stitchkit 0.76.1 → 0.76.2

package/dist/agent-runtime-coding-tools.js

@@ -16,8 +16,7 @@ import {
 } from "./index-wwst0td5.js";
 import"./index-22by16v6.js";
 import"./index-cby4ar3v.js";
-import"./index-hsz2mmk0.js";
-import"./index-rxfy4cq7.js";
+import"./index-vj3vvpaa.js";
 import {
   AppError,
   conflict,

package/dist/agent-runtime-harness.js

@@ -3,7 +3,7 @@ import {
   composeAgentPrompt,
   createAgentRuntime,
   createAgentRuntimeEventSink
-} from "./index-v7xjfy10.js";
+} from "./index-m668wzyc.js";
 import {
   walkContainedFiles
 } from "./index-rqpdar1e.js";
@@ -16,8 +16,8 @@ import"./index-3xnq72rz.js";
 import {
   defineRuntimeTool
 } from "./index-wwst0td5.js";
-import"./index-k68e5jz0.js";
-import"./index-e0a57ymn.js";
+import"./index-s4c8wy8m.js";
+import"./index-nemjkxjp.js";
 import {
   AgentMessagePartSchema,
   AgentSnapshotSchema
@@ -25,8 +25,7 @@ import {
 import"./index-22by16v6.js";
 import"./index-cby4ar3v.js";
 import"./index-nt1mp8km.js";
-import"./index-hsz2mmk0.js";
-import"./index-rxfy4cq7.js";
+import"./index-vj3vvpaa.js";
 import"./index-0w9abg87.js";
 import"./index-qyrqwr4c.js";
 import"./index-6k1937bx.js";

package/dist/agent-runtime.js

@@ -27,7 +27,7 @@ import {
   registerDeferredToolRepair,
   repairedSearchCall,
   selectAgentHistory
-} from "./index-v7xjfy10.js";
+} from "./index-m668wzyc.js";
 import {
   AgentModelCapabilitySchema,
   AgentModelCatalogEntrySchema,
@@ -86,15 +86,15 @@ import {
 import {
   buildToolManifest,
   mountAgent
-} from "./index-xgahrwdf.js";
+} from "./index-ezmn6ac6.js";
 import"./index-3xnq72rz.js";
-import"./index-9c5dbr5q.js";
+import"./index-k2zczx1g.js";
 import {
   defineRuntimeTool
 } from "./index-wwst0td5.js";
-import"./index-885chjxq.js";
-import"./index-k68e5jz0.js";
-import"./index-e0a57ymn.js";
+import"./index-7qy2ex0m.js";
+import"./index-s4c8wy8m.js";
+import"./index-nemjkxjp.js";
 import {
   AgentAssistantPlaceholderSchema,
   AgentControlPartSchema,
@@ -134,8 +134,7 @@ import {
   childSpan,
   createTraceContext
 } from "./index-nt1mp8km.js";
-import"./index-hsz2mmk0.js";
-import"./index-rxfy4cq7.js";
+import"./index-vj3vvpaa.js";
 import"./index-0w9abg87.js";
 import {
   executableAgentRuntimeTools,

package/dist/application/watch-hub.d.ts

@@ -129,6 +129,6 @@ export interface WatchHub {
  * Exported because the client has to produce exactly this, and two
  * implementations of one key is the failure the digest exists to prevent.
  */
-export declare function watchKey(operation: WatchOperation, args: unknown): Promise<WatchKey>;
+export declare function watchKey(operation: WatchOperation, args: unknown): WatchKey;
 export declare function createWatchHub(config: WatchHubConfig): WatchHub;
 //# sourceMappingURL=watch-hub.d.ts.map

package/dist/application/watch-hub.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"watch-hub.d.ts","sourceRoot":"","sources":["../../src/application/watch-hub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAE,KAAK,aAAa,EAAiB,MAAM,sBAAsB,CAAC;AAEzE,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,eAAe,EAErB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE9C,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,KAAK,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IACpC,oDAAoD;IACpD,KAAK,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,GAAG;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3E,KAAK,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,yEAAyE;IACzE,MAAM,IAAI,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;;;;;;;;;;;;OAeG;IACH,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,gFAAgF;IAChF,SAAS,CAAC,SAAS,EAAE,cAAc,GAAG,OAAO,CAAC;IAC9C;;;;;;;;;OASG;IACH,aAAa,CAAC,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,CAAC;IAC3E,mFAAmF;IACnF,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;IAC3D,kEAAkE;IAClE,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,yFAAyF;IACzF,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACjD,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,CAAC,UAAU,EAAE,eAAe,GAAG,eAAe,CAAC;IACrD;;;;;;OAMG;IACH,SAAS,IAAI,MAAM,CAAC;IACpB,qEAAqE;IACrE,IAAI,IAAI,MAAM,CAAC;IACf,KAAK,IAAI,IAAI,CAAC;CACf;AAqBD;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAU1F;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,QAAQ,CA4M/D"}
+{"version":3,"file":"watch-hub.d.ts","sourceRoot":"","sources":["../../src/application/watch-hub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAE,KAAK,aAAa,EAAiB,MAAM,sBAAsB,CAAC;AAEzE,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,eAAe,EAErB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE9C,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,KAAK,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IACpC,oDAAoD;IACpD,KAAK,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,GAAG;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3E,KAAK,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,yEAAyE;IACzE,MAAM,IAAI,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;;;;;;;;;;;;OAeG;IACH,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,gFAAgF;IAChF,SAAS,CAAC,SAAS,EAAE,cAAc,GAAG,OAAO,CAAC;IAC9C;;;;;;;;;OASG;IACH,aAAa,CAAC,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,CAAC;IAC3E,mFAAmF;IACnF,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;IAC3D,kEAAkE;IAClE,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,yFAAyF;IACzF,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACjD,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,CAAC,UAAU,EAAE,eAAe,GAAG,eAAe,CAAC;IACrD;;;;;;OAMG;IACH,SAAS,IAAI,MAAM,CAAC;IACpB,qEAAqE;IACrE,IAAI,IAAI,MAAM,CAAC;IACf,KAAK,IAAI,IAAI,CAAC;CACf;AAqBD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,GAAG,QAAQ,CAU3E;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,QAAQ,CA4M/D"}

package/dist/application.js

@@ -27,7 +27,7 @@ import {
 import {
   argumentsDigest,
   stableValue
-} from "./index-vdvmcy7r.js";
+} from "./index-a916km3r.js";
 import {
   ApplicationAdmissionError,
   ApplicationShutdownBudgetSchema,
@@ -52,7 +52,6 @@ import {
   projectApplicationStatus
 } from "./index-8eywc9zv.js";
 import"./index-3z73fh2c.js";
-import"./index-rxfy4cq7.js";
 import"./index-0w9abg87.js";
 import {
   isRecord
@@ -1535,12 +1534,12 @@ function watchKeyString(key) {
 
 // src/application/watch-hub.ts
 var DEFAULT_BACKOFF = { minDelayMs: 250, maxDelayMs: 30000, jitter: 0.2 };
-async function watchKey(operation, args) {
+function watchKey(operation, args) {
   const record = typeof args === "object" && args !== null && !Array.isArray(args) ? args : { value: args };
   return {
     service: operation.service,
     action: operation.action,
-    digest: await argumentsDigest(record)
+    digest: argumentsDigest(record)
   };
 }
 function createWatchHub(config) {

package/dist/cli.js

@@ -5,18 +5,17 @@ import {
   emitResult,
   parseCliArgs,
   pollUntilDone
-} from "./index-9my2n66s.js";
-import"./index-9c5dbr5q.js";
+} from "./index-s2rchahr.js";
+import"./index-k2zczx1g.js";
 import"./index-wwst0td5.js";
-import"./index-885chjxq.js";
-import"./index-k68e5jz0.js";
-import"./index-e0a57ymn.js";
+import"./index-7qy2ex0m.js";
+import"./index-s4c8wy8m.js";
+import"./index-nemjkxjp.js";
 import"./index-sbdmyz75.js";
 import"./index-22by16v6.js";
 import"./index-cby4ar3v.js";
 import"./index-nt1mp8km.js";
-import"./index-hsz2mmk0.js";
-import"./index-rxfy4cq7.js";
+import"./index-vj3vvpaa.js";
 import"./index-0w9abg87.js";
 import"./index-qyrqwr4c.js";
 import"./index-6k1937bx.js";

package/dist/contract/index.js

@@ -20,8 +20,7 @@ import {
   paginatedSchema,
   rateLimited,
   unauthorized
-} from "../index-4kp4fxvp.js";
-import"../index-rxfy4cq7.js";
+} from "../index-f6n5n7nz.js";
 import"../index-ksp6e2ye.js";
 export {
   unauthorized,

package/dist/{index-v5dm4bwq.js → index-58jzmnn4.js}

@@ -8,7 +8,7 @@ import {
   ContractStreamFrameSchema,
   DEFAULT_CONTRACT_STREAM_FRAME_BYTES,
   parseTrailingWildcard
-} from "./index-hsz2mmk0.js";
+} from "./index-vj3vvpaa.js";
 import {
   isRecord,
   mapObject,

package/dist/{index-885chjxq.js → index-7qy2ex0m.js}

@@ -1,6 +1,6 @@
 import {
   executeToolMethod
-} from "./index-k68e5jz0.js";
+} from "./index-s4c8wy8m.js";
 import {
   assertToolExtensionCompatible,
   mergeSchemas,

package/dist/index-a916km3r.js

@@ -0,0 +1,45 @@
+// src/internal/stable-digest.ts
+function stableValue(value) {
+  if (Array.isArray(value))
+    return value.map(stableValue);
+  if (value === null || typeof value !== "object")
+    return value;
+  const result = {};
+  for (const key of Object.keys(value).sort()) {
+    result[key] = stableValue(Reflect.get(value, key));
+  }
+  return result;
+}
+function mix128(input) {
+  let a = 2654435769;
+  let b = 2246822507;
+  let c = 3266489909;
+  let d = 668265263;
+  for (let index = 0;index < input.length; index += 1) {
+    const code = input.charCodeAt(index);
+    a = Math.imul(a ^ code, 2246822519);
+    b = Math.imul(b ^ code, 3266489917);
+    c = Math.imul(c ^ code, 668265263);
+    d = Math.imul(d ^ code, 374761393);
+    a = a << 13 | a >>> 19;
+    b = b << 17 | b >>> 15;
+    c = c << 7 | c >>> 25;
+    d = d << 11 | d >>> 21;
+  }
+  a ^= b >>> 15;
+  b ^= c >>> 13;
+  c ^= d >>> 11;
+  d ^= a >>> 9;
+  return [
+    Math.imul(a ^ a >>> 16, 575075507) >>> 0,
+    Math.imul(b ^ b >>> 13, 2654435761) >>> 0,
+    Math.imul(c ^ c >>> 16, 2246822507) >>> 0,
+    Math.imul(d ^ d >>> 15, 3266489909) >>> 0
+  ];
+}
+function argumentsDigest(args) {
+  const lanes = mix128(JSON.stringify(stableValue(args)) ?? "undefined");
+  return lanes.map((lane) => lane.toString(16).padStart(8, "0")).join("");
+}
+
+export { stableValue, argumentsDigest };

package/dist/{index-28jsdwt1.js → index-aczggrty.js}

@@ -1,6 +1,6 @@
 import {
   isUnsafeKey
-} from "./index-hsz2mmk0.js";
+} from "./index-vj3vvpaa.js";
 import {
   isRecord
 } from "./index-qyrqwr4c.js";

package/dist/{index-65kathdm.js → index-da1aqnhb.js}

@@ -2,15 +2,13 @@ import {
   contextContributionDelta,
   mergeContextContribution,
   prepareContextContribution
-} from "./index-endzd8sj.js";
+} from "./index-vbf2p6me.js";
 import {
+  base64UrlToBytes,
+  bytesToBase64Url,
   isUnsafeKey,
   safeJsonParse
-} from "./index-hsz2mmk0.js";
-import {
-  base64UrlToBytes,
-  bytesToBase64Url
-} from "./index-rxfy4cq7.js";
+} from "./index-vj3vvpaa.js";
 import {
   forbidden,
   unauthorized

package/dist/{index-xgahrwdf.js → index-ezmn6ac6.js}

@@ -3,15 +3,15 @@ import {
 } from "./index-3xnq72rz.js";
 import {
   collectToolSurface
-} from "./index-9c5dbr5q.js";
+} from "./index-k2zczx1g.js";
 import {
   createToolRunner,
   formatToolError
-} from "./index-885chjxq.js";
+} from "./index-7qy2ex0m.js";
 import {
   isToolExecutionControlError,
   toolResultFromError
-} from "./index-k68e5jz0.js";
+} from "./index-s4c8wy8m.js";
 import {
   isRecord
 } from "./index-qyrqwr4c.js";

package/dist/{index-4kp4fxvp.js → index-f6n5n7nz.js}

@@ -1,7 +1,3 @@
-import {
-  base64UrlToBytes,
-  bytesToBase64Url
-} from "./index-rxfy4cq7.js";
 import {
   mapObjectTypeBoundary
 } from "./index-ksp6e2ye.js";
@@ -435,6 +431,24 @@ var ManagedFileRefSchema = z3.object({
 });
 // src/contract/pagination.ts
 import { z as z4 } from "zod";
+
+// src/internal/base64url.ts
+function bytesToBase64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes)
+    binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlToBytes(segment) {
+  if (!/^[A-Za-z0-9_-]*$/.test(segment) || segment.length % 4 === 1) {
+    throw new Error("invalid base64url segment");
+  }
+  const b64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = b64.padEnd(Math.ceil(b64.length / 4) * 4, "=");
+  return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
+}
+
+// src/contract/pagination.ts
 function paginatedSchema(itemSchema) {
   return z4.object({
     items: z4.array(itemSchema),

package/dist/{index-6wr9f6qm.js → index-jqtsc9mj.js}

@@ -1,10 +1,10 @@
 import {
   collectTools,
   createToolRunner
-} from "./index-885chjxq.js";
+} from "./index-7qy2ex0m.js";
 import {
   toolErrorFromResult
-} from "./index-k68e5jz0.js";
+} from "./index-s4c8wy8m.js";
 import {
   assertUniqueToolName
 } from "./index-22by16v6.js";

package/dist/{index-9c5dbr5q.js → index-k2zczx1g.js}

@@ -3,7 +3,7 @@ import {
 } from "./index-wwst0td5.js";
 import {
   contractToolMountable
-} from "./index-885chjxq.js";
+} from "./index-7qy2ex0m.js";
 import {
   projectToolSurface
 } from "./index-22by16v6.js";

package/dist/{index-v7xjfy10.js → index-m668wzyc.js}

@@ -15,7 +15,7 @@ import {
 import {
   ToolExecutionControlError,
   isToolExecutionControlError
-} from "./index-k68e5jz0.js";
+} from "./index-s4c8wy8m.js";
 import {
   AgentAssistantPlaceholderSchema,
   AgentJsonObjectSchema,

package/dist/{index-e0a57ymn.js → index-nemjkxjp.js}

@@ -3,7 +3,7 @@ import {
 } from "./index-nt1mp8km.js";
 import {
   isUnsafeKey
-} from "./index-hsz2mmk0.js";
+} from "./index-vj3vvpaa.js";
 import {
   isRecord
 } from "./index-qyrqwr4c.js";

package/dist/{index-9my2n66s.js → index-s2rchahr.js}

@@ -1,14 +1,14 @@
 import {
   collectToolSurface
-} from "./index-9c5dbr5q.js";
+} from "./index-k2zczx1g.js";
 import {
   createToolRunner,
   formatToolError
-} from "./index-885chjxq.js";
+} from "./index-7qy2ex0m.js";
 import {
   coerceJsonArgs,
   toolResultFromError
-} from "./index-k68e5jz0.js";
+} from "./index-s4c8wy8m.js";
 import {
   isWithinDir
 } from "./index-sbdmyz75.js";
@@ -27,7 +27,7 @@ import {
 import {
   isUnsafeKey,
   safeJsonParse
-} from "./index-hsz2mmk0.js";
+} from "./index-vj3vvpaa.js";
 import {
   isRecord
 } from "./index-qyrqwr4c.js";

package/dist/{index-k68e5jz0.js → index-s4c8wy8m.js}

@@ -1,7 +1,7 @@
 import {
   getRequestContext,
   runWithRequestContext
-} from "./index-e0a57ymn.js";
+} from "./index-nemjkxjp.js";
 import {
   objectShapeKeys
 } from "./index-22by16v6.js";
@@ -13,7 +13,7 @@ import {
 import {
   isUnsafeKey,
   safeJsonParse
-} from "./index-hsz2mmk0.js";
+} from "./index-vj3vvpaa.js";
 import {
   AppError,
   STITCH_ERROR_STATUS,

package/dist/{index-52400rdd.js → index-t8qyvrvg.js}

@@ -7,7 +7,7 @@ import {
   defaultSignalSource,
   guardSignalCallback,
   reportSignalError
-} from "./index-endzd8sj.js";
+} from "./index-vbf2p6me.js";
 import {
   extractIp,
   getClientInfo,
@@ -18,7 +18,7 @@ import {
   runWithRequestContext,
   setRequestEndpoint,
   setRequestError
-} from "./index-e0a57ymn.js";
+} from "./index-nemjkxjp.js";
 import {
   ShutdownOptionsSchema,
   isStreamCancellation,
@@ -39,7 +39,7 @@ import {
   joinRoutePath,
   parseTrailingWildcard,
   safeJsonParse
-} from "./index-hsz2mmk0.js";
+} from "./index-vj3vvpaa.js";
 import {
   AppError,
   badRequest

package/dist/{index-endzd8sj.js → index-vbf2p6me.js}

@@ -1,7 +1,7 @@
 import {
   isUnsafeKey,
   mergeMeta
-} from "./index-hsz2mmk0.js";
+} from "./index-vj3vvpaa.js";
 import {
   callRuntimeHandler,
   isRecord,

package/dist/{index-hsz2mmk0.js → index-vj3vvpaa.js}

@@ -272,6 +272,22 @@ function mergeMeta(contractMeta, endpointMeta) {
 import { z as z2 } from "zod";
 // src/contract/pagination.ts
 import { z as z3 } from "zod";
+
+// src/internal/base64url.ts
+function bytesToBase64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes)
+    binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlToBytes(segment) {
+  if (!/^[A-Za-z0-9_-]*$/.test(segment) || segment.length % 4 === 1) {
+    throw new Error("invalid base64url segment");
+  }
+  const b64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = b64.padEnd(Math.ceil(b64.length / 4) * 4, "=");
+  return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
+}
 // src/contract/stream.ts
 import { z as z4 } from "zod";
 var DEFAULT_CONTRACT_STREAM_FRAME_BYTES = 256 * 1024;
@@ -288,4 +304,4 @@ var ContractStreamFrameSchema = z4.discriminatedUnion("type", [
   }).strict(),
   z4.object({ type: z4.literal("end") }).strict()
 ]);
-export { joinRoutePath, parseTrailingWildcard, isUnsafeKey, safeJsonParse, defineContract, mergeMeta, DEFAULT_CONTRACT_STREAM_FRAME_BYTES, ContractStreamFrameSchema };
+export { joinRoutePath, parseTrailingWildcard, isUnsafeKey, safeJsonParse, defineContract, mergeMeta, bytesToBase64Url, base64UrlToBytes, DEFAULT_CONTRACT_STREAM_FRAME_BYTES, ContractStreamFrameSchema };

package/dist/index.js

@@ -27,8 +27,7 @@ import {
   parseTrailingWildcard,
   rateLimited,
   unauthorized
-} from "./index-4kp4fxvp.js";
-import"./index-rxfy4cq7.js";
+} from "./index-f6n5n7nz.js";
 import {
   isRecord,
   mapObject,

package/dist/internal/stable-digest.d.ts

@@ -1,3 +1,38 @@
+/**
+ * A stable identity for a call's arguments — one implementation, two callers.
+ *
+ * Two callers need the same thing for different reasons. The MCP round keys a
+ * tool invocation by `(operation, arguments)` so a retry is recognised as the
+ * same round; a watched read keys its shared source by `(operation, arguments)`
+ * so two browsers asking the same question are one read on the server. If those
+ * two computed the key differently, the same arguments would be the same round
+ * and two different watches — and nothing would say so.
+ *
+ * The stability that matters is key order: `{a:1,b:2}` and `{b:2,a:1}` are the
+ * same arguments and `JSON.stringify` disagrees, so a naive key silently splits
+ * one shared source into two whenever a caller builds its object in a different
+ * order. That is not a hypothetical: object literal order follows the source
+ * that wrote it, and two components asking the same question rarely share one.
+ *
+ * ## Why this is not SHA-256
+ *
+ * It was, and that made every watched read fail on an ordinary intranet. Web
+ * Crypto — `crypto.subtle` — exists only in a **secure context**, so a page
+ * served over plain HTTP from a LAN name has no `crypto.subtle` at all and the
+ * first digest throws `Cannot read properties of undefined`. `localhost` is
+ * secure by definition, which is exactly why nothing caught it until a browser
+ * opened the app by its name.
+ *
+ * The fix is not a fallback, it is admitting what this is for: **identity, not
+ * secrecy**. Nothing here resists an adversary — an attacker who can choose your
+ * watch arguments can already ask the question directly. So the requirement is
+ * distribution and determinism, both ends agreeing, and no ambient capability;
+ * a cryptographic hash bought none of that and cost the entire non-secure web.
+ *
+ * Being synchronous is the second thing it buys. A promise for a key made the
+ * first subscription of a question asynchronous, which meant a component could
+ * not be handed a retained value in the same turn it subscribed.
+ */
 /**
  * The value with every object's keys sorted, recursively — arrays keep their
  * order, because in an array order *is* the value.
@@ -7,12 +42,11 @@
  */
 export declare function stableValue(value: unknown): unknown;
 /**
- * A bounded, order-independent digest of a call's arguments.
+ * A bounded, order-independent identity for a call's arguments.
  *
- * SHA-256 over the key-sorted JSON, base64url without padding. Bounded because
- * the key travels on the wire and arguments do not have a bounded size; a hash
- * rather than the JSON itself so a large argument object does not become a
- * large subscription key repeated in every frame.
+ * 128 bits as 32 lowercase hex characters. Deterministic across runtimes and
+ * across both ends of a socket, synchronous, and dependent on no ambient
+ * capability — see the module header for why that last one is the whole point.
  *
  * What it cannot do, stated because the limit is easy to walk into: values
  * `JSON.stringify` drops or transforms — `undefined` members, a `Date`, a `Map`,
@@ -20,5 +54,5 @@ export declare function stableValue(value: unknown): unknown;
  * Contract arguments are parsed JSON, so this is the argument shape by
  * construction; a caller digesting something else has to say what it means.
  */
-export declare function argumentsDigest(args: Record<string, unknown>): Promise<string>;
+export declare function argumentsDigest(args: Record<string, unknown>): string;
 //# sourceMappingURL=stable-digest.d.ts.map

package/dist/internal/stable-digest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stable-digest.d.ts","sourceRoot":"","sources":["../../src/internal/stable-digest.ts"],"names":[],"mappings":"AAkBA;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAQnD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAGpF"}
+{"version":3,"file":"stable-digest.d.ts","sourceRoot":"","sources":["../../src/internal/stable-digest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAQnD;AAyCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAGrE"}

package/dist/live/watch-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"watch-client.d.ts","sourceRoot":"","sources":["../../src/live/watch-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEnE,OAAO,EACL,WAAW,EACX,UAAU,EACV,WAAW,EACX,WAAW,EACX,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,eAAe,EAErB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,WAAW,cAAc,CAAC,MAAM;IACpC,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,kEAAkE;IAClE,KAAK,CAAC,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,WAAW,CAAC,MAAM;IACjC,sFAAsF;IACtF,SAAS,CAAC,SAAS,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC;IACzD,wEAAwE;IACxE,KAAK,IAAI,IAAI,CAAC;CACf;AAED,sDAAsD;AACtD,MAAM,WAAW,kBAAkB;IACjC,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;IAC/B,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;CAChC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAC;IAClC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAC;IACpC,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAC;IACvC,kBAAkB,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAC;CACnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,kBAAkB,GAAG,cAAc,CAKzE;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,CAAC,MAAM,SAAS,MAAM,kBAAkB,EACxC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,KAAK,IAAI,GACrD,MAAM,IAAI,CAAC;IACd,IAAI,CAAC,KAAK,EAAE,OAAO,WAAW,EAAE,OAAO,EAAE;QAAE,GAAG,EAAE,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC;IACrE,OAAO,CACL,KAAK,EAAE,OAAO,UAAU,EACxB,OAAO,EAAE;QAAE,GAAG,EAAE,QAAQ,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,EACzC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAC7B,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD;;;;;;;OAOG;IACH,kBAAkB,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;CACzF;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,wEAAwE;IACxE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9D;AAuBD,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI;KACnE,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,WAAW,CAAC,OAAO,CAAC;CACzE,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACrE,QAAQ,EAAE,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,EAChC,MAAM,EAAE,iBAAiB,GACxB,gBAAgB,CAAC,CAAC,CAAC,CAwNrB"}
+{"version":3,"file":"watch-client.d.ts","sourceRoot":"","sources":["../../src/live/watch-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEnE,OAAO,EACL,WAAW,EACX,UAAU,EACV,WAAW,EACX,WAAW,EACX,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,eAAe,EAErB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,WAAW,cAAc,CAAC,MAAM;IACpC,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,kEAAkE;IAClE,KAAK,CAAC,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,WAAW,CAAC,MAAM;IACjC,sFAAsF;IACtF,SAAS,CAAC,SAAS,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC;IACzD,wEAAwE;IACxE,KAAK,IAAI,IAAI,CAAC;CACf;AAED,sDAAsD;AACtD,MAAM,WAAW,kBAAkB;IACjC,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;IAC/B,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;CAChC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAC;IAClC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAC;IACpC,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAC;IACvC,kBAAkB,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAC;CACnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,kBAAkB,GAAG,cAAc,CAKzE;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,CAAC,MAAM,SAAS,MAAM,kBAAkB,EACxC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,KAAK,IAAI,GACrD,MAAM,IAAI,CAAC;IACd,IAAI,CAAC,KAAK,EAAE,OAAO,WAAW,EAAE,OAAO,EAAE;QAAE,GAAG,EAAE,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC;IACrE,OAAO,CACL,KAAK,EAAE,OAAO,UAAU,EACxB,OAAO,EAAE;QAAE,GAAG,EAAE,QAAQ,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,EACzC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAC7B,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD;;;;;;;OAOG;IACH,kBAAkB,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;CACzF;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,wEAAwE;IACxE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9D;AAuBD,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI;KACnE,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,WAAW,CAAC,OAAO,CAAC;CACzE,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACrE,QAAQ,EAAE,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,EAChC,MAAM,EAAE,iBAAiB,GACxB,gBAAgB,CAAC,CAAC,CAAC,CAgLrB"}

package/dist/live.js

@@ -2,9 +2,6 @@ import {
   LiveStatePhaseSchema,
   LiveStateStopReasonSchema
 } from "./index-35z5h2ty.js";
-import {
-  bytesToBase64Url
-} from "./index-rxfy4cq7.js";
 
 // src/live/events.ts
 import { z } from "zod";
@@ -68,9 +65,36 @@ function stableValue(value) {
   }
   return result;
 }
-async function argumentsDigest(args) {
-  const bytes = new TextEncoder().encode(JSON.stringify(stableValue(args)));
-  return bytesToBase64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", bytes)));
+function mix128(input) {
+  let a = 2654435769;
+  let b = 2246822507;
+  let c = 3266489909;
+  let d = 668265263;
+  for (let index = 0;index < input.length; index += 1) {
+    const code = input.charCodeAt(index);
+    a = Math.imul(a ^ code, 2246822519);
+    b = Math.imul(b ^ code, 3266489917);
+    c = Math.imul(c ^ code, 668265263);
+    d = Math.imul(d ^ code, 374761393);
+    a = a << 13 | a >>> 19;
+    b = b << 17 | b >>> 15;
+    c = c << 7 | c >>> 25;
+    d = d << 11 | d >>> 21;
+  }
+  a ^= b >>> 15;
+  b ^= c >>> 13;
+  c ^= d >>> 11;
+  d ^= a >>> 9;
+  return [
+    Math.imul(a ^ a >>> 16, 575075507) >>> 0,
+    Math.imul(b ^ b >>> 13, 2654435761) >>> 0,
+    Math.imul(c ^ c >>> 16, 2246822507) >>> 0,
+    Math.imul(d ^ d >>> 15, 3266489909) >>> 0
+  ];
+}
+function argumentsDigest(args) {
+  const lanes = mix128(JSON.stringify(stableValue(args)) ?? "undefined");
+  return lanes.map((lane) => lane.toString(16).padStart(8, "0")).join("");
 }
 
 // src/live/watch-contract.ts
@@ -121,7 +145,6 @@ function watchTransport(client) {
 }
 function createWatchClient(contract, config) {
   const entries = new Map;
-  const digests = new Map;
   const holdMs = config.holdMs ?? 0;
   const openTimeoutMs = config.openTimeoutMs ?? 1e4;
   const service = contract.meta.prefix;
@@ -168,18 +191,6 @@ function createWatchClient(contract, config) {
       open(entry);
     }
   });
-  function cachedDigest(action, args) {
-    return digests.get(`${service}/${action}/${JSON.stringify(stableValue(args))}`);
-  }
-  async function resolveDigest(action, args) {
-    const cacheKey = `${service}/${action}/${JSON.stringify(stableValue(args))}`;
-    const cached = digests.get(cacheKey);
-    if (cached !== undefined)
-      return cached;
-    const digest = await argumentsDigest(args);
-    digests.set(cacheKey, digest);
-    return digest;
-  }
   function entryFor(key, args) {
     const id = watchKeyString(key);
     const existing = entries.get(id);
@@ -246,55 +257,27 @@ function createWatchClient(contract, config) {
   }
   function handleFor(action, args) {
     const mine = new Set;
-    let entry;
-    const known = cachedDigest(action, args);
-    if (known !== undefined)
-      entry = entryFor({ service, action, digest: known }, args);
-    const ready = (async () => {
-      if (entry)
-        return entry;
-      const digest = await resolveDigest(action, args);
-      entry = entryFor({ service, action, digest }, args);
-      return entry;
-    })();
+    const entry = entryFor({ service, action, digest: argumentsDigest(args) }, args);
     return {
       subscribe(listeners) {
         const registered = listeners;
         mine.add(registered);
-        if (entry) {
-          entry.listeners.add(registered);
-          if (entry.hasValue)
-            registered.value(entry.value);
-          registered.state?.(entry.state);
-        }
-        ready.then((target) => {
-          if (!mine.has(registered))
-            return;
-          if (!target.listeners.has(registered)) {
-            target.listeners.add(registered);
-            if (target.hasValue)
-              registered.value(target.value);
-            registered.state?.(target.state);
-          }
-          open(target);
-        });
+        entry.listeners.add(registered);
+        if (entry.hasValue)
+          registered.value(entry.value);
+        registered.state?.(entry.state);
+        open(entry);
         return () => {
           mine.delete(registered);
-          const target = entry;
-          if (!target)
-            return;
-          target.listeners.delete(registered);
-          releaseEntry(target);
+          entry.listeners.delete(registered);
+          releaseEntry(entry);
         };
       },
       close() {
-        const target = entry;
-        if (!target)
-          return;
         for (const listener of mine)
-          target.listeners.delete(listener);
+          entry.listeners.delete(listener);
         mine.clear();
-        releaseEntry(target);
+        releaseEntry(entry);
       }
     };
   }

package/dist/node.js

@@ -5,7 +5,7 @@ import {
   createHandler,
   createSocketIOServer,
   createUnixClientTransport
-} from "./index-52400rdd.js";
+} from "./index-t8qyvrvg.js";
 import {
   createImplement,
   createImplementRegistry,
@@ -14,8 +14,8 @@ import {
   createScopedImplementRegistry,
   implement,
   implementRegistry
-} from "./index-endzd8sj.js";
-import"./index-e0a57ymn.js";
+} from "./index-vbf2p6me.js";
+import"./index-nemjkxjp.js";
 import"./index-7b188kmz.js";
 import {
   ShutdownOptionsSchema,
@@ -25,8 +25,7 @@ import {
   createServerLifecycle
 } from "./index-3z73fh2c.js";
 import"./index-nt1mp8km.js";
-import"./index-hsz2mmk0.js";
-import"./index-rxfy4cq7.js";
+import"./index-vj3vvpaa.js";
 import {
   AppError,
   appError,

package/dist/observability/index.js

@@ -10,7 +10,7 @@ import {
   redact,
   sanitizePayload,
   truncatePreview
-} from "../index-28jsdwt1.js";
+} from "../index-aczggrty.js";
 import {
   getRequestContext,
   getTraceId,
@@ -21,7 +21,7 @@ import {
   setRequestError,
   setRequestUser,
   wrapInRequestContext
-} from "../index-e0a57ymn.js";
+} from "../index-nemjkxjp.js";
 import {
   childSpan,
   createTraceContext,
@@ -31,8 +31,7 @@ import {
   resolvePropagationContext,
   resolveTraceContext
 } from "../index-nt1mp8km.js";
-import"../index-hsz2mmk0.js";
-import"../index-rxfy4cq7.js";
+import"../index-vj3vvpaa.js";
 import"../index-0w9abg87.js";
 import {
   isRecord

package/dist/primitives.js

@@ -1,7 +1,6 @@
 import {
   ManagedFileRefSchema
-} from "./index-4kp4fxvp.js";
-import"./index-rxfy4cq7.js";
+} from "./index-f6n5n7nz.js";
 import"./index-ksp6e2ye.js";
 
 // src/primitives/audit.ts

package/dist/remote.js

@@ -1,13 +1,12 @@
 import {
   ApiError,
   createClient
-} from "./index-v5dm4bwq.js";
+} from "./index-58jzmnn4.js";
 import"./index-1rxswfbv.js";
 import"./index-nt1mp8km.js";
 import {
   mergeMeta
-} from "./index-hsz2mmk0.js";
-import"./index-rxfy4cq7.js";
+} from "./index-vj3vvpaa.js";
 import {
   AppError
 } from "./index-0w9abg87.js";

package/dist/server/index.js

@@ -13,7 +13,7 @@ import {
   sseRoute,
   streamingRoute,
   webSocketLane
-} from "../index-52400rdd.js";
+} from "../index-t8qyvrvg.js";
 import {
   composeAuthHooks,
   createAuthHook,
@@ -26,7 +26,7 @@ import {
   signJwt,
   verifyJwt,
   verifyPkce
-} from "../index-65kathdm.js";
+} from "../index-da1aqnhb.js";
 import {
   DEFAULT_CORS_ALLOW_HEADERS,
   DEFAULT_CORS_EXPOSE_HEADERS,
@@ -40,7 +40,7 @@ import {
   defineMultipartStream,
   implement,
   implementRegistry
-} from "../index-endzd8sj.js";
+} from "../index-vbf2p6me.js";
 import {
   extractIp,
   generateTraceId,
@@ -49,7 +49,7 @@ import {
   isPublicIp,
   resolveSocketIp,
   resolveTraceId
-} from "../index-e0a57ymn.js";
+} from "../index-nemjkxjp.js";
 import {
   isWithinDir,
   realPathWithinDir
@@ -81,8 +81,7 @@ import {
   DEFAULT_CONTRACT_STREAM_FRAME_BYTES,
   joinRoutePath,
   parseTrailingWildcard
-} from "../index-hsz2mmk0.js";
-import"../index-rxfy4cq7.js";
+} from "../index-vj3vvpaa.js";
 import {
   AppError,
   STITCH_ERROR_STATUS,

package/dist/testing.js

@@ -24,13 +24,12 @@ import {
 import {
   createClient,
   createClients
-} from "./index-v5dm4bwq.js";
+} from "./index-58jzmnn4.js";
 import"./index-1rxswfbv.js";
 import"./index-nt1mp8km.js";
 import {
   joinRoutePath
-} from "./index-hsz2mmk0.js";
-import"./index-rxfy4cq7.js";
+} from "./index-vj3vvpaa.js";
 import"./index-0w9abg87.js";
 import {
   isRecord

package/dist/tool-invoker.js

@@ -1,14 +1,13 @@
 import {
   createToolInvoker
-} from "./index-6wr9f6qm.js";
-import"./index-885chjxq.js";
-import"./index-k68e5jz0.js";
-import"./index-e0a57ymn.js";
+} from "./index-jqtsc9mj.js";
+import"./index-7qy2ex0m.js";
+import"./index-s4c8wy8m.js";
+import"./index-nemjkxjp.js";
 import"./index-22by16v6.js";
 import"./index-cby4ar3v.js";
 import"./index-nt1mp8km.js";
-import"./index-hsz2mmk0.js";
-import"./index-rxfy4cq7.js";
+import"./index-vj3vvpaa.js";
 import"./index-0w9abg87.js";
 import"./index-qyrqwr4c.js";
 import"./index-6k1937bx.js";

package/dist/tools.js

@@ -1,18 +1,18 @@
 import {
   redact
-} from "./index-28jsdwt1.js";
+} from "./index-aczggrty.js";
 import {
   buildToolManifest,
   mountAgent
-} from "./index-xgahrwdf.js";
+} from "./index-ezmn6ac6.js";
 import"./index-3xnq72rz.js";
 import {
   argumentsDigest
-} from "./index-vdvmcy7r.js";
+} from "./index-a916km3r.js";
 import {
   signJwt,
   verifyPkce
-} from "./index-65kathdm.js";
+} from "./index-da1aqnhb.js";
 import {
   DEFAULT_CORS_ALLOW_HEADERS,
   DEFAULT_PROCESS_SIGNALS,
@@ -20,10 +20,10 @@ import {
   defaultSignalSource,
   guardSignalCallback,
   reportSignalError
-} from "./index-endzd8sj.js";
+} from "./index-vbf2p6me.js";
 import {
   createToolInvoker
-} from "./index-6wr9f6qm.js";
+} from "./index-jqtsc9mj.js";
 import {
   WaitTimeoutError,
   createCli,
@@ -32,10 +32,10 @@ import {
   fetchPinnedDocument,
   readCapped,
   runWaitOperation
-} from "./index-9my2n66s.js";
+} from "./index-s2rchahr.js";
 import {
   collectToolSurface
-} from "./index-9c5dbr5q.js";
+} from "./index-k2zczx1g.js";
 import {
   createRuntimeToolFactory,
   defineRuntimeTool
@@ -44,19 +44,19 @@ import {
   collectTools,
   createToolRunner,
   formatToolError
-} from "./index-885chjxq.js";
+} from "./index-7qy2ex0m.js";
 import {
   ToolExecutionControlError,
   coerceJsonArgs,
   executeToolMethod,
   isToolExecutionControlError,
   toolResultFromError
-} from "./index-k68e5jz0.js";
+} from "./index-s4c8wy8m.js";
 import {
   getRequestContext,
   getTraceId,
   runWithRequestContext
-} from "./index-e0a57ymn.js";
+} from "./index-nemjkxjp.js";
 import {
   ManagedFileError
 } from "./index-bfcpjw20.js";
@@ -79,8 +79,7 @@ import {
 } from "./index-nt1mp8km.js";
 import {
   defineContract
-} from "./index-hsz2mmk0.js";
-import"./index-rxfy4cq7.js";
+} from "./index-vj3vvpaa.js";
 import {
   AppError,
   STITCH_ERROR_STATUS
@@ -1146,7 +1145,7 @@ async function resolveMcpRound(options) {
   });
   const requests = policy.inputRequired;
   const state = options.context.mcpReq.requestState();
-  const digest = await argumentsDigest(options.rawArgs);
+  const digest = argumentsDigest(options.rawArgs);
   if (!state) {
     if (isRecord(options.context.mcpReq.inputResponses)) {
       return failedResolution({

package/llms-full.txt

@@ -7657,6 +7657,13 @@ Without that, one address changing wakes every watcher of the operation. Twenty
 conversations open means twenty reads for one change — nineteen of them publish
 nothing, because nothing changed, and the read is paid anyway.
 
+The digest is a plain 128-bit hash computed in JavaScript, on purpose. It used
+to be SHA-256 through Web Crypto, which exists **only in a secure context** — so
+every watched read threw on a page served over plain HTTP from a LAN name, while
+`localhost` (secure by definition) and every test kept saying the code was fine.
+The key identifies a question; it does not protect one, and an attacker who can
+choose your watch arguments can already ask the question directly.
+
 ### Who shares with whom
 
 A key is `(service, action, digest of arguments)`, and everyone on that key gets

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stitchkit",
-  "version": "0.76.1",
+  "version": "0.76.2",
   "description": "Contract-first backend framework — one defineContract() into an HTTP API, MCP tools, AI-agent tools and a typed client. Bun and Node.",
   "keywords": [
     "bun",

package/dist/index-rxfy4cq7.js

@@ -1,17 +0,0 @@
-// src/internal/base64url.ts
-function bytesToBase64Url(bytes) {
-  let binary = "";
-  for (const byte of bytes)
-    binary += String.fromCharCode(byte);
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function base64UrlToBytes(segment) {
-  if (!/^[A-Za-z0-9_-]*$/.test(segment) || segment.length % 4 === 1) {
-    throw new Error("invalid base64url segment");
-  }
-  const b64 = segment.replace(/-/g, "+").replace(/_/g, "/");
-  const padded = b64.padEnd(Math.ceil(b64.length / 4) * 4, "=");
-  return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
-}
-
-export { bytesToBase64Url, base64UrlToBytes };

package/dist/index-vdvmcy7r.js

@@ -1,22 +0,0 @@
-import {
-  bytesToBase64Url
-} from "./index-rxfy4cq7.js";
-
-// src/internal/stable-digest.ts
-function stableValue(value) {
-  if (Array.isArray(value))
-    return value.map(stableValue);
-  if (value === null || typeof value !== "object")
-    return value;
-  const result = {};
-  for (const key of Object.keys(value).sort()) {
-    result[key] = stableValue(Reflect.get(value, key));
-  }
-  return result;
-}
-async function argumentsDigest(args) {
-  const bytes = new TextEncoder().encode(JSON.stringify(stableValue(args)));
-  return bytesToBase64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", bytes)));
-}
-
-export { stableValue, argumentsDigest };