Stackline Open Source

Package selector

Start with the problem. Leave with one small dependency.

Four focused packages cover merge safety, reproducible JSON, streaming events, and bounded AI tool catalogs. Every option ships TypeScript declarations and runs without runtime dependencies.

Recommended @stackline/deepmerge

Immutable deep merge with prototype-pollution defenses and familiar array controls.

Open docs

Published on npm

The catalog

Nested configuration structures joining through a controlled merge

Object composition

@stackline/deepmerge

Maintained

Secure, immutable deep merge with a familiar deepmerge-compatible API, configurable arrays, cycle handling, ESM, CommonJS, and browser builds.

  • Prototype-pollution defenses
  • Zero runtime dependencies
  • Migration alias documented
Checking latestChecking downloads last week
Docs npm GitHub
JSON keys arranged into a stable deterministic sequence

Deterministic data

@stackline/stable-stringify

Maintained

Deterministic and cycle-aware JSON serialization with a fast-json-stable-stringify-compatible entry point plus RFC 8785 canonicalization.

  • Stable cache keys and digests
  • Safe logging mode
  • Zero runtime dependencies
Checking latestChecking downloads last week
Docs npm GitHub
A continuous event stream crossing browser, server, and edge runtimes

Streaming transport

@stackline/sse

Maintained

A universal, spec-correct SSE toolkit for parsing, encoding, reconnecting, and consuming AI streams across browsers, Node.js, Deno, Bun, and edge runtimes.

  • OpenAI and Anthropic examples
  • Memory and payload limits
  • Zero runtime dependencies
Checking latestChecking downloads last week
Docs npm GitHub
A large AI tool catalog narrowed to a relevant working set

AI context control

@stackline/tool-router

Maintained

Local, provider-neutral tool discovery for MCP, OpenAI, Anthropic, and Gemini catalogs with deterministic ranking, budgets, filters, and pinned tools.

  • No model or vector database call
  • Incremental catalogs
  • Zero runtime dependencies
Checking latestChecking downloads last week
Docs npm GitHub

Decision table

Four boundaries, four packages

PackageUse it atCompatibility pathPrimary guardrail
deepmergeConfiguration and object compositiondeepmerge API and npm aliasUnsafe keys and mutation
stable-stringifySerialization, caches, signatures, logsfast-json-stable-stringify APIOrder, cycles, output limits
sseHTTP event streams and AI outputWeb Streams and async iterationMalformed frames and unbounded buffers
tool-routerLarge function and MCP catalogsNative provider definitionsContext size and irrelevant tools

Implementation guides

Solve the underlying problem

Code, tradeoffs, and migration paths. No account required.

SecurityHow to deep merge untrusted JavaScript objects safely

Prototype pollution, array semantics, compatibility aliases, and tests.

 Data integrityStable, safe, and canonical JSON are different tools

Choose the right serializer for cache keys, signatures, and logs.

 StreamingBuild a bounded SSE client for AI streams

Parsing, cancellation, reconnects, limits, and provider event shapes.

 AI agentsRoute large tool catalogs before model inference

Reduce context without losing native MCP or provider definitions.

Maintenance contract

Small packages still need grown-up releases.

Compatibility first. Migration paths and public types are tested alongside the native API.

Inspect before install. Source, test suites, benchmarks, changelogs, security policy, and packed contents are public.

No dependency chain. These four packages have zero runtime dependencies, reducing install and supply-chain surface.