing until
-/// its first `lookup`, so there is nothing to capture - a provider that
-/// does hold a resource acquires it there and lets the instance scope
-/// unwind it.
-///
-/// Every built-in and every plugin is made this way, so a custom provider
-/// kind is one call:
-///
-/// ```ignore
-/// providerplugin("mystore", |spec| {
-///     Ok(Rc::new(MyStore { addr: spec.addr.clone() }) as Rc<dyn Provider>)
-/// })
-/// ```
-///
-/// The provider crosses the boundary as `Value::Opaque` - plugin's own
-/// escape hatch for "a client the library never inspects" (§11). The
-/// value model carries JSON, and a `Provider` is not JSON.
 pub fn providerplugin<F>(kind: &str, make: F) -> Definition
 where
     F: Fn(&ProviderSpec) -> Answer<Rc<dyn Provider>> + 'static,
@@ -426,8 +312,6 @@ where
                 inst.export(PROVIDER_EXPORT, Value::Opaque(Rc::new(provider)));
                 Ok(())
             }
-            // The message is the spec's, byte for byte. `cause` is where
-            // `Sekreto::new` reads it back from.
             Err(err) => Err(PluginError::new(
                 ERROR_CODE,
                 &err.message,
@@ -605,10 +489,6 @@ fn gettext(value: &Value, key: &str) -> String {
     value.get(key).as_str().unwrap_or("").to_string()
 }
 
-/// The four built-in provider kinds, as definitions, in a fresh vector:
-/// `env`, `memory`, `dotenv` and `file` - the same four in every port.
-/// `Sekreto::new` puts them in every catalog ahead of the plugins it is
-/// handed.
 pub fn builtins() -> Vec<Definition> {
     vec![
         providerplugin("env", |spec| {
@@ -639,15 +519,8 @@ pub fn builtins() -> Vec<Definition> {
     ]
 }
 
-/// The four kinds built into this crate.
 pub const BUILTIN_KINDS: [&str; 4] = ["env", "memory", "dotenv", "file"];
 
-/// Every kind that ships as a plugin, so that an unknown kind can be told
-/// from a plugin that was not passed in.
-///
-/// The core names the KINDS, which are spec, and links none of the crates
-/// that implement them - the list is eleven strings, and a string reaches
-/// nothing.
 pub const PLUGIN_KINDS: [&str; 11] = [
     "hashicorp",
     "boru",

package/project/.sdk/tm/rust/feature/secrets/sekreto/sekreto.rs

@@ -1,17 +1,6 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (rust/src/sekreto.rs)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (rust/src/sekreto.rs)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-//! sekreto: one interface for secrets, wherever they live.
-//!
-//! A `Sekreto` is an ordered chain of providers. `get` asks each in turn and
-//! returns the first hit, so an app can be configured from environment
-//! variables in development and a vault in production without changing a
-//! line of its own code.
-//!
-//! A port of typescript/src/Sekreto.ts, which is canonical.
-//!
-//! Rust has no exceptions, so where the canonical implementation throws a
-//! `SekretoError` this port returns one in a `Result`.
 
 use std::collections::BTreeMap;
 use std::fmt;
@@ -58,7 +47,6 @@ impl From<String> for SekretoError {
 
 pub type Answer<T> = Result<T, SekretoError>;
 
-/// Is this a well-formed secret name?
 pub fn validname(name: &str) -> bool {
     if name.is_empty() {
         return false;
@@ -82,7 +70,6 @@ pub fn checkname(name: &str) -> Answer<()> {
     Ok(())
 }
 
-/// The environment-variable key for a name: `api.token` -> `API_TOKEN`.
 pub fn envkey(name: &str, prefix: &str) -> Answer<String> {
     checkname(name)?;
 
@@ -96,7 +83,6 @@ pub fn envkey(name: &str, prefix: &str) -> Answer<String> {
     ))
 }
 
-/// Where a name lives in a KV vault.
 #[derive(Clone, Debug, PartialEq)]
 pub struct VaultRef {
     pub path: String,
@@ -126,16 +112,6 @@ pub fn vaultref(name: &str) -> Answer<VaultRef> {
     })
 }
 
-/// A name flattened to one segment: `api.token` -> `api_token` (GCP
-/// Secret Manager, `_`) or `api-token` (Azure Key Vault, `-`).
-///
-/// Those stores have no path hierarchy and reject dots in ids, so the
-/// dots become the store's conventional separator. With `-` as the
-/// separator, underscores flatten too: Azure Key Vault's alphabet is
-/// letters, digits and hyphens only, and a valid sekreto name like
-/// `with_underscore` must still be representable there. (The resulting
-/// `.`/`_` collision mirrors the documented envkey behaviour, where
-/// both already map to `_`.)
 pub fn flatname(name: &str, sep: &str) -> Answer<String> {
     checkname(name)?;
     let flat = name.split('.').collect::<Vec<&str>>().join(sep);
@@ -167,11 +143,6 @@ pub fn awsparam(name: &str, prefix: &str) -> Answer<String> {
     ))
 }
 
-/// Parse `.env` text into a map of raw keys to values.
-///
-/// Deliberately small: `KEY=value`, optional `export`, `#` comments on their
-/// own line, and single- or double-quoted values (double quotes also
-/// unescape `\n`, `\r`, `\t` and `\\`). A line with no `=` is skipped.
 pub fn parsedotenv(text: &str) -> BTreeMap<String, String> {
     let mut out = BTreeMap::new();
 
@@ -236,17 +207,9 @@ fn unescape(text: &str) -> String {
     out
 }
 
-/// Replace known secret values in text with `[redacted]`.
-///
-/// Only values of four characters or more are replaced: shorter ones are too
-/// likely to appear in ordinary text, and redacting them would make logs
-/// unreadable without making them safer.
 pub fn redact(text: &str, values: &[String]) -> String {
     let mut out = text.to_string();
 
-    // Longest first: a shorter secret that prefixes a longer one used to eat
-    // the prefix and leave the rest in the log. Collected into our own Vec,
-    // so the caller's slice is not reordered.
     let mut usable: Vec<&String> = values.iter().filter(|value| 4 <= value.len()).collect();
     usable.sort_by(|left, right| right.len().cmp(&left.len()));
 
@@ -274,14 +237,6 @@ pub fn storename(provider: &dyn Provider) -> String {
         .to_string()
 }
 
-/// What building a chain can refuse with.
-///
-/// Two shapes, and keeping them apart is the whole point. A `SekretoError`
-/// is sekreto's own refusal - an unknown kind, an invalid store name, a
-/// provider that would not accept its configuration - and the spec pins
-/// those messages byte for byte. Anything else a definition raised is the
-/// HOST's report of it, kept exactly as it came: the §12 code is that
-/// error's identity and not sekreto's to rewrite.
 #[derive(Clone, Debug)]
 pub enum ChainError {
     Sekreto(SekretoError),
@@ -289,7 +244,6 @@ pub enum ChainError {
 }
 
 impl ChainError {
-    /// The message, whichever half it came from.
     pub fn message(&self) -> String {
         match self {
             ChainError::Sekreto(err) => err.message.clone(),
@@ -328,35 +282,20 @@ impl From<PluginError> for ChainError {
     }
 }
 
-/// How a `Sekreto` is built.
-///
-/// `plugins` is the load-bearing one: a `Sekreto` can build the four
-/// built-in kinds and EXACTLY the plugin definitions handed in here.
-/// Loading is explicit, never a side effect of importing - a list given to
-/// a constructor cannot be erased by a compiler, and the set of stores an
-/// app can reach is not something to discover at run time.
 #[derive(Default)]
 pub struct Options {
     /// The provider kinds this Sekreto may build, beyond the built-ins.
     /// A plugin naming a built-in kind replaces it.
     pub plugins: Vec<Definition>,
-    /// The chain, in resolution order.
     pub providers: Vec<ProviderSpec>,
-    /// Ask the providers afresh every time.
     pub nocache: bool,
 }
 
-/// One provider in the chain, under the store name it answers to.
 struct Entry {
     store: String,
     provider: Rc<dyn Provider>,
 }
 
-/// The secrets facade: a chain of providers plus a cache.
-///
-/// Two ways to read. `get` is transparent - it walks the chain and takes the
-/// first hit, and the caller never learns which store answered. `getfrom` is
-/// directed - it names the store, and only that store is asked.
 pub struct Sekreto {
     /// The voxgig/plugin host every spec'd provider is an instance of, and
     /// the catalog of definitions it can build: the built-ins plus what
@@ -377,12 +316,7 @@ pub struct Sekreto {
 }
 
 impl Sekreto {
-    /// A Sekreto over this chain.
     pub fn new(options: Options) -> Result<Sekreto, ChainError> {
-        // Built-ins first, then the plugins, into one catalog: a plugin
-        // that names a built-in kind replaces it, which is how a host
-        // substitutes an implementation and never an accident, because the
-        // four names are documented.
         let mut definitions = builtins();
         definitions.extend(options.plugins);
         let catalog = make_catalog(definitions)?;
@@ -419,13 +353,6 @@ impl Sekreto {
         Ok(sek)
     }
 
-    /// One chain entry, as a plugin instance.
-    ///
-    /// The instance is `kind` for a store named after its kind and
-    /// `kind$store` otherwise - `hashicorp$prod` - so `host().list()` reads
-    /// like the chain. A store name that is already taken gets a numbered
-    /// tag from the host instead, because two providers MAY share a store
-    /// name (a directed read walks both) and an instance ref may not.
     fn declare(&mut self, spec: &ProviderSpec) -> Result<Entry, ChainError> {
         let kind = spec.kind.as_str();
 
@@ -492,8 +419,6 @@ impl Sekreto {
         &self.host
     }
 
-    /// The definitions this Sekreto can build: the built-ins plus what
-    /// `Options::plugins` handed in.
     pub fn catalog(&self) -> &Catalog {
         &self.catalog
     }
@@ -512,7 +437,6 @@ impl Sekreto {
         outcome.map_err(ChainError::from)
     }
 
-    /// The secret, or a SekretoError if no provider has it.
     pub fn get(&mut self, name: &str) -> Answer<String> {
         match self.trysecret(name)? {
             Some(found) => Ok(found),
@@ -523,13 +447,10 @@ impl Sekreto {
         }
     }
 
-    /// The secret, or None if no provider has it.
     pub fn trysecret(&mut self, name: &str) -> Answer<Option<String>> {
         self.resolve("", name, None)
     }
 
-    /// The secret from one named store, or a SekretoError if that store does
-    /// not have it.
     pub fn getfrom(&mut self, store: &str, name: &str) -> Answer<String> {
         match self.tryfrom(store, name)? {
             Some(found) => Ok(found),
@@ -540,12 +461,6 @@ impl Sekreto {
         }
     }
 
-    /// The secret from one named store, or None if that store does not have
-    /// it.
-    ///
-    /// Naming a store that is not in the chain is an error, not a miss:
-    /// `trysecret` already means "this store may not have it", so it cannot
-    /// also mean "this store may not exist" without hiding a typo.
     pub fn tryfrom(&mut self, store: &str, name: &str) -> Answer<Option<String>> {
         if !self.entries.iter().any(|entry| entry.store == store) {
             return Err(SekretoError::new(format!(
@@ -557,7 +472,6 @@ impl Sekreto {
         self.resolve(store, name, Some(store))
     }
 
-    /// Walk the chain, optionally restricted to one store.
     fn resolve(
         &mut self,
         cachestore: &str,
@@ -596,17 +510,14 @@ impl Sekreto {
         Ok(None)
     }
 
-    /// Does any provider have this secret?
     pub fn has(&mut self, name: &str) -> Answer<bool> {
         Ok(self.trysecret(name)?.is_some())
     }
 
-    /// Does this named store have this secret?
     pub fn hasin(&mut self, store: &str, name: &str) -> Answer<bool> {
         Ok(self.tryfrom(store, name)?.is_some())
     }
 
-    /// Every named secret at once. Missing ones are an error.
     pub fn all(&mut self, names: &[String]) -> Answer<BTreeMap<String, String>> {
         let mut out = BTreeMap::new();
 
@@ -617,7 +528,6 @@ impl Sekreto {
         Ok(out)
     }
 
-    /// A description of each provider, in resolution order.
     pub fn sources(&self) -> Vec<String> {
         self.entries
             .iter()
@@ -625,8 +535,6 @@ impl Sekreto {
             .collect()
     }
 
-    /// The name of each store that can be named by `getfrom`, in resolution
-    /// order and without repeats.
     pub fn stores(&self) -> Vec<String> {
         let mut out: Vec<String> = Vec::new();
 
@@ -647,18 +555,11 @@ impl Sekreto {
         redact(text, &self.seen)
     }
 
-    /// Drop cached values, so the next `get` asks the providers again.
     pub fn refresh(&mut self) {
         self.cache.clear();
     }
 }
 
-/// The message for a kind the catalog does not hold.
-///
-/// A kind sekreto has never heard of is a typo; a kind that exists as a
-/// plugin but was not passed in is the split working as designed, and
-/// telling you what to pass. Collapsing the two was the first thing that
-/// made the split confusing to use.
 fn unknownkind(kind: &str, catalog: &Catalog) -> String {
     let message = format!(
         "sekreto: unknown provider kind: {} (available: {})",

package/project/.sdk/tm/rust/tests/vendor/omni/json.rs

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260917-1242-0 (rust/src/json.rs)
-// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/omni sdk-20260925-1316-0 (rust/src/json.rs)
+// Source: https://github.com/voxgig/omni @ b909ff51fc644e4955c850e30cc65e74be076df2  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The omni JSON value model, with a small in-tree parser.
 //!
@@ -165,12 +165,6 @@ impl From<String> for Json {
     }
 }
 
-/// Maximum nesting depth the parser will follow. Omni specs are trusted
-/// input, so this is crash-safety, not a security boundary: past this
-/// depth the recursive parser would overflow the stack and abort the
-/// process, so it returns an error instead. 1024 is far beyond any real
-/// spec, and low enough that reaching the limit itself fits comfortably
-/// in a default (2MiB) test-thread stack even in debug builds.
 const MAX_DEPTH: usize = 1024;
 
 /// Parse JSON text into a [`Json`] value.

package/project/.sdk/tm/rust/tests/vendor/omni/mod.rs

@@ -1,23 +1,7 @@
-// VENDORED: @voxgig/omni sdk-20260917-1242-0 (rust/src/lib.rs)
-// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/omni sdk-20260925-1316-0 (rust/src/lib.rs)
+// Source: https://github.com/voxgig/omni @ b909ff51fc644e4955c850e30cc65e74be076df2  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-//! voxgig_omni - the shared multi-language test runner.
-//!
-//! A test spec is plain JSON. The same spec file drives the same tests in
-//! every language that ships an omni port, so behaviour is defined once and
-//! verified everywhere.
-//!
-//! ```no_run
-//! use std::rc::Rc;
-//! use voxgig_omni::{make_runner, Json, Provider, Subject};
-//!
-//! let runner = make_runner("../spec/fib.json", Provider::default()).unwrap();
-//! let pack = runner.runner("fib", None).unwrap();
-//! let double: Subject = Rc::new(|args: &[Json]| {
-//!     Ok(Json::Num(args[0].asnum().unwrap_or(0.0) * 2.0))
-//! });
-//! pack.runset(&pack.set("basic"), Some(&double)).unwrap();
-//! ```
+#![doc = include_str!("../COMMENT-NOTES.md")]
 
 pub mod json;
 pub mod regex;

package/project/.sdk/tm/rust/tests/vendor/omni/regex.rs

@@ -1,16 +1,6 @@
-// VENDORED: @voxgig/omni sdk-20260917-1242-0 (rust/src/regex.rs)
-// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/omni sdk-20260925-1316-0 (rust/src/regex.rs)
+// Source: https://github.com/voxgig/omni @ b909ff51fc644e4955c850e30cc65e74be076df2  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-//! A small backtracking regex engine.
-//!
-//! Omni specs match error messages with `/pattern/` expectations, so every
-//! port needs a regex. Rust has no regex in its standard library, and omni
-//! adds no third-party dependencies, so it carries this one.
-//!
-//! Supported: literals, `.`, `^`, `$`, `|`, groups `(...)`, classes
-//! `[a-z0-9_]` and `[^...]`, quantifiers `* + ? {m} {m,} {m,n}` (greedy,
-//! and lazy with a trailing `?`), and the escapes `\d \D \w \W \s \S \n
-//! \r \t` plus any escaped punctuation.
 
 #[derive(Clone, Debug)]
 enum Node {