@fuzdev/fuz_app 0.110.1 → 0.112.0

package/dist/actions/CLAUDE.md

@@ -52,8 +52,9 @@ Optional fields:
 - `rate_limit?: 'ip' | 'account' | 'both'` — opts the action into the
   dispatcher's per-action rate-limit hook. **Throttle-requests semantics**
   — every invocation records regardless of outcome (different from REST
-  login's throttle-failures). `'account'` rejected at registration when
-  paired with `auth.account !== 'required'`. Limiters configured via
+  login's throttle-failures), and the gate fires ahead of param validation
+  so malformed calls are charged too. `'account'` / `'both'` rejected at
+  registration when paired with `auth.account !== 'required'`. Limiters configured via
   `AppServerOptions.action_ip_rate_limiter` / `action_account_rate_limiter`
   and threaded into both dispatchers automatically.
 
@@ -210,10 +211,13 @@ The HTTP RPC dispatcher is a thin shim around `perform_action`
 parsing, GET vs POST split, `c.json` binding); the
 auth/validation/dispatch pipeline is shared with the WebSocket dispatcher.
 
-**Phase order: 401 → authz → 403 → 400 → handler.** Authorize first,
-validate after — a caller the authority gates refuse never learns the
-action's input shape, and the coarse authority facts settle before the fine
-ones. Matches the Rust spine, which validates handler-side.
+**Phase order: 401 → authz → 403 → 429 → 400 → handler.** Authorize first,
+throttle, validate after — a caller the authority gates refuse never learns
+the action's input shape, the coarse authority facts settle before the fine
+ones, and a malformed flood burns the budget it should. The Rust spine's
+dispatcher enforces the same order: it validates the `acting` selector at
+the dispatcher after the rate limit and leaves every other field to the
+handlers.
 
 Shim responsibilities (per-request):
 
@@ -286,13 +290,13 @@ The transport-agnostic post-parse pipeline. Each transport assembles a
 `perform_action(input, deps)`, and binds the discriminated
 `PerformActionResult` to its wire shape.
 
-Pipeline (401 → authz → 403 → 400 → handler):
+Pipeline (401 → authz → 403 → 429 → 400 → handler):
 
 1. Pre-authorization auth (401)
-2. Authorization phase — `apply_authorization_phase` against `account_id` + `read_acting(auth, raw_params)`, which takes the selector off the raw params (malformed reads as omitted) since validation now runs later. Test escape hatch via `preset.request_context`
+2. Authorization phase — `apply_authorization_phase` against `account_id` + `read_acting(auth, raw_params)`, which takes the selector off the raw params (malformed reads as omitted) since validation runs later. Test escape hatch via `preset.request_context`
 3. Post-authorization auth (403) — credential-type gate, then token scope, then role
-4. Validate params (400) — `spec.input.safeParse` with `z.void()` / `?? {}` rules
-5. Rate limit (429) — throttle-requests semantics
+4. Rate limit (429) — throttle-requests semantics, ahead of validation so malformed params charge the budget and a throttled caller pays no schema work
+5. Validate params (400) — `spec.input.safeParse` with `z.void()` / `?? {}` rules
 6. Dispatch + DEV output validation + error normalization — `spec.side_effects` picks transaction vs pool. `ThrownJsonrpcError` preserves code + data; generic throws become `internal_error`
 
 `PerformActionInput` carries `account_id`, `credential_type`, `client_ip`,
@@ -529,7 +533,7 @@ dispatcher without the origin/auth front-stack.
 Per-message dispatch delegates to `perform_action` — the shared core that
 HTTP RPC also calls. `register_action_ws` owns only WS-specific concerns:
 
-- **Wire envelope parsing** — JSON.parse → batch rejection → notification interception (cancel, silent drop) → per-message dispatch
+- **Wire envelope parsing** — JSON.parse → batch rejection → peer-response routing → envelope-version guard → notification interception (cancel, silent drop) → `JsonrpcRequest.safeParse` → per-message dispatch. The version guard is what makes `{method: 'x'}` and `{jsonrpc: '1.0', method: 'x'}` an `invalid_request` answer rather than a silently dropped notification, matching the first check the Rust `classify` runs. Peer-response routing is the twin's response shape exactly — no `method` key, a string/number `id`, exactly one of `result` / `error` — so a hybrid frame like `{method, id, result}` stays a dispatchable request instead of being demuxed and swallowed. The envelope schema is the same one the HTTP POST path runs, so `params: null`, an array `params`, or a non-string/number `id` answers `invalid_request` (-32600) on both transports rather than reaching the dispatcher as `invalid_params`. It runs **after** the notification/cancel block: notifications carry no id to echo and stay unvalidated, and `cancel` routing precedes it. The version guard echoes the id via `to_jsonrpc_envelope_id` (a scalar frame answers `id: null`), the later steps via `to_jsonrpc_message_id`.
 - **Cancel-notification interception** — `{request_id → AbortController}` map; aborts the matching pending controller before the cancel bubbles past the dispatcher
 - **Socket-scoped notify** — `(method, params) => ws.send(notification)`, threaded into `perform_action` as `notify`
 - **Composed abort signal** — `AbortSignal.any([socket_close, per_request_cancel])`, threaded as `signal`

package/dist/actions/action_rpc.d.ts

@@ -61,8 +61,8 @@ export interface ActionContext {
     db: Db;
     /**
      * Eager fire-and-forget queue — push the in-flight `Promise<void>` for
-     * pool writes already running (audit emits, session touch, api-token
-     * usage tracking). Drained via `flush_pending_effects` after the
+     * pool writes already running (audit emits, api-token usage
+     * tracking). Drained via `flush_pending_effects` after the
      * handler returns.
      */
     pending_effects: Array<Promise<void>>;
@@ -85,7 +85,7 @@ export interface ActionContext {
     /**
      * Credential channel the request arrived on (`'session'` | `'api_token'` |
      * `'daemon_token'`), or `null` for anonymous requests. Same value the
-     * dispatcher's `credential_types` gate consumed at step 4 — exposed here
+     * dispatcher's `credential_types` gate consumed at step 3 — exposed here
      * so handlers can record it in audit metadata (defense in depth: the
      * gate may be loosened or bypassed in a future refactor, but the audit
      * row preserves what actually authenticated the request).

package/dist/actions/action_rpc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action_rpc.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/action_rpc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAqB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAE1E,OAAO,EAEN,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAKN,KAAK,cAAc,EACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAGN,KAAK,gBAAgB,EAErB,MAAM,oBAAoB,CAAC;AAO5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC7B,+DAA+D;IAC/D,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;IAC5B,iDAAiD;IACjD,UAAU,EAAE,gBAAgB,CAAC;IAC7B;;;;OAIG;IACH,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B;;;;;OAKG;IACH,EAAE,EAAE,EAAE,CAAC;IACP;;;;;OAKG;IACH,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC;;;;;OAKG;IACH,mBAAmB,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD;;;;;;;OAOG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,eAAe,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;OAQG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD;;;;;OAKG;IACH,MAAM,EAAE,WAAW,CAAC;CACpB;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,CACxD,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,aAAa,KACd,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;IACrE,IAAI,EAAE,cAAc,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,CAC5D,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,iBAAiB,KAClB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAmB,SAAQ,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;IACtE,IAAI,EAAE,mBAAmB,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,CAC7D,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,kBAAkB,KACnB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,yBAAyB,CAAC;IAChC,OAAO,EAAE,aAAa,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,cAAc,CAAC,KAAK,SAAS,yBAAyB,IAAI;IACrE,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;CACtB,SAAS,CAAC,UAAU,CAAC,GACnB,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GACrE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,GAC9C,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GACpE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,UAAU,GAAI,KAAK,SAAS,yBAAyB,EACjE,MAAM,KAAK,EACX,SAAS,cAAc,CAAC,KAAK,CAAC,KAC5B,SAGD,CAAC;AAEH,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACxC,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1B,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5C;;;;;;;OAOG;IACH,2BAA2B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CACjD;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,eAAO,MAAM,mBAAmB,GAAI,SAAS,wBAAwB,KAAG,KAAK,CAAC,SAAS,CA2MtF,CAAC"}
+{"version":3,"file":"action_rpc.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/action_rpc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAqB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAE1E,OAAO,EAEN,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAKN,KAAK,cAAc,EACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAGN,KAAK,gBAAgB,EAErB,MAAM,oBAAoB,CAAC;AAQ5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC7B,+DAA+D;IAC/D,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;IAC5B,iDAAiD;IACjD,UAAU,EAAE,gBAAgB,CAAC;IAC7B;;;;OAIG;IACH,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B;;;;;OAKG;IACH,EAAE,EAAE,EAAE,CAAC;IACP;;;;;OAKG;IACH,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC;;;;;OAKG;IACH,mBAAmB,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD;;;;;;;OAOG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,eAAe,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;OAQG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD;;;;;OAKG;IACH,MAAM,EAAE,WAAW,CAAC;CACpB;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,CACxD,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,aAAa,KACd,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;IACrE,IAAI,EAAE,cAAc,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,CAC5D,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,iBAAiB,KAClB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAmB,SAAQ,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;IACtE,IAAI,EAAE,mBAAmB,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,CAC7D,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,kBAAkB,KACnB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,yBAAyB,CAAC;IAChC,OAAO,EAAE,aAAa,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,cAAc,CAAC,KAAK,SAAS,yBAAyB,IAAI;IACrE,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;CACtB,SAAS,CAAC,UAAU,CAAC,GACnB,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GACrE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,GAC9C,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GACpE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,UAAU,GAAI,KAAK,SAAS,yBAAyB,EACjE,MAAM,KAAK,EACX,SAAS,cAAc,CAAC,KAAK,CAAC,KAC5B,SAGD,CAAC;AAEH,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACxC,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1B,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5C;;;;;;;OAOG;IACH,2BAA2B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CACjD;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,eAAO,MAAM,mBAAmB,GAAI,SAAS,wBAAwB,KAAG,KAAK,CAAC,SAAS,CAuMtF,CAAC"}

package/dist/actions/action_rpc.js

@@ -20,6 +20,7 @@ import { ACCOUNT_ID_KEY, CREDENTIAL_TYPE_KEY, TOKEN_SCOPE_KEY, TEST_CONTEXT_PRES
 import { compile_action_registry } from './compile_action_registry.js';
 import { JSONRPC_VERSION, JsonrpcRequest } from '../http/jsonrpc.js';
 import { jsonrpc_error_messages, jsonrpc_error_code_to_http_status, JSONRPC_ERROR_CODES, dev_only } from '../http/jsonrpc_errors.js';
+import { to_jsonrpc_envelope_id } from '../http/jsonrpc_helpers.js';
 import { perform_action, perform_action_result_to_envelope } from './perform_action.js';
 /**
  * Pair a spec with a handler while preserving per-method input/output types
@@ -200,12 +201,9 @@ export const create_rpc_endpoint = (options) => {
         }
         const envelope = JsonrpcRequest.safeParse(body);
         if (!envelope.success) {
-            // try to extract id even from an invalid envelope
-            const raw_id = typeof body === 'object' && body !== null && 'id' in body
-                ? body.id
-                : null;
-            const id = typeof raw_id === 'string' || typeof raw_id === 'number' ? raw_id : null;
-            const error = jsonrpc_error_envelope(id, jsonrpc_error_messages.invalid_request(dev_only({ issues: envelope.error.issues })));
+            // echo the id when the body is an object carrying one — the same
+            // extraction the WS path runs; a scalar body answers `id: null`
+            const error = jsonrpc_error_envelope(to_jsonrpc_envelope_id(body), jsonrpc_error_messages.invalid_request(dev_only({ issues: envelope.error.issues })));
             return c.json(error, 400);
         }
         return dispatch(c, route, envelope.data.method, envelope.data.params, envelope.data.id, false);

package/dist/actions/peer_ping.d.ts

@@ -87,6 +87,13 @@ export type PingResponse = z.infer<typeof PingResponse>;
  * client→server invocation drives a server→client request); `auth: public`
  * (liveness is non-sensitive; the upgrade authenticated the socket);
  * `side_effects: false` (no state change — the handler only round-trips a ping).
+ *
+ * Public is not ungoverned: `rate_limit: 'ip'` is the one throttle an
+ * unauthenticated method can be given (there is no account to key on). It
+ * bounds anonymous fan-out and keeps the class at parity with the Rust spec's
+ * `RateLimitClass::Ip` — there the no-transport refusal costs two pool
+ * checkouts per call; here the public auth shape skips the authorization
+ * phase, so the refusal is free and the class is carried for the bound alone.
  */
 export declare const peer_ping_action_spec: {
     method: string;
@@ -106,6 +113,7 @@ export declare const peer_ping_action_spec: {
         protocol_version: z.ZodNumber;
     }, z.core.$strict>;
     async: true;
+    rate_limit: "ip";
     description: string;
 };
 /**

package/dist/actions/peer_ping.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"peer_ping.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/peer_ping.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGhE,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAE5C;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAIvC,kDAAkD;AAClD,eAAO,MAAM,mBAAmB,iBAAiB,CAAC;AAClD,iDAAiD;AACjD,eAAO,MAAM,2BAA2B,yBAAyB,CAAC;AAClE,iHAAiH;AACjH,eAAO,MAAM,wBAAwB,sBAAsB,CAAC;AAC5D,sEAAsE;AACtE,eAAO,MAAM,8BAA8B,4BAA4B,CAAC;AACxE,0EAA0E;AAC1E,eAAO,MAAM,8BAA8B,4BAA4B,CAAC;AACxE,qFAAqF;AACrF,eAAO,MAAM,+BAA+B,6BAA6B,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,eAAe;;;mBAQf,CAAC;AACd,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB;;kBAE5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,YAAY;;;kBAGvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;CAYG,CAAC;AA+BtC;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,GAC7B,OAAO,eAAe,EACtB,KAAK,aAAa,KAChB,OAAO,CAAC,YAAY,CAqCtB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,GAAI,QAAQ,OAAO,KAAG,YAGrD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAG9B,CAAC"}
+{"version":3,"file":"peer_ping.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/peer_ping.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGhE,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAE5C;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAIvC,kDAAkD;AAClD,eAAO,MAAM,mBAAmB,iBAAiB,CAAC;AAClD,iDAAiD;AACjD,eAAO,MAAM,2BAA2B,yBAAyB,CAAC;AAClE,iHAAiH;AACjH,eAAO,MAAM,wBAAwB,sBAAsB,CAAC;AAC5D,sEAAsE;AACtE,eAAO,MAAM,8BAA8B,4BAA4B,CAAC;AACxE,0EAA0E;AAC1E,eAAO,MAAM,8BAA8B,4BAA4B,CAAC;AACxE,qFAAqF;AACrF,eAAO,MAAM,+BAA+B,6BAA6B,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,eAAe;;;mBAQf,CAAC;AACd,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB;;kBAE5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,YAAY;;;kBAGvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;CAaG,CAAC;AA+BtC;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,GAC7B,OAAO,eAAe,EACtB,KAAK,aAAa,KAChB,OAAO,CAAC,YAAY,CAqCtB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,GAAI,QAAQ,OAAO,KAAG,YAGrD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAG9B,CAAC"}

package/dist/actions/peer_ping.js

@@ -91,6 +91,13 @@ export const PingResponse = z.strictObject({
  * client→server invocation drives a server→client request); `auth: public`
  * (liveness is non-sensitive; the upgrade authenticated the socket);
  * `side_effects: false` (no state change — the handler only round-trips a ping).
+ *
+ * Public is not ungoverned: `rate_limit: 'ip'` is the one throttle an
+ * unauthenticated method can be given (there is no account to key on). It
+ * bounds anonymous fan-out and keeps the class at parity with the Rust spec's
+ * `RateLimitClass::Ip` — there the no-transport refusal costs two pool
+ * checkouts per call; here the public auth shape skips the authorization
+ * phase, so the refusal is free and the class is carried for the bound alone.
  */
 export const peer_ping_action_spec = {
     method: PEER_PING_METHOD,
@@ -101,6 +108,7 @@ export const peer_ping_action_spec = {
     input: PingActionInput,
     output: PingResponse,
     async: true,
+    rate_limit: 'ip',
     description: 'Liveness round-trip — the handler pings the originating client back over its socket, ' +
         'validates the echo, and returns it. Refused as no-transport over HTTP RPC.'
 };

package/dist/actions/peer_request.d.ts

@@ -25,7 +25,7 @@ export declare const DEFAULT_PEER_REQUEST_TIMEOUT = 10000;
 /**
  * Per-connection cap on concurrent in-flight server→client requests. A caller
  * past it gets `too_many_in_flight` instead of growing the pending map
- * unbounded. Twin of the Rust spine's `DEFAULT_MAX_IN_FLIGHT_PER_CONN`.
+ * unbounded. Twin of the Rust spine's `DEFAULT_MAX_OUTBOUND_PEER_REQUESTS_PER_CONN`.
  */
 export declare const MAX_IN_FLIGHT_PEER_REQUESTS_PER_CONNECTION = 256;
 /**

package/dist/actions/peer_request.js

@@ -23,7 +23,7 @@ export const DEFAULT_PEER_REQUEST_TIMEOUT = 10_000;
 /**
  * Per-connection cap on concurrent in-flight server→client requests. A caller
  * past it gets `too_many_in_flight` instead of growing the pending map
- * unbounded. Twin of the Rust spine's `DEFAULT_MAX_IN_FLIGHT_PER_CONN`.
+ * unbounded. Twin of the Rust spine's `DEFAULT_MAX_OUTBOUND_PEER_REQUESTS_PER_CONN`.
  */
 export const MAX_IN_FLIGHT_PEER_REQUESTS_PER_CONNECTION = 256;
 /**

package/dist/actions/perform_action.d.ts

@@ -18,7 +18,16 @@
  * 3. **Post-authorization auth (403)** — gates `auth.credential_types`,
  *    the credential's `token_scope`, and `auth.roles` against the resolved
  *    context.
- * 4. **Validate params (400)** — `spec.input.safeParse(raw_params)` with
+ * 4. **Rate limit (429)** — per-action IP / account throttling, throttle-
+ *    requests semantics (every invocation records, regardless of outcome).
+ *    Ahead of validation so the budget is charged for malformed params too
+ *    — a flood of garbage bodies must cost the sender its quota, not slip
+ *    past the limiter on a cheap 400 — and so a throttled caller never pays
+ *    for schema work. The account key is the credential's own account
+ *    (`request_context.account.id`), settled by authentication, so the gate
+ *    sits behind the authority gates by choice rather than necessity: a
+ *    caller those gates refuse is answered 403, not 429.
+ * 5. **Validate params (400)** — `spec.input.safeParse(raw_params)` with
  *    `z.void()` / `?? {}` rules. Runs **after** the authority gates: a
  *    400 describing the action's input shape to a caller those gates
  *    refuse would confirm the method exists and describe how to call it,
@@ -26,13 +35,11 @@
  *    facts before fine ones, and no shape disclosure before authority is
  *    settled — the same argument that puts the credential gate ahead of
  *    the scope gate. The cost: a malformed request from an *authenticated*
- *    caller now pays for the authorization phase's actor + role_grant reads
- *    before being rejected, where validation used to turn it away first.
- *    Not a new DoS lever — the same caller reaches that work anyway by
- *    sending well-formed params — but it does remove a cheap-rejection path
- *    that buggy clients used to hit.
- * 5. **Rate limit (429)** — per-action IP / account throttling, throttle-
- *    requests semantics (every invocation records, regardless of outcome).
+ *    caller pays for the authorization phase's actor + role_grant reads
+ *    before being rejected, rather than being turned away by validation
+ *    first. Not a new DoS lever — the same caller reaches that work anyway
+ *    by sending well-formed params — but there is no cheap-rejection path
+ *    for buggy clients.
  * 6. **Dispatch + DEV-only output validation + error normalization** —
  *    `spec.side_effects` picks transaction (`deps.db.transaction`) vs
  *    pool. Handler throws roll back the transaction; the catch sits
@@ -150,7 +157,7 @@ export type PerformActionResult = {
  * transport calls into this with pre-parsed inputs and binds the result
  * to its wire shape.
  *
- * Phase order: 401 → authz → 403 → 400 → handler. On the test-preset path
+ * Phase order: 401 → authz → 403 → 429 → 400 → handler. On the test-preset path
  * the dispatcher skips the live authorization phase and uses the supplied
  * pre-baked context for post-authorization checks; the 401 still fires when
  * the harness omits `account_id`.

package/dist/actions/perform_action.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"perform_action.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/perform_action.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGtC,OAAO,EAEN,KAAK,gBAAgB,EAErB,KAAK,kBAAkB,EACvB,MAAM,oBAAoB,CAAC;AAc5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAgC,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAGN,KAAK,UAAU,EACf,MAAM,wBAAwB,CAAC;AAEhC;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAClC,kEAAkE;IAClE,MAAM,EAAE,SAAS,CAAC;IAClB,mGAAmG;IACnG,UAAU,EAAE,OAAO,CAAC;IACpB,sDAAsD;IACtD,UAAU,EAAE,gBAAgB,CAAC;IAC7B,yDAAyD;IACzD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uEAAuE;IACvE,eAAe,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC;;;;;OAKG;IACH,WAAW,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,MAAM,EAAE,WAAW,CAAC;IACpB,sFAAsF;IACtF,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD,uDAAuD;IACvD,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B;;;;OAIG;IACH,MAAM,CAAC,EAAE;QAAE,eAAe,EAAE,cAAc,GAAG,IAAI,CAAA;KAAE,CAAC;CACpD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IACjC,gGAAgG;IAChG,EAAE,EAAE,EAAE,CAAC;IACP;;;OAGG;IACH,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC;;;OAGG;IACH,mBAAmB,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C,uEAAuE;IACvE,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAC9B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhG;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,GAC1B,OAAO,kBAAkB,EACzB,MAAM,iBAAiB,KACrB,OAAO,CAAC,mBAAmB,CA+K7B,CAAC;AAuHF;;;GAGG;AACH,eAAO,MAAM,iCAAiC,GAC7C,IAAI,gBAAgB,EACpB,QAAQ,mBAAmB,KACzB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,gBAAgB,CAAA;CAAE,GAAG,CAC9C;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAMnD,CAAC"}
+{"version":3,"file":"perform_action.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/perform_action.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGtC,OAAO,EAEN,KAAK,gBAAgB,EAErB,KAAK,kBAAkB,EACvB,MAAM,oBAAoB,CAAC;AAc5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAgC,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAGN,KAAK,UAAU,EACf,MAAM,wBAAwB,CAAC;AAEhC;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAClC,kEAAkE;IAClE,MAAM,EAAE,SAAS,CAAC;IAClB,mGAAmG;IACnG,UAAU,EAAE,OAAO,CAAC;IACpB,sDAAsD;IACtD,UAAU,EAAE,gBAAgB,CAAC;IAC7B,yDAAyD;IACzD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uEAAuE;IACvE,eAAe,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC;;;;;OAKG;IACH,WAAW,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,MAAM,EAAE,WAAW,CAAC;IACpB,sFAAsF;IACtF,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD,uDAAuD;IACvD,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B;;;;OAIG;IACH,MAAM,CAAC,EAAE;QAAE,eAAe,EAAE,cAAc,GAAG,IAAI,CAAA;KAAE,CAAC;CACpD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IACjC,gGAAgG;IAChG,EAAE,EAAE,EAAE,CAAC;IACP;;;OAGG;IACH,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC;;;OAGG;IACH,mBAAmB,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C,uEAAuE;IACvE,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAC9B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhG;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,GAC1B,OAAO,kBAAkB,EACzB,MAAM,iBAAiB,KACrB,OAAO,CAAC,mBAAmB,CAiL7B,CAAC;AAuHF;;;GAGG;AACH,eAAO,MAAM,iCAAiC,GAC7C,IAAI,gBAAgB,EACpB,QAAQ,mBAAmB,KACzB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,gBAAgB,CAAA;CAAE,GAAG,CAC9C;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAMnD,CAAC"}

package/dist/actions/perform_action.js

@@ -18,7 +18,16 @@
  * 3. **Post-authorization auth (403)** — gates `auth.credential_types`,
  *    the credential's `token_scope`, and `auth.roles` against the resolved
  *    context.
- * 4. **Validate params (400)** — `spec.input.safeParse(raw_params)` with
+ * 4. **Rate limit (429)** — per-action IP / account throttling, throttle-
+ *    requests semantics (every invocation records, regardless of outcome).
+ *    Ahead of validation so the budget is charged for malformed params too
+ *    — a flood of garbage bodies must cost the sender its quota, not slip
+ *    past the limiter on a cheap 400 — and so a throttled caller never pays
+ *    for schema work. The account key is the credential's own account
+ *    (`request_context.account.id`), settled by authentication, so the gate
+ *    sits behind the authority gates by choice rather than necessity: a
+ *    caller those gates refuse is answered 403, not 429.
+ * 5. **Validate params (400)** — `spec.input.safeParse(raw_params)` with
  *    `z.void()` / `?? {}` rules. Runs **after** the authority gates: a
  *    400 describing the action's input shape to a caller those gates
  *    refuse would confirm the method exists and describe how to call it,
@@ -26,13 +35,11 @@
  *    facts before fine ones, and no shape disclosure before authority is
  *    settled — the same argument that puts the credential gate ahead of
  *    the scope gate. The cost: a malformed request from an *authenticated*
- *    caller now pays for the authorization phase's actor + role_grant reads
- *    before being rejected, where validation used to turn it away first.
- *    Not a new DoS lever — the same caller reaches that work anyway by
- *    sending well-formed params — but it does remove a cheap-rejection path
- *    that buggy clients used to hit.
- * 5. **Rate limit (429)** — per-action IP / account throttling, throttle-
- *    requests semantics (every invocation records, regardless of outcome).
+ *    caller pays for the authorization phase's actor + role_grant reads
+ *    before being rejected, rather than being turned away by validation
+ *    first. Not a new DoS lever — the same caller reaches that work anyway
+ *    by sending well-formed params — but there is no cheap-rejection path
+ *    for buggy clients.
  * 6. **Dispatch + DEV-only output validation + error normalization** —
  *    `spec.side_effects` picks transaction (`deps.db.transaction`) vs
  *    pool. Handler throws roll back the transaction; the catch sits
@@ -62,7 +69,7 @@ import { token_scope_admits_method, token_scope_method_capability } from '../aut
  * transport calls into this with pre-parsed inputs and binds the result
  * to its wire shape.
  *
- * Phase order: 401 → authz → 403 → 400 → handler. On the test-preset path
+ * Phase order: 401 → authz → 403 → 429 → 400 → handler. On the test-preset path
  * the dispatcher skips the live authorization phase and uses the supplied
  * pre-baked context for post-authorization checks; the 401 still fires when
  * the harness omits `account_id`.
@@ -77,10 +84,10 @@ export const perform_action = async (input, deps) => {
     if (pre)
         return error_result(pre);
     // step 2: authorization phase. `acting` reads off the raw params rather
-    // than a validated field, because validation now runs after the authority
+    // than a validated field, because validation runs after the authority
     // gates. Per registry-time invariant 2,
     // `auth.actor !== 'none' ⟺ input declares acting?: ActingActor` — so the
-    // selector is present on exactly the specs that need it, and step 4 is
+    // selector is present on exactly the specs that need it, and step 5 is
     // what rejects a malformed one.
     let request_context = null;
     if (preset !== undefined) {
@@ -105,18 +112,11 @@ export const perform_action = async (input, deps) => {
     const post = check_action_auth_post_authorization(action_auth, request_context, credential_type, action.spec.method, token_scope);
     if (post)
         return error_result(post);
-    // step 4: validate params. JSON-RPC 2.0 §4.2 forbids `params: null`;
-    // registration sites reject `z.null()` inputs. Empty-body convention
-    // (`raw_params ?? {}`) lets all-optional-object methods omit `params`.
-    const params = is_void_schema(spec.input) ? raw_params : (raw_params ?? {});
-    const parse_result = spec.input.safeParse(params);
-    if (!parse_result.success) {
-        return error_result(jsonrpc_error_messages.invalid_params('invalid params', dev_only({ issues: parse_result.error.issues })));
-    }
-    const validated_input = parse_result.data;
-    // step 5: rate limit — throttle-requests semantics (record on every
+    // step 4: rate limit — throttle-requests semantics (record on every
     // invocation, no success-reset). Same limiters shared with the WS
     // dispatcher so an attacker can't switch transports to bypass the budget.
+    // Runs ahead of validation so a flood of malformed params burns the
+    // budget it should, and so a throttled caller pays no schema work.
     const rate_limit = spec.rate_limit;
     if (rate_limit) {
         const ip_check = action_ip_rate_limiter && (rate_limit === 'ip' || rate_limit === 'both');
@@ -141,6 +141,15 @@ export const perform_action = async (input, deps) => {
             action_account_rate_limiter.record(account_keyed_context.account.id);
         }
     }
+    // step 5: validate params. JSON-RPC 2.0 §4.2 forbids `params: null`;
+    // registration sites reject `z.null()` inputs. Empty-body convention
+    // (`raw_params ?? {}`) lets all-optional-object methods omit `params`.
+    const params = is_void_schema(spec.input) ? raw_params : (raw_params ?? {});
+    const parse_result = spec.input.safeParse(params);
+    if (!parse_result.success) {
+        return error_result(jsonrpc_error_messages.invalid_params('invalid params', dev_only({ issues: parse_result.error.issues })));
+    }
+    const validated_input = parse_result.data;
     // step 6: dispatch — transaction for mutations, pool for reads.
     const use_transaction = spec.side_effects;
     const execute = async (effective_db) => {

package/dist/actions/register_action_ws.d.ts

@@ -176,7 +176,7 @@ export interface RegisterActionWsResult {
  *   `ctx.signal` before bubbling out.
  * - Per-message dispatch goes through `perform_action`: pre-authorization
  *   auth (401) → authorization phase → post-authorization auth (403) →
- *   input validation (400) → rate limit (429) → handler (with transaction
+ *   rate limit (429) → input validation (400) → handler (with transaction
  *   wrap iff `spec.side_effects: true`) → DEV output validation.
  * - Authorization phase runs **per message** — role_grant changes during a
  *   connection lifetime are picked up on the next message without any

package/dist/actions/register_action_ws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register_action_ws.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/register_action_ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAE3D,OAAO,EAAU,KAAK,MAAM,IAAI,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAWnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAmBtD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAIhD,OAAO,EAAE,yBAAyB,EAAE,KAAK,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAIhG,YAAY,EAAE,MAAM,EAAE,CAAC;AAEvB,0EAA0E;AAC1E,eAAO,MAAM,gCAAgC,QAAS,CAAC;AAEvD;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IACjC,qFAAqF;IACrF,EAAE,EAAE,SAAS,CAAC;IACd,4EAA4E;IAC5E,aAAa,EAAE,IAAI,CAAC;IACpB,oDAAoD;IACpD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B;;;OAGG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD,wFAAwF;IACxF,MAAM,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IAClC,+CAA+C;IAC/C,EAAE,EAAE,SAAS,CAAC;IACd,2CAA2C;IAC3C,aAAa,EAAE,IAAI,CAAC;IACpB,kGAAkG;IAClG,QAAQ,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACtC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wCAAwC;AACxC,MAAM,WAAW,uBAAuB;IACvC,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,GAAG,EAAE,IAAI,CAAC;IACV,iEAAiE;IACjE,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;;;;OAOG;IACH,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;;;;;OASG;IACH,EAAE,EAAE,EAAE,CAAC;IACP;;;;OAIG;IACH,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,sBAAsB,CAAC;IAC7C,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qDAAqD;IACrD,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5C;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CACjD;AAED,sCAAsC;AACtC,MAAM,WAAW,sBAAsB;IACtC,yEAAyE;IACzE,SAAS,EAAE,yBAAyB,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,uBAAuB,KAAG,sBAuZrE,CAAC"}
+{"version":3,"file":"register_action_ws.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/register_action_ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAE3D,OAAO,EAAU,KAAK,MAAM,IAAI,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAWnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAyBtD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAIhD,OAAO,EAAE,yBAAyB,EAAE,KAAK,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAIhG,YAAY,EAAE,MAAM,EAAE,CAAC;AAEvB,0EAA0E;AAC1E,eAAO,MAAM,gCAAgC,QAAS,CAAC;AAsCvD;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IACjC,qFAAqF;IACrF,EAAE,EAAE,SAAS,CAAC;IACd,4EAA4E;IAC5E,aAAa,EAAE,IAAI,CAAC;IACpB,oDAAoD;IACpD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B;;;OAGG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD,wFAAwF;IACxF,MAAM,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IAClC,+CAA+C;IAC/C,EAAE,EAAE,SAAS,CAAC;IACd,2CAA2C;IAC3C,aAAa,EAAE,IAAI,CAAC;IACpB,kGAAkG;IAClG,QAAQ,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACtC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wCAAwC;AACxC,MAAM,WAAW,uBAAuB;IACvC,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,GAAG,EAAE,IAAI,CAAC;IACV,iEAAiE;IACjE,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;;;;OAOG;IACH,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;;;;;OASG;IACH,EAAE,EAAE,EAAE,CAAC;IACP;;;;OAIG;IACH,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,sBAAsB,CAAC;IAC7C,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qDAAqD;IACrD,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5C;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CACjD;AAED,sCAAsC;AACtC,MAAM,WAAW,sBAAsB;IACtC,yEAAyE;IACzE,SAAS,EAAE,yBAAyB,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,uBAAuB,KAAG,sBAgbrE,CAAC"}

package/dist/actions/register_action_ws.js

@@ -32,8 +32,9 @@ import { get_request_context, require_request_context, token_scope_surface_denia
 import { hash_session_token } from '../auth/session_queries.js';
 import { get_client_ip } from '../http/client_ip.js';
 import { flush_pending_effects, flush_post_commit_effects } from '../http/pending_effects.js';
-import { jsonrpc_error_messages } from '../http/jsonrpc_errors.js';
-import { create_jsonrpc_error_response, create_jsonrpc_notification, to_jsonrpc_message_id, to_jsonrpc_params, is_jsonrpc_request, is_jsonrpc_response, is_jsonrpc_error_response } from '../http/jsonrpc_helpers.js';
+import { JsonrpcRequest } from '../http/jsonrpc.js';
+import { dev_only, jsonrpc_error_messages } from '../http/jsonrpc_errors.js';
+import { create_jsonrpc_error_response, create_jsonrpc_notification, to_jsonrpc_envelope_id, to_jsonrpc_message_id, to_jsonrpc_params, is_jsonrpc_object, is_jsonrpc_request, is_jsonrpc_request_id } from '../http/jsonrpc_helpers.js';
 import { CREDENTIAL_TYPE_KEY, TOKEN_SCOPE_KEY, AUTH_API_TOKEN_ID_KEY, TEST_CONTEXT_PRESET_KEY } from '../hono_context.js';
 import {} from './action_types.js';
 import { compile_action_registry } from './compile_action_registry.js';
@@ -44,6 +45,39 @@ import { audit_unmatched_peer_response } from './peer_request.js';
 import { perform_action, perform_action_result_to_envelope } from './perform_action.js';
 /** Default inactivity window before the server closes a silent socket. */
 export const DEFAULT_SERVER_HEARTBEAT_TIMEOUT = 60_000;
+/** Send one JSON-RPC error response frame on `ws`. */
+const send_error_response = (ws, id, error) => {
+    ws.send(JSON.stringify(create_jsonrpc_error_response(id, error)));
+};
+/**
+ * Whether a frame is a reply to a server-initiated request, in the shape the
+ * Rust twin's `classify` accepts: `jsonrpc: '2.0'`, **no** string `method`, a
+ * string/number `id`, and exactly one of `result` / `error`.
+ *
+ * The method axis is string-typed like the twin, whose
+ * `obj.get("method").and_then(Value::as_str)` reads a present-but-non-string
+ * `method` as absent — so `{id, method: 123, result}` is a response on both
+ * sides, not a request. The `result` / `error` XOR likewise refuses a frame
+ * carrying both, so neither side has to pick a winner between them.
+ *
+ * Deliberately narrower than the `is_jsonrpc_response` /
+ * `is_jsonrpc_error_response` guards, which only ask for a version, an `id`,
+ * and a `result` or `error` — those stay loose because a client matching a
+ * reply must still recognize an error response carrying `id: null`. Here a
+ * loose match would swallow hybrids the twin answers: `{method, id, result}`
+ * is a request the dispatcher should run, and `{id, result, error}` or a
+ * boolean `id` is `invalid_request`. Everything this rejects falls through to
+ * the version guard / notification / envelope steps below.
+ */
+const is_peer_response = (json) => {
+    if (!is_jsonrpc_object(json))
+        return false;
+    if (typeof json.method === 'string')
+        return false;
+    if (!is_jsonrpc_request_id(json.id))
+        return false;
+    return 'result' in json !== 'error' in json;
+};
 /**
  * Mount a JSON-RPC WebSocket endpoint that dispatches via the shared
  * `perform_action` core.
@@ -55,7 +89,7 @@ export const DEFAULT_SERVER_HEARTBEAT_TIMEOUT = 60_000;
  *   `ctx.signal` before bubbling out.
  * - Per-message dispatch goes through `perform_action`: pre-authorization
  *   auth (401) → authorization phase → post-authorization auth (403) →
- *   input validation (400) → rate limit (429) → handler (with transaction
+ *   rate limit (429) → input validation (400) → handler (with transaction
  *   wrap iff `spec.side_effects: true`) → DEV output validation.
  * - Authorization phase runs **per message** — role_grant changes during a
  *   connection lifetime are picked up on the next message without any
@@ -219,7 +253,7 @@ export const register_action_ws = (options) => {
                     catch (error) {
                         log.error('on_socket_open failed — closing socket:', error);
                         try {
-                            ws.send(JSON.stringify(create_jsonrpc_error_response(null, jsonrpc_error_messages.internal_error())));
+                            send_error_response(ws, null, jsonrpc_error_messages.internal_error());
                         }
                         catch {
                             // ignore — socket may already be dead
@@ -236,22 +270,23 @@ export const register_action_ws = (options) => {
                 }
                 catch (error) {
                     log.error('JSON parse error:', error);
-                    ws.send(JSON.stringify(create_jsonrpc_error_response(null, jsonrpc_error_messages.parse_error())));
+                    send_error_response(ws, null, jsonrpc_error_messages.parse_error());
                     return;
                 }
                 // Batch JSON-RPC is not supported on the WebSocket path.
                 if (Array.isArray(json)) {
-                    ws.send(JSON.stringify(create_jsonrpc_error_response(null, jsonrpc_error_messages.invalid_request('batch JSON-RPC requests are not supported on WebSocket'))));
+                    send_error_response(ws, null, jsonrpc_error_messages.invalid_request('batch JSON-RPC requests are not supported on WebSocket'));
                     return;
                 }
                 // Inbound responses to server-initiated requests (`peer/ping`,
                 // etc.) — route to the pending-request registry scoped to THIS
-                // socket. A response carries `result`/`error` + `id` and no
-                // `method`, so it precedes the request/notification split below.
-                // An unmatched id (unsolicited, cross-connection, or already
-                // settled) resolves nothing and is dropped, so the read loop
-                // survives a junk frame.
-                if (is_jsonrpc_response(json) || is_jsonrpc_error_response(json)) {
+                // socket. A response carries a string/number `id`, exactly one
+                // of `result` / `error`, and no string `method`, so it precedes the
+                // request/notification split below. An unmatched id
+                // (unsolicited, cross-connection, or already settled) resolves
+                // nothing and is dropped, so the read loop survives a junk
+                // frame.
+                if (is_peer_response(json)) {
                     if (captured_connection_id !== undefined) {
                         const matched = transport.resolve_peer_response(captured_connection_id, json);
                         if (!matched)
@@ -259,13 +294,32 @@ export const register_action_ws = (options) => {
                     }
                     return;
                 }
-                // Notifications (method + no id) — `cancel` is intercepted
-                // for request-scoped cancellation; other notifications are
-                // silenced per JSON-RPC spec (consumer notification handlers
-                // are not a feature yet).
+                // Envelope version — the first thing the Rust twin's `classify`
+                // checks (version → id → method → params). A frame without
+                // `jsonrpc: '2.0'` is `invalid_request` on both transports
+                // rather than falling through to the notification branch,
+                // which would silently drop `{method: 'x'}` and
+                // `{jsonrpc: '1.0', method: 'x'}`. It also covers a
+                // non-object frame (a scalar has no id to echo — `id: null`).
+                // A genuine peer response carries the version and is matched
+                // above; a response-shaped frame that misses that shape check
+                // falls through here on purpose, so it is answered rather
+                // than swallowed.
+                if (!is_jsonrpc_object(json)) {
+                    send_error_response(ws, to_jsonrpc_envelope_id(json), jsonrpc_error_messages.invalid_request());
+                    return;
+                }
+                // Notifications (string method + no id) — `cancel` is
+                // intercepted for request-scoped cancellation; other
+                // notifications are silenced per JSON-RPC spec (consumer
+                // notification handlers are not a feature yet). The method
+                // axis is string-typed like the twin's `classify`, so a
+                // non-string `method` is answered `invalid_request` below
+                // rather than silently dropped as a notification.
                 if (!is_jsonrpc_request(json)) {
-                    if (typeof json === 'object' && json !== null && 'method' in json && !('id' in json)) {
-                        if (json.method === cancel_action_spec.method) {
+                    const notification_method = json.method;
+                    if (typeof notification_method === 'string' && !('id' in json)) {
+                        if (notification_method === cancel_action_spec.method) {
                             const parsed = CancelNotificationParams.safeParse(json.params);
                             if (!parsed.success) {
                                 log.debug('cancel: invalid params, ignoring', parsed.error.issues);
@@ -281,17 +335,30 @@ export const register_action_ws = (options) => {
                         }
                         return;
                     }
-                    ws.send(JSON.stringify(create_jsonrpc_error_response(to_jsonrpc_message_id(json), jsonrpc_error_messages.invalid_request())));
+                    send_error_response(ws, to_jsonrpc_message_id(json), jsonrpc_error_messages.invalid_request());
+                    return;
+                }
+                // Envelope validation — the same `JsonrpcRequest.safeParse` the
+                // HTTP POST path runs, so a malformed envelope (`params: null`,
+                // an array `params`, a boolean `id`) answers `invalid_request`
+                // on both transports instead of reaching the dispatcher and
+                // surfacing as `invalid_params`. It sits after the
+                // notification / cancel block so notifications stay
+                // unvalidated (they carry no id to echo) and `cancel` routing
+                // precedes it.
+                const envelope = JsonrpcRequest.safeParse(json);
+                if (!envelope.success) {
+                    send_error_response(ws, to_jsonrpc_message_id(json), jsonrpc_error_messages.invalid_request(dev_only({ issues: envelope.error.issues })));
                     return;
                 }
-                const { method, id, params } = json;
+                const { method, id, params } = envelope.data;
                 // Per-action method lookup — return method_not_found before
                 // we engage the dispatch machinery. Specs without a handler
                 // (client-only / dispatcher-handled) miss action_map and
                 // surface as method_not_found just like unknown methods.
                 const action = action_map.get(method);
                 if (!action) {
-                    ws.send(JSON.stringify(create_jsonrpc_error_response(id, jsonrpc_error_messages.method_not_found(method))));
+                    send_error_response(ws, id, jsonrpc_error_messages.method_not_found(method));
                     return;
                 }
                 if (artificial_delay > 0) {