@zudojs/rpc 1.1.0 → 1.3.0

package/README.md

@@ -2,6 +2,12 @@
 
 Type-safe RPC — define procedures, apply middleware, dispatch calls, and serve them over your own transport.
 
+<!-- zudo-docs:start -->
+
+**Documentation:** [zudojs.oyinlola.site/docs/packages-rpc](https://zudojs.oyinlola.site/docs/packages-rpc) · **For AI agents:** [Markdown version](https://zudojs.oyinlola.site/docs/packages-rpc.md), [llms.txt](https://zudojs.oyinlola.site/llms.txt)
+
+<!-- zudo-docs:end -->
+
 ## When to use
 
 Import this when you need:
@@ -68,7 +74,11 @@ const server = new RPCServer();
 server.register(sum);
 
 const response = await server.handle(
-  createRPCRequest({ id: "req-1", procedure: "math.sum", payload: { a: 1, b: 2 } }),
+  createRPCRequest({
+    id: "req-1",
+    procedure: "math.sum",
+    payload: { a: 1, b: 2 },
+  }),
 );
 // { id: "req-1", success: true, result: 3 }
 ```
@@ -92,7 +102,10 @@ import { RPCClient, type RPCTransport } from "@zudojs/rpc";
 const transport: RPCTransport = { send: (request) => server.handle(request) };
 const client = new RPCClient(transport, { timeout: 5_000 });
 
-const total = await client.call<{ a: number; b: number }, number>("math.sum", { a: 1, b: 2 });
+const total = await client.call<{ a: number; b: number }, number>("math.sum", {
+  a: 1,
+  b: 2,
+});
 // 3
 ```
 
@@ -100,25 +113,38 @@ A failed call rejects with a typed error rebuilt from the wire code
 (`RPCTimeoutError`, `RPCCancelledError`, `RPCUnavailableError`, or an
 `RPCError` carrying the server's `code` and `details`).
 
-### Middleware
+### Middleware and trusted identity
+
+Everything in a frame, `metadata` included, is written by the caller: any
+client can send `metadata: { userId: "admin" }`. Never authorise on it.
+Identity your transport has verified (a checked bearer token, an mTLS peer,
+a server-side session) goes in the second argument of `handle`, and reaches
+middleware and handlers as the frozen `context.auth`:
 
 ```typescript
 import { RPCMiddlewareStack, RPCAuthenticationError } from "@zudojs/rpc";
 
 const stack = new RPCMiddlewareStack([
   async (context, next) => {
-    if (context.metadata.userId === undefined) {
+    if (typeof context.auth?.userId !== "string") {
       throw new RPCAuthenticationError("Sign in first.");
     }
+    context.set("actor", context.auth.userId);
     return next();
   },
 ]);
 
 const server = new RPCServer(undefined, stack);
+
+// In the transport, after verifying the caller's credentials yourself:
+await server.handle(frame, { auth: { userId: verifiedUserId } });
 ```
 
 Each middleware may call `next()` once. Input validation runs before the
-stack, so middleware sees a payload the procedure's schema has accepted.
+stack. `context.input` holds the payload as the procedure's schema parsed
+it (unknown keys stripped, defaults applied, values coerced), so authorise
+on `context.input`, not on `context.request.payload`, which stays the raw
+frame value.
 
 ## Errors
 
@@ -139,12 +165,19 @@ caller's.
 
 ```typescript
 const server = new RPCServer(undefined, undefined, {
-  limits: { maxPayloadBytes: 256 * 1024 },
+  limits: { maxPayloadBytes: 256 * 1024, maxRequestIdLength: 128 },
   dispatch: { defaultTimeout: 10_000 },
   onInternalError: (error, requestId) => logger.error({ requestId, error }),
 });
 ```
 
+`maxPayloadBytes` bounds `payload` and `metadata` together, because both are
+caller-controlled and both reach the handler. `maxRequestIdLength` bounds
+`request.id`, which every response echoes back; an id over the limit is
+refused before a response is built, so it is never reflected. Both default to
+`MAX_RPC_PAYLOAD_SIZE` (1 MiB) and `MAX_RPC_REQUEST_ID_LENGTH` (128), and
+either can be set to `0` when the transport already enforces the limit.
+
 ## License
 
 MIT

package/dist/index.d.ts

@@ -21,7 +21,7 @@
  */
 export type { RPCProcedureName, RPCMetadata, RPCMetadataOptions, RPCRequest, RPCRequestOptions, RPCErrorPayload, RPCResponse, } from "./rpc/types/index.js";
 export { createRPCMetadata, createRPCRequest, createRPCResponse, createRPCErrorResponse, } from "./rpc/types/index.js";
-export { DEFAULT_RPC_TIMEOUT, MAX_RPC_PAYLOAD_SIZE, MAX_PENDING_REQUESTS, MAX_MIDDLEWARE, MAX_PROCEDURES, MAX_PROCEDURE_NAME_LENGTH, MAX_TIMER_DELAY, PROCEDURE_NAME_PATTERN, INTERNAL_ERROR_MESSAGE, } from "./rpc/constants/index.js";
+export { DEFAULT_RPC_TIMEOUT, MAX_RPC_PAYLOAD_SIZE, MAX_RPC_REQUEST_ID_LENGTH, MAX_PENDING_REQUESTS, MAX_MIDDLEWARE, MAX_PROCEDURES, MAX_PROCEDURE_NAME_LENGTH, MAX_TIMER_DELAY, PROCEDURE_NAME_PATTERN, INTERNAL_ERROR_MESSAGE, } from "./rpc/constants/index.js";
 export type { RPCRequestLimits, RPCSchema } from "./rpc/validation/index.js";
 export { assertValidProcedureName, assertValidRequest, measurePayloadBytes, toValidationIssues, parseInput, parseOutput, } from "./rpc/validation/index.js";
 export type { RPCErrorOptions } from "./rpc/errors/index.js";
@@ -29,7 +29,7 @@ export { RPCError, RPCProcedureNotFoundError, RPCInvalidRequestError, RPCValidat
 export type { RPCHandler, RPCProcedure, RPCProcedureOptions, } from "./rpc/procedure/index.js";
 export { createRPCProcedure } from "./rpc/procedure/index.js";
 export { RPCProcedureRegistry, RPCProcedureRouter, } from "./rpc/procedure/index.js";
-export type { RPCContext } from "./rpc/context/index.js";
+export type { RPCAuthContext, RPCContext, RPCContextOptions, } from "./rpc/context/index.js";
 export { createRPCContext } from "./rpc/context/index.js";
 export type { RPCMiddleware } from "./rpc/middleware/index.js";
 export { RPCMiddlewareStack } from "./rpc/middleware/index.js";

package/dist/index.js

@@ -21,7 +21,7 @@
  */
 export { createRPCMetadata, createRPCRequest, createRPCResponse, createRPCErrorResponse, } from "./rpc/types/index.js";
 // Constants
-export { DEFAULT_RPC_TIMEOUT, MAX_RPC_PAYLOAD_SIZE, MAX_PENDING_REQUESTS, MAX_MIDDLEWARE, MAX_PROCEDURES, MAX_PROCEDURE_NAME_LENGTH, MAX_TIMER_DELAY, PROCEDURE_NAME_PATTERN, INTERNAL_ERROR_MESSAGE, } from "./rpc/constants/index.js";
+export { DEFAULT_RPC_TIMEOUT, MAX_RPC_PAYLOAD_SIZE, MAX_RPC_REQUEST_ID_LENGTH, MAX_PENDING_REQUESTS, MAX_MIDDLEWARE, MAX_PROCEDURES, MAX_PROCEDURE_NAME_LENGTH, MAX_TIMER_DELAY, PROCEDURE_NAME_PATTERN, INTERNAL_ERROR_MESSAGE, } from "./rpc/constants/index.js";
 export { assertValidProcedureName, assertValidRequest, measurePayloadBytes, toValidationIssues, parseInput, parseOutput, } from "./rpc/validation/index.js";
 export { RPCError, RPCProcedureNotFoundError, RPCInvalidRequestError, RPCValidationError, RPCAuthenticationError, RPCForbiddenError, RPCTimeoutError, RPCCancelledError, RPCInternalError, RPCTransportError, RPCSerializationError, RPCDeserializationError, RPCUnavailableError, RPCRateLimitedError, RPCDeadlineExceededError, RPCDuplicateProcedureError, createRPCError, isRPCError, } from "./rpc/errors/index.js";
 export { createRPCProcedure } from "./rpc/procedure/index.js";

package/dist/rpc/constants/index.d.ts

@@ -1,2 +1,2 @@
-export { DEFAULT_RPC_TIMEOUT, MAX_RPC_PAYLOAD_SIZE, MAX_PENDING_REQUESTS, MAX_MIDDLEWARE, MAX_PROCEDURES, MAX_PROCEDURE_NAME_LENGTH, MAX_TIMER_DELAY, PROCEDURE_NAME_PATTERN, INTERNAL_ERROR_MESSAGE, } from "./rpcConstants.core.js";
+export { DEFAULT_RPC_TIMEOUT, MAX_RPC_PAYLOAD_SIZE, MAX_RPC_REQUEST_ID_LENGTH, MAX_PENDING_REQUESTS, MAX_MIDDLEWARE, MAX_PROCEDURES, MAX_PROCEDURE_NAME_LENGTH, MAX_TIMER_DELAY, PROCEDURE_NAME_PATTERN, INTERNAL_ERROR_MESSAGE, } from "./rpcConstants.core.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/rpc/constants/index.js

@@ -1,2 +1,2 @@
-export { DEFAULT_RPC_TIMEOUT, MAX_RPC_PAYLOAD_SIZE, MAX_PENDING_REQUESTS, MAX_MIDDLEWARE, MAX_PROCEDURES, MAX_PROCEDURE_NAME_LENGTH, MAX_TIMER_DELAY, PROCEDURE_NAME_PATTERN, INTERNAL_ERROR_MESSAGE, } from "./rpcConstants.core.js";
+export { DEFAULT_RPC_TIMEOUT, MAX_RPC_PAYLOAD_SIZE, MAX_RPC_REQUEST_ID_LENGTH, MAX_PENDING_REQUESTS, MAX_MIDDLEWARE, MAX_PROCEDURES, MAX_PROCEDURE_NAME_LENGTH, MAX_TIMER_DELAY, PROCEDURE_NAME_PATTERN, INTERNAL_ERROR_MESSAGE, } from "./rpcConstants.core.js";
 //# sourceMappingURL=index.js.map

package/dist/rpc/constants/rpcConstants.core.d.ts

@@ -11,6 +11,15 @@ export declare const DEFAULT_RPC_TIMEOUT = 30000;
  * Maximum payload size for RPC messages (1MB).
  */
 export declare const MAX_RPC_PAYLOAD_SIZE: number;
+/**
+ * Maximum length of a request id accepted from a peer.
+ *
+ * The id is echoed verbatim into every success and error response, so an
+ * unbounded id is a reflection amplifier: the server writes back whatever
+ * the caller sent, on both paths. 128 characters holds a UUID, a ULID or a
+ * W3C trace id with room to spare.
+ */
+export declare const MAX_RPC_REQUEST_ID_LENGTH = 128;
 /**
  * Maximum number of pending requests allowed in the client.
  */

package/dist/rpc/constants/rpcConstants.core.js

@@ -11,6 +11,15 @@ export const DEFAULT_RPC_TIMEOUT = 30_000;
  * Maximum payload size for RPC messages (1MB).
  */
 export const MAX_RPC_PAYLOAD_SIZE = 1024 * 1024;
+/**
+ * Maximum length of a request id accepted from a peer.
+ *
+ * The id is echoed verbatim into every success and error response, so an
+ * unbounded id is a reflection amplifier: the server writes back whatever
+ * the caller sent, on both paths. 128 characters holds a UUID, a ULID or a
+ * W3C trace id with room to spare.
+ */
+export const MAX_RPC_REQUEST_ID_LENGTH = 128;
 /**
  * Maximum number of pending requests allowed in the client.
  */

package/dist/rpc/context/index.d.ts

@@ -1,3 +1,7 @@
-export type { RPCContext } from "./rpcContext.type.js";
+/**
+ * RPC execution context: per-call state, the caller's (untrusted) frame
+ * metadata, the transport's trusted `auth`, and the validated `input`.
+ */
+export type { RPCAuthContext, RPCContext, RPCContextOptions, } from "./rpcContext.type.js";
 export { createRPCContext } from "./rpcContext.type.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/rpc/context/index.js

@@ -1,2 +1,6 @@
+/**
+ * RPC execution context: per-call state, the caller's (untrusted) frame
+ * metadata, the transport's trusted `auth`, and the validated `input`.
+ */
 export { createRPCContext } from "./rpcContext.type.js";
 //# sourceMappingURL=index.js.map

package/dist/rpc/context/rpcContext.type.d.ts

@@ -1,18 +1,57 @@
 import type { RPCMetadata } from "../types/rpcMetadata.type.js";
 import type { RPCRequest } from "../types/rpcRequest.type.js";
+/**
+ * Identity and other facts established by the transport (a verified
+ * bearer token, an mTLS peer, a session looked up server-side).
+ *
+ * Unlike frame `metadata`, which the caller writes, this is supplied by
+ * the server's own code through `RPCServer.handle(request, { auth })`, so
+ * it is the only context field safe to authorise on.
+ */
+export type RPCAuthContext = Readonly<Record<string, unknown>>;
+/**
+ * Extra, server-supplied values for {@link createRPCContext}.
+ */
+export interface RPCContextOptions {
+    /** Trusted, transport-derived identity. See {@link RPCAuthContext}. */
+    readonly auth?: RPCAuthContext;
+}
 /**
  * Context passed through the RPC execution pipeline.
  */
 export interface RPCContext {
     readonly request: RPCRequest;
+    /**
+     * Frame metadata exactly as the caller sent it. Untrusted: any client
+     * can set `userId`, `tenantId` or any other key. Authorise on
+     * {@link RPCContext.auth} instead.
+     */
     readonly metadata: RPCMetadata;
+    /**
+     * Trusted identity supplied by the transport through
+     * `RPCServer.handle(request, { auth })`; `undefined` when none was given.
+     */
+    readonly auth: RPCAuthContext | undefined;
+    /**
+     * The payload after the procedure's input schema has parsed it
+     * (stripped, defaulted, coerced), or the raw payload when the procedure
+     * declares no input schema. `undefined` until validation has run, i.e.
+     * in an interceptor before it calls `next()`. `request.payload` always
+     * stays the raw, unvalidated value.
+     */
+    readonly input: unknown;
     readonly signal: AbortSignal;
     readonly state: Map<string, unknown>;
     get<T>(key: string): T | undefined;
     set<T>(key: string, value: T): void;
 }
+/**
+ * Records the validated input on a context. Called by the dispatcher
+ * once, after input validation and before the middleware stack runs.
+ */
+export declare function bindRPCContextInput(context: RPCContext, input: unknown): void;
 /**
  * Creates a new RPC context.
  */
-export declare function createRPCContext(request: RPCRequest, signal: AbortSignal): RPCContext;
+export declare function createRPCContext(request: RPCRequest, signal: AbortSignal, options?: RPCContextOptions): RPCContext;
 //# sourceMappingURL=rpcContext.type.d.ts.map

package/dist/rpc/context/rpcContext.type.js

@@ -1,13 +1,26 @@
+const inputs = new WeakMap();
+/**
+ * Records the validated input on a context. Called by the dispatcher
+ * once, after input validation and before the middleware stack runs.
+ */
+export function bindRPCContextInput(context, input) {
+    inputs.set(context, input);
+}
 /**
  * Creates a new RPC context.
  */
-export function createRPCContext(request, signal) {
+export function createRPCContext(request, signal, options = {}) {
     const state = new Map();
+    const auth = options.auth === undefined ? undefined : Object.freeze({ ...options.auth });
     const context = {
         request,
         // A frame decoded from JSON may omit `metadata`; middleware reads
         // `context.metadata.userId` and the like without guarding.
         metadata: request.metadata ?? {},
+        auth,
+        get input() {
+            return inputs.get(context);
+        },
         signal,
         state,
         get(key) {

package/dist/rpc/dispatcher/rpcDispatcher.core.d.ts

@@ -3,6 +3,7 @@ import type { RPCResponse } from "../types/rpcResponse.type.js";
 import type { RPCProcedure } from "../procedure/rpcProcedure.type.js";
 import type { RPCMiddlewareStack } from "../middleware/rpcMiddleware.core.js";
 import type { RPCInterceptor } from "../interceptor/rpcInterceptor.type.js";
+import type { RPCContextOptions } from "../context/rpcContext.type.js";
 /**
  * Options controlling dispatch.
  */
@@ -46,8 +47,12 @@ export declare class RPCDispatcher {
     }, middleware: RPCMiddlewareStack, options?: RPCDispatcherOptions);
     /**
      * Dispatches an RPC request.
+     *
+     * `trusted` carries server-supplied context (`auth`) that the caller
+     * cannot forge; it is exposed to middleware and handlers as
+     * `context.auth`.
      */
-    dispatch(input: RPCRequest): Promise<RPCResponse>;
+    dispatch(input: RPCRequest, trusted?: RPCContextOptions): Promise<RPCResponse>;
     /**
      * Runs the interceptor chain around the dispatch.
      *

package/dist/rpc/dispatcher/rpcDispatcher.core.js

@@ -1,4 +1,4 @@
-import { createRPCContext } from "../context/rpcContext.type.js";
+import { bindRPCContextInput, createRPCContext, } from "../context/rpcContext.type.js";
 import { createRPCResponse } from "../types/rpcResponse.type.js";
 import { RPCCancelledError } from "../errors/rpc.errors.js";
 import { DEFAULT_RPC_TIMEOUT } from "../constants/rpcConstants.core.js";
@@ -26,15 +26,19 @@ export class RPCDispatcher {
     }
     /**
      * Dispatches an RPC request.
+     *
+     * `trusted` carries server-supplied context (`auth`) that the caller
+     * cannot forge; it is exposed to middleware and handlers as
+     * `context.auth`.
      */
-    async dispatch(input) {
+    async dispatch(input, trusted = {}) {
         // Tolerate a frame without `metadata`: the field is optional when a
         // request is built by hand or decoded from JSON, and everything below
         // — deadline reading, the context's `metadata` — reads it as an object.
         const request = input.metadata === undefined ? { ...input, metadata: {} } : input;
         const procedure = this.registry.require(request.procedure);
         const controller = new AbortController();
-        const context = createRPCContext(request, controller.signal);
+        const context = createRPCContext(request, controller.signal, trusted);
         const timeoutMs = this.resolveTimeout(request, procedure);
         // A deadline already in the past is rejected before any work runs.
         if (this.options.honourDeadline ?? true) {
@@ -49,6 +53,7 @@ export class RPCDispatcher {
                 const input = procedure.options?.input
                     ? parseInput(procedure.options.input, request.payload, request.procedure)
                     : request.payload;
+                bindRPCContextInput(context, input);
                 const result = await this.middleware.execute(context, async () => {
                     return procedure.handler(input, context);
                 });

package/dist/rpc/server/rpcServer.core.d.ts

@@ -3,6 +3,7 @@ import type { RPCResponse } from "../types/rpcResponse.type.js";
 import type { RPCProcedure } from "../procedure/rpcProcedure.type.js";
 import { RPCProcedureRegistry } from "../procedure/rpcProcedureRegistry.core.js";
 import { RPCMiddlewareStack } from "../middleware/rpcMiddleware.core.js";
+import type { RPCContextOptions } from "../context/rpcContext.type.js";
 import type { RPCDispatcherOptions } from "../dispatcher/rpcDispatcher.core.js";
 import type { RPCRequestLimits } from "../validation/rpcValidation.core.js";
 /**
@@ -49,8 +50,13 @@ export declare class RPCServer {
      * `onInternalError` and answered with a fixed message: internal
      * exception text can name hosts, paths, credentials or queries, and
      * the caller is an untrusted peer.
+     *
+     * Everything in `request` comes from that peer, including
+     * `request.metadata.userId`. Identity the transport has verified goes
+     * in `trusted.auth` and reaches middleware and handlers as
+     * `context.auth`; authorise on that, never on frame metadata.
      */
-    handle(request: RPCRequest): Promise<RPCResponse>;
+    handle(request: RPCRequest, trusted?: RPCContextOptions): Promise<RPCResponse>;
     /**
      * Returns the procedure registry.
      */

package/dist/rpc/server/rpcServer.core.js

@@ -3,7 +3,7 @@ import { RPCMiddlewareStack } from "../middleware/rpcMiddleware.core.js";
 import { RPCDispatcher } from "../dispatcher/rpcDispatcher.core.js";
 import { createRPCErrorResponse } from "../types/rpcResponse.type.js";
 import { isRPCError, RPCAuthenticationError, RPCCancelledError, RPCDeadlineExceededError, RPCDeserializationError, RPCForbiddenError, RPCInternalError, RPCInvalidRequestError, RPCProcedureNotFoundError, RPCRateLimitedError, RPCSerializationError, RPCTimeoutError, RPCUnavailableError, RPCValidationError, } from "../errors/rpc.errors.js";
-import { INTERNAL_ERROR_MESSAGE } from "../constants/rpcConstants.core.js";
+import { INTERNAL_ERROR_MESSAGE, MAX_RPC_REQUEST_ID_LENGTH, } from "../constants/rpcConstants.core.js";
 import { assertValidRequest } from "../validation/rpcValidation.core.js";
 /**
  * Wire codes for the error types the server maps.
@@ -65,10 +65,21 @@ export class RPCServer {
      * `onInternalError` and answered with a fixed message: internal
      * exception text can name hosts, paths, credentials or queries, and
      * the caller is an untrusted peer.
+     *
+     * Everything in `request` comes from that peer, including
+     * `request.metadata.userId`. Identity the transport has verified goes
+     * in `trusted.auth` and reaches middleware and handlers as
+     * `context.auth`; authorise on that, never on frame metadata.
      */
-    async handle(request) {
-        const requestId = typeof request?.id === "string"
-            ? request.id
+    async handle(request, trusted = {}) {
+        // An id the validator would refuse is never reflected: the error
+        // response below echoes this value, so accepting an over-long id here
+        // would amplify it straight back to the peer that sent it.
+        const rawId = request?.id;
+        const maxIdLength = this.options.limits?.maxRequestIdLength ?? MAX_RPC_REQUEST_ID_LENGTH;
+        const requestId = typeof rawId === "string" &&
+            (maxIdLength <= 0 || rawId.length <= maxIdLength)
+            ? rawId
             : "";
         try {
             assertValidRequest(request, this.options.limits);
@@ -77,7 +88,7 @@ export class RPCServer {
             // reads it as an object, so a frame without it used to fail with a
             // TypeError reported as an internal error.
             const frame = request.metadata === undefined ? { ...request, metadata: {} } : request;
-            return await this.dispatcher.dispatch(frame);
+            return await this.dispatcher.dispatch(frame, trusted);
         }
         catch (error) {
             const mapped = this.mapError(error);

package/dist/rpc/validation/rpcValidation.core.d.ts

@@ -13,11 +13,21 @@ import type { RPCRequest } from "../types/rpcRequest.type.js";
  */
 export interface RPCRequestLimits {
     /**
-     * Maximum encoded payload size in bytes. Defaults to
+     * Maximum combined encoded size, in bytes, of the caller-controlled
+     * parts of the frame — `payload` and `metadata`. Defaults to
      * {@link MAX_RPC_PAYLOAD_SIZE}. Set to `0` to skip the check when the
      * transport already enforces a frame limit.
+     *
+     * `metadata` counts because it is caller-controlled and is handed to
+     * middleware and handlers as `context.metadata`; measuring `payload`
+     * alone left an unbounded second channel into the same handler.
      */
     readonly maxPayloadBytes?: number;
+    /**
+     * Maximum length of `request.id`. Defaults to
+     * {@link MAX_RPC_REQUEST_ID_LENGTH}. Set to `0` to skip the check.
+     */
+    readonly maxRequestIdLength?: number;
     /**
      * Whether procedure names must match {@link PROCEDURE_NAME_PATTERN}.
      * Defaults to `true`.
@@ -41,8 +51,12 @@ export declare function measurePayloadBytes(payload: unknown): number | undefine
 /**
  * Validates the shape and size of an incoming request.
  *
- * @throws {RPCInvalidRequestError} when the frame is malformed or the
- * payload exceeds the configured limit.
+ * Every caller-controlled part of the frame is bounded: the id by
+ * length, the procedure name by length and pattern, and `payload` plus
+ * `metadata` by their combined encoded size.
+ *
+ * @throws {RPCInvalidRequestError} when the frame is malformed, the id is
+ * over-long, or payload and metadata together exceed the configured limit.
  */
 export declare function assertValidRequest(request: unknown, limits?: RPCRequestLimits): asserts request is RPCRequest;
 /**

package/dist/rpc/validation/rpcValidation.core.js

@@ -7,7 +7,7 @@
  * the first checks the server runs, not the last.
  */
 import { RPCInternalError, RPCInvalidRequestError, RPCValidationError, } from "../errors/rpc.errors.js";
-import { MAX_PROCEDURE_NAME_LENGTH, MAX_RPC_PAYLOAD_SIZE, PROCEDURE_NAME_PATTERN, } from "../constants/rpcConstants.core.js";
+import { MAX_PROCEDURE_NAME_LENGTH, MAX_RPC_PAYLOAD_SIZE, MAX_RPC_REQUEST_ID_LENGTH, PROCEDURE_NAME_PATTERN, } from "../constants/rpcConstants.core.js";
 /**
  * Validates a procedure name.
  *
@@ -49,8 +49,12 @@ export function measurePayloadBytes(payload) {
 /**
  * Validates the shape and size of an incoming request.
  *
- * @throws {RPCInvalidRequestError} when the frame is malformed or the
- * payload exceeds the configured limit.
+ * Every caller-controlled part of the frame is bounded: the id by
+ * length, the procedure name by length and pattern, and `payload` plus
+ * `metadata` by their combined encoded size.
+ *
+ * @throws {RPCInvalidRequestError} when the frame is malformed, the id is
+ * over-long, or payload and metadata together exceed the configured limit.
  */
 export function assertValidRequest(request, limits = {}) {
     if (typeof request !== "object" || request === null) {
@@ -60,6 +64,13 @@ export function assertValidRequest(request, limits = {}) {
     if (typeof candidate.id !== "string" || candidate.id.length === 0) {
         throw new RPCInvalidRequestError("Request id must be a non-empty string.");
     }
+    // Checked before anything else touches the frame: the id is reflected
+    // into every response the server builds, so an oversized one must be
+    // refused before a response exists to carry it.
+    const maxIdLength = limits.maxRequestIdLength ?? MAX_RPC_REQUEST_ID_LENGTH;
+    if (maxIdLength > 0 && candidate.id.length > maxIdLength) {
+        throw new RPCInvalidRequestError(`Request id exceeds ${maxIdLength} characters.`);
+    }
     if (limits.enforceProcedureNamePattern ?? true) {
         assertValidProcedureName(candidate.procedure);
     }
@@ -73,10 +84,12 @@ export function assertValidRequest(request, limits = {}) {
     }
     const maxBytes = limits.maxPayloadBytes ?? MAX_RPC_PAYLOAD_SIZE;
     if (maxBytes > 0) {
-        const size = measurePayloadBytes(candidate.payload);
-        if (size === undefined) {
+        const payloadSize = measurePayloadBytes(candidate.payload);
+        const metadataSize = measurePayloadBytes(candidate.metadata);
+        if (payloadSize === undefined || metadataSize === undefined) {
             throw new RPCInvalidRequestError("Request payload could not be encoded.", candidate.procedure);
         }
+        const size = payloadSize + metadataSize;
         if (size > maxBytes) {
             throw new RPCInvalidRequestError(`Request payload of ${size} bytes exceeds the ${maxBytes} byte limit.`, candidate.procedure);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/rpc",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "description": "Remote procedure call infrastructure for Zudojs applications.",
   "license": "MIT",
   "author": {
@@ -27,10 +27,10 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@zudojs/errors": "1.0.1",
-    "@zudojs/constants": "1.0.1",
-    "@zudojs/types": "1.0.0",
-    "@zudojs/schema": "1.0.1"
+    "@zudojs/errors": "1.2.0",
+    "@zudojs/constants": "1.1.1",
+    "@zudojs/types": "1.1.1",
+    "@zudojs/schema": "1.1.1"
   },
   "devDependencies": {
     "typescript": "7.0.2",