Connect for ECMAScript 2

Apply the Node.js 24 and JavaScript ES2026 prompts first, using Node-specific rules only in Node deployments. These rules cover Connect-ES 2 clients, servers, and official adapters, and were checked against 2.1.2. Browser transports support unary and server-streaming RPCs; Node supports all four RPC kinds subject to the adapter and HTTP version.

Versions, routes, and adapters

• Keep the official Connect transports and adapters on the same v2 release as @connectrpc/connect and move them together, because the adapters require the matching Connect packages, and use a reviewed @bufbuild/protobuf version satisfying ^2.7.0. Generate from reviewed schemas with a compatible, pinned Protobuf-ES v2 protoc-gen-es; remove the obsolete protoc-gen-connect-es generator when migrating.
• Register only intended procedures with router.rpc() when exposing a subset of a service. router.service() registers every described method, including unimplemented stubs. Protect administrative, health, reflection, and adapter fallback routes independently.
• Disable unused protocols through grpc, grpcWeb, and connect; all three default to enabled. Verify each registered handler's effective protocolNames and mandatory interceptors when using service or RPC options. Per-registration interceptor arrays replace the router array rather than append to it.
• Put credential checks and coarse rate limits in HTTP middleware or hooks before the Connect adapter when they must precede decoding. Unary RPC interceptors run after the request message is read and parsed; they cannot provide that