@voxgig/sdkgen 4.9.0 → 4.10.0

package/project/.sdk/tm/js/src/feature/secrets/sekreto/plugins/sigv4.js

@@ -0,0 +1,157 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/plugins/sigv4.js)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// AWS Signature Version 4, hand-rolled.
+//
+// The AWS providers need exactly one thing from the AWS SDK - request
+// signing - and taking the SDK for it would break the no-dependency rule
+// that keeps twenty-three ports honest. SigV4 is a stable, published
+// algorithm built from HMAC-SHA256, which node's own crypto already has.
+//
+// `sigv4` is pure: the caller passes the timestamp, so the same input
+// yields the same signature everywhere. That is what lets the shared spec
+// carry known-answer cases that all the ports must reproduce bit-for-bit,
+// and lets the integration mock recompute the signature server-side.
+//
+// A port of typescript/plugins/sigv4.ts, which is canonical.
+
+// node:crypto is loaded ON FIRST USE, not at require time.
+//
+// This module lives under plugins/ and is reached only through the aws
+// plugin, so the core never sees it at all; deferring the builtin on top
+// of that keeps requiring the plugin free of side effects too, and lets
+// the sigv4 conformance group run on a runtime that has crypto without
+// anything else in the module graph having asked for it.
+//
+// require(), not `await import()`: these helpers are synchronous and are
+// called from synchronous signing code.
+function crypto() {
+  try {
+    return require('node:crypto')
+  } catch (err) {
+    throw new Error(
+      'sekreto: AWS request signing needs node:crypto, which this runtime ' +
+        'does not provide: ' +
+        err.message,
+      { cause: err },
+    )
+  }
+}
+
+function sha256hex(text) {
+  return crypto().createHash('sha256').update(text, 'utf8').digest('hex')
+}
+
+function hmac(key, text) {
+  return crypto().createHmac('sha256', key).update(text, 'utf8').digest()
+}
+
+/** RFC 3986 escaping, which is stricter than encodeURIComponent: AWS
+ * wants `!`, `'`, `(`, `)` and `*` escaped too. */
+function uriescape(text) {
+  return encodeURIComponent(text).replace(
+    /[!'()*]/g,
+    (ch) => '%' + ch.charCodeAt(0).toString(16).toUpperCase(),
+  )
+}
+
+/** The canonical query string: each pair RFC 3986-escaped, sorted by
+ * escaped key then escaped value. */
+function canonicalquery(query) {
+  if ('' === query) {
+    return ''
+  }
+
+  const pairs = query.split('&').map((pair) => {
+    const eq = pair.indexOf('=')
+    const key = -1 === eq ? pair : pair.slice(0, eq)
+    const value = -1 === eq ? '' : pair.slice(eq + 1)
+    return [uriescape(decodeURIComponent(key)), uriescape(decodeURIComponent(value))]
+  })
+
+  pairs.sort((left, right) => {
+    if (left[0] !== right[0]) {
+      return left[0] < right[0] ? -1 : 1
+    }
+    return left[1] < right[1] ? -1 : left[1] > right[1] ? 1 : 0
+  })
+
+  return pairs.map((pair) => pair[0] + '=' + pair[1]).join('&')
+}
+
+/** Sign one request. Returns the headers to attach: authorization,
+ * x-amz-date, and x-amz-security-token when a session token was given. */
+function sigv4(input) {
+  const url = new URL(input.url)
+
+  const date = input.datetime.slice(0, 8)
+  const body = input.body || ''
+
+  // Every header that will be signed: the caller's extras, plus host and
+  // x-amz-date (and the session token when present), lower-cased and
+  // trimmed the way the canonical form requires.
+  // Canonical header values are trimmed AND internally collapsed -
+  // AWS folds sequential whitespace to one space before signing, so a
+  // header like "a  b" must sign as "a b" or the service refuses it.
+  const headers = {}
+  for (const [key, value] of Object.entries(input.headers || {})) {
+    headers[key.toLowerCase()] = String(value).trim().replace(/\s+/g, ' ')
+  }
+  headers['host'] = url.host
+  headers['x-amz-date'] = input.datetime
+  if (input.session) {
+    headers['x-amz-security-token'] = input.session
+  }
+
+  const names = Object.keys(headers).sort()
+  const canonicalheaders = names.map((name) => name + ':' + headers[name] + '\n').join('')
+  const signedheaders = names.join(';')
+
+  const canonicalrequest = [
+    input.method.toUpperCase(),
+    url.pathname || '/',
+    canonicalquery(url.search.replace(/^\?/, '')),
+    canonicalheaders,
+    signedheaders,
+    sha256hex(body),
+  ].join('\n')
+
+  const scope = date + '/' + input.region + '/' + input.service + '/aws4_request'
+
+  const stringtosign = [
+    'AWS4-HMAC-SHA256',
+    input.datetime,
+    scope,
+    sha256hex(canonicalrequest),
+  ].join('\n')
+
+  const kdate = hmac('AWS4' + input.secret, date)
+  const kregion = hmac(kdate, input.region)
+  const kservice = hmac(kregion, input.service)
+  const ksigning = hmac(kservice, 'aws4_request')
+  const signature = crypto()
+    .createHmac('sha256', ksigning)
+    .update(stringtosign, 'utf8')
+    .digest('hex')
+
+  const out = {
+    authorization:
+      'AWS4-HMAC-SHA256 Credential=' +
+      input.keyid +
+      '/' +
+      scope +
+      ', SignedHeaders=' +
+      signedheaders +
+      ', Signature=' +
+      signature,
+    'x-amz-date': input.datetime,
+  }
+
+  if (input.session) {
+    out['x-amz-security-token'] = input.session
+  }
+
+  return out
+}
+
+module.exports = { sigv4 }

package/project/.sdk/tm/js/src/feature/secrets/sekreto/provider/addr.js

@@ -0,0 +1,119 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/src/provider/addr.js)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+// A port of typescript/src/provider/addr.ts, which is canonical.
+
+const { SekretoError } = require('./support')
+
+/** An address with any userinfo replaced by `[redacted]`, for messages.
+ *
+ * Every refusal below names the address it refused, and one of them fires
+ * precisely because the address carries a credential - so printing it
+ * verbatim wrote the password to stderr and into the logs. It cannot be
+ * cleaned up afterwards either: that password was never resolved as a
+ * secret, so `redact()` has never seen it and never will. The host is what
+ * a reader needs to identify which chain entry is at fault; the userinfo
+ * is not. */
+function safeaddr(addr) {
+  const mark = addr.indexOf('://')
+  if (-1 === mark) {
+    return addr
+  }
+
+  const rest = addr.slice(mark + 3)
+  const end = rest.search(/[/?#]/)
+  const authority = -1 === end ? rest : rest.slice(0, end)
+
+  const at = authority.lastIndexOf('@')
+  if (-1 === at) {
+    return addr
+  }
+
+  return addr.slice(0, mark + 3) + '[redacted]' + addr.slice(mark + 3 + at)
+}
+
+/** Refuse to send a secret-bearing credential in the clear.
+ *
+ * A vault API is HTTPS in any real deployment; plaintext is a dev-mode
+ * convenience. Sending a token over http to anything but the local
+ * machine puts both the token and the secret it fetches on the wire for
+ * anyone on the path, so sekreto will not do it. Loopback stays allowed:
+ * that is `vault server -dev`, `boru vault serve`, and this repo's own
+ * test harness.
+ *
+ * The address is read by hand, in the same handful of steps in every
+ * port, rather than by each platform's URL parser. That is deliberate.
+ * Twelve parsers disagree about malformed input - where userinfo ends,
+ * whether `0177.0.0.1` is loopback, what an unclosed bracket means - and
+ * a check that answers differently in different ports is not a check.
+ *
+ * The rule this parse obeys, and the reason it can be trusted: it is
+ * never more permissive than the HTTP client that will dial the address.
+ * It ends the authority at `/`, `?` or `#` only, so a client that also
+ * breaks on `\` (WHATWG does) can only ever see a SHORTER host than this
+ * does. It refuses userinfo outright rather than locating its end. It
+ * compares the host literally, so a numeric form no parser here agrees
+ * on is refused rather than guessed at.
+ *
+ * A pure validator with no platform dependency, so it stays in the core
+ * even though only plugins dial an address: callers validate a
+ * configured address before building a chain. */
+function checkaddr(addr) {
+  const scheme = addr.startsWith('https://')
+    ? 'https://'
+    : addr.startsWith('http://')
+      ? 'http://'
+      : ''
+
+  if ('' === scheme) {
+    throw new SekretoError('sekreto: not an http(s) address: ' + safeaddr(addr))
+  }
+
+  const rest = addr.slice(scheme.length)
+  const end = rest.search(/[/?#]/)
+  const authority = -1 === end ? rest : rest.slice(0, end)
+
+  // Userinfo is refused outright rather than parsed around, and on https
+  // as well as http. No store this library speaks authenticates by
+  // userinfo - they take a token or a signature - so an address carrying
+  // one is a mistake at best. At worst it is the attack this whole
+  // function exists to stop: `http://localhost:8200@evil.example.com/` is
+  // a request to evil.example.com that reads, to anything that splits the
+  // authority on ':', as loopback.
+  if (authority.includes('@')) {
+    throw new SekretoError(
+      'sekreto: refusing an address with embedded credentials: ' + safeaddr(addr),
+    )
+  }
+
+  // An opening bracket with no closing one is not an address at all.
+  if (authority.startsWith('[') && !authority.includes(']')) {
+    throw new SekretoError('sekreto: not a valid http(s) address: ' + safeaddr(addr))
+  }
+
+  if ('https://' === scheme) {
+    return
+  }
+
+  // A bracketed IPv6 literal keeps its brackets. Splitting the authority
+  // on the first colon yields '[', so `http://[::1]:8200` could never
+  // match - which made the '[::1]' entry below unreachable, and refused a
+  // legitimate local vault.
+  const host = (
+    authority.startsWith('[')
+      ? authority.slice(0, authority.indexOf(']') + 1)
+      : authority.split(':')[0]
+  ).toLowerCase()
+
+  if ('localhost' === host || '127.0.0.1' === host || '::1' === host || '[::1]' === host) {
+    return
+  }
+
+  throw new SekretoError(
+    'sekreto: refusing to send a token in plaintext to ' + safeaddr(addr) + ' (use https)',
+  )
+}
+
+module.exports = { checkaddr, safeaddr }

package/project/.sdk/tm/js/src/feature/secrets/sekreto/provider/builtin.js

@@ -0,0 +1,39 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/src/provider/builtin.js)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+// THE BUILT-IN PROVIDER KINDS - the same four in every port.
+//
+// What makes a kind built in is that it needs nothing of the platform
+// beyond reading a local file: no socket, no TLS, no crypto, no child
+// process. These four are the floor every chain stands on, and a chain
+// that reads secrets from options, the environment, a plaintext `.env`
+// and a mounted secret directory works with no plugin loaded at all.
+// Everything else - the vault clients, the cloud stores, the CLIs - is a
+// plugin, and lives under `plugins/` (docs/design/plugin-providers.md).
+
+const { providerplugin } = require('./support')
+const { envprovider } = require('./env')
+const { memoryprovider } = require('./memory')
+const { dotenvprovider } = require('./dotenv')
+const { fileprovider } = require('./file')
+
+const BUILTINS = [
+  providerplugin('env', (spec) => envprovider(spec.prefix)),
+  providerplugin('memory', (spec) => memoryprovider(spec.values || {}, spec.prefix)),
+  providerplugin('dotenv', (spec) => dotenvprovider(spec.file || '.env', spec.prefix)),
+  providerplugin('file', (spec) => fileprovider(spec.dir || '', spec.prefix)),
+]
+
+/** Every kind this library ships, built in or as a plugin, so that an
+ * unknown kind can be told from a plugin that was not loaded. */
+const KINDS = {
+  builtin: ['env', 'memory', 'dotenv', 'file'],
+  plugin: [
+    'hashicorp', 'boru', 'awssecrets', 'awsparams', 'gcpsecrets',
+    'azuresecrets', 'onepassword', 'doppler', 'infisical', 'secretspec',
+  ],
+}
+
+module.exports = { BUILTINS, KINDS }

package/project/.sdk/tm/js/src/feature/secrets/sekreto/provider/dotenv.js

@@ -0,0 +1,40 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/src/provider/dotenv.js)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+const { SekretoError, envkey, nodemod, parsedotenv } = require('./support')
+
+/** A `.env` file, read once, keyed exactly like the environment. */
+function dotenvprovider(file, prefix) {
+  let values
+
+  const load = () => {
+    if (undefined === values) {
+      try {
+        const { readFileSync } = nodemod('node:fs')
+        values = parsedotenv(readFileSync(file, 'utf8'))
+      } catch (err) {
+        // An absent file - or an absent directory - means "no secrets
+        // here", exactly like fileprovider. Anything else (permission
+        // denied, an unreadable mount) is a store that could not answer,
+        // and swallowing it would fall through to a weaker store.
+        if ('ENOENT' === err.code || 'ENOTDIR' === err.code) {
+          values = {}
+        } else {
+          throw new SekretoError(
+            'sekreto: dotenv provider cannot read ' + file + ': ' + err.message,
+          )
+        }
+      }
+    }
+    return values
+  }
+
+  return {
+    lookup: (name) => load()[envkey(name, prefix)],
+    describe: () => 'dotenv:' + file,
+  }
+}
+
+module.exports = { dotenvprovider }

package/project/.sdk/tm/js/src/feature/secrets/sekreto/provider/env.js

@@ -0,0 +1,21 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/src/provider/env.js)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+const { envkey } = require('./support')
+
+/** Environment variables: `api.token` from `API_TOKEN`. */
+function envprovider(prefix, source) {
+  const env = source || process.env
+
+  return {
+    lookup: (name) => {
+      const value = env[envkey(name, prefix)]
+      return undefined === value || null === value ? undefined : String(value)
+    },
+    describe: () => 'env' + (prefix ? ':' + prefix : ''),
+  }
+}
+
+module.exports = { envprovider }

package/project/.sdk/tm/js/src/feature/secrets/sekreto/provider/file.js

@@ -0,0 +1,42 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/src/provider/file.js)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+const { SekretoError, envkey, nodemod } = require('./support')
+
+/** A directory of one-secret-per-file entries, keyed like the
+ * environment: `api.token` reads `<dir>/API_TOKEN`.
+ *
+ * This is the shape of a mounted Kubernetes Secret, a Docker or Swarm
+ * secret, and a systemd credentials directory, so those all work with no
+ * further configuration. One trailing newline is stripped - tools that
+ * write these files disagree about it, and a newline is never part of a
+ * secret on purpose. */
+function fileprovider(dir, prefix) {
+  return {
+    lookup: (name) => {
+      const { join } = nodemod('node:path')
+      const file = join(dir, envkey(name, prefix))
+
+      let text
+      try {
+        const { readFileSync } = nodemod('node:fs')
+        text = readFileSync(file, 'utf8')
+      } catch (err) {
+        // An absent file - or an absent directory - means "no secrets
+        // here", exactly like a missing .env. Anything else (permission
+        // denied, an unreadable mount) is a store that could not answer.
+        if ('ENOENT' === err.code || 'ENOTDIR' === err.code) {
+          return undefined
+        }
+        throw new SekretoError('sekreto: file provider cannot read ' + file + ': ' + err.message)
+      }
+
+      return text.replace(/\r?\n$/, '')
+    },
+    describe: () => 'file:' + dir,
+  }
+}
+
+module.exports = { fileprovider }

package/project/.sdk/tm/js/src/feature/secrets/sekreto/provider/memory.js

@@ -0,0 +1,18 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/src/provider/memory.js)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+const { envkey } = require('./support')
+
+/** Literal values, keyed like environment variables. The spec uses this
+ * to test chain behaviour without touching the outside world, and an app
+ * uses it for defaults. */
+function memoryprovider(values, prefix) {
+  return {
+    lookup: (name) => values[envkey(name, prefix)],
+    describe: () => 'memory' + (prefix ? ':' + prefix : ''),
+  }
+}
+
+module.exports = { memoryprovider }

package/project/.sdk/tm/js/src/feature/secrets/sekreto/provider/support.js

@@ -0,0 +1,151 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/src/provider/support.js)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+// What a provider is, what its declarative form looks like, and how a
+// provider kind becomes a voxgig/plugin definition.
+//
+// A provider answers one question: "do you have this secret?" It returns
+// the value, or undefined to mean "ask the next one". Nothing else about
+// a provider is visible to the caller - which is the point: an app reads
+// `api.token` and never learns whether it came from the environment, a
+// .env file, HashiCorp Vault, AWS, GCP, Azure or a boru vault.
+//
+// Two failure shapes, and they are never interchangeable. A store that
+// does not hold the secret is a MISS (undefined) - the chain carries on.
+// A store that could not answer - bad credentials, unreachable host,
+// missing configuration - is an ERROR: falling through there would
+// quietly reach for a weaker store.
+//
+// A port of typescript/src/provider/support.ts, which is canonical.
+
+const { PluginError } = require('../../plugin')
+
+// Sekreto.js is required at the TOP here, and requires nothing under
+// this directory at the top of itself - it reaches builtin.js through a
+// function. That is what keeps the pair acyclic in CommonJS, where a
+// module that replaces `module.exports` at the end of its body hands a
+// stale empty object to anything that required it half-built.
+const {
+  ERROR_CODE,
+  PROVIDER_EXPORT,
+  SekretoError,
+  awsparam,
+  checkname,
+  envkey,
+  flatname,
+  parsedotenv,
+  vaultref,
+} = require('../Sekreto')
+
+// NODE BUILTINS, LOADED ON FIRST USE.
+//
+// `fs` and `path` are what the two built-in file-reading providers need,
+// and they are loaded when a lookup runs rather than when sekreto is
+// required: a caller who only ever configures `memory` or `env` never
+// evaluates them, and a runtime that lacks them fails at the point of
+// use rather than at import. The platform-dependent providers proper -
+// everything that opens a socket or spawns a process - are not in the
+// core at all; they are plugins (docs/design/plugin-providers.md).
+//
+// A plain require(), not `await import()`: dotenvprovider and
+// fileprovider have SYNCHRONOUS lookups, and making them async to
+// accommodate a dynamic import would change observable behaviour for
+// anyone calling a provider directly.
+const nodemods = {}
+
+function nodemod(name) {
+  let mod = nodemods[name]
+
+  if (undefined === mod) {
+    try {
+      mod = nodemods[name] = require(name)
+    } catch (err) {
+      throw new SekretoError(
+        'sekreto: this provider needs ' +
+          name +
+          ', which this runtime does not provide: ' +
+          err.message,
+      )
+    }
+  }
+
+  return mod
+}
+
+// --- providers as voxgig/plugin definitions --------------------------
+
+// `PROVIDER_EXPORT` and `ERROR_CODE` are re-exported from Sekreto.js
+// rather than declared here, where canonical declares them: both ends of
+// the plugin boundary need them, and this module sits on the far side of
+// the one deferred require that keeps the pair acyclic in CommonJS.
+// Every consumer still reads them from here, as canonical's do.
+
+/** A provider kind, as a voxgig/plugin definition.
+ *
+ * This is the whole bridge between the two libraries. The definition's
+ * `name` is the `kind` a provider spec names; its `define` reads the
+ * spec as `inst.options`, builds the provider with `make`, and exports
+ * it. Nothing runs at `activate`: a provider opens nothing until its
+ * first lookup, so there is nothing to capture - a provider that does
+ * hold a resource acquires it there and lets the instance scope unwind
+ * it.
+ *
+ * Every built-in and every plugin is made this way, so a custom
+ * provider kind is one call:
+ *
+ *     providerplugin('mystore', (spec) => mystoreprovider(spec.addr))
+ */
+function providerplugin(kind, make) {
+  return {
+    name: kind,
+    define: (inst) => {
+      let provider
+      try {
+        provider = make(inst.options)
+      } catch (err) {
+        if (err instanceof SekretoError) {
+          throw new PluginError(ERROR_CODE, err.message, { ref: inst.ref, cause: err.message })
+        }
+        throw err
+      }
+      inst.export(PROVIDER_EXPORT, provider)
+    },
+  }
+}
+
+/** Decode standard base64, or undefined when the text is not base64.
+ *
+ * `Buffer.from(text, 'base64')` is lenient: it skips anything outside the
+ * alphabet and hands back whatever it managed, so a corrupted payload
+ * became a plausible-looking string of bytes that the caller then returned
+ * AS THE SECRET. The alphabet is checked first, so a store that answered
+ * incoherently can be told apart from one that answered.
+ *
+ * A store that could not answer coherently is an ERROR, never a miss - the
+ * same rule this library already applies to a 200 whose body is not JSON. */
+function unbase64(text) {
+  const trimmed = text.replace(/\s+/g, '')
+
+  if (!/^[A-Za-z0-9+/]*={0,2}$/.test(trimmed) || 0 !== trimmed.length % 4) {
+    return undefined
+  }
+
+  return Buffer.from(trimmed, 'base64').toString('utf8')
+}
+
+module.exports = {
+  ERROR_CODE,
+  PROVIDER_EXPORT,
+  SekretoError,
+  awsparam,
+  checkname,
+  envkey,
+  flatname,
+  nodemod,
+  parsedotenv,
+  providerplugin,
+  unbase64,
+  vaultref,
+}

package/project/.sdk/tm/js/src/utility/StructUtility.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/struct 0.1.4 (javascript/src/struct.js)
-// Source: https://github.com/voxgig/struct @ adda9521c828147573df5a8878408a3f2193ddf4  [tag: sdk-20260907-0029-0]
+// Source: https://github.com/voxgig/struct @ adda9521c828147573df5a8878408a3f2193ddf4  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025-2026 Voxgig Ltd. MIT LICENSE. */
 // VERSION: @voxgig/struct-js 0.1.5