fix(client): lower default SSE event size limit to 4 MiB

Realistic A2A events (Message/Task JSON) are KB-scale and large files
should be referenced via FileWithUri parts rather than inlined, so 4 MiB
(matching gRPC's default max message size) leaves ample headroom. Also
make the error actionable: point at maxEventSizeBytes and FileWithUri.

Addresses review feedback from JakubWorek on #582.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: RenKoya1

src/sse_utils.ts

@@ -71,12 +71,15 @@ export function formatSSEErrorEvent(error: unknown): string {
  * Without this cap a malicious or broken server can stream bytes that never
  * form a complete line — or `data:` lines whose blank-line terminator never
  * arrives — growing an in-memory buffer without limit until the client
- * process exhausts memory (CWE-400, uncontrolled resource consumption). The
- * default is deliberately generous so that legitimate large JSON events
- * (e.g. base64 file parts) still pass; callers handling larger payloads can
- * raise it via the `maxEventSizeBytes` argument.
+ * process exhausts memory (CWE-400, uncontrolled resource consumption).
+ *
+ * Realistic A2A events (Message/Task JSON) are KB-scale, and large files
+ * should be referenced via `FileWithUri` parts rather than inlined, so the
+ * 4 MiB default (matching gRPC's default max message size) leaves ample
+ * headroom. Callers that must inline larger payloads can raise it via the
+ * `maxEventSizeBytes` argument.
  */
-export const DEFAULT_MAX_SSE_EVENT_SIZE_BYTES = 20 * 1024 * 1024; // 20 MiB
+export const DEFAULT_MAX_SSE_EVENT_SIZE_BYTES = 4 * 1024 * 1024; // 4 MiB
 
 /**
  * Parses an SSE stream from a `Response`, yielding events as they arrive.
@@ -107,9 +110,7 @@ export async function* parseSseStream(
 
     while ((lineEndIndex = buffer.indexOf('\n')) >= 0) {
       if (lineEndIndex > maxEventSizeBytes) {
-        throw new Error(
-          `SSE line exceeded the maximum allowed size of ${maxEventSizeBytes} bytes.`
-        );
+        throw sseSizeError('SSE line', maxEventSizeBytes);
       }
       // Per the SSE spec lines may end with `\r\n`, `\r`, or `\n`. We
       // strip a trailing `\r` explicitly rather than calling `.trim()`,
@@ -137,17 +138,15 @@ export async function* parseSseStream(
         const fieldValue = stripOptionalLeadingSpace(line.substring('data:'.length));
         eventData = eventData === '' ? fieldValue : `${eventData}\n${fieldValue}`;
         if (eventData.length > maxEventSizeBytes) {
-          throw new Error(
-            `SSE event data exceeded the maximum allowed size of ${maxEventSizeBytes} bytes.`
-          );
+          throw sseSizeError('SSE event data', maxEventSizeBytes);
         }
       }
     }
 
     // Same cap for a line that never terminates: the loop above never runs,
     // so the residual buffer would otherwise grow without bound.
     if (buffer.length > maxEventSizeBytes) {
-      throw new Error(`SSE line exceeded the maximum allowed size of ${maxEventSizeBytes} bytes.`);
+      throw sseSizeError('SSE line', maxEventSizeBytes);
     }
   }
 
@@ -157,6 +156,13 @@ export async function* parseSseStream(
   }
 }
 
+function sseSizeError(what: string, maxEventSizeBytes: number): Error {
+  return new Error(
+    `${what} exceeded the maximum allowed size of ${maxEventSizeBytes} bytes. ` +
+      `Pass maxEventSizeBytes to raise the limit, or prefer FileWithUri parts for large payloads.`
+  );
+}
+
 /**
  * Per the SSE spec, the optional single leading space after the field-name
  * colon is consumed by the parser; embedded and trailing whitespace are