stitchkit 0.2.0 → 0.4.0

package/dist/{index-v2z2v3mq.js → index-3qmtdfpa.js}

@@ -1,70 +1,121 @@
 import {
-  normalizeError
-} from "./index-a35v22fh.js";
+  isWithinDir
+} from "./index-x3fcszf8.js";
+import {
+  normalizeError,
+  validateHandlerOutput
+} from "./index-vhdvv00d.js";
 import {
   AppError,
   badRequest
-} from "./index-kckky6zw.js";
+} from "./index-afzt3nmx.js";
 import {
   extractIp,
   getClientInfo,
   parseQueryParams,
+  resolveSocketIp,
   resolveTraceId
-} from "./index-ke4mx4ea.js";
+} from "./index-mwmpw6j1.js";
+import {
+  isUnsafeKey,
+  safeJsonParse
+} from "./index-kzfs85xp.js";
+import {
+  typedEntries
+} from "./index-809wc1tt.js";
+import {
+  __require
+} from "./index-37x76zdn.js";
 
 // src/server/multipart.ts
 var DEFAULT_MAX_UPLOAD_BYTES = 25 * 1024 * 1024;
-async function parseMultipart(req, fileField, fieldsSchema, maxBytes = DEFAULT_MAX_UPLOAD_BYTES) {
-  const declared = Number(req.headers.get("content-length") ?? 0);
-  if (declared > maxBytes) {
-    badRequest(`Upload exceeds the ${Math.round(maxBytes / 1024 / 1024)} MB limit`);
+async function readBodyCapped(req, maxBytes) {
+  const reader = req.body?.getReader();
+  if (!reader)
+    return new Uint8Array(0);
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      total += value.length;
+      if (total > maxBytes) {
+        await reader.cancel();
+        badRequest(`Upload exceeds the ${Math.round(maxBytes / 1024 / 1024)} MB limit`);
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const buffer = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    buffer.set(chunk, offset);
+    offset += chunk.length;
   }
-  const formData = await req.formData();
+  return buffer;
+}
+async function parseMultipart(req, fileField, fieldsSchema, maxBytes = DEFAULT_MAX_UPLOAD_BYTES) {
+  const body = await readBodyCapped(req, maxBytes);
+  const contentType = req.headers.get("content-type") ?? "";
+  const formData = await new Response(body, {
+    headers: { "content-type": contentType }
+  }).formData();
   const file = formData.get(fileField);
   if (!file || !(file instanceof File)) {
     badRequest(`Missing file field: ${fileField}`);
   }
-  if (file.size > maxBytes) {
-    badRequest(`Upload exceeds the ${Math.round(maxBytes / 1024 / 1024)} MB limit`);
-  }
   const fields = {};
   for (const [key, value] of formData.entries()) {
     if (key === fileField)
       continue;
+    if (isUnsafeKey(key))
+      continue;
     if (typeof value === "string") {
       try {
-        fields[key] = JSON.parse(value);
+        fields[key] = safeJsonParse(value);
       } catch {
         fields[key] = value;
       }
     }
   }
-  const parsed = fieldsSchema ? fieldsSchema.parse(fields) : fields;
-  return { file, fields: parsed };
+  return { file, fields: fieldsSchema ? fieldsSchema.parse(fields) : fields };
 }
 
 // src/server/middleware/cors.ts
-function corsHeaders(config, requestOrigin) {
-  let allowOrigin;
+function assertCorsConfig(config) {
+  if (config.credentials && (config.origin === undefined || config.origin === "*")) {
+    throw new Error("[stitchkit] cors: `credentials: true` cannot be combined with a wildcard origin. " + "Set `origin` to an explicit string or list.");
+  }
+}
+function resolveOrigin(config, requestOrigin) {
   if (config.origin === undefined || config.origin === "*") {
-    allowOrigin = config.credentials ? requestOrigin ?? undefined : "*";
-  } else if (Array.isArray(config.origin)) {
-    allowOrigin = requestOrigin && config.origin.includes(requestOrigin) ? requestOrigin : undefined;
-  } else {
-    allowOrigin = config.origin;
+    return "*";
+  }
+  if (Array.isArray(config.origin)) {
+    if (!requestOrigin)
+      return;
+    const lower = requestOrigin.toLowerCase();
+    return config.origin.some((o) => o.toLowerCase() === lower) ? requestOrigin : undefined;
   }
+  return config.origin;
+}
+function corsHeaders(config, requestOrigin) {
+  const allowOrigin = resolveOrigin(config, requestOrigin);
   const headers = {
     "Access-Control-Allow-Methods": config.methods ?? "GET, POST, PUT, PATCH, DELETE, OPTIONS",
     "Access-Control-Allow-Headers": config.headers ?? "Content-Type, Authorization, X-Trace-Id"
   };
   if (allowOrigin !== undefined) {
     headers["Access-Control-Allow-Origin"] = allowOrigin;
+    if (config.credentials) {
+      headers["Access-Control-Allow-Credentials"] = "true";
+    }
   }
-  if (config.credentials) {
-    headers["Access-Control-Allow-Credentials"] = "true";
-  }
-  const variesByOrigin = Array.isArray(config.origin) || (config.origin === undefined || config.origin === "*") && Boolean(config.credentials);
-  if (variesByOrigin) {
+  if (Array.isArray(config.origin)) {
     headers.Vary = "Origin";
   }
   return headers;
@@ -77,7 +128,8 @@ function corsPreflightResponse(config, req) {
 }
 
 // src/server/router.ts
-import { resolve, sep } from "node:path";
+import { readFile, stat } from "node:fs/promises";
+import { extname, resolve } from "node:path";
 function joinPath(...parts) {
   const joined = parts.filter(Boolean).map((part) => part.replace(/^\/+|\/+$/g, "")).filter(Boolean).join("/");
   return `/${joined}`;
@@ -195,25 +247,51 @@ function matchRawRoute(rawRoutes, httpMethod, pathname) {
   }
   return null;
 }
+var STATIC_MIME = {
+  ".html": "text/html; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".ico": "image/x-icon",
+  ".woff2": "font/woff2",
+  ".txt": "text/plain; charset=utf-8"
+};
 function staticRoute(prefix, dir) {
   const cleanPrefix = prefix.replace(/\/+$/, "");
-  const cleanDir = dir.replace(/\/+$/, "");
+  const root = resolve(dir.replace(/\/+$/, ""));
   return {
     method: "GET",
     path: `${cleanPrefix}/*`,
     handler: async (req) => {
       const pathname = new URL(req.url).pathname;
-      const rel = pathname.slice(cleanPrefix.length).replace(/^\/+/, "");
-      const root = resolve(cleanDir);
+      let rel;
+      try {
+        rel = decodeURIComponent(pathname.slice(cleanPrefix.length)).replace(/^\/+/, "");
+      } catch {
+        return new Response("Bad request", { status: 400 });
+      }
       const target = resolve(root, rel);
-      if (target !== root && !target.startsWith(root + sep)) {
+      if (!isWithinDir(root, target)) {
         return new Response("Forbidden", { status: 403 });
       }
-      const file = Bun.file(target);
-      if (!await file.exists()) {
+      const info = await stat(target).catch(() => null);
+      if (!info?.isFile()) {
         return new Response("Not found", { status: 404 });
       }
-      return new Response(file);
+      const body = await readFile(target);
+      return new Response(body, {
+        headers: {
+          "Content-Type": STATIC_MIME[extname(target).toLowerCase()] ?? "application/octet-stream",
+          "X-Content-Type-Options": "nosniff"
+        }
+      });
     }
   };
 }
@@ -235,13 +313,16 @@ async function readJsonBody(req) {
   const text = await req.text();
   if (text.trim() === "")
     return {};
+  if (!req.headers.get("content-type")?.includes("application/json")) {
+    badRequest("Request body must be application/json");
+  }
   try {
-    return JSON.parse(text);
+    return safeJsonParse(text);
   } catch {
     badRequest("Invalid JSON body");
   }
 }
-async function buildContext(req, url, method, pathParams, traceId) {
+async function buildContext(req, url, method, pathParams, traceId, clientIp) {
   const parsedParams = method.paramsSchema ? method.paramsSchema.parse(pathParams) : undefined;
   let parsedInput;
   let file;
@@ -265,7 +346,7 @@ async function buildContext(req, url, method, pathParams, traceId) {
   }
   const safePathParams = {};
   for (const [k, v] of Object.entries(pathParams)) {
-    if (!RESERVED_KEYS.has(k))
+    if (!RESERVED_KEYS.has(k) && !isUnsafeKey(k))
       safePathParams[k] = v;
   }
   return {
@@ -278,10 +359,10 @@ async function buildContext(req, url, method, pathParams, traceId) {
     headers: req.headers,
     ...safePathParams,
     traceId,
-    ...getClientInfo(req)
+    ...getClientInfo(req, clientIp)
   };
 }
-function buildErrorContext(req, url, traceId) {
+function buildErrorContext(req, url, traceId, clientIp) {
   return {
     params: undefined,
     input: undefined,
@@ -290,7 +371,7 @@ function buildErrorContext(req, url, traceId) {
     url,
     headers: req.headers,
     traceId,
-    ...getClientInfo(req)
+    ...getClientInfo(req, clientIp)
   };
 }
 
@@ -326,7 +407,10 @@ function timestamp() {
   return `${t}.${now.getMilliseconds().toString().padStart(3, "0")}`;
 }
 function elapsedMs(startTime) {
-  return Number(process.hrtime.bigint() - startTime) / 1e6;
+  return performance.now() - startTime;
+}
+function safePath(pathname) {
+  return pathname.replace(/[-]/g, "");
 }
 function levelForStatus(status) {
   if (status >= 500)
@@ -372,15 +456,15 @@ function shouldLog(pathname, method) {
     return false;
   return !SKIP_PREFIXES.some((prefix) => pathname.startsWith(prefix));
 }
-function logIncoming(req, pathname, traceId) {
-  const log = { traceId, startTime: process.hrtime.bigint() };
+function logIncoming(req, pathname, traceId, ipAddress) {
+  const log = { traceId, startTime: performance.now() };
   if (!isProd) {
     const mc = METHOD_COLOR[req.method] ?? c.dim;
-    console.log(`${c.gray}[${timestamp()}]${c.reset} ${mc}${req.method}${c.reset} ${c.dim}${traceId}${c.reset} ${c.cyan}→${c.reset} ${pathname} ${ipLabel(extractIp(req))}`);
+    console.log(`${c.gray}[${timestamp()}]${c.reset} ${mc}${req.method}${c.reset} ${c.dim}${traceId}${c.reset} ${c.cyan}→${c.reset} ${safePath(pathname)} ${ipLabel(ipAddress ?? "")}`);
   }
   return log;
 }
-function logOutgoing(req, pathname, status, log) {
+function logOutgoing(req, pathname, status, log, ipAddress) {
   const ms = elapsedMs(log.startTime);
   if (isProd) {
     console.log(JSON.stringify({
@@ -388,42 +472,45 @@ function logOutgoing(req, pathname, status, log) {
       level: levelForStatus(status),
       msg: `${req.method} ${pathname} ${status}`,
       ...buildLogFields(req.method, pathname, status, Math.round(ms), log.traceId),
-      ip: extractIp(req) || undefined
+      ip: ipAddress
     }));
     return;
   }
   const mc = METHOD_COLOR[req.method] ?? c.dim;
-  console.log(`${c.gray}[${timestamp()}]${c.reset} ${mc}${req.method}${c.reset} ${c.dim}${log.traceId}${c.reset} ${c.cyan}←${c.reset} ${pathname} ${statusColor(status)}${status}${c.reset} ${durationColor(ms)}${formatMs(ms)}${c.reset} ${ipLabel(extractIp(req))}`);
+  console.log(`${c.gray}[${timestamp()}]${c.reset} ${mc}${req.method}${c.reset} ${c.dim}${log.traceId}${c.reset} ${c.cyan}←${c.reset} ${safePath(pathname)} ${statusColor(status)}${status}${c.reset} ${durationColor(ms)}${formatMs(ms)}${c.reset} ${ipLabel(ipAddress ?? "")}`);
 }
 
 // src/server/create.ts
 function createHandler(config) {
-  const { cors, hooks, logging = false } = config;
+  const { cors, hooks, logging = false, trustProxy = false } = config;
+  if (cors)
+    assertCorsConfig(cors);
   const customLogger = typeof logging === "object" ? logging : null;
   const useDefaultLog = logging === true;
   const resolveId = config.traceId ?? resolveTraceId;
   const routeMap = buildRouteMap(normalizeGroups(config));
   validateRoutes(routeMap);
-  async function dispatch(req, url, traceId, server) {
+  async function dispatch(req, url, traceId, server, clientIp) {
     const shouldLogRequest = logging && shouldLog(url.pathname, req.method);
+    const ipAddress = extractIp(req, clientIp) || undefined;
     let reqLog;
     if (shouldLogRequest && useDefaultLog) {
-      reqLog = logIncoming(req, url.pathname, traceId);
+      reqLog = logIncoming(req, url.pathname, traceId, ipAddress);
     }
     if (shouldLogRequest && customLogger) {
       customLogger.debug(`${req.method} ${url.pathname}`, {
         traceId,
         method: req.method,
         path: url.pathname,
-        ip: extractIp(req) || undefined
+        ip: ipAddress
       });
-      reqLog = { traceId, startTime: process.hrtime.bigint() };
+      reqLog = { traceId, startTime: performance.now() };
     }
     const logDone = (status) => {
       if (!reqLog)
         return;
       if (useDefaultLog)
-        logOutgoing(req, url.pathname, status, reqLog);
+        logOutgoing(req, url.pathname, status, reqLog, ipAddress);
       if (customLogger) {
         const durationMs = Math.round(elapsedMs(reqLog.startTime));
         const level = levelForStatus(status);
@@ -433,7 +520,7 @@ function createHandler(config) {
     const respondError = async (err, errCtx, endpoint) => {
       if (hooks?.onError) {
         try {
-          const response = await hooks.onError(errCtx ?? buildErrorContext(req, url, traceId), err, endpoint);
+          const response = await hooks.onError(errCtx ?? buildErrorContext(req, url, traceId, clientIp), err, endpoint);
           if (response instanceof Response) {
             const withCors = applyCors(response, cors, req);
             logDone(withCors.status);
@@ -463,7 +550,8 @@ function createHandler(config) {
         try {
           const res = await rawMatch.route.handler(req, {
             params: rawMatch.params,
-            server
+            server,
+            ipAddress
           });
           const withCors = applyCors(res, cors, req);
           logDone(withCors.status);
@@ -486,7 +574,7 @@ function createHandler(config) {
     const { method, pathParams, groupHooks } = match;
     let ctx;
     try {
-      ctx = await buildContext(req, url, method, pathParams, traceId);
+      ctx = await buildContext(req, url, method, pathParams, traceId, clientIp);
       if (hooks?.beforeHandle) {
         await hooks.beforeHandle(ctx, method);
       }
@@ -505,7 +593,11 @@ function createHandler(config) {
           result = transformed;
       }
       if (method.outputSchema) {
-        result = method.outputSchema.parse(result);
+        const checked = validateHandlerOutput(method.outputSchema, result);
+        if (!checked.ok) {
+          throw new AppError("INTERNAL_SERVER_ERROR", checked.message, 500);
+        }
+        result = checked.data;
       }
       if (result === undefined || result === null) {
         logDone(204);
@@ -520,10 +612,14 @@ function createHandler(config) {
   return async (req, server) => {
     const url = new URL(req.url, "http://localhost");
     const traceId = resolveId(req);
-    const response = await dispatch(req, url, traceId, server);
-    if (!response.headers.has("x-request-id")) {
+    const clientIp = {
+      trustProxy,
+      socketIp: resolveSocketIp(req, server)
+    };
+    const response = await dispatch(req, url, traceId, server, clientIp);
+    try {
       response.headers.set("x-request-id", traceId);
-    }
+    } catch {}
     return response;
   };
 }
@@ -584,4 +680,150 @@ function json(data, status, cors, req) {
   return Response.json(data, { status, headers: corsHeaders2(cors, req) });
 }
 
-export { parseMultipart, corsHeaders, corsPreflightResponse, staticRoute, createHandler, createServer };
+// src/server/implement.ts
+function implement(contract, handlers) {
+  const methods = {};
+  const groupScope = contract.meta.scope ?? "public";
+  for (const [key, endpoint] of typedEntries(contract.endpoints)) {
+    const typedHandler = handlers[key];
+    methods[String(key)] = {
+      method: endpoint.method,
+      path: endpoint.path,
+      desc: endpoint.desc,
+      toolName: "toolName" in endpoint ? endpoint.toolName : undefined,
+      expose: endpoint.expose,
+      scope: endpoint.scope ?? groupScope,
+      paramsSchema: endpoint.params,
+      inputSchema: endpoint.input,
+      outputSchema: endpoint.output,
+      multipart: endpoint.multipart,
+      ui: "ui" in endpoint ? endpoint.ui : undefined,
+      annotations: "annotations" in endpoint ? endpoint.annotations : undefined,
+      handler: (ctx) => typedHandler(ctx)
+    };
+  }
+  return {
+    name: contract.meta.prefix,
+    prefix: contract.meta.prefix,
+    scope: groupScope,
+    methods
+  };
+}
+function createImplement() {
+  return (contract, handlers) => implement(contract, handlers);
+}
+
+// src/server/websocket.ts
+function webSocketLane(lane) {
+  const { match, handlers } = lane;
+  return {
+    match,
+    handlers: {
+      message(ws, message) {
+        if (match(ws))
+          handlers.message(ws, message);
+      },
+      open(ws) {
+        if (match(ws))
+          handlers.open?.(ws);
+      },
+      close(ws, code, reason) {
+        if (match(ws))
+          handlers.close?.(ws, code, reason);
+      },
+      drain(ws) {
+        if (match(ws))
+          handlers.drain?.(ws);
+      },
+      ping(ws, data) {
+        if (match(ws))
+          handlers.ping?.(ws, data);
+      },
+      pong(ws, data) {
+        if (match(ws))
+          handlers.pong?.(ws, data);
+      }
+    }
+  };
+}
+function composeWebSocketHandlers(lanes, config) {
+  const pick = (ws) => lanes.find((lane) => lane.match(ws));
+  return {
+    ...config,
+    message(ws, message) {
+      pick(ws)?.handlers.message(ws, message);
+    },
+    open(ws) {
+      pick(ws)?.handlers.open?.(ws);
+    },
+    close(ws, code, reason) {
+      pick(ws)?.handlers.close?.(ws, code, reason);
+    },
+    drain(ws) {
+      pick(ws)?.handlers.drain?.(ws);
+    },
+    ping(ws, data) {
+      pick(ws)?.handlers.ping?.(ws, data);
+    },
+    pong(ws, data) {
+      pick(ws)?.handlers.pong?.(ws, data);
+    }
+  };
+}
+
+// src/server/socket-io.ts
+var noop = () => {};
+async function createSocketIOServer(config) {
+  const path = config.path ?? "/socket.io/";
+  const onBun = "Bun" in globalThis;
+  const transports = config.transports ?? (onBun ? ["websocket", "polling"] : ["websocket"]);
+  const { Server } = await import("socket.io");
+  const io = new Server({
+    path,
+    cors: {
+      origin: config.cors.origin,
+      credentials: config.cors.credentials ?? true,
+      methods: ["GET", "POST"]
+    },
+    transports,
+    pingTimeout: config.pingTimeout ?? 20000,
+    pingInterval: config.pingInterval ?? 1e4
+  });
+  if (onBun) {
+    const { Server: Engine } = await import("@socket.io/bun-engine");
+    const engine = new Engine({ path });
+    io.bind(engine);
+    const { websocket } = engine.handler();
+    const route = {
+      method: "ALL",
+      path: `${path.replace(/\/+$/, "")}/*`,
+      handler: (req, ctx) => {
+        if (!ctx.server) {
+          throw new Error("[stitchkit] createSocketIOServer route needs a running Bun server — mount it via createServer.");
+        }
+        return engine.handleRequest(req, ctx.server);
+      }
+    };
+    return { io, websocket, route, attach: noop };
+  }
+  return {
+    io,
+    attach: (server) => io.attach(server),
+    websocket: { open: noop, message: noop, close: noop, maxPayloadLength: 0 },
+    route: {
+      method: "ALL",
+      path: `${path.replace(/\/+$/, "")}/*`,
+      handler: () => {
+        throw new Error("[stitchkit] On Node, Socket.IO attaches via serveNode({ socket }) — this route is not mounted.");
+      }
+    }
+  };
+}
+function socketIoLane(websocket) {
+  return webSocketLane({
+    match: (_ws) => true,
+    handlers: websocket
+  });
+}
+
+export { parseMultipart, corsHeaders, corsPreflightResponse, staticRoute, createHandler, createServer, implement, createImplement, webSocketLane, composeWebSocketHandlers, createSocketIOServer, socketIoLane };

package/dist/index-48ffdxgk.js

@@ -0,0 +1,6 @@
+// src/internal/http-input.ts
+function inputIsQuery(method) {
+  return method === "GET" || method === "DELETE";
+}
+
+export { inputIsQuery };

package/dist/{index-5sxnvwb1.js → index-78q1qm7v.js}

@@ -1,3 +1,6 @@
+import {
+  inputIsQuery
+} from "./index-48ffdxgk.js";
 import {
   isRecord,
   mapObject,
@@ -40,7 +43,7 @@ function createHttpClient(config) {
   let ssrCookies = null;
   let isLoggedOut = false;
   const listeners = new Set;
-  const authEndpoints = config.authEndpoints ?? ["auth/"];
+  const authEndpoints = config.authEndpoints ?? ["/auth/"];
   const parseError = config.parseError ?? parseApiErrorBody;
   function emit(event) {
     for (const fn of listeners) {
@@ -76,7 +79,7 @@ function createHttpClient(config) {
         async ({ request: request2, response }) => {
           if (response.status === 401) {
             const url = new URL(request2.url).pathname;
-            if (!isLoggedOut && !authEndpoints.some((path) => url.includes(path))) {
+            if (!isLoggedOut && !authEndpoints.some((path) => url.startsWith(path))) {
               isLoggedOut = true;
               emit({ type: "unauthorized" });
             }
@@ -261,7 +264,7 @@ function createFetchMethod(endpoint, prefix, config) {
       Accept: "application/json",
       ...typeof config.headers === "function" ? config.headers() : config.headers
     };
-    const isQuery = endpoint.method === "GET" || endpoint.method === "DELETE";
+    const isQuery = inputIsQuery(endpoint.method);
     const hasBody = !isQuery && !endpoint.multipart && endpoint.input && args;
     if (isQuery && args) {
       const remaining = stripParams(args, endpoint.path);

package/dist/{index-kckky6zw.js → index-afzt3nmx.js}

@@ -1,5 +1,5 @@
 // src/contract/define.ts
-var ALL_TRANSPORTS = ["HTTP", "MCP", "AGENT"];
+var ALL_TRANSPORTS = ["HTTP", "MCP", "AGENT", "CLI"];
 function defineContract(meta, endpoints) {
   const toolTransports = new Map;
   for (const [key, ep] of Object.entries(endpoints)) {

package/dist/{index-n7bmdwmz.js → index-d4rwrjbc.js}

@@ -1,3 +1,7 @@
+import {
+  normalizeError
+} from "./index-vhdvv00d.js";
+
 // src/server/stream.ts
 function streamSSE(generator) {
   const encoder = new TextEncoder;
@@ -15,8 +19,8 @@ function streamSSE(generator) {
 `));
         controller.close();
       } catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        controller.enqueue(encoder.encode(`data: ${JSON.stringify({ error: msg })}
+        const envelope = normalizeError(err).toJSON();
+        controller.enqueue(encoder.encode(`data: ${JSON.stringify(envelope)}
 
 `));
         controller.close();
@@ -48,9 +52,9 @@ async function* parseSSE(response, options) {
       buffer = lines.pop() ?? "";
       for (const rawLine of lines) {
         const line = rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine;
-        if (!line.startsWith("data: "))
+        if (!line.startsWith("data:"))
           continue;
-        const data = line.slice(6);
+        const data = line.slice(5).replace(/^ /, "");
         if (data === "[DONE]")
           return;
         try {

package/dist/index-kzfs85xp.js

@@ -0,0 +1,9 @@
+// src/internal/safe-json.ts
+function isUnsafeKey(key) {
+  return key === "__proto__";
+}
+function safeJsonParse(text) {
+  return JSON.parse(text, (key, value) => isUnsafeKey(key) ? undefined : value);
+}
+
+export { isUnsafeKey, safeJsonParse };