@fuzdev/fuz_app 0.107.0 → 0.109.0

package/dist/testing/rate_limiting.js

@@ -27,35 +27,25 @@ import { auth_migration_ns } from '../auth/migrations.js';
 import { create_test_app } from './app_server.js';
 import { create_pglite_factory, create_describe_db, auth_integration_truncate_tables } from './db.js';
 import { find_auth_route, assert_rate_limit_retry_after_header } from './integration_helpers.js';
-import { rpc_call_non_browser, require_rpc_endpoint_path, resolve_rpc_endpoints_for_setup } from './rpc_helpers.js';
 import { run_migrations } from '../db/migrate.js';
-import { account_verify_action_spec } from '../auth/account_action_specs.js';
 /**
  * Standard rate limiting integration test suite.
  *
- * Creates 3 test groups:
+ * Creates 2 test groups:
  * 1. IP rate limiting on login — fires `max_attempts + 1` login requests,
  *    verifies the last returns 429 with a valid `RateLimitError` body.
  * 2. Per-account rate limiting on login — fires `max_attempts + 1` login
  *    requests with the same username, verifies the last returns 429.
- * 3. Bearer auth IP rate limiting — fires `max_attempts + 1` bearer requests
- *    with an invalid token, verifies the last returns 429.
+ *
+ * There is deliberately no bearer-auth group: the bearer path carries no rate
+ * limiter on either spine, because an API token's entropy — not throttling —
+ * is what bounds guessing it. See `auth/bearer_auth.ts`.
  *
  * Each test group asserts that required routes exist, failing with a descriptive
  * message if the consumer's route specs are misconfigured.
- *
- * @throws Error at setup time when `options.rpc_endpoints` is empty — the
- *   bearer-auth rate-limit test probes via the `account_verify` RPC action,
- *   so the suite hard-fails via `require_rpc_endpoint_path`.
  */
 export const describe_rate_limiting_tests = (options) => {
     const max_attempts = options.max_attempts ?? 2;
-    // Hard-fail early so consumers see a clear setup error instead of a
-    // confusing test failure when `rpc_endpoints` is missing. Factory-form
-    // callers are resolved with a stub ctx purely to extract the endpoint
-    // path; real handlers run per-test via the top-level `rpc_endpoints` slot on `CreateTestAppOptions`.
-    const rpc_endpoints_for_setup = resolve_rpc_endpoints_for_setup(options.rpc_endpoints, options.session_options);
-    const rpc_path = require_rpc_endpoint_path(rpc_endpoints_for_setup);
     const init_schema = async (db) => {
         await run_migrations(db, [auth_migration_ns]);
     };
@@ -67,7 +57,7 @@ export const describe_rate_limiting_tests = (options) => {
         // --- 1. IP rate limiting on login ---
         describe('IP rate limiting on login', () => {
             test(`login is blocked after ${max_attempts} failed attempts`, async () => {
-                const ip_rate_limiter = create_test_rate_limiter();
+                const login_ip_rate_limiter = create_test_rate_limiter();
                 try {
                     const test_app = await create_test_app({
                         session_options: options.session_options,
@@ -76,9 +66,8 @@ export const describe_rate_limiting_tests = (options) => {
                         rpc_endpoints: options.rpc_endpoints,
                         app_options: {
                             ...options.app_options,
-                            ip_rate_limiter,
-                            login_account_rate_limiter: null,
-                            bearer_ip_rate_limiter: null
+                            login_ip_rate_limiter,
+                            login_account_rate_limiter: null
                         }
                     });
                     const login_route = find_auth_route(test_app.route_specs, '/login', 'POST');
@@ -113,7 +102,7 @@ export const describe_rate_limiting_tests = (options) => {
                     assert_rate_limit_retry_after_header(blocked_res, body);
                 }
                 finally {
-                    ip_rate_limiter.dispose();
+                    login_ip_rate_limiter.dispose();
                 }
             });
         });
@@ -129,9 +118,8 @@ export const describe_rate_limiting_tests = (options) => {
                         rpc_endpoints: options.rpc_endpoints,
                         app_options: {
                             ...options.app_options,
-                            ip_rate_limiter: null,
-                            login_account_rate_limiter,
-                            bearer_ip_rate_limiter: null
+                            login_ip_rate_limiter: null,
+                            login_account_rate_limiter
                         }
                     });
                     const login_route = find_auth_route(test_app.route_specs, '/login', 'POST');
@@ -182,77 +170,5 @@ export const describe_rate_limiting_tests = (options) => {
                 }
             });
         });
-        // --- 3. Bearer auth IP rate limiting ---
-        describe('bearer auth IP rate limiting', () => {
-            test(`bearer auth is blocked after ${max_attempts} invalid token attempts`, async () => {
-                const bearer_ip_rate_limiter = create_test_rate_limiter();
-                try {
-                    const test_app = await create_test_app({
-                        session_options: options.session_options,
-                        create_route_specs: options.create_route_specs,
-                        db: get_db(),
-                        rpc_endpoints: options.rpc_endpoints,
-                        app_options: {
-                            ...options.app_options,
-                            ip_rate_limiter: null,
-                            login_account_rate_limiter: null,
-                            bearer_ip_rate_limiter
-                        }
-                    });
-                    // Probe `account_verify` via RPC with an invalid bearer token.
-                    // The REST `/api/account/verify` shim is status-only (empty body
-                    // for nginx `auth_request`), so we use the RPC surface to exercise
-                    // a typed authenticated method. The bearer_auth rate limiter
-                    // increments per attempt regardless of the route's own auth outcome.
-                    // Use `rpc_call_non_browser` so the default `origin` header is
-                    // suppressed — bearer_auth discards the token when Origin or
-                    // Referer is present (browser context), which would short-circuit
-                    // before the rate limiter records the attempt.
-                    //
-                    // Note: the rate limiter short-circuits before the RPC dispatcher,
-                    // so the 429 response is a REST-shaped `RateLimitError`, not a
-                    // JSON-RPC envelope. We use the underlying `app.request` for the
-                    // blocked probe so `rpc_call_non_browser` doesn't throw on the
-                    // non-envelope body.
-                    const bearer_probe_headers = {
-                        authorization: 'Bearer secret_fuz_token_invalid'
-                    };
-                    // Fire max_attempts invalid bearer requests (sequential — must exhaust the window)
-                    for (let i = 0; i < max_attempts; i++) {
-                        const res = await rpc_call_non_browser({
-                            app: test_app.app,
-                            path: rpc_path,
-                            method: account_verify_action_spec.method,
-                            id: 'rl-probe',
-                            headers: bearer_probe_headers
-                        });
-                        assert.notStrictEqual(res.status, 429, `Request ${i + 1}/${max_attempts} should not be rate limited`);
-                    }
-                    // The next request should be rate limited. The 429 body is REST-shape
-                    // (middleware short-circuits before the RPC dispatcher), so go
-                    // direct — `rpc_call_non_browser` would throw on the non-envelope body.
-                    const blocked_res = await test_app.app.request(rpc_path, {
-                        method: 'POST',
-                        headers: {
-                            host: 'localhost',
-                            'content-type': 'application/json',
-                            ...bearer_probe_headers
-                        },
-                        body: JSON.stringify({
-                            jsonrpc: '2.0',
-                            method: account_verify_action_spec.method,
-                            id: 'rl-probe-blocked'
-                        })
-                    });
-                    assert.strictEqual(blocked_res.status, 429);
-                    const body = await blocked_res.json();
-                    RateLimitError.parse(body);
-                    assert_rate_limit_retry_after_header(blocked_res, body);
-                }
-                finally {
-                    bearer_ip_rate_limiter.dispose();
-                }
-            });
-        });
     });
 };

package/dist/testing/stubs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stubs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/stubs.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAa7B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAG3E,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAmB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAA+B,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAI9F;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,GAAG,GAAG,EAAE,OAAO,MAAM,KAAG,CAqBtD,CAAC;AAET;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,GAAG,GAAG,EAAE,QAAQ,MAAM,EAAE,YAAY,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,CAOxF,CAAC;AAET,iEAAiE;AACjE,eAAO,MAAM,IAAI,EAAE,GAAkC,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,QAAO,EAI/B,CAAC;AAEJ,gDAAgD;AAChD,eAAO,MAAM,YAAY,QAAO,QAAgC,CAAC;AAEjE,2CAA2C;AAC3C,eAAO,MAAM,OAAO,GAAU,IAAI,GAAG,EAAE,MAAM,GAAG,KAAG,OAAO,CAAC,IAAI,CAAW,CAAC;AAI3E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,QAAO,YAW3C,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,QAAO,WAUxC,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,aAAa,EAAE,OAS3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,QAAO,OAStC,CAAC;AAEH,2FAA2F;AAC3F,eAAO,MAAM,0BAA0B,GAAI,UAAU;IACpD,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAC/B,KAAG,KAAK,CAAC,cAAc,CAqBvB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,GAC1C,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,gBAoBF,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,+BAA+B;IAC/C,6DAA6D;IAC7D,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,qFAAqF;IACrF,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7F;;;;;;;;OAQG;IACH,YAAY,CAAC,EACZ,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAC5F,mFAAmF;IACnF,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/E;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,cAmDF,CAAC"}
+{"version":3,"file":"stubs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/stubs.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAa7B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAG3E,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAmB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAA+B,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAI9F;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,GAAG,GAAG,EAAE,OAAO,MAAM,KAAG,CAqBtD,CAAC;AAET;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,GAAG,GAAG,EAAE,QAAQ,MAAM,EAAE,YAAY,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,CAOxF,CAAC;AAET,iEAAiE;AACjE,eAAO,MAAM,IAAI,EAAE,GAAkC,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,QAAO,EAI/B,CAAC;AAEJ,gDAAgD;AAChD,eAAO,MAAM,YAAY,QAAO,QAAgC,CAAC;AAEjE,2CAA2C;AAC3C,eAAO,MAAM,OAAO,GAAU,IAAI,GAAG,EAAE,MAAM,GAAG,KAAG,OAAO,CAAC,IAAI,CAAW,CAAC;AAI3E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,QAAO,YAW3C,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,QAAO,WAUxC,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,aAAa,EAAE,OAS3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,QAAO,OAStC,CAAC;AAEH,2FAA2F;AAC3F,eAAO,MAAM,0BAA0B,GAAI,UAAU;IACpD,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAC/B,KAAG,KAAK,CAAC,cAAc,CAqBvB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,GAC1C,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,gBAsBF,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,+BAA+B;IAC/C,6DAA6D;IAC7D,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,qFAAqF;IACrF,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7F;;;;;;;;OAQG;IACH,YAAY,CAAC,EACZ,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAC5F,mFAAmF;IACnF,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/E;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,cAmDF,CAAC"}

package/dist/testing/stubs.js

@@ -199,7 +199,9 @@ export const create_stub_app_server_context = (session_options) => {
         },
         bootstrap_status: { available: false, token_path: null },
         session_options,
-        ip_rate_limiter: null,
+        login_ip_rate_limiter: null,
+        signup_ip_rate_limiter: null,
+        bootstrap_ip_rate_limiter: null,
         login_account_rate_limiter: null,
         signup_account_rate_limiter: null,
         action_ip_rate_limiter: null,

package/dist/testing/testing_rate_limiter.d.ts

@@ -20,7 +20,7 @@ import './assert_dev_env.js';
  * import {TestingRateLimiter} from '@fuzdev/fuz_app/testing/testing_rate_limiter.ts';
  *
  * const limiter = new TestingRateLimiter(default_login_ip_rate_limit);
- * await create_app_server({backend, ip_rate_limiter: limiter, ...});
+ * await create_app_server({backend, login_ip_rate_limiter: limiter, ...});
  *
  * // Inside the `_testing_reset` handler's `reset_state`:
  * limiter.reset_all();
@@ -45,6 +45,12 @@ export declare class TestingRateLimiter extends RateLimiter {
      * safe to call before any check/record activity. Designed to be invoked
      * from a `_testing_reset` handler's `reset_state` callback so the test
      * binary's rate-limit buckets don't leak across test cases.
+     *
+     * This is the **one sanctioned caller that clears IP-aggregate keys** —
+     * `RateLimiter.reset` forbids that for production code, because refunding
+     * the IP bucket on a successful auth reopens the distributed-spray path.
+     * Here it is test-state teardown between cases, not success-forgiveness, so
+     * the rule doesn't apply.
      */
     reset_all(): void;
     /**

package/dist/testing/testing_rate_limiter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_rate_limiter.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/testing_rate_limiter.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAEvE;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,WAAW;;IAGzC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,eAAe;IAKjD,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,eAAe;IAKlD,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAKjC;;;;;OAKG;IACH,SAAS,IAAI,IAAI;IAOjB;;;;;;OAMG;IACH,IAAI,YAAY,IAAI,WAAW,CAAC,MAAM,CAAC,CAEtC;CACD"}
+{"version":3,"file":"testing_rate_limiter.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/testing_rate_limiter.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAEvE;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,WAAW;;IAGzC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,eAAe;IAKjD,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,eAAe;IAKlD,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAKjC;;;;;;;;;;;OAWG;IACH,SAAS,IAAI,IAAI;IAOjB;;;;;;OAMG;IACH,IAAI,YAAY,IAAI,WAAW,CAAC,MAAM,CAAC,CAEtC;CACD"}

package/dist/testing/testing_rate_limiter.js

@@ -20,7 +20,7 @@ import './assert_dev_env.js';
  * import {TestingRateLimiter} from '@fuzdev/fuz_app/testing/testing_rate_limiter.ts';
  *
  * const limiter = new TestingRateLimiter(default_login_ip_rate_limit);
- * await create_app_server({backend, ip_rate_limiter: limiter, ...});
+ * await create_app_server({backend, login_ip_rate_limiter: limiter, ...});
  *
  * // Inside the `_testing_reset` handler's `reset_state`:
  * limiter.reset_all();
@@ -54,6 +54,12 @@ export class TestingRateLimiter extends RateLimiter {
      * safe to call before any check/record activity. Designed to be invoked
      * from a `_testing_reset` handler's `reset_state` callback so the test
      * binary's rate-limit buckets don't leak across test cases.
+     *
+     * This is the **one sanctioned caller that clears IP-aggregate keys** —
+     * `RateLimiter.reset` forbids that for production code, because refunding
+     * the IP bucket on a successful auth reopens the distributed-spray path.
+     * Here it is test-state teardown between cases, not success-forgiveness, so
+     * the rule doesn't apply.
      */
     reset_all() {
         for (const key of this.#seen_keys) {

package/dist/ui/CLAUDE.md

@@ -244,9 +244,13 @@ destructive actions.
 - `table_state.svelte.ts` — `TableState`. Paginated DB browser state.
   Holds one `AsyncSlot` (`list`) + payload fields (`table_name`,
   `columns`, `rows`, `total`, `offset`, `limit` capped by
-  `TABLE_LIMIT_MAX = 1000`, `primary_key`). Derived
-  `showing_start`/`showing_end`/`has_prev`/`has_next`. Methods:
-  `fetch`, `go_prev`/`go_next`, `delete_row`. `delete_row` uses
+  `http/db_routes.ts`'s `DB_TABLE_ROWS_LIMIT_MAX`, `primary_key`,
+  `deletable`). Derived
+  `showing_start`/`showing_end`/`has_prev`/`has_next`, plus
+  `can_delete` (`deletable && primary_key !== null`) — gate the
+  delete affordance on that, not on `primary_key`, or a
+  policy-excluded table shows a button that only ever refuses.
+  Methods: `fetch`, `go_prev`/`go_next`, `delete_row`. `delete_row` uses
   plain try/catch + scalar `deleting` / `delete_error` fields (no
   slot — error must survive past `list.run()` retries).
 - `form_state.svelte.ts` — `FormState`. Enter-advance between
@@ -421,4 +425,5 @@ format_scope, global_label)` helper — `global_label = null` renders no
   - `format_value(value)` — table-cell stringifier (NULL / undefined /
     JSON / primitive).
   - `format_audit_metadata(event_type, metadata)` — event-type-
-    specific metadata summary (switch across every `AuditEventType`).
+    specific metadata summary (bespoke cases for the common event types,
+    JSON-stringified fallback for the rest).

package/dist/ui/table_state.svelte.d.ts

@@ -40,9 +40,7 @@
  * @module
  */
 import { AsyncSlot } from './async_slot.svelte.js';
-import type { ColumnInfo } from '../http/db_routes.js';
-/** Maximum number of rows that can be fetched in a single page. */
-export declare const TABLE_LIMIT_MAX = 1000;
+import { type ColumnInfo } from '../http/db_routes.js';
 export declare class TableState {
     readonly list: AsyncSlot<void, string>;
     table_name: string;
@@ -52,15 +50,30 @@ export declare class TableState {
     offset: number;
     limit: number;
     primary_key: string | null;
+    /**
+     * Whether the server will accept a row `DELETE` on this table. False for a
+     * table with no single-column primary key *and* for one the server excludes
+     * by policy (the audit trail, singleton bookkeeping rows), which `primary_key`
+     * alone can't distinguish — it reports the key shape, not the policy.
+     */
+    deletable: boolean;
     deleting: string | null;
     delete_error: string | null;
+    /**
+     * Whether to offer a delete affordance at all. Gate rendering on this rather
+     * than on `primary_key`, or a policy-excluded table shows a button whose only
+     * outcome is a `table_not_deletable` refusal.
+     */
+    readonly can_delete: boolean;
     readonly showing_start: number;
     readonly showing_end: number;
     readonly has_prev: boolean;
     readonly has_next: boolean;
     /**
      * Fetch a page of rows for `table_name` from `GET /api/db/tables/{table_name}`.
-     * `limit` is clamped to `[1, TABLE_LIMIT_MAX]`.
+     * `limit` is clamped to `[1, DB_TABLE_ROWS_LIMIT_MAX]` — the same bounds
+     * the route 400s on, single-sourced so the client guard can't drift into
+     * sending a request the server refuses.
      *
      * @mutates `this`
      */
@@ -72,7 +85,7 @@ export declare class TableState {
      * Optimistically drops it from `rows` and decrements `total` on success;
      * surfaces server errors on `delete_error`.
      *
-     * @returns `true` when the row was removed; `false` on missing primary key or server error
+     * @returns `true` when the row was removed; `false` when the table isn't deletable or the server refused
      * @mutates `this`
      */
     delete_row(row: Record<string, unknown>): Promise<boolean>;

package/dist/ui/table_state.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"table_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/table_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAIH,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAGnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,mEAAmE;AACnE,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC,qBAAa,UAAU;IACtB,QAAQ,CAAC,IAAI,0BAAyB;IAEtC,UAAU,EAAE,MAAM,CAAkB;IACpC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAkB;IAC5C,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAkB;IACtD,KAAK,SAAiB;IACtB,MAAM,SAAiB;IACvB,KAAK,SAAmB;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC9C,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC3C,YAAY,EAAE,MAAM,GAAG,IAAI,CAAoB;IAG/C,QAAQ,CAAC,aAAa,SAAoD;IAC1E,QAAQ,CAAC,WAAW,SAAkE;IACtF,QAAQ,CAAC,QAAQ,UAA6B;IAC9C,QAAQ,CAAC,QAAQ,UAAmD;IAEpE;;;;;OAKG;IACG,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,SAAI,EAAE,KAAK,SAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBvE,OAAO,IAAI,IAAI;IAIf,OAAO,IAAI,IAAI;IAIf;;;;;;;OAOG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;CAoChE"}
+{"version":3,"file":"table_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/table_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAIH,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAGnD,OAAO,EAGN,KAAK,UAAU,EACf,MAAM,sBAAsB,CAAC;AAE9B,qBAAa,UAAU;IACtB,QAAQ,CAAC,IAAI,0BAAyB;IAEtC,UAAU,EAAE,MAAM,CAAkB;IACpC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAkB;IAC5C,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAkB;IACtD,KAAK,SAAiB;IACtB,MAAM,SAAiB;IACvB,KAAK,SAA2C;IAChD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC9C;;;;;OAKG;IACH,SAAS,UAAqB;IAC9B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC3C,YAAY,EAAE,MAAM,GAAG,IAAI,CAAoB;IAE/C;;;;OAIG;IACH,QAAQ,CAAC,UAAU,UAAyD;IAG5E,QAAQ,CAAC,aAAa,SAAoD;IAC1E,QAAQ,CAAC,WAAW,SAAkE;IACtF,QAAQ,CAAC,QAAQ,UAA6B;IAC9C,QAAQ,CAAC,QAAQ,UAAmD;IAEpE;;;;;;;OAOG;IACG,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,SAAI,EAAE,KAAK,SAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBvE,OAAO,IAAI,IAAI;IAIf,OAAO,IAAI,IAAI;IAIf;;;;;;;OAOG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;CAoChE"}

package/dist/ui/table_state.svelte.js

@@ -43,8 +43,7 @@ import { to_error_message } from '@fuzdev/fuz_util/error.ts';
 import { AsyncSlot } from './async_slot.svelte.js';
 import { parse_response_error, ui_fetch } from './ui_fetch.js';
 import { format_value } from './ui_format.js';
-/** Maximum number of rows that can be fetched in a single page. */
-export const TABLE_LIMIT_MAX = 1000;
+import { DB_TABLE_ROWS_DEFAULT_LIMIT, DB_TABLE_ROWS_LIMIT_MAX } from '../http/db_routes.js';
 export class TableState {
     list = new AsyncSlot();
     table_name = $state.raw('');
@@ -52,10 +51,23 @@ export class TableState {
     rows = $state.raw([]);
     total = $state.raw(0);
     offset = $state.raw(0);
-    limit = $state.raw(100);
+    limit = $state.raw(DB_TABLE_ROWS_DEFAULT_LIMIT);
     primary_key = $state.raw(null);
+    /**
+     * Whether the server will accept a row `DELETE` on this table. False for a
+     * table with no single-column primary key *and* for one the server excludes
+     * by policy (the audit trail, singleton bookkeeping rows), which `primary_key`
+     * alone can't distinguish — it reports the key shape, not the policy.
+     */
+    deletable = $state.raw(false);
     deleting = $state.raw(null);
     delete_error = $state.raw(null);
+    /**
+     * Whether to offer a delete affordance at all. Gate rendering on this rather
+     * than on `primary_key`, or a policy-excluded table shows a button whose only
+     * outcome is a `table_not_deletable` refusal.
+     */
+    can_delete = $derived(this.deletable && this.primary_key !== null);
     // Pagination computed values
     showing_start = $derived(this.total === 0 ? 0 : this.offset + 1);
     showing_end = $derived(Math.min(this.offset + this.rows.length, this.total));
@@ -63,14 +75,16 @@ export class TableState {
     has_next = $derived(this.offset + this.limit < this.total);
     /**
      * Fetch a page of rows for `table_name` from `GET /api/db/tables/{table_name}`.
-     * `limit` is clamped to `[1, TABLE_LIMIT_MAX]`.
+     * `limit` is clamped to `[1, DB_TABLE_ROWS_LIMIT_MAX]` — the same bounds
+     * the route 400s on, single-sourced so the client guard can't drift into
+     * sending a request the server refuses.
      *
      * @mutates `this`
      */
     async fetch(table_name, offset = 0, limit = 100) {
         this.table_name = table_name;
         this.offset = offset;
-        this.limit = Math.max(1, Math.min(TABLE_LIMIT_MAX, limit));
+        this.limit = Math.max(1, Math.min(DB_TABLE_ROWS_LIMIT_MAX, limit));
         await this.list.run(async () => {
             const response = await ui_fetch(`/api/db/tables/${table_name}?offset=${this.offset}&limit=${this.limit}`);
             if (!response.ok) {
@@ -81,6 +95,7 @@ export class TableState {
             this.rows = data.rows ?? [];
             this.total = data.total ?? 0;
             this.primary_key = data.primary_key ?? null;
+            this.deletable = data.deletable ?? false;
         });
     }
     go_prev() {
@@ -94,11 +109,11 @@ export class TableState {
      * Optimistically drops it from `rows` and decrements `total` on success;
      * surfaces server errors on `delete_error`.
      *
-     * @returns `true` when the row was removed; `false` on missing primary key or server error
+     * @returns `true` when the row was removed; `false` when the table isn't deletable or the server refused
      * @mutates `this`
      */
     async delete_row(row) {
-        if (!this.primary_key)
+        if (!this.can_delete || !this.primary_key)
             return false;
         const pk_value = row[this.primary_key];
         if (pk_value === null || pk_value === undefined)

package/dist/ui/ui_format.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ui_format.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/ui_format.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAChC,WAAW,MAAM,GAAG,MAAM,GAAG,IAAI,EACjC,MAAK,MAAmB,KACtB,MA2BF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,IAAI,MAAM,KAAG,MAY1C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,EAAE,YAAY,MAAM,EAAE,kBAAe,KAAG,MAOlF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,MAAmC,CAAC;AAEjF;;GAEG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,OAAO,KAAG,MAS7C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,WAAW,MAAM,GAAG,MAAM,GAAG,IAAI,KAAG,MAOzE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GACjC,YAAY,MAAM,EAClB,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,KACtC,MAyDF,CAAC"}
+{"version":3,"file":"ui_format.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/ui_format.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAChC,WAAW,MAAM,GAAG,MAAM,GAAG,IAAI,EACjC,MAAK,MAAmB,KACtB,MA2BF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,IAAI,MAAM,KAAG,MAY1C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,EAAE,YAAY,MAAM,EAAE,kBAAe,KAAG,MAOlF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,MAAmC,CAAC;AAEjF;;GAEG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,OAAO,KAAG,MAS7C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,WAAW,MAAM,GAAG,MAAM,GAAG,IAAI,KAAG,MAOzE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GACjC,YAAY,MAAM,EAClB,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,KACtC,MAgEF,CAAC"}

package/dist/ui/ui_format.js

@@ -178,6 +178,10 @@ export const format_audit_metadata = (event_type, metadata) => {
             return metadata.setting
                 ? `${metadata.setting}: ${JSON.stringify(metadata.old_value)} → ${JSON.stringify(metadata.new_value)}`
                 : '';
+        case 'db_admin_row_delete':
+            return metadata.table
+                ? `${metadata.table}.${metadata.pk_column}: ${truncate_middle(metadata.id, 12)}`
+                : '';
         default:
             return JSON.stringify(metadata);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.107.0",
+  "version": "0.109.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",