fix(rpc): reject batch messages with non-string ids

packages/client/src/plugins/batch.test.ts

@@ -1133,6 +1133,64 @@ describe('batchLinkPlugin', () => {
       ])
     })
 
+    it.each([
+      ['true', true],
+      ['an object', {}],
+      ['an array', []],
+      ['null', null],
+      ['a number', 0],
+      ['missing', undefined],
+    ] as const)('rejects on array batch responses whose message id is %s', async (_, id) => {
+      const codec = makeCodec()
+      const transport = makeTransport()
+
+      vi.mocked(transport.send).mockImplementation(async () => {
+        return {
+          status: 207,
+          headers: {},
+          resolveBody: async () => [{ kind: 'response', id, json: { status: 200, headers: {}, body: 'result' } }],
+        }
+      })
+
+      const link = new StandardLink(codec, transport, {
+        plugins: [new BatchLinkPlugin({ groups: [defaultGroup] })],
+      })
+
+      await Promise.all([
+        expect(link.call(['a'], {}, { context: {} })).rejects.toThrow('Invalid batch response format'),
+        expect(link.call(['b'], {}, { context: {} })).rejects.toThrow('Invalid batch response format'),
+      ])
+    })
+
+    it('rejects on array batch responses whose message binary is not binary', async () => {
+      const codec = makeCodec()
+      const transport = makeTransport()
+
+      vi.mocked(transport.send).mockImplementation(async (request) => {
+        const messages = extractBatchMessagesFromRequest(request)
+
+        return {
+          status: 207,
+          headers: {},
+          resolveBody: async () => messages.map(message => ({
+            kind: 'response',
+            id: message.id,
+            json: { status: 200, headers: {} },
+            binary: {},
+          })),
+        }
+      })
+
+      const link = new StandardLink(codec, transport, {
+        plugins: [new BatchLinkPlugin({ groups: [defaultGroup] })],
+      })
+
+      await Promise.all([
+        expect(link.call(['a'], {}, { context: {} })).rejects.toThrow('Invalid batch response format'),
+        expect(link.call(['b'], {}, { context: {} })).rejects.toThrow('Invalid batch response format'),
+      ])
+    })
+
     it('rejects on malformed blob batch responses with incomplete headers', async () => {
       const codec = makeCodec()
       const transport = makeTransport()

packages/client/src/plugins/batch.ts

@@ -5,7 +5,7 @@ import type { StandardLinkOptions, StandardLinkPlugin, StandardLinkTransportInte
 import type { ClientContext } from '../types'
 import { captureAsyncContext, defer, isAsyncIteratorObject, loadBytes, once, promiseWithResolvers, safeEncodeURIComponent, splitInHalf, stringifyJSON, toArray, value } from '@orpc/shared'
 import { parseStandardUrl } from '@standard-server/core'
-import { ClientPeer, decodePeerMessage, isServerPeerSendMessage } from '@standard-server/peer'
+import { ClientPeer, decodePeerMessage, isPeerMessage, isServerPeerSendMessage } from '@standard-server/peer'
 
 /**
  * Header that marks a request as a batch, set by the Batch Link Plugin and detected by the Batch Handler Plugin.
@@ -433,7 +433,7 @@ export class BatchLinkPlugin<T extends ClientContext> implements StandardLinkPlu
 
         const body = await batchResponse.resolveBody()
 
-        if (Array.isArray(body) && body.every(v => isServerPeerSendMessage(v))) {
+        if (Array.isArray(body) && body.every((v: unknown) => isPeerMessage(v) && isServerPeerSendMessage(v))) {
           for (const message of body) {
             await peer.message(message)
           }

packages/node/src/batch-response-compression-handler-plugin.test.ts

@@ -22,9 +22,9 @@ function createBatchRequest(
   return new Request('https://example.com/__batch__', {
     method: 'POST',
     headers: { ...headers, 'content-type': 'application/json', 'orpc-batch': '1' },
-    body: JSON.stringify(urls.map((url, id) => ({
+    body: JSON.stringify(urls.map((url, index) => ({
       kind: 'request',
-      id,
+      id: String(index),
       json: { method: 'POST', url, headers: {}, body: undefined },
       binary: undefined,
     }))),