@abide/abide 0.28.0

package/src/lib/server/runtime/listenOnOpenPort.ts

@@ -0,0 +1,36 @@
+import type { Server } from 'bun'
+
+// Ports tried upward from `start` before giving up and letting the kernel assign one.
+const SCAN_RANGE = 100
+
+/*
+Binds the real server, scanning upward from `start` for the first free port.
+The listener that wins a port is the one that keeps it: unlike probing a
+throwaway server and releasing it before the real bind, this leaves no window
+for the chosen port to be stolen in between — the gap that crashed boot on
+EADDRINUSE instead of stepping to the next port. `bindAt` does the actual
+Bun.serve; only an in-use port is retried, any other failure propagates. After
+SCAN_RANGE occupied ports it binds port 0 so the kernel assigns any free port.
+*/
+export function listenOnOpenPort(
+    bindAt: (port: number) => Server<unknown>,
+    start: number,
+): Server<unknown> {
+    for (let port = start; port < start + SCAN_RANGE; port++) {
+        try {
+            return bindAt(port)
+        } catch (error) {
+            if (!isAddressInUse(error)) {
+                throw error
+            }
+            // port in use — try the next one up
+        }
+    }
+    // every candidate was taken; bind to 0 so the kernel picks a free port
+    return bindAt(0)
+}
+
+// Bun reports a taken port as an Error carrying code 'EADDRINUSE'.
+function isAddressInUse(error: unknown): boolean {
+    return error instanceof Error && (error as { code?: string }).code === 'EADDRINUSE'
+}

package/src/lib/server/runtime/logExposedSurfaces.ts

@@ -0,0 +1,156 @@
+import { abideLog } from '../../shared/abideLog.ts'
+import type { Pages } from '../../ui/types/Pages.ts'
+import { verbRegistry } from '../rpc/verbRegistry.ts'
+import { socketRegistry } from '../sockets/socketRegistry.ts'
+import { ensureRegistriesLoaded } from './registryManifests.ts'
+
+// Cell glyphs: PRESENT, ABSENT.
+const PRESENT = '✓'
+const ABSENT = '·'
+const COLUMN_GAP = 2
+
+const hasColor = typeof Bun !== 'undefined' && Bun.enableANSIColors
+// Red foreground then `\x1b[39m` (default-foreground, not full reset) so the enclosing dim survives.
+const redden = (text: string): string =>
+    hasColor ? `${Bun.color('red', 'ansi-256')}${text}\x1b[39m` : text
+
+/*
+A declared inputSchema is what makes mcp/cli safe to advertise (see defineVerb /
+defineSocket), so a missing schema gets a red `·` to flag the declaration whose
+machine surfaces are gated behind it.
+*/
+const schemaCell = (hasSchema: boolean): string => (hasSchema ? PRESENT : redden(ABSENT))
+const flag = (on: boolean): string => (on ? PRESENT : ABSENT)
+
+// Display width ignoring ANSI color escapes, so colored glyphs don't inflate alignment.
+// biome-ignore lint/suspicious/noControlCharactersInRegex: the ESC (\x1b) is the intended match — stripping the color escape to measure visible width
+const displayWidth = (cell: string): number => cell.replace(/\x1b\[[0-9;]*m/g, '').length
+
+// A titled table: its header row plus data rows, all sharing the column layout below.
+type SurfaceTable = { title: string; header: string[]; rows: string[][] }
+
+// Per-column width: the widest cell's display width across every row given.
+function columnWidths(rows: string[][]): number[] {
+    const columnCount = Math.max(...rows.map((row) => row.length))
+    return Array.from({ length: columnCount }, (_, column) =>
+        Math.max(...rows.map((row) => displayWidth(row[column] ?? ''))),
+    )
+}
+
+/*
+Left-aligns one row's cells into the given fixed column widths plus a gap.
+Padding is explicit spaces measured by displayWidth so embedded color escapes
+don't inflate the width and break alignment. Two-space indented.
+*/
+function renderRow(row: string[], widths: number[]): string {
+    return (
+        '  ' +
+        row
+            .map((cell, column) => {
+                /* widths covers every column (computed from the longest row); the fallback
+                   exists for noUncheckedIndexedAccess in consumer tsconfigs and pads only the gap. */
+                const width = widths[column] ?? displayWidth(cell)
+                return cell + ' '.repeat(width - displayWidth(cell) + COLUMN_GAP)
+            })
+            .join('')
+            .trimEnd()
+    )
+}
+
+/*
+Prints every non-empty table under one shared set of column widths, so the
+identifier and glyph columns line up vertically across the page/socket/rpc
+tables rather than each table aligning only within itself. Each table keeps its
+own dim header row.
+*/
+function logTables(tables: SurfaceTable[]): void {
+    const present = tables.filter((table) => table.rows.length > 0)
+    if (present.length === 0) {
+        return
+    }
+    const widths = columnWidths(present.flatMap((table) => [table.header, ...table.rows]))
+    present.forEach((table) => {
+        abideLog.info(`${table.title}:`)
+        abideLog.detail(
+            [table.header, ...table.rows].map((row) => renderRow(row, widths)).join('\n'),
+        )
+    })
+}
+
+/*
+Boot-time surface map: every page, socket, and rpc with the surfaces it is
+exposed on, so abide's routing and multimodal-by-default exposure are auditable
+rather than implicit. Three aligned tables — scan a column to spot a missing
+surface, a row to see one declaration's reach:
+
+  - pages: each route with the nearest layout and error boundary wrapping it.
+  - sockets: name + client surfaces (schema/browser/mcp/cli) and whether clients
+    may publish.
+  - rpcs: method+path (headed `http` since http/openapi are unconditional) +
+    per-declaration client surfaces.
+
+All three render under one shared column grid (see logTables): the identifier
+leads flush-left in every table — page route, socket name, or rpc method+path —
+then the surface columns, so the glyphs line up vertically across the tables.
+rpc folds its method into a left-aligned prefix of the identifier cell, so paths
+still start at a shared column. For sockets and rpcs the `schema`
+column leads: it's what unlocks the non-browser surfaces, so a missing schema
+reddens to flag the gated declaration. Loads the full registry, so it runs once
+at boot and only under `abide` debug logging (DEBUG=abide) to avoid forcing
+eager imports in production. Best-effort: enumeration failures are swallowed,
+this is diagnostic only.
+*/
+export async function logExposedSurfaces(routing: { pages: Pages }): Promise<void> {
+    try {
+        await ensureRegistriesLoaded()
+    } catch {
+        return
+    }
+
+    const pageRows = Object.keys(routing.pages)
+        .map((route) => [route])
+        .sort()
+
+    const socketRows = Array.from(socketRegistry.values(), (entry) => [
+        entry.socket.name,
+        schemaCell(Boolean(entry.schema)),
+        flag(entry.clients.browser),
+        flag(entry.clients.mcp),
+        flag(entry.clients.cli),
+        flag(entry.allowClientPublish),
+    ]).sort()
+
+    /*
+    rpc identifier = method left-aligned to a shared width then the path, so the
+    methods line up and every path starts at the same column — while the cell as
+    a whole still leads flush-left like the page route and socket name.
+    */
+    const methodWidth = Math.max(
+        'http'.length,
+        ...Array.from(verbRegistry.values(), (entry) => entry.remote.method.length),
+    )
+    const withMethod = (method: string, identifier: string): string =>
+        method.padEnd(methodWidth + COLUMN_GAP) + identifier
+
+    const rpcRows = Array.from(verbRegistry.values(), (entry) => [
+        withMethod(entry.remote.method, entry.remote.url),
+        schemaCell(Boolean(entry.inputSchema)),
+        flag(entry.clients.browser),
+        flag(entry.clients.mcp),
+        flag(entry.clients.cli),
+    ]).sort()
+
+    logTables([
+        { title: 'pages', header: ['page'], rows: pageRows },
+        {
+            title: 'sockets',
+            header: ['socket', 'schema', 'browser', 'mcp', 'cli', 'publish'],
+            rows: socketRows,
+        },
+        {
+            title: 'rpcs',
+            header: [withMethod('http', ''), 'schema', 'browser', 'mcp', 'cli'],
+            rows: rpcRows,
+        },
+    ])
+}

package/src/lib/server/runtime/maybeMountInspector.ts

@@ -0,0 +1,97 @@
+import { abideLog } from '../../shared/abideLog.ts'
+import { logTapSlot } from '../../shared/logTapSlot.ts'
+import { requestScopeSlot } from '../../shared/requestScopeSlot.ts'
+import { socketTapSlot } from '../../shared/socketTapSlot.ts'
+import type { LogRecord } from '../../shared/types/LogRecord.ts'
+import { buildCacheSnapshot } from './buildCacheSnapshot.ts'
+import { buildInspectorSurface } from './buildInspectorSurface.ts'
+import { ensureRegistriesLoaded } from './registryManifests.ts'
+import type { InspectorContext } from './types/InspectorContext.ts'
+
+/* The request handler `@abide/inspector` returns — serves its UI + data routes. */
+type InspectorHandler = (request: Request, url: URL) => Promise<Response>
+
+/* Shapes a published socket frame as a log record so the inspector's one feed
+   carries it like any other event — on the `socket` channel, tied to the active
+   trace when the publish happened inside a request (e.g. an RPC broadcasting). */
+function socketFrameRecord(frame: { socket: string; message: unknown }): LogRecord {
+    const scope = requestScopeSlot.resolver?.()
+    return {
+        ts: Date.now(),
+        level: 'info',
+        channel: 'socket',
+        msg: frame.socket,
+        data: frame.message,
+        trace: scope?.trace.traceId,
+        elapsedMs: scope?.elapsedMs,
+        method: scope?.method,
+        path: scope?.path,
+    }
+}
+
+/*
+Non-literal so Bun's bundler can't fold the optional package into a compiled
+binary: the import stays external and resolves only at runtime, only when the
+package is actually installed.
+*/
+const INSPECTOR_PACKAGE = '@abide/inspector'
+
+/*
+Activates the opt-in inspector when ABIDE_ENABLE_INSPECTOR=true. The flag is the
+activation switch; the package is installed explicitly (`bun add -d
+@abide/inspector`) — core never installs anything. Returns the package's request
+handler for createServer to route, or undefined when the flag is off or the
+package isn't present (with a one-line install hint in that case).
+
+The inspector exposes all traffic and the whole machine surface, so it's gated
+behind the operator's explicit flag and announces itself loudly on mount —
+enable it only in trusted/dev environments (mirrors warnUnguardedMcp).
+*/
+export async function maybeMountInspector(app: {
+    name: string
+    version: string
+}): Promise<InspectorHandler | undefined> {
+    if (process.env.ABIDE_ENABLE_INSPECTOR !== 'true') {
+        return undefined
+    }
+    const imported = (await import(INSPECTOR_PACKAGE).catch(() => undefined)) as
+        | { mountInspector: (context: InspectorContext) => InspectorHandler }
+        | undefined
+    if (!imported) {
+        abideLog.warn(
+            `ABIDE_ENABLE_INSPECTOR=true but ${INSPECTOR_PACKAGE} isn't installed — run \`bun add -d ${INSPECTOR_PACKAGE}\``,
+        )
+        return undefined
+    }
+    const context: InspectorContext = {
+        app,
+        loadSurface: async () => {
+            await ensureRegistriesLoaded()
+            return buildInspectorSurface()
+        },
+        cacheSnapshot: buildCacheSnapshot,
+        /*
+        One process-wide tap each for the log and socket chokepoints; the
+        inspector owns both and fans out to its readers. Socket frames arrive
+        shaped as `socket`-channel records, so the inspector sees a single
+        uniform event stream.
+        */
+        onRecord: (listener: (record: LogRecord) => void) => {
+            const onFrame = (frame: { socket: string; message: unknown }) =>
+                listener(socketFrameRecord(frame))
+            logTapSlot.tap = listener
+            socketTapSlot.tap = onFrame
+            return () => {
+                if (logTapSlot.tap === listener) {
+                    logTapSlot.tap = undefined
+                }
+                if (socketTapSlot.tap === onFrame) {
+                    socketTapSlot.tap = undefined
+                }
+            }
+        },
+    }
+    const handler = imported.mountInspector(context)
+    abideLog.warn('inspector enabled — exposes all traffic and the full surface; trusted use only')
+    return handler
+}

package/src/lib/server/runtime/mimeForExtension.ts

@@ -0,0 +1,14 @@
+/*
+Derives the MIME type from a URL pathname using Bun.file().type, which
+operates on the file extension synchronously without touching the disk. The
+Bun.file ref here is never read from — it exists only to reuse Bun's
+extension-to-MIME table. Cache by extension so repeat hits for the same
+chunk type (.js / .css / .map / .svg / …) skip the BunFile allocation.
+*/
+const mimeByExtension = new Map<string, string>()
+
+export function mimeForExtension(pathname: string): string {
+    const dot = pathname.lastIndexOf('.')
+    const extension = dot === -1 ? '' : pathname.slice(dot)
+    return mimeByExtension.getOrInsertComputed(extension, () => Bun.file(pathname).type)
+}

package/src/lib/server/runtime/pageUrlFromStore.ts

@@ -0,0 +1,15 @@
+import { withBaseUrl } from '../../shared/withBaseUrl.ts'
+import type { RequestStore } from './types/RequestStore.ts'
+
+/*
+The browser-space URL `page.url` publishes for a request: store.url with the
+mount base re-applied, matching what window.location shows under a proxy
+mount, so an active-state compare against url() output hydrates identically.
+store.url itself stays app-space (base-stripped by the proxy) for routing and
+error-prefix matching. Memoized on the store so repeated page-proxy reads
+share one URL.
+*/
+export function pageUrlFromStore(store: RequestStore): URL {
+    store.pageUrl ??= withBaseUrl(store.url)
+    return store.pageUrl
+}

package/src/lib/server/runtime/parseIdleTimeout.ts

@@ -0,0 +1,10 @@
+import { parseBoundedEnvInt } from '../../shared/parseBoundedEnvInt.ts'
+
+/*
+Parses ABIDE_IDLE_TIMEOUT into Bun's per-connection idle timeout in seconds.
+Bun accepts 0–255 (0 disables the timeout); returns undefined for missing,
+empty, or out-of-range/non-integer input so the caller keeps its default.
+*/
+export function parseIdleTimeout(value: string | undefined): number | undefined {
+    return parseBoundedEnvInt(value, 0, 255)
+}

package/src/lib/server/runtime/parsePort.ts

@@ -0,0 +1,11 @@
+import { parseBoundedEnvInt } from '../../shared/parseBoundedEnvInt.ts'
+
+/*
+Parses a PORT env value into a usable TCP port (0–65535), returning undefined
+for missing, empty, or out-of-range/non-integer input so the caller can fall
+back to a default. A bare Number() would turn '' into 0 (a random
+kernel-assigned port) and 'abc' into NaN, both silently wrong.
+*/
+export function parsePort(value: string | undefined): number | undefined {
+    return parseBoundedEnvInt(value, 0, 65535)
+}

package/src/lib/server/runtime/registryManifests.ts

@@ -0,0 +1,66 @@
+import type { PromptRoutes } from '../prompts/types/PromptRoutes.ts'
+import type { RemoteRoutes } from '../rpc/types/RemoteRoutes.ts'
+import type { SocketRoutes } from '../sockets/types/SocketRoutes.ts'
+
+/*
+Process-wide slot for the rpc + sockets + prompts manifests. createServer
+assigns once at boot (right after the route table is built); the MCP
+server, the OpenAPI emitter, and prompt enumeration read it on first
+request so they can lazy-import every module and walk the
+verb/socket/prompt registries.
+
+The slot pattern (mirrors getActiveServer) lets the framework-generated
+McpServer bind to the manifests at module scope while the loaders stay
+lazy until the first enumeration request.
+*/
+type RegistryManifests = {
+    rpc: RemoteRoutes
+    sockets: SocketRoutes
+    prompts: PromptRoutes
+}
+
+let manifests: RegistryManifests | undefined
+let loading: Promise<void> | undefined
+
+export function setRegistryManifests(value: RegistryManifests): void {
+    manifests = value
+    loading = undefined
+}
+
+/*
+On first call, eagerly imports every rpc + socket + prompt module so
+defineVerb / defineSocket / definePrompt fire and populate the
+registries. Idempotent — repeat calls reuse the same in-flight promise,
+so concurrent first requests (e.g. /openapi.json + an MCP tools/list)
+trigger exactly one load instead of racing to fire the full import set
+each. Eager loading is acceptable here because enumeration (MCP
+tool/resource/prompt lists, the OpenAPI document) fundamentally requires
+the full surface; the alternative of per-call lazy loading produces flaky
+first-call latency.
+*/
+export function ensureRegistriesLoaded(): Promise<void> {
+    if (!manifests) {
+        return Promise.resolve()
+    }
+    if (!loading) {
+        const { rpc, sockets, prompts } = manifests
+        loading = Promise.all([
+            ...Object.values(rpc).map((loader) => loader()),
+            ...Object.values(sockets).map((loader) => loader()),
+            ...Object.values(prompts).map((loader) => loader()),
+        ])
+            .then(() => undefined)
+            /*
+            Clear the memo on failure so a transient import error (a
+            module that throws at load, fixed by the next HMR pass)
+            doesn't poison every later enumeration request for the
+            process lifetime. The rejection still propagates to this
+            caller; the reset only affects subsequent calls.
+            */
+            .catch((error) => {
+                loading = undefined
+                throw error
+            })
+    }
+    return loading
+}

package/src/lib/server/runtime/requestContext.ts

@@ -0,0 +1,5 @@
+// AsyncLocalStorage is canonical via node:async_hooks — Bun has no separate API
+import { AsyncLocalStorage } from 'node:async_hooks'
+import type { RequestStore } from './types/RequestStore.ts'
+
+export const requestContext = new AsyncLocalStorage<RequestStore>()

package/src/lib/server/runtime/resolvePageSnapshot.ts

@@ -0,0 +1,25 @@
+import type { PageSnapshot } from '../../shared/types/PageSnapshot.ts'
+import { pageUrlFromStore } from './pageUrlFromStore.ts'
+import { requestContext } from './requestContext.ts'
+
+/*
+The server's page resolver: the `page` proxy reads route/params/url off the
+ALS request store, so layout-scoped components see the live match during SSR
+without a module singleton leaking across concurrent or streaming renders.
+route/params land just before render; url is set at the request boundary, so
+404/error renders still get a correct page.url. Registered by serverEntry at
+boot and mirrored by bootTestServer; undefined outside a request scope falls
+through to activePage's empty fallback.
+*/
+export function resolvePageSnapshot(): PageSnapshot | undefined {
+    const store = requestContext.getStore()
+    if (!store) {
+        return undefined
+    }
+    return {
+        route: store.route ?? '',
+        params: store.params ?? {},
+        url: pageUrlFromStore(store),
+        navigating: false,
+    }
+}

package/src/lib/server/runtime/respondWithEmbeddedAsset.ts

@@ -0,0 +1,18 @@
+/*
+Serves one compile-time-embedded asset: a gzip-capable client gets the stored
+bytes as-is, anyone else gets them decompressed on the fly. Shared by the
+`_app` and public/ asset servers so the decompress fallback lives once.
+*/
+export function respondWithEmbeddedAsset(
+    compressed: Uint8Array<ArrayBuffer>,
+    wantsGzip: boolean,
+    headers: { base: HeadersInit; gzip: HeadersInit },
+): Response {
+    if (wantsGzip) {
+        return new Response(compressed, { headers: headers.gzip })
+    }
+    /* gunzipSync's Buffer is freshly allocated over a plain ArrayBuffer; @types/bun widens it to ArrayBufferLike, which BodyInit rejects. */
+    return new Response(Bun.gunzipSync(compressed) as Uint8Array<ArrayBuffer>, {
+        headers: headers.base,
+    })
+}

package/src/lib/server/runtime/runWithRequestScope.ts

@@ -0,0 +1,150 @@
+import { abideLog } from '../../shared/abideLog.ts'
+import { createCacheStore } from '../../shared/createCacheStore.ts'
+import { createTraceContext } from '../../shared/createTraceContext.ts'
+import { formatTraceparent } from '../../shared/formatTraceparent.ts'
+import { isStreamingResponse } from '../../shared/isStreamingResponse.ts'
+import { logClosingRecord } from '../../shared/logClosingRecord.ts'
+import type { AppModule } from '../AppModule.ts'
+import { internalErrorResponse } from './internalErrorResponse.ts'
+import { requestContext } from './requestContext.ts'
+import type { RequestStore } from './types/RequestStore.ts'
+
+/*
+Establishes the per-request scope and runs `body` inside it: a fresh
+CacheStore, the request's trace position and start time, and request metadata
+published through the AsyncLocalStorage RequestStore (so cache(), request()/
+server(), trace(), and log prefixes resolve without threading args), the
+app's handleError — or the framework's 500 fallback — on a thrown body, and
+optional request logging. The single seam every dynamic route crosses;
+extracted from createServer so the scope, error, and logging behaviour is
+exercisable through this interface without booting a Bun server.
+*/
+export function runWithRequestScope(
+    req: Request,
+    /* `url` skips the WHATWG re-parse when the caller already parsed it (the fetch fallback). */
+    options: { app?: AppModule; logRequests: boolean; url?: URL },
+    body: (store: RequestStore) => Promise<Response>,
+): Promise<Response> {
+    const url = options.url ?? new URL(req.url)
+    const store: RequestStore = {
+        url,
+        req,
+        cache: createCacheStore(),
+        trace: createTraceContext(req.headers.get('traceparent')),
+        start: Bun.nanoseconds(),
+    }
+    return requestContext.run(store, async () => {
+        let response: Response
+        try {
+            response = await body(store)
+        } catch (error) {
+            if (options.app?.handleError) {
+                response = await options.app.handleError(error, req)
+            } else {
+                abideLog.error(error)
+                response = internalErrorResponse(error)
+            }
+        }
+        /*
+        Flush any cookies the handler set onto the outgoing response. Only when
+        a jar was materialized (cookies() was called) and only via append, so a
+        Set-Cookie the handler already placed on the response init survives.
+        */
+        if (store.cookies) {
+            const setCookies = store.cookies.toSetCookieHeaders()
+            if (setCookies.length > 0) {
+                try {
+                    setCookies.forEach((header) => {
+                        response.headers.append('set-cookie', header)
+                    })
+                } catch {
+                    /* A passthrough Response (proxied fetch) carries immutable headers;
+                       rebuild it with a mutable copy so the cookies still ship rather
+                       than the append throwing and 500ing the successful response. */
+                    response = new Response(response.body, response)
+                    setCookies.forEach((header) => {
+                        response.headers.append('set-cookie', header)
+                    })
+                }
+            }
+        }
+        /*
+        Server-Timing is always-on (identical dev/build): `total` is what's
+        knowable at header time — for streamed responses the settled total
+        belongs to the closing log record — and the `traceparent` entry is the
+        one header browsers expose to page JS, so RUM tooling links the
+        frontend to this trace. Guarded: a passthrough Response (proxied
+        fetch) carries immutable headers.
+        */
+        const headerMs = (Bun.nanoseconds() - store.start) / 1e6
+        const stats = store.cache.stats
+        const cacheEntry =
+            stats.hits + stats.misses + stats.coalesced > 0
+                ? `, cache;desc="hits=${stats.hits} misses=${stats.misses} coalesced=${stats.coalesced}"`
+                : ''
+        try {
+            response.headers.set(
+                'server-timing',
+                `total;dur=${headerMs.toFixed(1)}, traceparent;desc="${formatTraceparent(store.trace)}"${cacheEntry}`,
+            )
+        } catch {
+            /* Immutable headers — skip; the closing log record still reports. */
+        }
+        if (!options.logRequests) {
+            return response
+        }
+        /*
+        The closing record logs at settle so its elapsed IS the total. Buffered
+        responses settle here; streaming bodies (SSE/JSONL) settle when the
+        stream ends — re-entered into the request scope because stream
+        callbacks don't inherit the ALS context.
+        */
+        let settled = false
+        const emitClose = () => {
+            if (settled) {
+                return
+            }
+            settled = true
+            requestContext.run(store, () => {
+                const ms = (Bun.nanoseconds() - store.start) / 1e6
+                /* Copy freezes the tallies at settle — the live object keeps counting if late reads land. */
+                logClosingRecord(req.method, `${url.pathname}${url.search}`, response.status, ms, {
+                    ...store.cache.stats,
+                })
+            })
+        }
+        if (response.body && isStreamingResponse(response)) {
+            /*
+            A hand-pumped wrap rather than a TransformStream: streams typically
+            end by client disconnect (an SSE tab closing), which cancels the
+            readable without ever flushing a transform — Bun also skips the
+            transformer's cancel hook — so only this readable's own close/error/
+            cancel paths see every termination.
+            */
+            const reader = response.body.getReader()
+            const monitored = new ReadableStream({
+                async pull(controller) {
+                    try {
+                        const { done, value } = await reader.read()
+                        if (done) {
+                            emitClose()
+                            controller.close()
+                            return
+                        }
+                        controller.enqueue(value)
+                    } catch (error) {
+                        emitClose()
+                        controller.error(error)
+                    }
+                },
+                cancel(reason) {
+                    emitClose()
+                    return reader.cancel(reason)
+                },
+            })
+            return new Response(monitored, response)
+        }
+        emitClose()
+        return response
+    })
+}

package/src/lib/server/runtime/safeJsonForScript.ts

@@ -0,0 +1,17 @@
+/*
+Escapes characters that could prematurely terminate the surrounding <script>
+tag or be interpreted as HTML comment delimiters when a JSON literal is
+inlined into an HTML document. U+2028 (LS) and U+2029 (PS) are valid in JSON
+but break a `<script>` tag's inline content because the JavaScript lexer
+treats them as line terminators; encode them as Unicode escapes.
+*/
+const LINE_SEPARATOR = String.fromCharCode(0x2028)
+const PARAGRAPH_SEPARATOR = String.fromCharCode(0x2029)
+
+export function safeJsonForScript(value: unknown): string {
+    return JSON.stringify(value)
+        .replace(/</g, '\\u003c')
+        .replace(/-->/g, '--\\u003e')
+        .replaceAll(LINE_SEPARATOR, '\\u2028')
+        .replaceAll(PARAGRAPH_SEPARATOR, '\\u2029')
+}