gRPC for Node.js 1.14

Apply the Node.js 24 and JavaScript ES2026 prompts first. These rules cover @grpc/grpc-js 1.14 credentials, metadata, interceptors, protobuf boundaries, deadlines, streaming, errors, reflection, and deployment.

Credentials and channels

• Use ServerCredentials.createSsl and ChannelCredentials.createSsl for every connection outside a controlled local boundary.
• Verify the expected server name and trusted certificate chain and never override authority merely to bypass validation; never set rejectUnauthorized: false, and preserve tls.checkServerIdentity in custom checkServerIdentity callbacks.
• Require and verify client certificates when mutual TLS is the selected workload identity control.
• Keep private keys, bearer tokens, and call credentials out of source, targets, logs, and error details.
• Rotate credentials without falling back to createInsecure or an unverified endpoint.

Metadata and authorization

• Authenticate metadata in a server interceptor or equivalent shared boundary before invoking protected handlers.
• Authorize every RPC method and resource, including each privileged streaming operation.
• Validate metadata key, value, count, encoding, and total bytes before use.
• Never trust client-supplied peer, tenant, role, forwarding, or workload identity metadata without a verified intermediary.
• Propagate only the minimum downstream credential metadata and bind tokens to the intended audience.

Protobuf and dynamic loading

• Validate semantic ranges, identifiers, collection sizes, strings, and cross-field invariants after protobuf