@voxgig/sdkgen 4.8.3 → 4.9.0

package/project/.sdk/tm/go/feature/secrets/plugins/hashicorp/hashicorp.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/plugins/hashicorp/hashicorp.go)
-// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/sekreto sdk-20260907-0029-0 (go/plugins/hashicorp/hashicorp.go)
+// Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The hashicorp plugin: HashiCorp Vault, and OpenBao. Needs HTTPS, and
 // the filesystem for a kubernetes service-account JWT. A port of
@@ -7,7 +7,6 @@
 package hashicorp
 
 import (
-	"encoding/json"
 	"net/http"
 	"os"
 	"strconv"
@@ -91,12 +90,12 @@ func (provider *Provider) login() (string, error) {
 			}
 			jwt = strings.TrimSpace(string(raw))
 		}
-		payload, _ = json.Marshal(struct {
+		payload, _ = sekreto.WriteJSON(struct {
 			Role string `json:"role"`
 			Jwt  string `json:"jwt"`
 		}{Role: auth.Role, Jwt: jwt})
 	case "approle":
-		payload, _ = json.Marshal(struct {
+		payload, _ = sekreto.WriteJSON(struct {
 			RoleID   string `json:"role_id"`
 			SecretID string `json:"secret_id"`
 		}{RoleID: auth.RoleID, SecretID: auth.SecretID})

package/project/.sdk/tm/go/feature/secrets/plugins/httpjson/httpjson.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/plugins/httpjson/httpjson.go)
-// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/sekreto sdk-20260907-0029-0 (go/plugins/httpjson/httpjson.go)
+// Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The HTTP half of every plugin that speaks to a store over the wire, in
 // one place and OUTSIDE the core: a chain of built-ins never links this
@@ -207,7 +207,7 @@ func ToString(value any) string {
 	case float64:
 		return strconv.FormatFloat(typed, 'f', -1, 64)
 	default:
-		text, err := json.Marshal(typed)
+		text, err := sekreto.WriteJSON(typed)
 		if nil != err {
 			return ""
 		}

package/project/.sdk/tm/go/feature/secrets/plugins/infisical/infisical.go

@@ -1,12 +1,11 @@
-// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/plugins/infisical/infisical.go)
-// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/sekreto sdk-20260907-0029-0 (go/plugins/infisical/infisical.go)
+// Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The infisical plugin: Infisical. Needs HTTPS. A port of
 // typescript/plugins/infisical.ts.
 package infisical
 
 import (
-	"encoding/json"
 	"net/http"
 	"strconv"
 	"strings"
@@ -48,7 +47,7 @@ func (provider *Provider) login(addr string) (string, error) {
 		return "", sekreto.Fail("sekreto: infisical: no token and no client credentials")
 	}
 
-	payload, _ := json.Marshal(struct {
+	payload, _ := sekreto.WriteJSON(struct {
 		ClientID     string `json:"clientId"`
 		ClientSecret string `json:"clientSecret"`
 	}{ClientID: provider.ClientID, ClientSecret: provider.ClientSecret})

package/project/.sdk/tm/go/feature/secrets/plugins/onepassword/onepassword.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/plugins/onepassword/onepassword.go)
-// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/sekreto sdk-20260907-0029-0 (go/plugins/onepassword/onepassword.go)
+// Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The onepassword plugin: 1Password, through a Connect server. Needs
 // HTTPS. A port of typescript/plugins/onepassword.ts.

package/project/.sdk/tm/go/feature/secrets/plugins/secretspec/secretspec.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/plugins/secretspec/secretspec.go)
-// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/sekreto sdk-20260907-0029-0 (go/plugins/secretspec/secretspec.go)
+// Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The secretspec plugin: SecretSpec, through its CLI. Needs a child
 // process. A port of typescript/plugins/secretspec.ts.

package/project/.sdk/tm/go/feature/secrets/sekreto/addr.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/sekreto/addr.go)
-// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/sekreto sdk-20260907-0029-0 (go/sekreto/addr.go)
+// Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The plaintext-address guard, in the core because it is pure - a
 // handful of string steps, no socket - and because it is on the spec:

package/project/.sdk/tm/go/feature/secrets/sekreto/providers.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/sekreto/providers.go)
-// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/sekreto sdk-20260907-0029-0 (go/sekreto/providers.go)
+// Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // What a provider is, what its declarative form looks like, how a provider
 // kind becomes a voxgig/plugin definition - and the four BUILT-IN kinds.
@@ -368,6 +368,9 @@ func ProviderPlugin(kind string, make func(spec *ProviderSpec) (Provider, error)
 // the JSON shape OptionsOf produced, and the shape a config document
 // would.
 func SpecOf(options map[string]any) (*ProviderSpec, error) {
+	// json.Marshal, not WriteJSON: these bytes are unmarshalled on the next
+	// line and never leave the process, so HTML escaping cannot be observed
+	// - Unmarshal reads \u003c back as <. WriteJSON is for what is emitted.
 	text, err := json.Marshal(options)
 	if nil != err {
 		return nil, Fail("sekreto: unreadable provider options: " + err.Error())

package/project/.sdk/tm/go/feature/secrets/sekreto/sekreto.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/sekreto/sekreto.go)
-// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/sekreto sdk-20260907-0029-0 (go/sekreto/sekreto.go)
+// Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // sekreto: one interface for secrets, wherever they live.
 //
@@ -15,6 +15,8 @@
 package sekreto
 
 import (
+	"bytes"
+	"encoding/json"
 	"regexp"
 	"sort"
 	"strings"
@@ -39,6 +41,33 @@ func Fail(message string) error {
 	return &SekretoError{Message: message}
 }
 
+// WriteJSON is json.Marshal with Go's HTML escaping turned OFF.
+//
+// encoding/json escapes <, > and & as \u003c, \u003e and \u0026 unless
+// told otherwise. That is a defence for JSON pasted into an HTML page,
+// which this library never does, and it made go the only port whose bytes
+// differed: every other port emits those three characters raw. The
+// writer's output is part of what the ports agree on - the CLI line is
+// compared byte for byte across all of them - so go matches the rest
+// rather than the rest matching go.
+//
+// Encode appends a newline, which a JSON document does not carry, so it
+// is trimmed. Use this for every value that LEAVES the process: a request
+// body, a returned secret, the CLI's line. A marshal whose bytes are
+// unmarshalled again without ever being emitted needs no such care.
+func WriteJSON(value any) ([]byte, error) {
+	var buf bytes.Buffer
+
+	enc := json.NewEncoder(&buf)
+	enc.SetEscapeHTML(false)
+
+	if err := enc.Encode(value); nil != err {
+		return nil, err
+	}
+
+	return bytes.TrimRight(buf.Bytes(), "\n"), nil
+}
+
 var namepart = regexp.MustCompile(`^[a-z0-9_]+$`)
 
 // ValidName reports whether this is a well-formed secret name.

package/project/.sdk/tm/go/test/omni/omni.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260904-1610-0 (go/omni.go)
-// Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/omni sdk-20260907-0029-0 (go/omni.go)
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni: the shared multi-language test runner.
 //
@@ -638,7 +638,12 @@ func handleerror(flags Flags, index int, entry map[string]any, err error, provid
 // Match checks that every leaf of `check` is present, and matches, in
 // `base`.
 func Match(flags Flags, index int, entry map[string]any, check any, base any) error {
-	cbase := Clone(base)
+	// Read the base DIRECTLY. The clone bought nothing - the walk below
+	// only reads, via GetPath - and it blows the stack on a cyclic base. A
+	// port driving entries with live objects rather than pure JSON produces
+	// those routinely (voxgig/sdkgen's corpus matches a live client context
+	// whose root context reaches the client again).
+	cbase := base
 	var failure error
 
 	Walk(Clone(check), func(_key any, val any, _parent any, path []any) any {

package/project/.sdk/tm/go/test/omni/util.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260904-1610-0 (go/util.go)
-// Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/omni sdk-20260907-0029-0 (go/util.go)
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni internal JSON utilities.
 //
@@ -290,7 +290,16 @@ func Quote(val string) string {
 
 // JsonStr is compact JSON text with map keys sorted, so that messages are
 // identical in every port regardless of local map ordering.
+//
+// GUARDED against cycles: this renders FAILURE MESSAGES, and an entry
+// carrying a live cyclic value recursed until the stack gave out. A cycle
+// renders as "[Circular]". The ancestor set tracks the CURRENT PATH only,
+// removed again on the way out, so a DAG still renders in full.
 func JsonStr(val any) string {
+	return jsonstrSeen(val, map[uintptr]bool{})
+}
+
+func jsonstrSeen(val any, seen map[uintptr]bool) string {
 	if IsAbsent(val) {
 		return "undefined"
 	}
@@ -315,14 +324,25 @@ func JsonStr(val any) string {
 	}
 
 	if list, is := val.([]any); is {
+		ptr := reflect.ValueOf(list).Pointer()
+		if seen[ptr] {
+			return Quote("[Circular]")
+		}
+		seen[ptr] = true
 		parts := make([]string, len(list))
 		for index, entry := range list {
-			parts[index] = JsonStr(entry)
+			parts[index] = jsonstrSeen(entry, seen)
 		}
+		delete(seen, ptr)
 		return "[" + strings.Join(parts, ",") + "]"
 	}
 
 	if amap, is := val.(map[string]any); is {
+		ptr := reflect.ValueOf(amap).Pointer()
+		if seen[ptr] {
+			return Quote("[Circular]")
+		}
+		seen[ptr] = true
 		keys := make([]string, 0, len(amap))
 		for key := range amap {
 			keys = append(keys, key)
@@ -330,8 +350,9 @@ func JsonStr(val any) string {
 		sort.Strings(keys)
 		parts := make([]string, len(keys))
 		for index, key := range keys {
-			parts[index] = Quote(key) + ":" + JsonStr(amap[key])
+			parts[index] = Quote(key) + ":" + jsonstrSeen(amap[key], seen)
 		}
+		delete(seen, ptr)
 		return "{" + strings.Join(parts, ",") + "}"
 	}
 

package/project/.sdk/tm/go/utility/struct/voxgigstruct.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/struct 0.1.0 (go/voxgigstruct.go)
-// Source: https://github.com/voxgig/struct @ 2caf7f448f265144c18dd6fab6ba270a7f3bca07  [tag: sdk-20260904-1610-0]
+// Source: https://github.com/voxgig/struct @ adda9521c828147573df5a8878408a3f2193ddf4  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd. MIT LICENSE. */
 

package/project/.sdk/tm/java/test/vendor/omni/Json.java

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260904-1610-0 (java/src/com/voxgig/omni/Json.java)
-// Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/omni sdk-20260907-0029-0 (java/src/com/voxgig/omni/Json.java)
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Minimal JSON parser for omni.
 //

package/project/.sdk/tm/java/test/vendor/omni/Runner.java

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260904-1610-0 (java/src/com/voxgig/omni/Runner.java)
-// Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/omni sdk-20260907-0029-0 (java/src/com/voxgig/omni/Runner.java)
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni: the shared multi-language test runner.
 //

package/project/.sdk/tm/java/test/vendor/omni/Util.java

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260904-1610-0 (java/src/com/voxgig/omni/Util.java)
-// Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/omni sdk-20260907-0029-0 (java/src/com/voxgig/omni/Util.java)
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni internal JSON utilities.
 //

package/project/.sdk/tm/java/utility/struct/Struct.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/struct 0.1.1 (java/src/Struct.java)
-// Source: https://github.com/voxgig/struct @ 2caf7f448f265144c18dd6fab6ba270a7f3bca07  [tag: sdk-20260904-1610-0]
+// Source: https://github.com/voxgig/struct @ adda9521c828147573df5a8878408a3f2193ddf4  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package JAVAPACKAGE.utility.struct;
 

package/project/.sdk/tm/js/src/utility/StructUtility.js

@@ -1,8 +1,8 @@
 // VENDORED: @voxgig/struct 0.1.4 (javascript/src/struct.js)
-// Source: https://github.com/voxgig/struct @ 2caf7f448f265144c18dd6fab6ba270a7f3bca07  [tag: sdk-20260904-1610-0]
+// Source: https://github.com/voxgig/struct @ adda9521c828147573df5a8878408a3f2193ddf4  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025-2026 Voxgig Ltd. MIT LICENSE. */
-// VERSION: @voxgig/struct-js 0.1.4
+// VERSION: @voxgig/struct-js 0.1.5
 /* Voxgig Struct
  * =============
  *

package/project/.sdk/tm/js/test/vendor/omni/index.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni 0.1.4 (javascript/src/index.js)
-// Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // @voxgig/omni-js - shared multi-language test runner.
 //

package/project/.sdk/tm/js/test/vendor/omni/runner.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni 0.1.4 (javascript/src/runner.js)
-// Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni: the shared multi-language test runner.
 //
@@ -299,6 +299,14 @@ function errify(err) {
   if (err instanceof Error) {
     return { ...err, name: err.name, message: err.message }
   }
+
+  // An error-SHAPED plain map ({name, message, ...}) spreads the same way
+  // an Error does - collapsing it to String(err) yields '[object Object]',
+  // which fails both the `err` check and every `match.err.*` leaf.
+  if (null != err && 'object' === typeof err) {
+    return { name: 'Error', ...err }
+  }
+
   return { name: 'Error', message: String(err) }
 }
 
@@ -308,7 +316,9 @@ function errbase(err, provider) {
 }
 
 function errmessage(err) {
-  return err instanceof Error ? err.message : String(err)
+  return err instanceof Error ? err.message
+    : null != err && 'string' === typeof err.message ? err.message
+      : String(err)
 }
 
 // The label of one entry, for failure messages.
@@ -410,7 +420,12 @@ function handleerror(flags, index, entry, err, provider) {
 
 // Check that every leaf of `check` is present, and matches, in `base`.
 function match(flags, index, entry, check, base) {
-  const cbase = clone(base)
+  // Read the base DIRECTLY. The clone bought nothing - the walk below only
+  // reads, via getpath - and it blows the stack on a cyclic base. A port
+  // that drives entries with live objects rather than pure JSON produces
+  // those routinely: voxgig/sdkgen's corpus matches against a live client
+  // context whose root context reaches the client again.
+  const cbase = base
 
   const at = (path) => (0 === path.length ? '<root>' : pathify(path))
 

package/project/.sdk/tm/js/test/vendor/omni/util.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni 0.1.4 (javascript/src/util.js)
-// Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni internal JSON utilities.
 //
@@ -147,7 +147,14 @@ function deepequal(a, b) {
 
 // Compact JSON text with map keys sorted, so that messages are identical
 // in every port regardless of local map ordering.
-function jsonstr(val) {
+// GUARDED against cycles: this renders FAILURE MESSAGES, and an entry
+// carrying a live cyclic value (voxgig/sdkgen's corpus bookkeeping does)
+// recursed until the stack gave out. A cycle renders as "[Circular]".
+// `seen` tracks the ANCESTORS of the current value, not every value
+// visited: it is removed again on the way out, so the same object
+// appearing twice as siblings - a DAG, not a cycle - still renders in
+// full.
+function jsonstr(val, seen) {
   if (undefined === val) {
     return 'undefined'
   }
@@ -168,13 +175,23 @@ function jsonstr(val) {
     return val ? 'true' : 'false'
   }
 
-  if (islist(val)) {
-    return '[' + val.map((entry) => jsonstr(entry)).join(',') + ']'
-  }
+  if (islist(val) || ismap(val)) {
+    seen = seen || new Set()
 
-  if (ismap(val)) {
-    const keys = Object.keys(val).sort()
-    return '{' + keys.map((key) => JSON.stringify(key) + ':' + jsonstr(val[key])).join(',') + '}'
+    if (seen.has(val)) {
+      return '"[Circular]"'
+    }
+
+    seen.add(val)
+
+    const out = islist(val)
+      ? '[' + val.map((entry) => jsonstr(entry, seen)).join(',') + ']'
+      : '{' + Object.keys(val).sort()
+        .map((key) => JSON.stringify(key) + ':' + jsonstr(val[key], seen)).join(',') + '}'
+
+    seen.delete(val)
+
+    return out
   }
 
   if ('function' === typeof val) {

package/project/.sdk/tm/kotlin/test/vendor/omni/Json.kt

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260904-1610-0 (kotlin/src/Json.kt)
-// Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/omni sdk-20260907-0029-0 (kotlin/src/Json.kt)
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The omni JSON value model, with a small in-tree parser.
 //

package/project/.sdk/tm/kotlin/test/vendor/omni/Runner.kt

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260904-1610-0 (kotlin/src/Runner.kt)
-// Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/omni sdk-20260907-0029-0 (kotlin/src/Runner.kt)
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni: the shared multi-language test runner (Kotlin port).
 //

package/project/.sdk/tm/kotlin/test/vendor/omni/Util.kt

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260904-1610-0 (kotlin/src/Util.kt)
-// Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/omni sdk-20260907-0029-0 (kotlin/src/Util.kt)
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni internal JSON utilities.
 //

package/project/.sdk/tm/kotlin/utility/struct/Struct.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/struct 0.1.1 (kotlin/src/main/kotlin/voxgig/struct/Struct.kt)
-// Source: https://github.com/voxgig/struct @ 2caf7f448f265144c18dd6fab6ba270a7f3bca07  [tag: sdk-20260904-1610-0]
+// Source: https://github.com/voxgig/struct @ adda9521c828147573df5a8878408a3f2193ddf4  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package KOTLINPACKAGE.utility.struct
 

package/project/.sdk/tm/lean/test/vendor/omni/Omni.lean

@@ -1,5 +1,5 @@
--- VENDORED: @voxgig/omni sdk-20260904-1610-0 (lean/Omni.lean)
--- Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
+-- VENDORED: @voxgig/omni sdk-20260907-0029-0 (lean/Omni.lean)
+-- Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
 -- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /-
 Omni: the shared multi-language test runner (Lean 4 port).

package/project/.sdk/tm/lua/test/vendor/omni/json.lua

@@ -1,5 +1,5 @@
--- VENDORED: @voxgig/omni sdk-20260904-1610-0 (lua/src/json.lua)
--- Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
+-- VENDORED: @voxgig/omni sdk-20260907-0029-0 (lua/src/json.lua)
+-- Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
 -- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 -- The omni JSON value model and parser.
 --

package/project/.sdk/tm/lua/test/vendor/omni/regex.lua

@@ -1,5 +1,5 @@
--- VENDORED: @voxgig/omni sdk-20260904-1610-0 (lua/src/regex.lua)
--- Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
+-- VENDORED: @voxgig/omni sdk-20260907-0029-0 (lua/src/regex.lua)
+-- Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
 -- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 -- A small backtracking regex engine.
 --

package/project/.sdk/tm/lua/test/vendor/omni/runner.lua

@@ -1,5 +1,5 @@
--- VENDORED: @voxgig/omni sdk-20260904-1610-0 (lua/src/runner.lua)
--- Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
+-- VENDORED: @voxgig/omni sdk-20260907-0029-0 (lua/src/runner.lua)
+-- Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
 -- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 -- Omni: the shared multi-language test runner (Lua port).
 --

package/project/.sdk/tm/lua/test/vendor/omni/util.lua

@@ -1,5 +1,5 @@
--- VENDORED: @voxgig/omni sdk-20260904-1610-0 (lua/src/util.lua)
--- Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
+-- VENDORED: @voxgig/omni sdk-20260907-0029-0 (lua/src/util.lua)
+-- Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
 -- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 -- Omni internal JSON utilities.
 --

package/project/.sdk/tm/lua/utility/struct/regex.lua

@@ -1,5 +1,5 @@
 -- VENDORED: @voxgig/struct 0.1.1 (lua/src/regex.lua)
--- Source: https://github.com/voxgig/struct @ 2caf7f448f265144c18dd6fab6ba270a7f3bca07  [tag: sdk-20260904-1610-0]
+-- Source: https://github.com/voxgig/struct @ adda9521c828147573df5a8878408a3f2193ddf4  [tag: sdk-20260907-0029-0]
 -- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 -- Copyright (c) 2025-2026 Voxgig Ltd. MIT LICENSE.
 --

package/project/.sdk/tm/lua/utility/struct/struct.lua

@@ -1,5 +1,5 @@
 -- VENDORED: @voxgig/struct 0.1.1 (lua/src/struct.lua)
--- Source: https://github.com/voxgig/struct @ 2caf7f448f265144c18dd6fab6ba270a7f3bca07  [tag: sdk-20260904-1610-0]
+-- Source: https://github.com/voxgig/struct @ adda9521c828147573df5a8878408a3f2193ddf4  [tag: sdk-20260907-0029-0]
 -- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 -- Copyright (c) 2025-2026 Voxgig Ltd. MIT LICENSE.
 

package/project/.sdk/tm/ocaml/test/vendor/omni/omni.ml

@@ -1,5 +1,5 @@
-(* VENDORED: @voxgig/omni sdk-20260904-1610-0 (ocaml/src/omni.ml) *)
-(* Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0] *)
+(* VENDORED: @voxgig/omni sdk-20260907-0029-0 (ocaml/src/omni.ml) *)
+(* Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0] *)
 (* License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream. *)
 (* Omni: the shared multi-language test runner (OCaml port).
 

package/project/.sdk/tm/perl/lib/Voxgig/Struct.pm

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/struct 0.1.1 (perl/lib/Voxgig/Struct.pm)
-# Source: https://github.com/voxgig/struct @ 2caf7f448f265144c18dd6fab6ba270a7f3bca07  [tag: sdk-20260904-1610-0]
+# Source: https://github.com/voxgig/struct @ adda9521c828147573df5a8878408a3f2193ddf4  [tag: sdk-20260907-0029-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # Copyright (c) 2025-2026 Voxgig Ltd. MIT LICENSE.
 # Perl port of the canonical TypeScript implementation (ts/src/StructUtility.ts).

package/project/.sdk/tm/perl/t/vendor/omni/Voxgig/Omni/Runner.pm

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/omni 0.1.0 (perl/lib/Voxgig/Omni/Runner.pm)
-# Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
+# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package Voxgig::Omni::Runner;
 

package/project/.sdk/tm/perl/t/vendor/omni/Voxgig/Omni/Util.pm

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/omni 0.1.0 (perl/lib/Voxgig/Omni/Util.pm)
-# Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
+# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package Voxgig::Omni::Util;
 

package/project/.sdk/tm/perl/t/vendor/omni/Voxgig/Omni.pm

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/omni 0.1.0 (perl/lib/Voxgig/Omni.pm)
-# Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
+# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package Voxgig::Omni;
 

package/project/.sdk/tm/php/test/vendor/omni/Runner.php

@@ -1,6 +1,6 @@
 <?php
-// VENDORED: @voxgig/omni sdk-20260904-1610-0 (php/src/Runner.php)
-// Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/omni sdk-20260907-0029-0 (php/src/Runner.php)
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 
 /**

package/project/.sdk/tm/php/test/vendor/omni/Util.php

@@ -1,6 +1,6 @@
 <?php
-// VENDORED: @voxgig/omni sdk-20260904-1610-0 (php/src/Util.php)
-// Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/omni sdk-20260907-0029-0 (php/src/Util.php)
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 
 /**

package/project/.sdk/tm/py/pkg/feature/secrets/voxgig_plugin/__init__.py

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin 0.1.6 (python/voxgig_plugin/__init__.py)
-# Source: https://github.com/voxgig/plugin @ 8d8968afc0a2008fbd795b41ab166307d989f02a  [tag: sdk-20260904-1610-0]
+# Source: https://github.com/voxgig/plugin @ b48ae643eb0eb56c5ebe3198da98cecdf6a7f7fc  [tag: sdk-20260907-0029-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 """The canonical surface `make parity` checks (AGENTS.md section 4).
 

package/project/.sdk/tm/py/pkg/feature/secrets/voxgig_plugin/capability.py

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin 0.1.6 (python/voxgig_plugin/capability.py)
-# Source: https://github.com/voxgig/plugin @ 8d8968afc0a2008fbd795b41ab166307d989f02a  [tag: sdk-20260904-1610-0]
+# Source: https://github.com/voxgig/plugin @ b48ae643eb0eb56c5ebe3198da98cecdf6a7f7fc  [tag: sdk-20260907-0029-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 """Capabilities (section 11.1).
 

package/project/.sdk/tm/py/pkg/feature/secrets/voxgig_plugin/catalog.py

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin 0.1.6 (python/voxgig_plugin/catalog.py)
-# Source: https://github.com/voxgig/plugin @ 8d8968afc0a2008fbd795b41ab166307d989f02a  [tag: sdk-20260904-1610-0]
+# Source: https://github.com/voxgig/plugin @ b48ae643eb0eb56c5ebe3198da98cecdf6a7f7fc  [tag: sdk-20260907-0029-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 """The definition catalog (section 10.1).