@zudojs/rpc 1.4.2 → 1.5.0

package/dist/rpc/server/rpcErrorMapping.helper.d.ts

@@ -20,9 +20,8 @@ export interface RPCMappedError {
  * `RPC_CONFLICT`, `RPC_VALIDATION_ERROR` …). Anything not built to be
  * exposed — an `RPCInternalError`, a non-exposed custom `RPCError` or
  * `BaseError`, or any other error — is answered with
- * {@link INTERNAL_ERROR_MESSAGE}, so exception text, stack traces and
- * causes never reach the remote side — nor does a non-exposed custom
- * code ({@link withheldRPCErrorCode}).
+ * {@link INTERNAL_ERROR_MESSAGE} and its custom code withheld
+ * ({@link withheldRPCErrorCode}), so no server detail reaches the peer.
  */
 export declare function mapRPCError(error: unknown): RPCMappedError;
 /**
@@ -33,4 +32,3 @@ export declare function mapRPCError(error: unknown): RPCMappedError;
  * reported by the server or raised locally (its own deadline, a cancel).
  */
 export declare function rpcWireCodeOf(error: unknown): string | undefined;
-//# sourceMappingURL=rpcErrorMapping.helper.d.ts.map

package/dist/rpc/server/rpcErrorMapping.helper.js

@@ -1,6 +1,7 @@
 import { isRPCError, RPCAuthenticationError, RPCCancelledError, RPCDeadlineExceededError, RPCDeserializationError, RPCForbiddenError, RPCInternalError, RPCInvalidRequestError, RPCProcedureNotFoundError, RPCRateLimitedError, RPCSerializationError, RPCTimeoutError, RPCTransportError, RPCUnavailableError, RPCValidationError, } from "../errors/rpc.errors.js";
 import { INTERNAL_ERROR_MESSAGE } from "../constants/rpcConstants.core.js";
 import { mapExposedBaseError, withheldRPCErrorCode } from "./rpcBaseErrorMapping.helper.js";
+import { mapDownstreamError } from "./rpcDownstreamMapping.helper.js";
 /**
  * Wire codes for the error types the server maps.
  *
@@ -33,14 +34,16 @@ const ERROR_CODES = [
  * `RPC_CONFLICT`, `RPC_VALIDATION_ERROR` …). Anything not built to be
  * exposed — an `RPCInternalError`, a non-exposed custom `RPCError` or
  * `BaseError`, or any other error — is answered with
- * {@link INTERNAL_ERROR_MESSAGE}, so exception text, stack traces and
- * causes never reach the remote side — nor does a non-exposed custom
- * code ({@link withheldRPCErrorCode}).
+ * {@link INTERNAL_ERROR_MESSAGE} and its custom code withheld
+ * ({@link withheldRPCErrorCode}), so no server detail reaches the peer.
  */
 export function mapRPCError(error) {
     if (error instanceof RPCInternalError || !(error instanceof Error)) {
         return internalFailure("RPC_INTERNAL_ERROR");
     }
+    const downstream = mapDownstreamError(error);
+    if (downstream !== undefined)
+        return downstream;
     for (const [type, code, internal] of ERROR_CODES) {
         if (error instanceof type) {
             return internal === true
@@ -99,4 +102,3 @@ function exposed(code, message, details) {
 function internalFailure(code) {
     return { payload: { code, message: INTERNAL_ERROR_MESSAGE }, internal: true };
 }
-//# sourceMappingURL=rpcErrorMapping.helper.js.map

package/dist/rpc/server/rpcServer.core.d.ts

@@ -62,4 +62,3 @@ export declare class RPCServer {
      */
     getRegistry(): RPCProcedureRegistry;
 }
-//# sourceMappingURL=rpcServer.core.d.ts.map

package/dist/rpc/server/rpcServer.core.js

@@ -84,4 +84,3 @@ export class RPCServer {
         return this.registry;
     }
 }
-//# sourceMappingURL=rpcServer.core.js.map

package/dist/rpc/streaming/index.d.ts

@@ -1,3 +1,2 @@
 export type { RPCStreamingHandler, RPCStreamingProcedure, } from "./rpcStreaming.type.js";
 export { createRPCStreamingProcedure } from "./rpcStreaming.type.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/rpc/streaming/index.js

@@ -1,2 +1 @@
 export { createRPCStreamingProcedure } from "./rpcStreaming.type.js";
-//# sourceMappingURL=index.js.map

package/dist/rpc/streaming/rpcStreaming.type.d.ts

@@ -28,4 +28,3 @@ export interface RPCStreamingProcedure<TInput = unknown, TOutput = unknown> {
  * Creates a streaming RPC procedure.
  */
 export declare function createRPCStreamingProcedure<TInput = unknown, TOutput = unknown>(name: string, handler: RPCStreamingHandler<TInput, TOutput>): RPCStreamingProcedure<TInput, TOutput>;
-//# sourceMappingURL=rpcStreaming.type.d.ts.map

package/dist/rpc/streaming/rpcStreaming.type.js

@@ -21,4 +21,3 @@ export function createRPCStreamingProcedure(name, handler) {
         handler,
     });
 }
-//# sourceMappingURL=rpcStreaming.type.js.map

package/dist/rpc/transport/codec/index.d.ts

@@ -7,4 +7,3 @@ export type { RPCFrameSerializer, RPCJsonSerializerOptions, } from "./rpcCodec.h
 export { createRPCJsonSerializer, isRPCResponseFrame } from "./rpcCodec.helper.js";
 export type { RPCBodyReadResult, RPCBodySource } from "./rpcBody.helper.js";
 export { readBoundedBody } from "./rpcBody.helper.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/rpc/transport/codec/index.js

@@ -5,4 +5,3 @@
  */
 export { createRPCJsonSerializer, isRPCResponseFrame } from "./rpcCodec.helper.js";
 export { readBoundedBody } from "./rpcBody.helper.js";
-//# sourceMappingURL=index.js.map

package/dist/rpc/transport/codec/rpcBody.helper.d.ts

@@ -33,4 +33,3 @@ export interface RPCBodySource {
  * @param maxBytes Limit in bytes; `0` or less disables the limit.
  */
 export declare function readBoundedBody(source: RPCBodySource, maxBytes: number): Promise<RPCBodyReadResult>;
-//# sourceMappingURL=rpcBody.helper.d.ts.map

package/dist/rpc/transport/codec/rpcBody.helper.js

@@ -61,4 +61,3 @@ function concat(chunks, total) {
     }
     return joined;
 }
-//# sourceMappingURL=rpcBody.helper.js.map

package/dist/rpc/transport/codec/rpcCodec.helper.d.ts

@@ -38,4 +38,3 @@ export declare function createRPCJsonSerializer(options?: RPCJsonSerializerOptio
  * transport failure instead of being read as a result.
  */
 export declare function isRPCResponseFrame(value: unknown): value is RPCResponse;
-//# sourceMappingURL=rpcCodec.helper.d.ts.map

package/dist/rpc/transport/codec/rpcCodec.helper.js

@@ -37,4 +37,3 @@ export function isRPCResponseFrame(value) {
         typeof error.code === "string" &&
         typeof error.message === "string");
 }
-//# sourceMappingURL=rpcCodec.helper.js.map

package/dist/rpc/transport/http/index.d.ts

@@ -9,4 +9,3 @@ export { createRPCHttpTransport } from "./rpcHttpTransport.core.js";
 export type { RPCFetchHandlerOptions } from "./rpcFetchHandler.core.js";
 export { createRPCFetchHandler } from "./rpcFetchHandler.core.js";
 export { RPC_HTTP_STATUS, rpcHttpStatus } from "./rpcHttpStatus.helper.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/rpc/transport/http/index.js

@@ -7,4 +7,3 @@
 export { createRPCHttpTransport } from "./rpcHttpTransport.core.js";
 export { createRPCFetchHandler } from "./rpcFetchHandler.core.js";
 export { RPC_HTTP_STATUS, rpcHttpStatus } from "./rpcHttpStatus.helper.js";
-//# sourceMappingURL=index.js.map

package/dist/rpc/transport/http/rpcFetchHandler.core.d.ts

@@ -33,4 +33,3 @@ export interface RPCFetchHandlerOptions {
  * disconnects cancels the procedure (its `context.signal` aborts).
  */
 export declare function createRPCFetchHandler(server: RPCFrameHandler, options?: RPCFetchHandlerOptions): (request: Request) => Promise<Response>;
-//# sourceMappingURL=rpcFetchHandler.core.d.ts.map

package/dist/rpc/transport/http/rpcFetchHandler.core.js

@@ -94,4 +94,3 @@ function readFrameId(frame) {
     const id = frame?.id;
     return typeof id === "string" && id.length <= MAX_RPC_REQUEST_ID_LENGTH && /^[\w.:-]+$/.test(id) ? id : "";
 }
-//# sourceMappingURL=rpcFetchHandler.core.js.map

package/dist/rpc/transport/http/rpcHttpExchange.helper.d.ts

@@ -24,4 +24,3 @@ export declare function fetchOrThrow(run: () => Promise<Response>, signal: Abort
 export declare function encode(serializer: RPCFrameSerializer, request: RPCRequest): string;
 /** Reads, parses and shape-checks the reply to `request`. */
 export declare function decode(serializer: RPCFrameSerializer, response: Response, maxBytes: number, request: RPCRequest): Promise<RPCResponse>;
-//# sourceMappingURL=rpcHttpExchange.helper.d.ts.map

package/dist/rpc/transport/http/rpcHttpExchange.helper.js

@@ -8,6 +8,7 @@ import { RPCSerializationError, RPCTimeoutError, RPCTransportError, } from "../.
 import { combineSignals } from "../../reliability/cancellation/rpcCancellation.helper.js";
 import { abortReasonToRPCError } from "../../reliability/cancellation/rpcAbort.helper.js";
 import { MAX_TIMER_DELAY } from "../../constants/rpcConstants.core.js";
+import { withCause } from "../../errors/rpcErrorCause.helper.js";
 /**
  * Links the caller signal and the deadline into one abort signal.
  *
@@ -66,13 +67,3 @@ export async function decode(serializer, response, maxBytes, request) {
     }
     return frame;
 }
-function withCause(error, cause) {
-    Object.defineProperty(error, "cause", {
-        value: cause,
-        enumerable: false,
-        configurable: true,
-        writable: true,
-    });
-    return error;
-}
-//# sourceMappingURL=rpcHttpExchange.helper.js.map

package/dist/rpc/transport/http/rpcHttpStatus.helper.d.ts

@@ -13,4 +13,3 @@ export declare const RPC_HTTP_STATUS: Readonly<Record<string, number>>;
  * mapped status for a known error code, and 500 otherwise.
  */
 export declare function rpcHttpStatus(response: RPCResponse): number;
-//# sourceMappingURL=rpcHttpStatus.helper.d.ts.map

package/dist/rpc/transport/http/rpcHttpStatus.helper.js

@@ -34,4 +34,3 @@ export function rpcHttpStatus(response) {
     const code = response.error?.code;
     return (code !== undefined ? RPC_HTTP_STATUS[code] : undefined) ?? 500;
 }
-//# sourceMappingURL=rpcHttpStatus.helper.js.map

package/dist/rpc/transport/http/rpcHttpTransport.core.d.ts

@@ -33,4 +33,3 @@ export interface RPCHttpTransportOptions {
  * returned as a response for the client to rebuild into a typed error.
  */
 export declare function createRPCHttpTransport(options: RPCHttpTransportOptions): RPCTransport;
-//# sourceMappingURL=rpcHttpTransport.core.d.ts.map

package/dist/rpc/transport/http/rpcHttpTransport.core.js

@@ -42,4 +42,3 @@ export function createRPCHttpTransport(options) {
         },
     };
 }
-//# sourceMappingURL=rpcHttpTransport.core.js.map

package/dist/rpc/transport/index.d.ts

@@ -11,4 +11,3 @@ export type { RPCFrameHandler, RPCMemoryTransportOptions, } from "./memory/index
 export { createRPCMemoryTransport } from "./memory/index.js";
 export type { RPCHttpHeaders, RPCHttpTransportOptions, RPCFetchHandlerOptions, } from "./http/index.js";
 export { createRPCHttpTransport, createRPCFetchHandler, RPC_HTTP_STATUS, rpcHttpStatus, } from "./http/index.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/rpc/transport/index.js

@@ -7,4 +7,3 @@
 export { createRPCJsonSerializer, isRPCResponseFrame, readBoundedBody, } from "./codec/index.js";
 export { createRPCMemoryTransport } from "./memory/index.js";
 export { createRPCHttpTransport, createRPCFetchHandler, RPC_HTTP_STATUS, rpcHttpStatus, } from "./http/index.js";
-//# sourceMappingURL=index.js.map

package/dist/rpc/transport/memory/index.d.ts

@@ -4,4 +4,3 @@
  */
 export type { RPCFrameHandler, RPCMemoryTransportOptions, } from "./rpcMemoryTransport.core.js";
 export { createRPCMemoryTransport } from "./rpcMemoryTransport.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/rpc/transport/memory/index.js

@@ -3,4 +3,3 @@
  * same process, serializing frames across the boundary by default.
  */
 export { createRPCMemoryTransport } from "./rpcMemoryTransport.core.js";
-//# sourceMappingURL=index.js.map

package/dist/rpc/transport/memory/rpcMemoryTransport.core.d.ts

@@ -39,4 +39,3 @@ export interface RPCMemoryTransportOptions {
  * with `RPCUnavailableError`.
  */
 export declare function createRPCMemoryTransport(server: RPCFrameHandler, options?: RPCMemoryTransportOptions): RPCTransport;
-//# sourceMappingURL=rpcMemoryTransport.core.d.ts.map

package/dist/rpc/transport/memory/rpcMemoryTransport.core.js

@@ -70,4 +70,3 @@ function copyResponse(serializer, response) {
         });
     }
 }
-//# sourceMappingURL=rpcMemoryTransport.core.js.map

package/dist/rpc/transport/rpcTransport.type.d.ts

@@ -22,4 +22,3 @@ export interface RPCTransport {
     send(request: RPCRequest, options?: RPCTransportRequestOptions): Promise<RPCResponse>;
     close?(): Promise<void>;
 }
-//# sourceMappingURL=rpcTransport.type.d.ts.map

package/dist/rpc/transport/rpcTransport.type.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=rpcTransport.type.js.map

package/dist/rpc/types/index.d.ts

@@ -10,4 +10,3 @@ export type { RPCRequest, RPCRequestOptions } from "./rpcRequest.type.js";
 export { createRPCRequest } from "./rpcRequest.type.js";
 export type { RPCErrorPayload, RPCResponse } from "./rpcResponse.type.js";
 export { createRPCErrorPayload, createRPCResponse, createRPCErrorResponse, } from "./rpcResponse.type.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/rpc/types/index.js

@@ -6,4 +6,3 @@
 export { createRPCMetadata } from "./rpcMetadata.type.js";
 export { createRPCRequest } from "./rpcRequest.type.js";
 export { createRPCErrorPayload, createRPCResponse, createRPCErrorResponse, } from "./rpcResponse.type.js";
-//# sourceMappingURL=index.js.map

package/dist/rpc/types/rpcMetadata.type.d.ts

@@ -28,4 +28,3 @@ export interface RPCMetadataOptions {
  * Creates RPC metadata from options.
  */
 export declare function createRPCMetadata(options?: RPCMetadataOptions): RPCMetadata;
-//# sourceMappingURL=rpcMetadata.type.d.ts.map

package/dist/rpc/types/rpcMetadata.type.js

@@ -4,4 +4,3 @@
 export function createRPCMetadata(options = {}) {
     return Object.freeze({ ...options });
 }
-//# sourceMappingURL=rpcMetadata.type.js.map

package/dist/rpc/types/rpcProcedureName.type.d.ts

@@ -9,4 +9,3 @@
  * Must be dot-separated lowercase identifiers, e.g. "users.getUser".
  */
 export type RPCProcedureName = string;
-//# sourceMappingURL=rpcProcedureName.type.d.ts.map

package/dist/rpc/types/rpcProcedureName.type.js

@@ -4,4 +4,3 @@
  * Core types for the Zudojs RPC package.
  */
 export {};
-//# sourceMappingURL=rpcProcedureName.type.js.map

package/dist/rpc/types/rpcRequest.type.d.ts

@@ -24,4 +24,3 @@ export interface RPCRequestOptions<TPayload = unknown> {
  * Creates an RPC request.
  */
 export declare function createRPCRequest<TPayload = unknown>(options: RPCRequestOptions<TPayload>): RPCRequest<TPayload>;
-//# sourceMappingURL=rpcRequest.type.d.ts.map

package/dist/rpc/types/rpcRequest.type.js

@@ -8,4 +8,3 @@ export function createRPCRequest(options) {
         timestamp: options.timestamp ?? Date.now(),
     });
 }
-//# sourceMappingURL=rpcRequest.type.js.map

package/dist/rpc/types/rpcResponse.type.d.ts

@@ -29,4 +29,3 @@ export declare function createRPCResponse<TResult = unknown>(id: string, result:
  * Creates a failed RPC response.
  */
 export declare function createRPCErrorResponse(id: string, error: RPCErrorPayload, metadata?: RPCMetadata): RPCResponse<never>;
-//# sourceMappingURL=rpcResponse.type.d.ts.map

package/dist/rpc/types/rpcResponse.type.js

@@ -30,4 +30,3 @@ export function createRPCErrorResponse(id, error, metadata) {
         ...(metadata !== undefined ? { metadata } : {}),
     });
 }
-//# sourceMappingURL=rpcResponse.type.js.map

package/dist/rpc/validation/index.d.ts

@@ -1,3 +1,2 @@
 export type { RPCRequestLimits, RPCSchema } from "./rpcValidation.core.js";
 export { assertValidProcedureName, assertValidRequest, measurePayloadBytes, toValidationIssues, parseInput, parseOutput, } from "./rpcValidation.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/rpc/validation/index.js

@@ -1,2 +1 @@
 export { assertValidProcedureName, assertValidRequest, measurePayloadBytes, toValidationIssues, parseInput, parseOutput, } from "./rpcValidation.core.js";
-//# sourceMappingURL=index.js.map

package/dist/rpc/validation/rpcValidation.core.d.ts

@@ -106,4 +106,3 @@ export declare function parseInput<T>(schema: RPCSchema<T>, value: unknown, proc
  * @throws {RPCInternalError}
  */
 export declare function parseOutput<T>(schema: RPCSchema<T>, value: unknown, procedureName: string): T;
-//# sourceMappingURL=rpcValidation.core.d.ts.map

package/dist/rpc/validation/rpcValidation.core.js

@@ -152,4 +152,3 @@ export function parseOutput(schema, value, procedureName) {
         .join(", ");
     throw new RPCInternalError(`Procedure "${procedureName}" produced a response that does not match its output schema at ${where}.`, procedureName);
 }
-//# sourceMappingURL=rpcValidation.core.js.map

package/dist/testing/index.d.ts

@@ -8,4 +8,3 @@ export { createRPCRequest } from "../rpc/types/rpcRequest.type.js";
 export { createRPCProcedure } from "../rpc/procedure/rpcProcedure.type.js";
 export { RPCServer } from "../rpc/server/rpcServer.core.js";
 export { RPCClient } from "../rpc/client/rpcClient.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/testing/index.js

@@ -7,4 +7,3 @@ export { createRPCRequest } from "../rpc/types/rpcRequest.type.js";
 export { createRPCProcedure } from "../rpc/procedure/rpcProcedure.type.js";
 export { RPCServer } from "../rpc/server/rpcServer.core.js";
 export { RPCClient } from "../rpc/client/rpcClient.core.js";
-//# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/rpc",
-  "version": "1.4.2",
+  "version": "1.5.0",
   "description": "Remote procedure call infrastructure for Zudojs applications.",
   "license": "MIT",
   "author": {
@@ -27,12 +27,12 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@zudojs/constants": "1.1.3",
-    "@zudojs/errors": "1.3.1",
-    "@zudojs/schema": "1.2.2",
-    "@zudojs/security": "1.3.2",
-    "@zudojs/serialization": "1.2.2",
-    "@zudojs/types": "1.2.0"
+    "@zudojs/constants": "1.2.0",
+    "@zudojs/errors": "1.4.0",
+    "@zudojs/schema": "1.3.0",
+    "@zudojs/security": "1.3.4",
+    "@zudojs/serialization": "1.3.0",
+    "@zudojs/types": "1.3.0"
   },
   "devDependencies": {
     "typescript": "7.0.2",

package/dist/rpc/validation/rpcUnsafeKey.helper.d.ts

@@ -1,18 +0,0 @@
-/**
- * Detection of prototype-polluting keys in decoded, untrusted data.
- */
-/**
- * Returns the first `__proto__`, `constructor` or `prototype` key found
- * anywhere in `value`, or `undefined` when there is none.
- *
- * `JSON.parse` keeps such a key as an ordinary own property, so it reaches
- * handlers intact; the moment one is copied with `Object.assign`, a
- * `for…in` merge or a bracket assignment, it replaces the target's
- * prototype. Transports refuse a frame that carries one rather than
- * silently dropping it.
- *
- * Walks plain objects and arrays only, iteratively (no recursion limit)
- * and cycle-safe, so it is safe on any decoded or in-process value.
- */
-export declare function findUnsafeKey(value: unknown): string | undefined;
-//# sourceMappingURL=rpcUnsafeKey.helper.d.ts.map

package/dist/rpc/validation/rpcUnsafeKey.helper.js

@@ -1,60 +0,0 @@
-/**
- * Detection of prototype-polluting keys in decoded, untrusted data.
- */
-import { SCHEMA_FORBIDDEN_KEYS } from "@zudojs/constants";
-function isTraversable(value) {
-    if (typeof value !== "object" || value === null) {
-        return false;
-    }
-    if (Array.isArray(value)) {
-        return true;
-    }
-    const prototype = Object.getPrototypeOf(value);
-    return prototype === Object.prototype || prototype === null;
-}
-/**
- * Returns the first `__proto__`, `constructor` or `prototype` key found
- * anywhere in `value`, or `undefined` when there is none.
- *
- * `JSON.parse` keeps such a key as an ordinary own property, so it reaches
- * handlers intact; the moment one is copied with `Object.assign`, a
- * `for…in` merge or a bracket assignment, it replaces the target's
- * prototype. Transports refuse a frame that carries one rather than
- * silently dropping it.
- *
- * Walks plain objects and arrays only, iteratively (no recursion limit)
- * and cycle-safe, so it is safe on any decoded or in-process value.
- */
-export function findUnsafeKey(value) {
-    if (!isTraversable(value)) {
-        return undefined;
-    }
-    const seen = new WeakSet();
-    const pending = [value];
-    while (pending.length > 0) {
-        const node = pending.pop();
-        if (seen.has(node)) {
-            continue;
-        }
-        seen.add(node);
-        if (Array.isArray(node)) {
-            for (const child of node) {
-                if (isTraversable(child)) {
-                    pending.push(child);
-                }
-            }
-            continue;
-        }
-        for (const key of Object.keys(node)) {
-            if (SCHEMA_FORBIDDEN_KEYS.has(key)) {
-                return key;
-            }
-            const child = node[key];
-            if (isTraversable(child)) {
-                pending.push(child);
-            }
-        }
-    }
-    return undefined;
-}
-//# sourceMappingURL=rpcUnsafeKey.helper.js.map