@zudojs/rpc 1.4.0 → 1.4.2

package/README.md

@@ -245,7 +245,7 @@ Every error class from `@zudojs/errors`' RPC family is re-exported. The
 server maps them to wire codes (`RPC_PROCEDURE_NOT_FOUND`,
 `RPC_VALIDATION_ERROR`, `RPC_UNAUTHENTICATED`, `RPC_FORBIDDEN`,
 `RPC_RATE_LIMITED`, `RPC_TIMEOUT`, …). A custom `RPCError` subclass keeps its
-own `code`.
+own `code` only when it is built with `expose: true` (see below).
 
 `mapRPCError(error)` is the mapping the server and the fetch handler share. Use it in a custom transport to produce the same wire payloads.
 
@@ -262,7 +262,15 @@ thrown with `expose: false` — an `RPCInternalError`, an
 `expose: false`), a non-exposed `BaseError`, or any other error — is
 answered with the fixed `INTERNAL_ERROR_MESSAGE`; the
 original error is handed to `onInternalError(error, requestId)` so it can be
-logged against the request id. A handler result that fails the procedure's
+logged against the request id.
+
+A non-exposed error's code is withheld as well: `new RPCError("…", { code:
+"TASK_SECRET" })` goes out as `{ code: "RPC_INTERNAL_ERROR", message:
+INTERNAL_ERROR_MESSAGE }`, because a custom code is server detail just as the
+message is. The one exception is a standard wire code — a key of
+`RPC_HTTP_STATUS`, such as `RPC_UNAVAILABLE` or `RPC_TIMEOUT` — which is
+public vocabulary a client acts on (retries, status), so it travels with the
+generic message. To send a custom code, build the error with `expose: true`. A handler result that fails the procedure's
 `output` schema is treated the same way: it is the server's fault, not the
 caller's.
 

package/dist/rpc/server/rpcBaseErrorMapping.helper.d.ts

@@ -13,4 +13,14 @@ import type { RPCErrorPayload } from "../types/rpcResponse.type.js";
  * safe. Returns `undefined` for anything else, which stays internal.
  */
 export declare function mapExposedBaseError(error: unknown): RPCErrorPayload | undefined;
+/**
+ * The wire code for an `RPCError` that was not built to be exposed.
+ *
+ * A standard wire code (a key of `RPC_HTTP_STATUS`, such as
+ * `RPC_UNAVAILABLE`) is public vocabulary and callers act on it, so it
+ * travels. Any other code — `new RPCError("…", { code: "TASK_SECRET" })` —
+ * is server detail just as the message is, and goes out as
+ * `RPC_INTERNAL_ERROR`.
+ */
+export declare function withheldRPCErrorCode(code: string): string;
 //# sourceMappingURL=rpcBaseErrorMapping.helper.d.ts.map

package/dist/rpc/server/rpcBaseErrorMapping.helper.js

@@ -4,6 +4,7 @@
  * procedure calls.
  */
 import { isBaseError, RateLimitError, ValidationError } from "@zudojs/errors";
+import { RPC_HTTP_STATUS } from "../transport/http/rpcHttpStatus.helper.js";
 /** Wire code for each HTTP-style status an exposable error can carry. */
 const STATUS_WIRE_CODES = new Map([
     [400, "RPC_VALIDATION_ERROR"],
@@ -54,4 +55,16 @@ export function mapExposedBaseError(error) {
         ...(details !== undefined ? { details } : {}),
     };
 }
+/**
+ * The wire code for an `RPCError` that was not built to be exposed.
+ *
+ * A standard wire code (a key of `RPC_HTTP_STATUS`, such as
+ * `RPC_UNAVAILABLE`) is public vocabulary and callers act on it, so it
+ * travels. Any other code — `new RPCError("…", { code: "TASK_SECRET" })` —
+ * is server detail just as the message is, and goes out as
+ * `RPC_INTERNAL_ERROR`.
+ */
+export function withheldRPCErrorCode(code) {
+    return Object.hasOwn(RPC_HTTP_STATUS, code) ? code : "RPC_INTERNAL_ERROR";
+}
 //# sourceMappingURL=rpcBaseErrorMapping.helper.js.map

package/dist/rpc/server/rpcErrorMapping.helper.d.ts

@@ -21,7 +21,8 @@ export interface RPCMappedError {
  * exposed — an `RPCInternalError`, a non-exposed custom `RPCError` or
  * `BaseError`, or any other error — is answered with
  * {@link INTERNAL_ERROR_MESSAGE}, so exception text, stack traces and
- * causes never reach the remote side.
+ * causes never reach the remote side — nor does a non-exposed custom
+ * code ({@link withheldRPCErrorCode}).
  */
 export declare function mapRPCError(error: unknown): RPCMappedError;
 /**

package/dist/rpc/server/rpcErrorMapping.helper.js

@@ -1,6 +1,6 @@
 import { isRPCError, RPCAuthenticationError, RPCCancelledError, RPCDeadlineExceededError, RPCDeserializationError, RPCForbiddenError, RPCInternalError, RPCInvalidRequestError, RPCProcedureNotFoundError, RPCRateLimitedError, RPCSerializationError, RPCTimeoutError, RPCTransportError, RPCUnavailableError, RPCValidationError, } from "../errors/rpc.errors.js";
 import { INTERNAL_ERROR_MESSAGE } from "../constants/rpcConstants.core.js";
-import { mapExposedBaseError } from "./rpcBaseErrorMapping.helper.js";
+import { mapExposedBaseError, withheldRPCErrorCode } from "./rpcBaseErrorMapping.helper.js";
 /**
  * Wire codes for the error types the server maps.
  *
@@ -34,7 +34,8 @@ const ERROR_CODES = [
  * exposed — an `RPCInternalError`, a non-exposed custom `RPCError` or
  * `BaseError`, or any other error — is answered with
  * {@link INTERNAL_ERROR_MESSAGE}, so exception text, stack traces and
- * causes never reach the remote side.
+ * causes never reach the remote side — nor does a non-exposed custom
+ * code ({@link withheldRPCErrorCode}).
  */
 export function mapRPCError(error) {
     if (error instanceof RPCInternalError || !(error instanceof Error)) {
@@ -48,9 +49,9 @@ export function mapRPCError(error) {
         }
     }
     if (isRPCError(error)) {
-        return error.expose === false
-            ? internalFailure(error.code)
-            : exposed(error.code, error.message, undefined);
+        return error.expose === true
+            ? exposed(error.code, error.message, undefined)
+            : internalFailure(withheldRPCErrorCode(error.code));
     }
     const base = mapExposedBaseError(error);
     if (base !== undefined) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/rpc",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "Remote procedure call infrastructure for Zudojs applications.",
   "license": "MIT",
   "author": {
@@ -27,11 +27,11 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@zudojs/constants": "1.1.2",
-    "@zudojs/errors": "1.3.0",
-    "@zudojs/schema": "1.2.0",
-    "@zudojs/security": "1.3.0",
-    "@zudojs/serialization": "1.2.0",
+    "@zudojs/constants": "1.1.3",
+    "@zudojs/errors": "1.3.1",
+    "@zudojs/schema": "1.2.2",
+    "@zudojs/security": "1.3.2",
+    "@zudojs/serialization": "1.2.2",
     "@zudojs/types": "1.2.0"
   },
   "devDependencies": {