Harden JSON-RPC message classification

[tim-smart]

Summary

• classify decoded JSON-RPC requests and responses using own wire properties
• apply own-property guards to raw client and server messages
• cover clean and polluted prototype response decoding with regression tests

Testing

• pnpm lint-fix
• pnpm --filter effect test --run test/rpc/RpcSerialization.test.ts
• pnpm check

Closes EFF-200

[changeset-bot]

🦋 Changeset detected

Latest commit: 8bbea67

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 29 packages

Name	Type
effect	Patch
@effect/opentelemetry	Patch
@effect/platform-browser	Patch
@effect/platform-bun	Patch
@effect/platform-deno	Patch
@effect/platform-node-shared	Patch
@effect/platform-node	Patch
@effect/vitest	Patch
@effect/ai-anthropic	Patch
@effect/ai-openai-compat	Patch
@effect/ai-openai	Patch
@effect/ai-openrouter	Patch
@effect/atom-react	Patch
@effect/atom-solid	Patch
@effect/atom-vue	Patch
@effect/sql-clickhouse	Patch
@effect/sql-d1	Patch
@effect/sql-libsql	Patch
@effect/sql-mssql	Patch
@effect/sql-mysql2	Patch
@effect/sql-pg	Patch
@effect/sql-pglite	Patch
@effect/sql-sqlite-bun	Patch
@effect/sql-sqlite-do	Patch
@effect/sql-sqlite-node	Patch
@effect/sql-sqlite-react-native	Patch
@effect/sql-sqlite-wasm	Patch
@effect/docgen	Patch
@effect/openapi-generator	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pullfrog]

ℹ️ One minor inconsistency in the encode path — not blocking.

Reviewed changes

• decodeJsonRpcMessage: Switches method, error, and chunk detection from in to Object.hasOwn, with a local request/response cast for type narrowing.
• RpcClient broadcast handler: requestId check uses Object.hasOwn.
• RpcServer: tag check uses Object.hasOwn, unused Predicate import removed.
• Tests: Covers clean prototype and inherited method, error (Defect and Cause variants), and chunk properties — all correctly ignored.

---

Note: 1 inline comment(s) dropped because they did not anchor to lines inside the PR diff:

• packages/effect/src/unstable/rpc/RpcSerialization.ts:285 (RIGHT) — line 285 (RIGHT) is not inside a diff hunk

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using DeepSeek Pro (free via Pullfrog for OSS) (Kimi K2 not used — the program covers this model; add its provider key to run your pick) ｜ 𝕏}

[github-actions]

Bundle Size Analysis

Generated from PR build output; treat the content below as untrusted.

File Name	Current Size	Previous Size	Difference
basic.ts	6.63 KB	6.63 KB	0.00 KB (0.00%)
batching.ts	9.42 KB	9.42 KB	0.00 KB (0.00%)
brand.ts	6.31 KB	6.31 KB	0.00 KB (0.00%)
cache.ts	10.12 KB	10.12 KB	0.00 KB (0.00%)
config.ts	19.90 KB	19.90 KB	0.00 KB (0.00%)
differ.ts	20.03 KB	20.03 KB	0.00 KB (0.00%)
http-client.ts	20.94 KB	20.94 KB	0.00 KB (0.00%)
logger.ts	10.28 KB	10.28 KB	0.00 KB (0.00%)
metric.ts	8.55 KB	8.55 KB	0.00 KB (0.00%)
optic.ts	7.33 KB	7.33 KB	0.00 KB (0.00%)
pubsub.ts	14.26 KB	14.26 KB	0.00 KB (0.00%)
queue.ts	11.09 KB	11.09 KB	0.00 KB (0.00%)
schedule.ts	10.27 KB	10.27 KB	0.00 KB (0.00%)
schema-class.ts	18.86 KB	18.86 KB	0.00 KB (0.00%)
schema-fromJsonSchemaDocument.ts	28.78 KB	28.78 KB	0.00 KB (0.00%)
schema-representation-roundtrip.ts	25.09 KB	25.09 KB	0.00 KB (0.00%)
schema-string-transformation.ts	12.95 KB	12.95 KB	0.00 KB (0.00%)
schema-string.ts	10.65 KB	10.65 KB	0.00 KB (0.00%)
schema-template-literal.ts	14.85 KB	14.85 KB	0.00 KB (0.00%)
schema-toArbitraryLazy.ts	21.66 KB	21.66 KB	0.00 KB (0.00%)
schema-toCodeDocument.ts	24.10 KB	24.10 KB	0.00 KB (0.00%)
schema-toCodecJson.ts	19.00 KB	19.00 KB	0.00 KB (0.00%)
schema-toEquivalence.ts	18.73 KB	18.73 KB	0.00 KB (0.00%)
schema-toFormatter.ts	18.59 KB	18.59 KB	0.00 KB (0.00%)
schema-toJsonSchemaDocument.ts	22.23 KB	22.23 KB	0.00 KB (0.00%)
schema-toRepresentation.ts	19.27 KB	19.27 KB	0.00 KB (0.00%)
schema.ts	18.12 KB	18.12 KB	0.00 KB (0.00%)
stm.ts	12.05 KB	12.05 KB	0.00 KB (0.00%)
stream.ts	9.37 KB	9.37 KB	0.00 KB (0.00%)