bare-rpc 1.3.9 → 1.5.0

package/README.md

@@ -8,28 +8,119 @@ npm i bare-rpc
 
 ## Usage
 
+This example wires two peers together over IPC and makes one request:
+
 ```js
+import IPC from 'bare-ipc'
 import RPC from 'bare-rpc'
 
-// On one end
-const rpc = new RPC(stream, (req) => {
-  if (req.command === 42) {
-    console.log(req.data.toString()) // ping
-    req.reply('pong')
-  }
-})
+const [a, b] = IPC.open().map((port) => port.connect())
+
+const server = new RPC(a, (req) => req.reply('pong'))
 
-// On the other end
-const req = rpc.request(42)
+const client = new RPC(b)
+
+const req = client.request(1)
 req.send('ping')
 
-const replyBuffer = await req.reply()
-console.log(replyBuffer.toString()) // pong
+console.log((await req.reply()).toString()) // pong
+
+a.destroy()
+b.destroy()
+```
+
+`new RPC(stream, onrequest, opts)` runs a session over a duplex `stream`, such as a pipe, a socket or an IPC port. `onrequest` is a function that is called with each request and event of the peer, or a `CommandRouter`. `opts` takes `maxFrameSize` and `maxBufferedBytes`, as described under [Untrusted peers](#untrusted-peers).
+
+See the [`bare-rpc` reference](https://docs.pears.com/reference/bare/modules/bare-rpc) for the full API.
+
+## Command routing
+
+A `CommandRouter` sends each request and event to the handler registered for its command. Pass it to `RPC` as `onrequest`:
+
+```js
+const router = new RPC.CommandRouter()
+
+router.respond(1, (req, data) => Buffer.from('pong'))
+router.respond(2, (req, data) => console.log(req.command))
+
+const rpc = new RPC(stream, router)
+```
+
+A handler is called with the request and its data, and returns the data to reply with, unless it has answered the request itself. Events for a command go to the same handler, and its return value is ignored. A request for a command with no handler is rejected with the code `UNKNOWN_COMMAND`. An event for a command with no handler is dropped.
+
+The data is decoded and the reply encoded with a [compact-encoding](https://github.com/holepunchto/compact-encoding), `c.raw` by default. Pass `valueEncoding` to `new CommandRouter()` to change the default, or `valueEncoding`, `requestEncoding` and `responseEncoding` to `respond(command, opts, handler)` for one command.
+
+## Requests and responses
+
+`rpc.request(command)` returns a request. Call `send(data)` on it to send it, and `await reply()` to get its reply. `rpc.event(command)` returns an event, which gets no reply. Call `send(data)` on it to send it. Each can be sent once, and a reply can be read once. Sending again throws an `RPCError` with the code `ALREADY_SENT`, and reading again throws one with the code `ALREADY_RECEIVED`.
+
+Data can be a buffer, or a string that `send(data, encoding)` and `reply(data, encoding)` encode with `encoding`, `utf8` by default. `reply(encoding)` on a request you sent decodes the reply to a string.
+
+A request of the peer is answered once, with `reply()` or `createResponseStream()`. Answering again throws an `RPCError` with the code `ALREADY_SENT`, and `req.sent` tells whether the request has been answered. Events reach `onrequest` as requests without `reply()`. Each request and event of the peer is handled on its own, so a slow async handler does not hold back the others.
+
+If a request handler throws before it answers, the request is rejected with the `message` of the error, and its `code` and `errno` if it has them. If the handler had opened a response stream, the stream is destroyed with the error instead.
+
+When the peer rejects a request, `reply()` rejects with an `Error` with the `message`, `code` and `errno` of the peer.
+
+Without `onrequest`, every request is rejected with the code `UNKNOWN_COMMAND`, and events are dropped.
+
+## Streaming requests and responses
+
+A request can stream its body, its reply, or both:
+
+- `createRequestStream()` returns a `Writable` for the body, and `await reply()` gets a single reply.
+- `send(data)` sends a plain request, and `createResponseStream()` returns a `Readable` for the reply.
+- `createRequestStream()` and `createResponseStream()` together stream both.
+
+On the answering side, `req.createRequestStream()` returns a `Readable` for the body, and `req.createResponseStream()` returns a `Writable` for the reply. This handler echoes the body back:
+
+```js
+const server = new RPC(stream, (req) => {
+  req.createRequestStream().pipe(req.createResponseStream())
+})
+
+const req = client.request(1)
+const outgoing = req.createRequestStream()
+const incoming = req.createResponseStream()
+
+outgoing.end('ping')
+
+for await (const chunk of incoming) console.log(chunk.toString()) // ping
 ```
 
-## API
+A stream only carries data once both ends have opened it, so data written before then is held back until the peer has opened its end. The handler opens the body when it calls `req.createRequestStream()`. If the peer answers before it opens the body, the body is destroyed, with the error of the reply if it has one.
+
+An incoming stream asks the peer to pause once it buffers its `highWaterMark`, which is 16 KiB by default, and to resume once it is read. While the peer has paused an outgoing stream, its writes are held back. If the peer keeps sending anyway, an incoming stream holds at most `maxBufferedBytes`, 16 MiB by default, before the session fails with an `RPCError` with the code `STREAM_OVERFLOW`.
+
+The body of a request and the reply to a request can each be read once. Calling `createRequestStream()` on a request of the peer again, or `createResponseStream()` or `reply()` on a request you sent again, throws an `RPCError` with the code `ALREADY_RECEIVED`.
+
+## Termination
+
+The session ends with an `RPCError` with the code `CHANNEL_CLOSED` when `stream` closes. It fails with an error instead when:
+
+- `stream` emits an error, with that error.
+- `stream` ends partway through a frame, with the code `INVALID_MESSAGE`.
+- An event handler throws, with that error.
+- The peer sends a bad frame, as described under [Untrusted peers](#untrusted-peers).
+
+Pending replies then reject with the error, and so do later replies. Open streams are destroyed with it, and so are streams created later. Events sent after the end are dropped.
+
+`RPC` does not close `stream` when the session ends cleanly. When it fails for any reason but an error of `stream`, `RPC` destroys `stream` with the error, so the frames still queued in it are not written. To end the session yourself, destroy `stream`. `rpc.idle` tells whether no requests or streams are in flight, so that it is safe to do so.
+
+## Untrusted peers
+
+`RPC` does not trust the peer to send valid frames. If a frame is larger than `maxFrameSize`, cannot be decoded, or breaks the protocol, the session fails with an `RPCError`. The code tells you why:
+
+- `FRAME_TOO_LARGE`: The frame, with its 4-byte length prefix, is larger than `maxFrameSize`, 16 MiB by default. This is checked as soon as the length prefix arrives, before the rest of the frame is read.
+- `UNKNOWN_MESSAGE`: The frame has a message type that `RPC` does not know.
+- `INVALID_MESSAGE`: The frame cannot be decoded, `stream` ends partway through a frame, or the frame is one that a valid peer never sends. Examples are a response or stream message with an id of 0, a stream message with an invalid set of flags, and a new request that reuses the id of a request that is still in flight.
+- `STREAM_OVERFLOW`: An incoming stream holds more than `maxBufferedBytes` of data that has not been read. This only happens when the peer keeps sending after it was asked to pause.
+
+A frame that refers to a request or stream that has already finished, or that was never known, is ignored. The same goes for frames that arrive for a stream that has already ended or been destroyed.
+
+If you read the reply as a stream but the peer replies without one, the reply arrives on the stream as a single chunk, unless it is empty, and the stream then ends. An error reply destroys the stream with the error instead.
 
-See the [`bare-rpc` reference](https://docs.pears.com/reference/bare/modules/bare-rpc).
+If you expect a plain reply but the peer replies with a stream, `reply()` rejects with an `RPCError` with the code `UNEXPECTED_STREAM`. The session destroys the stream toward the peer and stays open.
 
 ## License
 

package/index.d.ts

@@ -124,7 +124,9 @@ interface RPCOutgoingRequest {
    * @param encoding - If given, decodes the reply payload to a string using this encoding; omit to
    * receive the raw `Buffer`.
    * @returns a promise that resolves with the remote end's reply payload, or rejects with the
-   * channel's teardown error if it closes before a reply arrives.
+   * channel's teardown error if it closes before a reply arrives. If the remote end replies with a
+   * stream, the promise rejects with an error whose code is `UNEXPECTED_STREAM`, the remote end's
+   * stream is destroyed, and the connection stays open.
    * @throws {ALREADY_RECEIVED} a reply is already being received for this request.
    */
   reply(encoding?: BufferEncoding): Promise<Buffer | string | null>
@@ -139,7 +141,8 @@ interface RPCOutgoingRequest {
   createRequestStream(opts?: WritableOptions): RPCOutgoingStream
   /**
    * Create a [`Readable`](https://github.com/mafintosh/streamx#readable-stream) stream for
-   * receiving data in reply to the request.
+   * receiving data in reply to the request. If the remote end replies without a stream, the reply
+   * arrives as a single chunk, unless it is empty, and the stream then ends.
    * @param opts - Options for the returned
    * [`Readable`](https://github.com/mafintosh/streamx#readable-stream) stream.
    * @throws {ALREADY_RECEIVED} the response has already been received.
@@ -212,16 +215,20 @@ interface RPCRespondOptions {
 }
 
 /**
- * @param req - The incoming request.
+ * @param req - The incoming request. For an event, this is an `RPCIncomingEvent`.
  * @param data - The request data, decoded with the request encoding of the command.
  * @returns the response data, encoded with the response encoding of the command and sent as the
- * reply unless the handler has already replied.
+ * reply unless the handler has already replied. For an event, the return value is ignored and
+ * nothing is sent.
  */
 type RPCRequestHandler = (req: RPCIncomingRequest, data: any) => unknown
 
 interface RPCCommandRouter {
   /**
    * Answer requests for `command` with `onrequest`, in place of any handler registered before.
+   * Events for `command` are also passed to `onrequest`, but are never answered. A request for a
+   * command with no handler is answered with an error whose code is `UNKNOWN_COMMAND`, and an event
+   * for such a command is dropped.
    * @param command - The command number to answer.
    * @param opts - The encodings of the command.
    * @param onrequest - The handler of the requests.
@@ -237,6 +244,21 @@ declare class RPCCommandRouter {
   constructor(opts?: RPCCommandRouterOptions)
 }
 
+interface RPCOptions {
+  /**
+   * The largest frame to accept from the remote end, in bytes, counting the 4-byte length prefix. A
+   * larger frame fails the connection with `FRAME_TOO_LARGE` as soon as its length prefix arrives.
+   * Defaults to 16 MiB.
+   */
+  maxFrameSize?: number
+  /**
+   * The most data, in bytes, that one incoming stream may hold before it is read. A remote end that
+   * keeps sending past this limit, rather than stop when asked to pause, fails the connection with
+   * `STREAM_OVERFLOW`. Defaults to 16 MiB.
+   */
+  maxBufferedBytes?: number
+}
+
 interface RPC {
   /**
    * Whether there are no requests or responses currently in flight. Useful for determining when it
@@ -264,12 +286,24 @@ declare class RPC {
    * @param stream - The duplex stream to frame RPC messages over, such as a pipe or socket.
    * @param onrequest - Callback run for each incoming request or event, receiving an
    * `RPCIncomingRequest` (or `RPCIncomingEvent`) to inspect and `reply()` to, or an
-   * `RPCCommandRouter` that answers each request with the handler of its command. Defaults to a
-   * no-op.
+   * `RPCCommandRouter` that answers each request with the handler of its command. If it throws, the
+   * request is answered with the error, or, if it has already created a response stream, that
+   * stream is destroyed with the error. If it has already replied, nothing more is sent. If
+   * omitted, every request is answered with an error whose code is `UNKNOWN_COMMAND` and every
+   * event is dropped.
+   * @param opts - Options for the connection.
+   *
+   * The remote end is not trusted to send valid frames. A frame that is too large, cannot be
+   * decoded, or breaks the protocol fails the connection, and so does a stream that holds more
+   * unread data than `maxBufferedBytes`: `stream` is destroyed with an `RPCError` whose code is
+   * `FRAME_TOO_LARGE`, `UNKNOWN_MESSAGE`, `INVALID_MESSAGE` or `STREAM_OVERFLOW`, and every request
+   * and stream in flight is rejected or destroyed with it. A frame that refers to a request or stream
+   * that has already finished, or that was never known, is ignored.
    */
   constructor(
     stream: Duplex,
-    onrequest?: ((req: RPCIncomingRequest) => void | Promise<void>) | RPCCommandRouter
+    onrequest?: ((req: RPCIncomingRequest) => void | Promise<void>) | RPCCommandRouter | null,
+    opts?: RPCOptions
   )
 }
 
@@ -290,7 +324,8 @@ declare namespace RPC {
     type RPCCommandRouterOptions as CommandRouterOptions,
     type RPCRespondOptions as RespondOptions,
     type RPCRequestHandler as RequestHandler,
-    type RPCValueEncoding as ValueEncoding
+    type RPCValueEncoding as ValueEncoding,
+    type RPCOptions as Options
   }
 }
 

package/index.js

@@ -1,6 +1,7 @@
 const safetyCatch = require('safety-catch')
 const b4a = require('b4a')
 const c = require('compact-encoding')
+const { isEnding } = require('bare-stream')
 const m = require('./lib/messages')
 const errors = require('./lib/errors')
 const { type: t, stream: s } = require('./lib/constants')
@@ -12,17 +13,45 @@ const OutgoingRequest = require('./lib/outgoing-request')
 const OutgoingStream = require('./lib/outgoing-stream')
 const CommandRouter = require('./lib/command-router')
 
+const DEFAULT_MAX_FRAME_SIZE = 16 * 1024 * 1024
+const DEFAULT_MAX_BUFFERED_BYTES = 16 * 1024 * 1024
+const MAX_PENDING_RESPONSES = 1024
+
+const streamFlags = new Set()
+
+for (const direction of [s.REQUEST, s.RESPONSE]) {
+  for (const action of [
+    s.OPEN,
+    s.CLOSE,
+    s.CLOSE | s.ERROR,
+    s.PAUSE,
+    s.RESUME,
+    s.DATA,
+    s.END,
+    s.DESTROY,
+    s.DESTROY | s.ERROR
+  ]) {
+    streamFlags.add(direction | action)
+  }
+}
+
 module.exports = exports = class RPC {
-  constructor(stream, onrequest = noop) {
+  constructor(stream, onrequest = null, opts = {}) {
+    const { maxFrameSize = DEFAULT_MAX_FRAME_SIZE, maxBufferedBytes = DEFAULT_MAX_BUFFERED_BYTES } =
+      opts
+
     this._stream = stream
+    this._maxFrameSize = maxFrameSize
+    this._maxBufferedBytes = maxBufferedBytes
     this._id = 0
 
     this._outgoingRequests = new Map()
     this._outgoingResponses = new Map()
     this._incomingRequests = new Map()
     this._incomingResponses = new Map()
-    this._pendingRequests = new Set()
     this._pendingResponses = new Set()
+    this._unansweredRequests = new Set()
+    this._highestRequestId = 0
 
     this._buffer = []
     this._buffered = 0
@@ -32,6 +61,10 @@ module.exports = exports = class RPC {
     this._closed = false
     this._error = null
 
+    if (onrequest === null) {
+      onrequest = new CommandRouter()
+    }
+
     if (typeof onrequest === 'function') {
       onrequest = onrequest.bind(this)
     } else {
@@ -42,12 +75,14 @@ module.exports = exports = class RPC {
     this._onerror = this._onerror.bind(this)
     this._onclose = this._onclose.bind(this)
     this._ondata = this._ondata.bind(this)
+    this._onend = this._onend.bind(this)
     this._ondrain = this._ondrain.bind(this)
 
     this._stream
       .on('error', this._onerror)
       .on('close', this._onclose)
       .on('data', this._ondata)
+      .on('end', this._onend)
       .on('drain', this._ondrain)
   }
 
@@ -59,7 +94,6 @@ module.exports = exports = class RPC {
       this._outgoingResponses.size === 0 &&
       this._incomingRequests.size === 0 &&
       this._incomingResponses.size === 0 &&
-      this._pendingRequests.size === 0 &&
       this._pendingResponses.size === 0
     )
   }
@@ -130,6 +164,10 @@ module.exports = exports = class RPC {
 
       this._outgoingRequests.set(request.id, request)
 
+      // Announce the stream right away rather than when it opens, so that the
+      // remote end also learns of a stream that is destroyed before it opens.
+      request._requestStream._sendOpen()
+
       request._requestStream.on('close', () => this._gcOutgoingRequest(request))
     } else {
       request._requestStream = new IncomingStream(this, request, t.REQUEST, opts)
@@ -149,6 +187,8 @@ module.exports = exports = class RPC {
     // settle.
     if (this._closed) return
 
+    this._onanswered(request)
+
     this._sendMessage({
       type: t.RESPONSE,
       id: request.id,
@@ -168,6 +208,10 @@ module.exports = exports = class RPC {
 
       this._outgoingResponses.set(request.id, request)
 
+      request._responseStream._sendOpen()
+
+      if (this._onanswered(request)) request._responseStream._continueOpen()
+
       request._responseStream.on('close', () => this._outgoingResponses.delete(request.id))
     } else {
       request._responseStream = new IncomingStream(this, request, t.RESPONSE, opts)
@@ -186,15 +230,23 @@ module.exports = exports = class RPC {
   }
 
   _sendError(request, err) {
+    this._onanswered(request)
+
     this._sendMessage({
       type: t.RESPONSE,
       id: request.id,
       stream: 0,
-      error: err,
+      error: m.toError(err),
       data: null
     })
   }
 
+  // Returns whether the remote end had already opened its response stream.
+  _onanswered(request) {
+    this._unansweredRequests.delete(request.id)
+    return this._pendingResponses.delete(request.id)
+  }
+
   _gcOutgoingRequest(request) {
     // The entry must stay reachable for as long as an incoming message might
     // still target it; until the response has settled and, if the request was
@@ -255,13 +307,19 @@ module.exports = exports = class RPC {
     this._outgoingResponses.clear()
     this._incomingRequests.clear()
     this._incomingResponses.clear()
-    this._pendingRequests.clear()
     this._pendingResponses.clear()
+    this._unansweredRequests.clear()
 
     for (const stream of streams) stream.destroy(err)
   }
 
+  _fail(err) {
+    this._stream.destroy(err)
+  }
+
   _ondata(data) {
+    if (this._stream.destroying) return
+
     this._buffer.push(data)
     this._buffered += data.byteLength
 
@@ -272,13 +330,25 @@ module.exports = exports = class RPC {
     }
   }
 
+  _onend() {
+    if (this._buffered > 0) this._fail(errors.INVALID_MESSAGE('Truncated frame'))
+  }
+
   _onbeforeframe() {
-    while (this._buffered >= 4) {
+    while (this._buffered >= 4 && !this._stream.destroying) {
       const buffer = this._buffer.length === 1 ? this._buffer[0] : b4a.concat(this._buffer)
 
       this._buffer = [buffer]
       this._frame = 4 + c.uint32.decode(c.state(0, 4, buffer))
 
+      if (this._frame > this._maxFrameSize) {
+        return this._fail(
+          errors.FRAME_TOO_LARGE(
+            `Frame of ${this._frame} bytes exceeds the limit of ${this._maxFrameSize} bytes`
+          )
+        )
+      }
+
       if (this._buffered < this._frame) return
 
       this._onframe()
@@ -304,71 +374,127 @@ module.exports = exports = class RPC {
     this._onmessage(buffer.subarray(0, frame))
   }
 
-  async _onmessage(buffer) {
+  _onmessage(buffer) {
     let message
     try {
       message = m.message.decode(c.state(0, buffer.length, buffer))
     } catch (err) {
-      safetyCatch(err)
-
-      return this._stream.destroy(err)
+      return this._fail(
+        err instanceof errors ? err : errors.INVALID_MESSAGE(`Malformed message: ${err.message}`)
+      )
     }
 
-    switch (message.type) {
-      case t.REQUEST: {
-        const request =
-          message.id === 0
-            ? new IncomingEvent(this, message.command, message.data)
-            : new IncomingRequest(this, message.id, message.command, message.data)
-
-        try {
-          await this._onrequest(request)
-        } catch (err) {
-          safetyCatch(err)
-
-          if (message.id) this._sendError(request, err)
-          else this._stream.destroy(err)
-        }
-        break
-      }
-      case t.RESPONSE:
-        try {
+    const violation = protocolViolation(message)
+
+    if (violation !== null) return this._fail(errors.INVALID_MESSAGE(violation))
+
+    // Handling a message can run user code, such as stream listeners, so route
+    // anything it throws through the connection failure path rather than let it
+    // escape into the underlying stream.
+    try {
+      switch (message.type) {
+        case t.REQUEST:
+          this._onrequestmessage(message)
+          break
+        case t.RESPONSE:
           this._onresponse(message)
-        } catch (err) {
-          safetyCatch(err)
-        }
-        break
-      case t.STREAM:
-        try {
+          break
+        case t.STREAM:
           this._onstream(message)
-        } catch (err) {
-          safetyCatch(err)
-        }
+      }
+    } catch (err) {
+      this._fail(err)
     }
   }
 
-  _onresponse(message) {
-    if (message.id === 0) return
+  async _onrequestmessage(message) {
+    // A repeated id can only be caught while its request is tracked here, which
+    // is also the only time it could corrupt any state.
+    if (
+      this._unansweredRequests.has(message.id) ||
+      this._incomingRequests.has(message.id) ||
+      this._outgoingResponses.has(message.id)
+    ) {
+      return this._fail(errors.INVALID_MESSAGE(`Request '${message.id}' is already in flight`))
+    }
+
+    let request
+
+    if (message.id === 0) {
+      request = new IncomingEvent(this, message.command, message.data)
+    } else {
+      request = new IncomingRequest(this, message.id, message.command, message.data)
+
+      this._unansweredRequests.add(message.id)
+      this._highestRequestId = Math.max(this._highestRequestId, message.id)
+    }
 
+    try {
+      await this._onrequest(request)
+    } catch (err) {
+      safetyCatch(err)
+
+      if (message.id === 0) this._stream.destroy(err)
+      else if (request._responseStream !== null) request._responseStream.destroy(err)
+      else if (!request.sent) this._sendError(request, err)
+    }
+  }
+
+  _onresponse(message) {
     const request = this._outgoingRequests.get(message.id)
     if (request === undefined) return
 
     if (message.error) {
-      request._responded = true
-      this._gcOutgoingRequest(request)
+      this._settle(request, message.error, null)
+
+      if (request._responseStream !== null) request._responseStream.destroy(message.error)
 
-      request._reject(message.error)
+      this._releaseRequestStream(request, message.error)
     } else if (message.stream === 0) {
-      request._responded = true
-      this._gcOutgoingRequest(request)
+      this._settle(request, null, message.data)
 
-      request._resolve(message.data)
+      const stream = request._responseStream
+
+      if (isPushable(stream)) {
+        if (message.data.byteLength > 0) stream.push(message.data)
+        stream.push(null)
+      }
+
+      this._releaseRequestStream(request, null)
+    } else if (request._responseStream === null) {
+      const err = errors.UNEXPECTED_STREAM(`Request '${request.id}' was answered with a stream`)
+
+      this._settle(request, err, null)
+
+      this._sendMessage({
+        type: t.STREAM,
+        id: request.id,
+        stream: s.RESPONSE | s.DESTROY,
+        error: null,
+        data: null
+      })
+
+      this._releaseRequestStream(request, err)
     }
   }
 
-  _onstream(message) {
-    if (message.id === 0) return
+  _settle(request, err, data) {
+    request._responded = true
+    this._gcOutgoingRequest(request)
+
+    if (err) request._reject(err)
+    else request._resolve(data)
+  }
 
+  // Once the request is answered, a request stream that the remote end never
+  // opened will never be read, and would otherwise wait for its open forever.
+  _releaseRequestStream(request, err) {
+    const stream = request._requestStream
+
+    if (stream !== null && !stream._acknowledged) stream.destroy(err)
+  }
+
+  _onstream(message) {
     if (message.stream & s.OPEN) this._onstreamopen(message)
     else if (message.stream & s.CLOSE) this._onstreamclose(message)
     else if (message.stream & s.PAUSE) this._onstreampause(message)
@@ -379,124 +505,67 @@ module.exports = exports = class RPC {
   }
 
   _onstreamopen(message) {
-    let stream
-
     if (message.stream & s.REQUEST) {
-      const request = this._outgoingRequests.get(message.id)
-      if (request === undefined) {
-        this._pendingRequests.add(message.id)
-        return
-      }
+      const stream = this._outgoingStream(message)
+      if (stream !== null) stream._continueOpen()
+    } else {
+      const request = this._outgoingResponses.get(message.id)
 
-      stream = request._requestStream
+      if (request !== undefined) return request._responseStream._continueOpen()
 
-      if (stream === null || stream._pendingOpen === null) {
-        this._pendingRequests.add(message.id)
-        return
-      }
-    } else if (message.stream & s.RESPONSE) {
-      const request = this._outgoingResponses.get(message.id)
-      if (request === undefined) {
-        this._pendingResponses.add(message.id)
+      // The remote end opens its response stream as soon as it is created,
+      // which may be before its request arrives or before the handler here
+      // creates the response stream. Remember the open until the response
+      // stream is created, the request is answered, or the remote end destroys
+      // its stream. Any other open is for a request that has already been
+      // answered.
+      if (this._pendingResponses.has(message.id)) return
+
+      if (!this._unansweredRequests.has(message.id) && message.id <= this._highestRequestId) {
         return
       }
 
-      stream = request._responseStream
-
-      if (stream === null || stream._pendingOpen === null) {
-        this._pendingResponses.add(message.id)
-        return
+      if (this._pendingResponses.size >= MAX_PENDING_RESPONSES) {
+        return this._fail(errors.INVALID_MESSAGE('Too many response streams opened early'))
       }
-    } else {
-      return
-    }
 
-    stream._continueOpen()
+      this._pendingResponses.add(message.id)
+    }
   }
 
   _onstreamclose(message) {
-    let stream
-
-    if (message.stream & s.REQUEST) {
-      const request = this._incomingRequests.get(message.id)
-      if (request === undefined) return
-
-      stream = request._requestStream
-    } else if (message.stream & s.RESPONSE) {
-      const request = this._incomingResponses.get(message.id)
-      if (request === undefined) return
-
-      stream = request._responseStream
-    } else {
-      return
-    }
-
+    const stream = this._incomingStream(message)
     if (stream === null) return
+
     if (message.error) stream.destroy(message.error)
     else stream.push(null)
   }
 
   _onstreampause(message) {
-    let stream
-
-    if (message.stream & s.REQUEST) {
-      const request = this._outgoingRequests.get(message.id)
-      if (request === undefined) return
-
-      stream = request._requestStream
-    } else if (message.stream & s.RESPONSE) {
-      const request = this._outgoingResponses.get(message.id)
-      if (request === undefined) return
-
-      stream = request._responseStream
-    } else {
-      return
-    }
-
-    if (stream === null) return
-    stream.cork()
+    const stream = this._outgoingStream(message)
+    if (stream !== null) stream.cork()
   }
 
   _onstreamresume(message) {
-    let stream
-
-    if (message.stream & s.REQUEST) {
-      const request = this._outgoingRequests.get(message.id)
-      if (request === undefined) return
-
-      stream = request._requestStream
-    } else if (message.stream & s.RESPONSE) {
-      const request = this._outgoingResponses.get(message.id)
-      if (request === undefined) return
-
-      stream = request._responseStream
-    } else {
-      return
-    }
-
-    if (stream === null) return
-    stream.uncork()
+    const stream = this._outgoingStream(message)
+    if (stream !== null) stream.uncork()
   }
 
   _onstreamdata(message) {
-    let stream
-
-    if (message.stream & s.REQUEST) {
-      const request = this._incomingRequests.get(message.id)
-      if (request === undefined) return
+    const stream = this._incomingStream(message)
+    if (!isPushable(stream)) return
 
-      stream = request._requestStream
-    } else if (message.stream & s.RESPONSE) {
-      const request = this._incomingResponses.get(message.id)
-      if (request === undefined) return
+    const flushed = stream.push(message.data)
 
-      stream = request._responseStream
-    } else {
-      return
+    if (stream._readableState.buffered > this._maxBufferedBytes) {
+      return this._fail(
+        errors.STREAM_OVERFLOW(
+          `Stream buffered more than the limit of ${this._maxBufferedBytes} bytes`
+        )
+      )
     }
 
-    if (stream === null) return
-    if (stream.push(message.data) === false) {
+    if (flushed === false) {
       this._sendMessage({
         type: t.STREAM,
         id: stream._request.id,
@@ -508,45 +577,23 @@ module.exports = exports = class RPC {
   }
 
   _onstreamend(message) {
-    let stream
-
-    if (message.stream & s.REQUEST) {
-      const request = this._incomingRequests.get(message.id)
-      if (request === undefined) return
-
-      stream = request._requestStream
-    } else if (message.stream & s.RESPONSE) {
-      const request = this._incomingResponses.get(message.id)
-      if (request === undefined) return
-
-      stream = request._responseStream
-    } else {
-      return
-    }
-
-    if (stream === null) return
-    stream.push(null)
+    const stream = this._incomingStream(message)
+    if (stream !== null) stream.push(null)
   }
 
   _onstreamdestroy(message) {
-    let stream
-
-    if (message.stream & s.REQUEST) {
-      const request = this._outgoingRequests.get(message.id)
-      if (request === undefined) return
+    if (message.stream & s.RESPONSE) this._pendingResponses.delete(message.id)
 
-      stream = request._requestStream
-    } else if (message.stream & s.RESPONSE) {
-      const request = this._outgoingResponses.get(message.id)
-      if (request === undefined) return
+    const stream = this._outgoingStream(message)
+    if (stream !== null) stream.destroy(message.error)
+  }
 
-      stream = request._responseStream
-    } else {
-      return
-    }
+  _incomingStream(message) {
+    return findStream(message, this._incomingRequests, this._incomingResponses)
+  }
 
-    if (stream === null) return
-    stream.destroy(message.error)
+  _outgoingStream(message) {
+    return findStream(message, this._outgoingRequests, this._outgoingResponses)
   }
 
   _ondrain(err = null) {
@@ -560,4 +607,41 @@ module.exports = exports = class RPC {
 
 exports.CommandRouter = CommandRouter
 
-function noop() {}
+// Messages that decode cleanly but that no valid peer ever sends, as derived
+// from what the outgoing side encodes.
+function protocolViolation(message) {
+  switch (message.type) {
+    case t.REQUEST:
+      if (message.stream === 0) return null
+      if (message.stream !== s.OPEN) return `Invalid request stream flags '${message.stream}'`
+      if (message.id === 0) return 'Stream request without an id'
+      return null
+
+    case t.RESPONSE:
+      if (message.id === 0) return 'Response without an id'
+      if (message.stream === 0) return null
+      if (message.stream !== s.OPEN || message.error) {
+        return `Invalid response stream flags '${message.stream}'`
+      }
+      return null
+
+    case t.STREAM:
+      if (message.id === 0) return 'Stream message without an id'
+      if (!streamFlags.has(message.stream)) return `Invalid stream flags '${message.stream}'`
+      return null
+  }
+}
+
+function findStream(message, requests, responses) {
+  if (message.stream & s.REQUEST) {
+    const request = requests.get(message.id)
+    return request === undefined ? null : request._requestStream
+  }
+
+  const request = responses.get(message.id)
+  return request === undefined ? null : request._responseStream
+}
+
+function isPushable(stream) {
+  return stream !== null && !stream.destroying && !isEnding(stream)
+}

package/lib/command-router.js

@@ -1,4 +1,5 @@
 const c = require('compact-encoding')
+const errors = require('./errors')
 
 module.exports = class RPCCommandRouter {
   constructor(opts = {}) {
@@ -30,20 +31,31 @@ module.exports = class RPCCommandRouter {
   async _onrequest(req) {
     const responder = this._responders.get(req.command)
 
-    if (responder === undefined) return
-
-    const { onrequest, requestEncoding, responseEncoding } = responder
+    if (req.id === undefined) {
+      if (responder !== undefined) await this._dispatch(responder, req)
+      return
+    }
 
-    let data = req.data
+    if (responder === undefined) throw errors.UNKNOWN_COMMAND(`Unknown command ${req.command}`)
 
-    if (requestEncoding) data = c.decode(requestEncoding, data)
-
-    data = await onrequest(req, data)
+    let data = await this._dispatch(responder, req)
 
     if (req.sent) return
 
+    const { responseEncoding } = responder
+
     if (responseEncoding) data = c.encode(responseEncoding, data)
 
     req.reply(data)
   }
+
+  _dispatch(responder, req) {
+    const { onrequest, requestEncoding } = responder
+
+    let data = req.data
+
+    if (requestEncoding) data = c.decode(requestEncoding, data)
+
+    return onrequest(req, data)
+  }
 }

package/lib/errors.d.ts

@@ -1,8 +1,13 @@
 declare class RPCError extends Error {
   static UNKNOWN_MESSAGE(msg: string): RPCError
+  static UNKNOWN_COMMAND(msg: string): RPCError
+  static INVALID_MESSAGE(msg: string): RPCError
+  static FRAME_TOO_LARGE(msg: string): RPCError
   static ALREADY_SENT(msg: string): RPCError
   static ALREADY_RECEIVED(msg: string): RPCError
   static CHANNEL_CLOSED(msg: string): RPCError
+  static UNEXPECTED_STREAM(msg: string): RPCError
+  static STREAM_OVERFLOW(msg: string): RPCError
 }
 
 export = RPCError

package/lib/errors.js

@@ -16,6 +16,18 @@ module.exports = class RPCError extends Error {
     return new RPCError(msg, 'UNKNOWN_MESSAGE', RPCError.UNKNOWN_MESSAGE)
   }
 
+  static UNKNOWN_COMMAND(msg) {
+    return new RPCError(msg, 'UNKNOWN_COMMAND', RPCError.UNKNOWN_COMMAND)
+  }
+
+  static INVALID_MESSAGE(msg) {
+    return new RPCError(msg, 'INVALID_MESSAGE', RPCError.INVALID_MESSAGE)
+  }
+
+  static FRAME_TOO_LARGE(msg) {
+    return new RPCError(msg, 'FRAME_TOO_LARGE', RPCError.FRAME_TOO_LARGE)
+  }
+
   static ALREADY_SENT(msg) {
     return new RPCError(msg, 'ALREADY_SENT', RPCError.ALREADY_SENT)
   }
@@ -27,4 +39,12 @@ module.exports = class RPCError extends Error {
   static CHANNEL_CLOSED(msg) {
     return new RPCError(msg, 'CHANNEL_CLOSED', RPCError.CHANNEL_CLOSED)
   }
+
+  static UNEXPECTED_STREAM(msg) {
+    return new RPCError(msg, 'UNEXPECTED_STREAM', RPCError.UNEXPECTED_STREAM)
+  }
+
+  static STREAM_OVERFLOW(msg) {
+    return new RPCError(msg, 'STREAM_OVERFLOW', RPCError.STREAM_OVERFLOW)
+  }
 }

package/lib/incoming-stream.js

@@ -1,5 +1,6 @@
 const { Readable } = require('bare-stream')
 const { type: t, stream: s } = require('./constants')
+const { toError } = require('./messages')
 
 module.exports = class RPCIncomingStream extends Readable {
   constructor(rpc, request, type, opts) {
@@ -41,7 +42,7 @@ module.exports = class RPCIncomingStream extends Readable {
           type: t.STREAM,
           id: this._request.id,
           stream: this._mask | s.DESTROY | s.ERROR,
-          error: err,
+          error: toError(err),
           data: null
         },
         cb

package/lib/messages.js

@@ -21,6 +21,11 @@ const error = {
   }
 }
 
+exports.toError = function toError(err) {
+  if (typeof err === 'object' && err !== null && typeof err.message === 'string') return err
+  return new Error(String(err))
+}
+
 function hasData(m) {
   switch (m.type) {
     case t.REQUEST:

package/lib/outgoing-request.js

@@ -16,6 +16,8 @@ module.exports = class RPCOutgoingRequest {
       this._reject = reject
     })
 
+    this._promise.catch(noop)
+
     this._requestStream = null
     this._responseStream = null
   }
@@ -79,3 +81,5 @@ module.exports = class RPCOutgoingRequest {
     return this._responseStream
   }
 }
+
+function noop() {}

package/lib/outgoing-stream.js

@@ -1,5 +1,6 @@
 const { Writable } = require('bare-stream')
 const { type: t, stream: s } = require('./constants')
+const { toError } = require('./messages')
 
 module.exports = class RPCOutgoingStream extends Writable {
   constructor(rpc, request, type, opts) {
@@ -11,25 +12,19 @@ module.exports = class RPCOutgoingStream extends Writable {
     this._mask = type === t.REQUEST ? s.REQUEST : s.RESPONSE
 
     this._pendingOpen = null
+    this._flushed = false
+    this._acknowledged = false
+    this._ended = false
   }
 
-  _open(cb) {
-    let pending
-
+  _sendOpen() {
     const onflushed = () => {
-      if (pending.has(this._request.id)) {
-        pending.delete(this._request.id)
-
-        cb(null)
-      } else {
-        this._pendingOpen = cb
-      }
+      this._flushed = true
+      this._finishOpen()
     }
 
     switch (this._type) {
       case t.REQUEST:
-        pending = this._rpc._pendingRequests
-
         this._rpc._sendMessage(
           {
             type: t.REQUEST,
@@ -43,8 +38,6 @@ module.exports = class RPCOutgoingStream extends Writable {
         break
 
       case t.RESPONSE:
-        pending = this._rpc._pendingResponses
-
         this._rpc._sendMessage(
           {
             type: t.RESPONSE,
@@ -59,11 +52,26 @@ module.exports = class RPCOutgoingStream extends Writable {
     }
   }
 
+  _open(cb) {
+    this._pendingOpen = cb
+    this._finishOpen()
+  }
+
   _continueOpen() {
-    if (this._pendingOpen === null) return
+    this._acknowledged = true
+    this._finishOpen()
+  }
+
+  _finishOpen() {
+    if (!this._flushed || !this._acknowledged || this._pendingOpen === null) return
+
     const cb = this._pendingOpen
     this._pendingOpen = null
-    cb()
+    cb(null)
+  }
+
+  _predestroy() {
+    this._continueOpen()
   }
 
   _write(data, encoding, cb) {
@@ -80,6 +88,8 @@ module.exports = class RPCOutgoingStream extends Writable {
   }
 
   _final(cb) {
+    this._ended = true
+
     this._rpc._sendMessage(
       {
         type: t.STREAM,
@@ -93,13 +103,15 @@ module.exports = class RPCOutgoingStream extends Writable {
   }
 
   _destroy(err, cb) {
-    if (err) {
+    if (this._ended) {
+      cb(null)
+    } else if (err) {
       this._rpc._sendMessage(
         {
           type: t.STREAM,
           id: this._request.id,
           stream: this._mask | s.CLOSE | s.ERROR,
-          error: err,
+          error: toError(err),
           data: null
         },
         cb

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bare-rpc",
-  "version": "1.3.9",
+  "version": "1.5.0",
   "description": "librpc ABI compatible RPC for Bare",
   "exports": {
     ".": {