llm-sse 0.4.1 → 0.4.3

package/CHANGELOG.md

@@ -4,6 +4,25 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project adheres
 to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.3] - 2026-06-05
+
+### Added
+
+- Added a public cross-provider stream fixture corpus for OpenAI, Anthropic and
+  Gemini weather-tool calls.
+- Added tests that parse the corpus and compare normalized `StreamEvent[]` and
+  collected message outputs, including byte-split stream boundaries.
+- Published the `fixtures/` directory in the npm package for downstream parser
+  and agent-loop tests.
+
+## [0.4.2] - 2026-06-04
+
+### Changed
+
+- Updated vulnerable development tooling and added CodeQL, OpenSSF Scorecard,
+  pinned GitHub Actions, least-privilege workflow permissions, Dependabot config
+  and a Scorecard README badge.
+
 ## [0.4.1] - 2026-06-04
 
 ### Changed

package/README.md

@@ -3,11 +3,15 @@
 [![npm version](https://img.shields.io/npm/v/llm-sse.svg)](https://www.npmjs.com/package/llm-sse)
 [![npm downloads](https://img.shields.io/npm/dm/llm-sse.svg)](https://www.npmjs.com/package/llm-sse)
 [![CI](https://github.com/slegarraga/llm-sse/actions/workflows/ci.yml/badge.svg)](https://github.com/slegarraga/llm-sse/actions/workflows/ci.yml)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/slegarraga/llm-sse/badge)](https://scorecard.dev/viewer/?uri=github.com/slegarraga/llm-sse)
 [![license](https://img.shields.io/npm/l/llm-sse.svg)](./LICENSE)
 [![zero dependencies](https://img.shields.io/badge/dependencies-0-brightgreen.svg)](./package.json)
 
 > Parse streaming responses from OpenAI, Anthropic, Gemini and OpenAI-compatible providers into one unified event format. Text, reasoning and tool-call deltas, handled. **Zero dependencies.**
 
+Security posture is tracked in [docs/security-posture.md](./docs/security-posture.md),
+including CodeQL, OpenSSF Scorecard, Dependabot and branch rules.
+
 Each provider streams differently. OpenAI sends `choices[].delta` chunks, Anthropic sends typed `content_block_*` / `message_*` events, Gemini sends `candidates[].content.parts` — and the SSE framing, tool-call argument fragments and stop reasons are all shaped differently. `llm-sse` turns any of them into the same small set of events, so your streaming UI or agent loop stays provider-agnostic.
 
 ```ts
@@ -32,6 +36,7 @@ for await (const event of parseOpenAIStream(res.body)) {
 - **One event shape, three providers.** `text`, `tool_call_start`, `tool_call_delta`, `finish`, `error` — the same whether the bytes came from OpenAI, Anthropic or Gemini.
 - **Tool calls just accumulate.** Streamed JSON argument fragments carry an `index`; concatenate by index (or let `collectStream` do it) to get the full call.
 - **Correct SSE framing.** Robust to chunk boundaries splitting a line or event mid-way, CRLF, multi-line `data:` fields, comments and keep-alives.
+- **Fixture-backed provider coverage.** Public OpenAI, Anthropic and Gemini `.sse` fixtures exercise text, reasoning, tool-call arguments and finish reasons.
 - **Bytes or strings.** Feed it a `fetch()` `ReadableStream<Uint8Array>`, a Node stream, or an async iterable of strings — multibyte UTF-8 split across chunks is handled.
 - **Zero dependencies**, ESM + CJS, fully typed.
 
@@ -102,6 +107,20 @@ The underlying SSE parser, exported for advanced use: yields the `data` payload
 
 All three providers are normalized to the same pattern: a `tool_call_start` (with `index`, and `id` / `name` when available) followed by one or more `tool_call_delta`s whose `argumentsDelta` strings concatenate into the call's JSON arguments. OpenAI and Anthropic fragment the arguments; Gemini sends them whole in a single delta. `collectStream` joins them for you.
 
+## Fixture corpus
+
+The package includes a small public fixture corpus under [`fixtures/`](./fixtures):
+
+- `openai-weather-tool.sse`
+- `anthropic-weather-tool.sse`
+- `gemini-weather-tool.sse`
+- expected normalized events and collected messages under `fixtures/expected/`
+
+Each fixture describes the same semantic turn: reasoning, visible text, a
+`get_weather` tool call, JSON arguments and provider-specific finish reason.
+The tests parse the fixtures directly, including byte-split stream boundaries,
+so contributors can change parsers with a stable cross-provider contract.
+
 ## Related
 
 - [`tool-schema`](https://www.npmjs.com/package/tool-schema) — convert a JSON Schema into OpenAI / Anthropic / Gemini / MCP tool schemas.

package/fixtures/README.md

@@ -0,0 +1,16 @@
+# Stream Fixture Corpus
+
+This corpus contains small, deterministic Server-Sent Events streams for the
+same semantic turn across providers:
+
+- OpenAI / OpenAI-compatible chat completions
+- Anthropic Messages streaming
+- Gemini `streamGenerateContent?alt=sse`
+
+Each `.sse` file is paired with expected normalized `StreamEvent[]` and
+`CollectedMessage` JSON. The fixtures are safe for public CI: they contain no
+API keys, no user data and no live provider responses.
+
+Use them when changing parsers, comparing providers or writing downstream tests
+that need stable examples of text, reasoning, tool-call arguments and finish
+reasons.

package/fixtures/anthropic-weather-tool.sse

@@ -0,0 +1,39 @@
+event: message_start
+data: {"type":"message_start","message":{"id":"msg_fixture_anthropic_weather","type":"message","role":"assistant","content":[]}}
+
+event: content_block_start
+data: {"type":"content_block_start","index":0,"content_block":{"type":"thinking","thinking":""}}
+
+event: content_block_delta
+data: {"type":"content_block_delta","index":0,"delta":{"type":"thinking_delta","thinking":"Need weather lookup. "}}
+
+event: content_block_stop
+data: {"type":"content_block_stop","index":0}
+
+event: content_block_start
+data: {"type":"content_block_start","index":1,"content_block":{"type":"text","text":""}}
+
+event: content_block_delta
+data: {"type":"content_block_delta","index":1,"delta":{"type":"text_delta","text":"Let me check Santiago. "}}
+
+event: content_block_stop
+data: {"type":"content_block_stop","index":1}
+
+event: content_block_start
+data: {"type":"content_block_start","index":2,"content_block":{"type":"tool_use","id":"toolu_weather_1","name":"get_weather","input":{}}}
+
+event: content_block_delta
+data: {"type":"content_block_delta","index":2,"delta":{"type":"input_json_delta","partial_json":"{\"city\":"}}
+
+event: content_block_delta
+data: {"type":"content_block_delta","index":2,"delta":{"type":"input_json_delta","partial_json":"\"Santiago\",\"units\":\"metric\"}"}}
+
+event: content_block_stop
+data: {"type":"content_block_stop","index":2}
+
+event: message_delta
+data: {"type":"message_delta","delta":{"stop_reason":"tool_use"}}
+
+event: message_stop
+data: {"type":"message_stop"}
+

package/fixtures/expected/anthropic-weather-tool.events.json

@@ -0,0 +1,17 @@
+[
+  { "type": "reasoning", "text": "Need weather lookup. " },
+  { "type": "text", "text": "Let me check Santiago. " },
+  {
+    "type": "tool_call_start",
+    "index": 2,
+    "id": "toolu_weather_1",
+    "name": "get_weather"
+  },
+  { "type": "tool_call_delta", "index": 2, "argumentsDelta": "{\"city\":" },
+  {
+    "type": "tool_call_delta",
+    "index": 2,
+    "argumentsDelta": "\"Santiago\",\"units\":\"metric\"}"
+  },
+  { "type": "finish", "reason": "tool_use" }
+]

package/fixtures/expected/anthropic-weather-tool.message.json

@@ -0,0 +1,13 @@
+{
+  "text": "Let me check Santiago. ",
+  "reasoning": "Need weather lookup. ",
+  "toolCalls": [
+    {
+      "index": 2,
+      "id": "toolu_weather_1",
+      "name": "get_weather",
+      "arguments": "{\"city\":\"Santiago\",\"units\":\"metric\"}"
+    }
+  ],
+  "finishReason": "tool_use"
+}

package/fixtures/expected/gemini-weather-tool.events.json

@@ -0,0 +1,11 @@
+[
+  { "type": "reasoning", "text": "Need weather lookup. " },
+  { "type": "text", "text": "Let me check Santiago. " },
+  { "type": "tool_call_start", "index": 0, "name": "get_weather" },
+  {
+    "type": "tool_call_delta",
+    "index": 0,
+    "argumentsDelta": "{\"city\":\"Santiago\",\"units\":\"metric\"}"
+  },
+  { "type": "finish", "reason": "STOP" }
+]

package/fixtures/expected/gemini-weather-tool.message.json

@@ -0,0 +1,12 @@
+{
+  "text": "Let me check Santiago. ",
+  "reasoning": "Need weather lookup. ",
+  "toolCalls": [
+    {
+      "index": 0,
+      "name": "get_weather",
+      "arguments": "{\"city\":\"Santiago\",\"units\":\"metric\"}"
+    }
+  ],
+  "finishReason": "STOP"
+}

package/fixtures/expected/openai-weather-tool.events.json

@@ -0,0 +1,17 @@
+[
+  { "type": "reasoning", "text": "Need weather lookup. " },
+  { "type": "text", "text": "Let me check Santiago. " },
+  {
+    "type": "tool_call_start",
+    "index": 0,
+    "id": "call_weather_1",
+    "name": "get_weather"
+  },
+  { "type": "tool_call_delta", "index": 0, "argumentsDelta": "{\"city\":" },
+  {
+    "type": "tool_call_delta",
+    "index": 0,
+    "argumentsDelta": "\"Santiago\",\"units\":\"metric\"}"
+  },
+  { "type": "finish", "reason": "tool_calls" }
+]

package/fixtures/expected/openai-weather-tool.message.json

@@ -0,0 +1,13 @@
+{
+  "text": "Let me check Santiago. ",
+  "reasoning": "Need weather lookup. ",
+  "toolCalls": [
+    {
+      "index": 0,
+      "id": "call_weather_1",
+      "name": "get_weather",
+      "arguments": "{\"city\":\"Santiago\",\"units\":\"metric\"}"
+    }
+  ],
+  "finishReason": "tool_calls"
+}

package/fixtures/gemini-weather-tool.sse

@@ -0,0 +1,6 @@
+data: {"candidates":[{"content":{"role":"model","parts":[{"text":"Need weather lookup. ","thought":true}]}}]}
+
+data: {"candidates":[{"content":{"role":"model","parts":[{"text":"Let me check Santiago. "}]}}]}
+
+data: {"candidates":[{"content":{"role":"model","parts":[{"functionCall":{"name":"get_weather","args":{"city":"Santiago","units":"metric"}}}]},"finishReason":"STOP"}]}
+

package/fixtures/openai-weather-tool.sse

@@ -0,0 +1,14 @@
+data: {"id":"chatcmpl_fixture_openai_weather","object":"chat.completion.chunk","choices":[{"index":0,"delta":{"role":"assistant","reasoning_content":"Need weather lookup. "}}]}
+
+data: {"id":"chatcmpl_fixture_openai_weather","object":"chat.completion.chunk","choices":[{"index":0,"delta":{"content":"Let me check Santiago. "}}]}
+
+data: {"id":"chatcmpl_fixture_openai_weather","object":"chat.completion.chunk","choices":[{"index":0,"delta":{"tool_calls":[{"index":0,"id":"call_weather_1","type":"function","function":{"name":"get_weather","arguments":""}}]}}]}
+
+data: {"id":"chatcmpl_fixture_openai_weather","object":"chat.completion.chunk","choices":[{"index":0,"delta":{"tool_calls":[{"index":0,"function":{"arguments":"{\"city\":"}}]}}]}
+
+data: {"id":"chatcmpl_fixture_openai_weather","object":"chat.completion.chunk","choices":[{"index":0,"delta":{"tool_calls":[{"index":0,"function":{"arguments":"\"Santiago\",\"units\":\"metric\"}"}}]}}]}
+
+data: {"id":"chatcmpl_fixture_openai_weather","object":"chat.completion.chunk","choices":[{"index":0,"delta":{},"finish_reason":"tool_calls"}]}
+
+data: [DONE]
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "llm-sse",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "Parse streaming SSE responses from OpenAI, Anthropic, Gemini and OpenAI-compatible providers into one unified event format. Text, reasoning and tool-call deltas. Zero dependencies.",
   "keywords": [
     "openai",
@@ -47,6 +47,7 @@
   },
   "files": [
     "dist",
+    "fixtures",
     "README.md",
     "LICENSE",
     "CHANGELOG.md"
@@ -74,6 +75,6 @@
     "tsup": "^8.3.5",
     "typescript": "^5.7.2",
     "typescript-eslint": "^8.60.0",
-    "vitest": "^2.1.8"
+    "vitest": "^4.1.8"
   }
 }