
Product
Socket Firewall Now Blocks Malicious VS Code and Open VSX Extensions
Socket Firewall blocks malicious VS Code and Open VSX extensions before install, protecting developers from compromised editor marketplaces.
shiki-stream
Advanced tools
Streaming colorization for Shiki. Moved to `@shikijs/stream`; this package re-exports from there.
Streaming highlighting with Shiki. Useful for highlighting text streams like LLM outputs.
[!IMPORTANT] This package has moved to
@shikijs/stream.Starting with
shiki-stream@4.2.0,shiki-streamis a thin re-export of@shikijs/stream— existing imports keep working without code changes, but all new code should import from@shikijs/streamdirectly. Future development and releases will happen there.- import { CodeToTokenTransformStream } from 'shiki-stream' - import { ShikiStreamRenderer } from 'shiki-stream/vue' - import { ShikiStreamRenderer } from 'shiki-stream/react' - import { ShikiStreamRenderer } from 'shiki-stream/solid' + import { CodeToTokenTransformStream } from '@shikijs/stream' + import { ShikiStreamRenderer } from '@shikijs/stream/vue' + import { ShikiStreamRenderer } from '@shikijs/stream/react' + import { ShikiStreamRenderer } from '@shikijs/stream/solid'
The snippets below show the new
@shikijs/streamimport paths. If you are still onshiki-stream, the same imports work — just swap the package name.
Create a transform stream with CodeToTokenTransformStream and .pipeThrough your text stream:
import { CodeToTokenTransformStream } from '@shikijs/stream'
import { createHighlighter, createJavaScriptRegexEngine } from 'shiki'
// Initialize the Shiki highlighter somewhere in your app
const highlighter = await createHighlighter({
langs: [/* ... */],
themes: [/* ... */],
engine: createJavaScriptRegexEngine()
})
// The ReadableStream<string> you want to highlight
const textStream = getTextStreamFromSomewhere()
// Pipe the text stream through the token stream
const tokensStream = textStream
.pipeThrough(new CodeToTokenTransformStream({
highlighter,
lang: 'javascript',
theme: 'nord',
allowRecalls: true, // see explanation below
}))
allowRecallsDue fact that the highlighting might be changed based on the context of the code, the themed tokens might be changed as the stream goes on. Because the streams are one-directional, we introduce a special "recall" token to notify the receiver to discard the last tokens that has changed.
By default, CodeToTokenTransformStream only returns stable tokens, no recalls. This also means the tokens are outputted less fine-grained, usually line-by-line.
For stream consumers that can handle recalls (e.g. our Vue / React components), you can set allowRecalls: true to get more fine-grained tokens.
Typically, recalls should be handled like:
const receivedTokens: ThemedToken[] = []
tokensStream.pipeTo(new WritableStream({
async write(token) {
if ('recall' in token) {
// discard the last `token.recall` tokens
receivedTokens.length -= token.recall
}
else {
receivedTokens.push(token)
}
}
}))
tokensStream.pipeTo(new WritableStream({
async write(token) {
console.log(token)
}
}))
Or in Node.js
for await (const token of tokensStream) {
console.log(token)
}
<script setup lang="ts">
import { ShikiStreamRenderer } from '@shikijs/stream/vue'
// get the token stream
</script>
<template>
<ShikiStreamRenderer :stream="tokensStream" />
</template>
import { ShikiStreamRenderer } from '@shikijs/stream/react'
export function MyComponent() {
// get the token stream
return <ShikiStreamRenderer stream={tokensStream} />
}
import { ShikiStreamRenderer } from '@shikijs/stream/solid'
export function MyComponent() {
// get the token stream
return <ShikiStreamRenderer stream={tokensStream} />
}
This library also provides a simpfiled renderer API to render incrementally updated code string.
[!NOTE] Experimental
<script setup lang="ts">
import { ShikiCachedRenderer } from '@shikijs/stream/vue'
const highlighter = await createHighlighter({
langs: [/* ... */],
themes: [/* ... */],
engine: createJavaScriptRegexEngine()
})
const code = ref('') // code should only be updated incrementally
// for demo purposes
onMounted(() => {
setInterval(() => {
code.value += '\nconsole.log("Hello, world!");'
}, 1000)
})
</script>
<template>
<ShikiCachedRenderer
:highlighter="highlighter"
:code="code"
lang="js"
theme="vitesse-light"
/>
</template>
TODO:
MIT License © Anthony Fu
FAQs
Streaming colorization for Shiki. Moved to `@shikijs/stream`; this package re-exports from there.
We found that shiki-stream demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Socket Firewall blocks malicious VS Code and Open VSX extensions before install, protecting developers from compromised editor marketplaces.

Research
More than 140 Mastra npm packages were compromised in a supply chain attack that used a typosquatted dependency to deliver a cross-platform infostealer during installation.

Research
/Security News
A new npm package tests AI malware scanners with prompt injection, safety-triggering comments, context flooding, and obfuscated JavaScript.