@voxgig/sdkgen 4.8.1 → 4.8.3

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/dotenv.ts

@@ -1,10 +1,11 @@
-// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/dotenv.ts)
-// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/provider/dotenv.ts)
+// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 
-import { ProviderSpec, Provider, SekretoError, envkey, nodemod, parsedotenv } from './support'
+import { Provider, SekretoError, envkey, nodemod, parsedotenv } from './support'
 
+/** A `.env` file, read once, keyed exactly like the environment. */
 export function dotenvprovider(file: string, prefix?: string): Provider {
   let values: Record<string, string> | undefined
 
@@ -35,17 +36,3 @@ export function dotenvprovider(file: string, prefix?: string): Provider {
     describe: () => 'dotenv:' + file,
   }
 }
-
-/** Literal values, keyed like environment variables. The spec uses this
- * to test chain behaviour without touching the outside world. */
-
-
-// Registering at import is what makes this module's presence the only
-// thing that decides whether the kind exists in a build.
-import { register } from './Registry'
-
-register({
-  name: 'dotenv',
-  needs: ['fs'],
-  define: (spec: ProviderSpec) => dotenvprovider(spec.file || '.env', spec.prefix),
-})

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/env.ts

@@ -1,10 +1,11 @@
-// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/env.ts)
-// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/provider/env.ts)
+// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 
-import { ProviderSpec, Provider, envkey } from './support'
+import { Provider, envkey } from './support'
 
+/** Environment variables: `api.token` from `API_TOKEN`. */
 export function envprovider(prefix?: string, source?: Record<string, any>): Provider {
   const env = source || process.env
 
@@ -16,16 +17,3 @@ export function envprovider(prefix?: string, source?: Record<string, any>): Prov
     describe: () => 'env' + (prefix ? ':' + prefix : ''),
   }
 }
-
-/** A `.env` file, read once, keyed exactly like the environment. */
-
-
-// Registering at import is what makes this module's presence the only
-// thing that decides whether the kind exists in a build.
-import { register } from './Registry'
-
-register({
-  name: 'env',
-  needs: [],
-  define: (spec: ProviderSpec) => envprovider(spec.prefix),
-})

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/file.ts

@@ -1,12 +1,18 @@
-// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/file.ts)
-// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/provider/file.ts)
+// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 
-import {
-  ProviderSpec, Provider, SekretoError, envkey, flatname, nodemod,
-} from './support'
+import { Provider, SekretoError, envkey, nodemod } from './support'
 
+/** A directory of one-secret-per-file entries, keyed like the
+ * environment: `api.token` reads `<dir>/API_TOKEN`.
+ *
+ * This is the shape of a mounted Kubernetes Secret, a Docker or Swarm
+ * secret, and a systemd credentials directory, so those all work with no
+ * further configuration. One trailing newline is stripped - tools that
+ * write these files disagree about it, and a newline is never part of a
+ * secret on purpose. */
 export function fileprovider(dir: string, prefix?: string): Provider {
   return {
     lookup: (name: string) => {
@@ -32,23 +38,3 @@ export function fileprovider(dir: string, prefix?: string): Provider {
     describe: () => 'file:' + dir,
   }
 }
-
-/** Refuse to send a secret-bearing credential in the clear.
- *
- * A vault API is HTTPS in any real deployment; plaintext is a dev-mode
- * convenience. Sending a token over http to anything but the local
- * machine puts both the token and the secret it fetches on the wire for
- * anyone on the path, so sekreto will not do it. Loopback stays allowed:
- * that is `vault server -dev`, `boru vault serve`, and this repo's own
- * test harness. */
-
-
-// Registering at import is what makes this module's presence the only
-// thing that decides whether the kind exists in a build.
-import { register } from './Registry'
-
-register({
-  name: 'file',
-  needs: ['fs'],
-  define: (spec: ProviderSpec) => fileprovider(spec.dir || '', spec.prefix),
-})

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/memory.ts

@@ -1,33 +1,16 @@
-// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/memory.ts)
-// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/provider/memory.ts)
+// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 
-import { ProviderSpec, Provider, envkey } from './support'
+import { Provider, envkey } from './support'
 
+/** Literal values, keyed like environment variables. The spec uses this
+ * to test chain behaviour without touching the outside world, and an app
+ * uses it for defaults. */
 export function memoryprovider(values: Record<string, string>, prefix?: string): Provider {
   return {
     lookup: (name: string) => values[envkey(name, prefix)],
     describe: () => 'memory' + (prefix ? ':' + prefix : ''),
   }
 }
-
-/** A directory of one-secret-per-file entries, keyed like the
- * environment: `api.token` reads `<dir>/API_TOKEN`.
- *
- * This is the shape of a mounted Kubernetes Secret, a Docker or Swarm
- * secret, and a systemd credentials directory, so those all work with no
- * further configuration. One trailing newline is stripped - tools that
- * write these files disagree about it, and a newline is never part of a
- * secret on purpose. */
-
-
-// Registering at import is what makes this module's presence the only
-// thing that decides whether the kind exists in a build.
-import { register } from './Registry'
-
-register({
-  name: 'memory',
-  needs: [],
-  define: (spec: ProviderSpec) => memoryprovider(spec.values || {}, spec.prefix),
-})

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/support.ts

@@ -1,7 +1,8 @@
-// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/support.ts)
-// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/provider/support.ts)
+// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-// The providers a Sekreto chains together.
+// What a provider is, what its declarative form looks like, and how a
+// provider kind becomes a voxgig/plugin definition.
 //
 // A provider answers one question: "do you have this secret?" It returns
 // the value, or undefined to mean "ask the next one". Nothing else about
@@ -15,6 +16,9 @@
 // missing configuration - is an ERROR: falling through there would
 // quietly reach for a weaker store.
 
+import { PluginError } from '../../plugin'
+import type { Definition } from '../../plugin'
+
 import {
   SekretoError,
   awsparam,
@@ -27,26 +31,19 @@ import {
 
 // NODE BUILTINS, LOADED ON FIRST USE.
 //
-// These were top-level imports, which made them a side effect of importing
-// sekreto AT ALL: `child_process`, `fs` and `path` entered the module graph
-// for a caller who only ever used a `memory` or `env` provider, and any
-// runtime lacking them failed at import time rather than at the point of
-// use. Sekreto.ts imports makeprovider from this module, so the chain
-// reached everything.
+// `fs` and `path` are what the two built-in file-reading providers need,
+// and they are loaded when a lookup runs rather than when sekreto is
+// imported: a caller who only ever configures `memory` or `env` never
+// evaluates them, and a runtime that lacks them fails at the point of
+// use rather than at import. The platform-dependent providers proper -
+// everything that opens a socket or spawns a process - are not in the
+// core at all; they are plugins (docs/design/plugin-providers.md).
 //
-// A plain require(), not `await import()`: dotenvprovider, fileprovider and
-// boruprovider all have SYNCHRONOUS lookups, and making them async to
-// accommodate a dynamic import would change observable behaviour for anyone
-// calling a provider directly. The package is CommonJS ("type":
+// A plain require(), not `await import()`: dotenvprovider and
+// fileprovider have SYNCHRONOUS lookups, and making them async to
+// accommodate a dynamic import would change observable behaviour for
+// anyone calling a provider directly. The package is CommonJS ("type":
 // "commonjs"), so require is available and synchronous.
-//
-// What this buys and what it does not: the builtins are no longer evaluated
-// at import time, so importing sekreto is safe in a runtime that lacks them
-// and a bundler can drop an unreachable provider along with its edge. It is
-// NOT by itself a complete browser story — a bundler still resolves a
-// require it can see statically, so a browser build wants conditional
-// exports ("browser" field) as well. That is a packaging change, tracked
-// separately.
 const nodemods: Record<string, any> = {}
 
 function nodemod<T = any>(name: string): T {
@@ -77,26 +74,14 @@ export type Provider = {
 }
 
 /** The declarative form of a provider, as used in config and in the
- * shared spec. */
+ * shared spec. `kind` names a built-in or a plugin; the rest is that
+ * kind's own configuration, and a plugin reads it as `inst.options`. */
 export type ProviderSpec = {
-  kind:
-    | 'env'
-    | 'dotenv'
-    | 'memory'
-    | 'file'
-    | 'hashicorp'
-    | 'boru'
-    | 'awssecrets'
-    | 'awsparams'
-    | 'gcpsecrets'
-    | 'azuresecrets'
-    | 'onepassword'
-    | 'doppler'
-    | 'infisical'
+  kind: string
   /** The store name `Sekreto.getfrom` addresses. Defaults to `kind`. */
   name?: string
   prefix?: string
-  /** dotenv: the file to read. */
+  /** dotenv: the file to read. secretspec: the declaration file. */
   file?: string
   /** memory: literal values, keyed like environment variables. */
   values?: Record<string, string>
@@ -130,8 +115,18 @@ export type ProviderSpec = {
     roleid?: string
     secretid?: string
   }
-  /** boru: the executable to run (default `boru`). */
+  /** boru / secretspec: the executable to run (default: the kind's own
+   * name). */
   command?: string
+  /** secretspec: the profile to read (`--profile`). */
+  profile?: string
+  /** secretspec: which of ITS backends to read from (`--provider`), e.g.
+   * `keyring` or `dotenv://.env`. Named `backend` here because
+   * `provider` already means a sekreto provider. */
+  backend?: string
+  /** secretspec: the audit reason recorded for the read (`--reason`).
+   * SecretSpec refuses to read without one. */
+  reason?: string
   /** boru: the namespace qualifying the alias. */
   namespace?: string
   /** boru: the vault home, passed as BORU_HOME. */
@@ -168,9 +163,81 @@ export type ProviderSpec = {
   path?: string
 }
 
-/** Environment variables: `api.token` from `API_TOKEN`. */
+// --- providers as voxgig/plugin definitions --------------------------
+
+/** The export key under which a provider definition publishes the
+ * provider it built. `Sekreto` reads `<ref>/provider` off the host. */
+export const PROVIDER_EXPORT = 'provider'
+
+/** The voxgig/plugin error code a SekretoError travels under when it is
+ * raised inside a definition's `define`.
+ *
+ * plugin wraps a code-less error raised by a callback as
+ * `plugin_define_failed`, and keeps an error that already carries a
+ * code. A provider that refuses its own configuration - `kv: 3`, a
+ * missing project - raises a SekretoError, and that message is pinned
+ * by the spec byte for byte, so it must come back out of the host
+ * exactly as it went in. `providerplugin` gives it this code on the way
+ * in; `Sekreto` turns it back into a SekretoError on the way out. */
+export const ERROR_CODE = 'sekreto_error'
+
+/** A provider kind, as a voxgig/plugin definition.
+ *
+ * This is the whole bridge between the two libraries. The definition's
+ * `name` is the `kind` a ProviderSpec names; its `define` reads the spec
+ * as `inst.options`, builds the provider with `make`, and exports it.
+ * Nothing runs at `activate`: a provider opens nothing until its first
+ * lookup, so there is nothing to capture - a provider that does hold a
+ * resource acquires it there and lets the instance scope unwind it.
+ *
+ * Every built-in and every plugin is made this way, so a custom
+ * provider kind is one call:
+ *
+ *     providerplugin('mystore', (spec) => mystoreprovider(spec.addr))
+ */
+export function providerplugin(
+  kind: string,
+  make: (spec: ProviderSpec) => Provider,
+): Definition {
+  return {
+    name: kind,
+    define: (inst: any) => {
+      let provider: Provider
+      try {
+        provider = make(inst.options as ProviderSpec)
+      } catch (err: any) {
+        if (err instanceof SekretoError) {
+          throw new PluginError(ERROR_CODE, err.message, { ref: inst.ref, cause: err.message })
+        }
+        throw err
+      }
+      inst.export(PROVIDER_EXPORT, provider)
+    },
+  }
+}
 
 export {
   SekretoError, awsparam, checkname, envkey, flatname, parsedotenv, vaultref,
 }
 export { nodemod }
+export type { Definition }
+
+/** Decode standard base64, or undefined when the text is not base64.
+ *
+ * `Buffer.from(text, 'base64')` is lenient: it skips anything outside the
+ * alphabet and hands back whatever it managed, so a corrupted payload
+ * became a plausible-looking string of bytes that the caller then returned
+ * AS THE SECRET. The alphabet is checked first so that a store which
+ * answered incoherently can be told apart from one that answered.
+ *
+ * A store that could not answer coherently is an ERROR, never a miss — the
+ * same rule this code already applies to a 200 whose body is not JSON. */
+export function unbase64(text: string): string | undefined {
+  const trimmed = text.replace(/\s+/g, '')
+
+  if (!/^[A-Za-z0-9+/]*={0,2}$/.test(trimmed) || 0 !== trimmed.length % 4) {
+    return undefined
+  }
+
+  return Buffer.from(trimmed, 'base64').toString('utf8')
+}

package/project/.sdk/tm/ts/src/utility/StructUtility.ts

@@ -1,9 +1,9 @@
-// VENDORED: @voxgig/struct 0.3.2 (typescript/src/StructUtility.ts)
-// Source: https://github.com/voxgig/struct @ 94409354d0a60fda8098c83e290583b7dee76c84
+// VENDORED: @voxgig/struct 0.3.4 (typescript/src/StructUtility.ts)
+// Source: https://github.com/voxgig/struct @ 2caf7f448f265144c18dd6fab6ba270a7f3bca07  [tag: sdk-20260904-1610-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025-2026 Voxgig Ltd. MIT LICENSE. */
 
-// VERSION: @voxgig/struct 0.3.2
+// VERSION: @voxgig/struct 0.3.4
 
 /* Voxgig Struct
  * =============

package/project/.sdk/tm/ts/test/omni.ts

@@ -1,24 +1,27 @@
-// The corpus test runner: vendored @voxgig/omni behind the struct-runner
-// API the corpus tests already use (`import { makeRunner } from '../omni'`
-// instead of the old hand-vendored '../runner').
+// The corpus test runner: vendored @voxgig/omni driven through its NATIVE
+// API (`makeRunner(specref, provider)`), presented to the corpus tests in
+// the struct-runner shape they already use (`R.spec`, `R.runset`,
+// `R.runsetflags`, `R.client`). No compat shim is vendored: the adapter
+// below IS the whole bridge, per language, per the vendor-tag rollout
+// (docs/design/vendor-tag-rollout.md, Decision 4).
 //
-// Two local decisions, both required (see vendor/omni/compat.ts):
+// Two local decisions, both required:
 //
-// 1. SPEC PATH. The compat shim's caller-directory heuristic resolves a
-//    relative test-file path one level too deep for this layout (loader in
-//    dist-test/, test files in dist-test/utility/) - its own header says a
-//    port must resolve the path itself. This module compiles to
-//    dist-test/omni.js, the same depth as the old dist-test/runner.js, so
-//    the existing TEST_JSON_FILE constant keeps working verbatim.
+// 1. SPEC PATH. omni's own spec resolution expects the caller to hand it a
+//    usable path — its docs say a port must resolve the path itself. This
+//    module compiles to dist-test/omni.js, the same depth as the old
+//    dist-test/runner.js, so the existing TEST_JSON_FILE constant keeps
+//    working verbatim: a relative path is absolutized against __dirname.
 //
 // 2. PROVIDER DELEGATION. Corpus-driven contexts get `ctx.client` set to
-//    the runner's provider. The stock structprovider forwards utility()
-//    and tester() but not options()/_features/_rootctx/_mode, which the
-//    corpus subjects and pipeline utilities (prepareHeaders via
-//    client.options(), test helpers via client._rootctx) do reach. The
-//    provider below is built by PROTOTYPE DELEGATION over the live SDK
-//    instance, so every SDK member resolves while the four omni hooks sit
-//    on top. Upstream omni's compat shim could adopt the same shape.
+//    the runner's provider (omni overwrites it on any ctx/args map entry).
+//    A five-hook provider object HIDES the live SDK from the generated
+//    utilities that reach through it — prepareHeaders via client.options(),
+//    fetcher via client._mode, the feature helpers via client._rootctx and
+//    even ASSIGNING client._features. So the provider here is built by
+//    PROTOTYPE DELEGATION over the live SDK instance: every SDK member
+//    resolves, while the omni hooks sit on top. (Upstream omni#56 tracks
+//    giving the stock provider the same shape.)
 
 import { isAbsolute, join } from 'node:path'
 
@@ -26,27 +29,92 @@ import {
   EXISTSMARK,
   NULLMARK,
   UNDEFMARK,
-  nullModifier,
-  structprovider,
-} from './vendor/omni/compat'
-
-import type { StructProvider, StructRunner } from './vendor/omni/compat'
+  OmniError,
+  nullmodifier,
+  makeRunner as omnimakerunner,
+} from './vendor/omni/index'
+
+import type { Json, Provider, Subject } from './vendor/omni/index'
+
+
+// The runner API the corpus tests consume — struct's runner shape, name
+// for name, served over native omni.
+export type StructSubject = (...args: any[]) => any
+export type StructRunSet = (testspec: any, testsubject?: StructSubject) => Promise<void>
+export type StructRunSetFlags = (
+  testspec: any,
+  flags: Record<string, any>,
+  testsubject?: StructSubject,
+) => Promise<void>
+
+export type StructRunPack = {
+  spec: any
+  runset: StructRunSet
+  runsetflags: StructRunSetFlags
+  subject?: StructSubject
+  client: StructProvider
+}
 
-import { OmniError, makeRunner as omnimakerunner } from './vendor/omni/index'
+export type StructRunner = (name: string, store?: any) => Promise<StructRunPack>
 
-import type { Json } from './vendor/omni/index'
+// An omni provider that is also the live SDK: test code reaches through the
+// runpack's `client` as an SDK (`client.utility().struct`), so alongside the
+// omni hooks every SDK member must resolve.
+export type StructProvider = Provider & {
+  utility: () => any
+  tester: (options?: any) => any
+  sdk: any
+}
 
 
-// Wrap the SDK as an omni provider WITHOUT hiding it: hooks from the stock
-// structprovider, everything else through the prototype chain.
-function sdkprovider(sdk: any): StructProvider {
-  const hooks = structprovider(sdk)
-  const provider = Object.assign(Object.create(sdk), hooks)
+// The omni hooks for an SDK subject — what the retired compat shim called
+// `structprovider`, inlined here because this resolver is the one consumer.
+function sdkhooks(sdk: any) {
+  return {
+    // A subject is resolved from the utility, or from utility.struct.
+    subject: (name: string): Subject | undefined => {
+      const utility = sdk.utility()
+      return utility[name] || (utility.struct && utility.struct[name])
+    },
+
+    // A DEF.client entry becomes another SDK instance — rewrapped with the
+    // same delegating shape, not a plain hook object.
+    client: async (options: Json) => sdkprovider(await sdk.tester(options)),
+
+    // The SDK supplies its own context wrapper.
+    contextify: (val: Json): Json => {
+      const utility = sdk.utility()
+      const hook =
+        'function' === typeof utility.contextify ? utility.contextify
+          : 'function' === typeof utility.makeContext ? utility.makeContext
+            : null
+      const ctx = null == hook ? val : hook.call(utility, val)
+      if (null != ctx && 'object' === typeof ctx) {
+        ; (ctx as any).utility = utility
+      }
+      return ctx
+    },
+
+    // Client options may reference the runner store.
+    inject: (options: Json, store: Json): Json => {
+      const structutils = sdk.utility().struct
+      if (structutils && 'function' === typeof structutils.inject) {
+        return structutils.inject(options, store)
+      }
+      return options
+    },
+
+    utility: () => sdk.utility(),
+    tester: (options?: any) => sdk.tester(options),
+    sdk,
+  }
+}
 
-  // DEF.client entries become SDK instances too - rewrap with the same
-  // delegating shape, not the stock one.
-  provider.client = async (options: Json) => sdkprovider(await sdk.tester(options))
 
+// Wrap the SDK as an omni provider WITHOUT hiding it: hooks from sdkhooks,
+// everything else through the prototype chain.
+function sdkprovider(sdk: any): StructProvider {
+  const provider = Object.assign(Object.create(sdk), sdkhooks(sdk))
   return provider
 }
 
@@ -76,6 +144,10 @@ async function makeRunner(testfile: string | Json, client: any): Promise<StructR
 }
 
 
+// struct's flag-modifier name, served from native omni.
+const nullModifier = nullmodifier
+
+
 export {
   EXISTSMARK,
   NULLMARK,

package/project/.sdk/tm/ts/test/utility/StructUtility.test.ts

@@ -315,6 +315,33 @@ describe('struct', async () => {
   })
 
 
+  // The struct.nullsem section: does a PRESENT key holding a JSON null
+  // read as "no value"? Opt-in per target (create-sdkgen ships it; an
+  // older project corpus may predate it - the skip below says so OUT
+  // LOUD rather than passing vacuously). All lanes run {null: false}:
+  // without the flag the runner rewrites every null to '__NULL__' and
+  // the section asserts nothing about null at all.
+  test('nullsem', async (t) => {
+    const nullsem = spec.nullsem
+    if (null == nullsem) {
+      t.skip('corpus predates struct.nullsem - refresh .sdk/test/struct from create-sdkgen')
+      return
+    }
+    const { getprop, getelem, getpath, haskey, keysof } = struct
+
+    await runsetflags(nullsem.getprop, { null: false }, (vin: any) =>
+      undefined === vin.alt ? getprop(vin.val, vin.key) : getprop(vin.val, vin.key, vin.alt))
+    await runsetflags(nullsem.getelem, { null: false }, (vin: any) =>
+      undefined === vin.alt ? getelem(vin.val, vin.key) : getelem(vin.val, vin.key, vin.alt))
+    await runsetflags(nullsem.getpath, { null: false }, (vin: any) =>
+      undefined === vin.alt ? getpath(vin.store, vin.path) : getpath(vin.store, vin.path, vin.alt))
+    await runsetflags(nullsem.haskey, { null: false }, (vin: any) =>
+      haskey(vin.src, vin.key))
+    await runsetflags(nullsem.keysof, { null: false }, (vin: any) =>
+      keysof(vin))
+  })
+
+
   test('minor-haskey', async () => {
     await runsetflags(spec.minor.haskey, { null: false }, (vin: any) =>
       struct.haskey(vin.src, vin.key))

package/project/.sdk/tm/ts/test/vendor/omni/Runner.ts

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni 0.1.2 (typescript/src/Runner.ts)
-// Source: https://github.com/voxgig/omni @ 5956cc4e5ecdaeebd11eab8bb4b9462dfc76e018
+// VENDORED: @voxgig/omni 0.1.4 (typescript/src/Runner.ts)
+// Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni: the shared multi-language test runner.
 //
@@ -50,6 +50,8 @@ export type Provider = {
   contextify?: (val: Json) => Json
   // Resolve references in client options against the runner store.
   inject?: (options: Json, store: Json) => Json
+  // Build the `match.err` base from the raised error. See `errify`.
+  errify?: (err: any) => Json
 }
 
 export type RunSet = (testspec: Json, testsubject?: Subject) => Promise<void>
@@ -359,6 +361,18 @@ function fixjsonval(val: Json, donull: boolean): Json {
 // collapsing that to String(err) yields '[object Object]', which fails both
 // the `err` check and every `match.err.*` leaf. The struct repository's
 // original runner read `.message` regardless of the thrown value's class.
+// THE SPREAD IS THE CONTRACT, not an accident of JavaScript. An error's
+// OWN enumerable properties survive into the base, so a library whose
+// errors carry a `code` (or a `status`, or a `path`) can assert on it
+// with `match: {err: {code: 'x'}}` rather than pattern-matching prose.
+//
+// Only JavaScript gets that for free. A port whose subject reports
+// failure as a message string - rust, cpp, zig, ocaml, haskell - has
+// nothing to spread, and a port that builds `{name, message}` by hand
+// drops the fields even when it has them. `Provider.errify` is how those
+// ports reach the same place: it overrides this function entirely, so a
+// library supplies its own structured base and omni needs to know
+// nothing about the shape of it.
 function errify(err: any): Json {
   if (err instanceof Error) {
     return { ...err, name: err.name, message: err.message }
@@ -371,6 +385,13 @@ function errify(err: any): Json {
   return { name: 'Error', message: String(err) }
 }
 
+// The error base a `match.err` sees: the provider's own, when it has one.
+function errbase(err: any, provider?: Provider): Json {
+  return null != provider && null != provider.errify
+    ? provider.errify(err)
+    : errify(err)
+}
+
 function errmessage(err: any): string {
   return err instanceof Error ? err.message
     : null != err && 'string' === typeof err.message ? err.message
@@ -457,7 +478,13 @@ function checkresult(flags: Flags, index: number, entry: Json, args: Json[], res
   }
 }
 
-function handleerror(flags: Flags, index: number, entry: Json, err: any) {
+function handleerror(
+  flags: Flags,
+  index: number,
+  entry: Json,
+  err: any,
+  provider?: Provider,
+) {
   entry.thrown = err
 
   const entryerr = entry.err
@@ -469,7 +496,7 @@ function handleerror(flags: Flags, index: number, entry: Json, err: any) {
           in: entry.in,
           out: entry.res,
           ctx: entry.ctx,
-          err: errify(err),
+          err: errbase(err, provider),
         })
       }
       return
@@ -661,7 +688,7 @@ async function makeRunner(specref: string | Json, provider?: Provider): Promise<
           if (err instanceof OmniError) {
             throw err
           }
-          handleerror(useflags, index, entry, err)
+          handleerror(useflags, index, entry, err, useprovider)
         }
       }
     }

package/project/.sdk/tm/ts/test/vendor/omni/Util.ts

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni 0.1.2 (typescript/src/Util.ts)
-// Source: https://github.com/voxgig/omni @ 5956cc4e5ecdaeebd11eab8bb4b9462dfc76e018
+// VENDORED: @voxgig/omni 0.1.4 (typescript/src/Util.ts)
+// Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni internal JSON utilities.
 //