@fuzdev/fuz_app 0.91.0 → 0.93.0

package/dist/testing/cross_backend/create_dual_spawn_global_setup.d.ts

@@ -0,0 +1,64 @@
+import '../assert_dev_env.js';
+/**
+ * Generic **dual-spawn** vitest `globalSetup` factory — spawns + bootstraps
+ * *two* backends at once and `provide`s both serialized handles, for any
+ * cross-impl gate that needs both alive together. (The per-backend
+ * `create_cross_backend_global_setup` derives one backend from the project
+ * name; this brings up a pair.)
+ *
+ * Its primary use is the **schema- / action-manifest-parity** gates (capture
+ * each backend over a `_testing_*` introspection RPC and diff with
+ * `assert_schema_snapshots_equal` / `assert_action_manifests_equal`) — which is
+ * why the default `provide_keys` are `parity_handle_*`. The login-security gate
+ * (`global_setup_login_security.ts`) reuses it with its own keys; any future
+ * two-backend gate can too.
+ *
+ * A consumer's dual-spawn `global_setup.ts` collapses to:
+ *
+ * ```ts
+ * import {create_dual_spawn_global_setup} from
+ *   '@fuzdev/fuz_app/testing/cross_backend/create_dual_spawn_global_setup.js';
+ * import {deno_backend_config, rust_backend_config} from './my_backend_config.js';
+ * import './cross_test_types.js'; // augments the two provide keys
+ *
+ * export default create_dual_spawn_global_setup({
+ *   configs: {a: deno_backend_config, b: rust_backend_config},
+ * });
+ * ```
+ *
+ * The `.cross.test.ts` `inject`s both keys, rebuilds each with
+ * `reconstruct_bootstrapped_handle`, and asserts. Run this project in a
+ * later `groupOrder` than the single-backend projects (or with distinct
+ * ports) — it reuses both configs' ports, so it must not run concurrently
+ * with the per-backend projects.
+ *
+ * @module
+ */
+import type { TestProject } from 'vitest/node';
+import type { BackendConfig } from './backend_config.js';
+export interface DualSpawnGlobalSetupOptions {
+    /**
+     * The two backend config factories to spawn. `a` is spawned first; on
+     * its success `b` is spawned (with `a` torn down if `b` throws). Label
+     * them in the consuming test (e.g. via `assert_schema_snapshots_equal`'s labels).
+     */
+    readonly configs: {
+        readonly a: () => BackendConfig;
+        readonly b: () => BackendConfig;
+    };
+    /**
+     * `project.provide` keys for the two serialized handles (read by
+     * `inject` in the test). Default `parity_handle_a` / `parity_handle_b`
+     * (the primary parity use); override for other dual-spawn gates. Augment
+     * vitest's `ProvidedContext` for whichever keys you use.
+     */
+    readonly provide_keys?: {
+        readonly a: string;
+        readonly b: string;
+    };
+}
+/**
+ * Build a vitest `globalSetup` default export that spawns both backends.
+ */
+export declare const create_dual_spawn_global_setup: ({ configs, provide_keys, }: DualSpawnGlobalSetupOptions) => ((project: TestProject) => Promise<() => Promise<void>>);
+//# sourceMappingURL=create_dual_spawn_global_setup.d.ts.map

package/dist/testing/cross_backend/create_dual_spawn_global_setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create_dual_spawn_global_setup.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/create_dual_spawn_global_setup.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,aAAa,CAAC;AAE7C,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAIvD,MAAM,WAAW,2BAA2B;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,aAAa,CAAC;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,aAAa,CAAA;KAAC,CAAC;IACrF;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;KAAC,CAAC;CACjE;AAED;;GAEG;AACH,eAAO,MAAM,8BAA8B,GAAI,4BAG5C,2BAA2B,KAAG,CAAC,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAmBvF,CAAC"}

package/dist/testing/cross_backend/{create_schema_parity_global_setup.js → create_dual_spawn_global_setup.js}

@@ -4,7 +4,7 @@ import { serialize_bootstrapped_handle } from './setup.js';
 /**
  * Build a vitest `globalSetup` default export that spawns both backends.
  */
-export const create_schema_parity_global_setup = ({ configs, provide_keys = { a: 'parity_handle_a', b: 'parity_handle_b' }, }) => {
+export const create_dual_spawn_global_setup = ({ configs, provide_keys = { a: 'parity_handle_a', b: 'parity_handle_b' }, }) => {
     return async (project) => {
         const a = await bootstrap_backend(configs.a());
         // Tear `a` down if `b` fails to spawn — no orphaned child process.

package/dist/testing/cross_backend/default_backend_configs.d.ts

@@ -35,6 +35,18 @@ import '../assert_dev_env.js';
 import type { BackendBootstrapConfig, BackendConfig } from './backend_config.js';
 import type { BackendCapabilities, BackendShapeNotes } from './capabilities.js';
 import { type TestBackendPaths } from './build_test_backend_paths.js';
+/**
+ * Env var both spine binaries read to enable their login rate limiters
+ * (`'true'` on / unset off). The cross-language contract for the login-security
+ * cross project: the TS binary reads it via `runtime.env_get` (a test-only flag,
+ * not in `BaseServerEnv`); the Rust `testing_spine_stub` reads it via
+ * `std::env::var` — so one backend-config option drives both impls. Shared home
+ * here because both `ts_spine_backend_config` and `rust_spine_stub_backend_config`
+ * already import this module. (The spawned TS binary re-declares the literal
+ * locally — it can't import this module, which transitively pulls `vitest` —
+ * mirroring how `testing_spine_server_node.ts` re-declares `TS_SPINE_DIR_ENV`.)
+ */
+export declare const LOGIN_RATE_LIMIT_ENABLED_ENV = "FUZ_LOGIN_RATE_LIMIT_ENABLED";
 /**
  * Capabilities shared by TS-family backends — same canonical implementation,
  * same feature set. The non-gating wiring facts (`bearer_auth` /

package/dist/testing/cross_backend/default_backend_configs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAC,sBAAsB,EAAE,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EAAC,mBAAmB,EAAE,iBAAiB,EAAC,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAA2B,KAAK,gBAAgB,EAAC,MAAM,+BAA+B,CAAC;AAQ9F;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAiBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAgBtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}
+{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAC,sBAAsB,EAAE,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EAAC,mBAAmB,EAAE,iBAAiB,EAAC,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAA2B,KAAK,gBAAgB,EAAC,MAAM,+BAA+B,CAAC;AAQ9F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAiBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAgBtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}

package/dist/testing/cross_backend/default_backend_configs.js

@@ -1,6 +1,18 @@
 import '../assert_dev_env.js';
 import { build_test_backend_paths } from './build_test_backend_paths.js';
 import { default_test_bootstrap_token, default_test_cookie_keys, default_test_keeper_password, default_test_keeper_username, } from './default_secrets.js';
+/**
+ * Env var both spine binaries read to enable their login rate limiters
+ * (`'true'` on / unset off). The cross-language contract for the login-security
+ * cross project: the TS binary reads it via `runtime.env_get` (a test-only flag,
+ * not in `BaseServerEnv`); the Rust `testing_spine_stub` reads it via
+ * `std::env::var` — so one backend-config option drives both impls. Shared home
+ * here because both `ts_spine_backend_config` and `rust_spine_stub_backend_config`
+ * already import this module. (The spawned TS binary re-declares the literal
+ * locally — it can't import this module, which transitively pulls `vitest` —
+ * mirroring how `testing_spine_server_node.ts` re-declares `TS_SPINE_DIR_ENV`.)
+ */
+export const LOGIN_RATE_LIMIT_ENABLED_ENV = 'FUZ_LOGIN_RATE_LIMIT_ENABLED';
 /**
  * Capabilities shared by TS-family backends — same canonical implementation,
  * same feature set. The non-gating wiring facts (`bearer_auth` /

package/dist/testing/cross_backend/default_spine_surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_spine_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_spine_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAIpD,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAqB,KAAK,gBAAgB,EAAC,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAwB,KAAK,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAIxF,OAAO,EAAqB,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAC5E,OAAO,KAAK,EAAC,cAAc,EAAE,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAC3E,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,oCAAoC,CAAC;AAGzE;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAAC,MAAM,CAAwC,CAAC;AAElG;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,EAAE,gBAExB,CAAC;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD,+CAA+C;AAC/C,MAAM,WAAW,wBAAwB;IACxC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,gBAAgB,EACrB,UAAU,wBAAwB,KAChC,KAAK,CAAC,eAAe,CAQvB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,GAAI,KAAK,gBAAgB,KAAG,KAAK,CAAC,SAAS,CAwB/E,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC;AAEjG;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,GAAI,MAAM,MAAM,KAAG,SAC6B,CAAC;AAE3F;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,QAAO,cAM1C,CAAC"}
+{"version":3,"file":"default_spine_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_spine_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAIpD,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAqB,KAAK,gBAAgB,EAAC,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAwB,KAAK,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAIxF,OAAO,EAAqB,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAC5E,OAAO,KAAK,EAAC,cAAc,EAAE,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAC3E,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,oCAAoC,CAAC;AAGzE;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAAC,MAAM,CAAwC,CAAC;AAElG;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,EAAE,gBAExB,CAAC;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD,+CAA+C;AAC/C,MAAM,WAAW,wBAAwB;IACxC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,gBAAgB,EACrB,UAAU,wBAAwB,KAChC,KAAK,CAAC,eAAe,CAQvB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,GAAI,KAAK,gBAAgB,KAAG,KAAK,CAAC,SAAS,CA+B/E,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC;AAEjG;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,GAAI,MAAM,MAAM,KAAG,SAC6B,CAAC;AAE3F;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,QAAO,cAM1C,CAAC"}

package/dist/testing/cross_backend/default_spine_surface.js

@@ -77,8 +77,15 @@ export const create_spine_route_specs = (ctx) => [
     ...prefix_route_specs('/api/account', [
         ...create_account_route_specs(ctx.deps, {
             session_options: spine_session_options,
-            ip_rate_limiter: null,
-            login_account_rate_limiter: null,
+            // Honor the limiters the server was assembled with (on `AppServerContext`
+            // per the `ip_rate_limiter` / `login_account_rate_limiter` TSDoc) rather
+            // than hardcoding `null`. The standard spine binary passes `null` (the
+            // cross suites fire many loopback logins and must not trip a limiter), so
+            // this is behavior-preserving there; the dedicated login-security cross
+            // backend passes real limiters to exercise the 429 + `Retry-After` path
+            // and XFF-keyed bucketing over the wire (see `login_security.ts`).
+            ip_rate_limiter: ctx.ip_rate_limiter,
+            login_account_rate_limiter: ctx.login_account_rate_limiter,
             login_fail_floor_ms: 0,
             bootstrap_status: ctx.bootstrap_status,
         }),

package/dist/testing/cross_backend/login_security.d.ts

@@ -0,0 +1,11 @@
+import '../assert_dev_env.js';
+import type { SetupTest } from './setup.js';
+/** Options for the login-security parity suite. */
+export interface LoginSecurityCrossTestOptions {
+    /** Per-test fixture producer (cross-process only — see the module doc). */
+    readonly setup_test: SetupTest;
+    /** REST login route path. Default `/api/account/login` (the spine convention). */
+    readonly login_path?: string;
+}
+export declare const describe_login_security_cross_tests: (options: LoginSecurityCrossTestOptions) => void;
+//# sourceMappingURL=login_security.d.ts.map

package/dist/testing/cross_backend/login_security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login_security.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/login_security.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAoD9B,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,YAAY,CAAC;AAE1C,mDAAmD;AACnD,MAAM,WAAW,6BAA6B;IAC7C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAyBD,eAAO,MAAM,mCAAmC,GAC/C,SAAS,6BAA6B,KACpC,IAoGF,CAAC"}

package/dist/testing/cross_backend/login_security.js

@@ -0,0 +1,130 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-backend parity suite for **login rate limiting + trusted-proxy
+ * (X-Forwarded-For) resolution** over real HTTP.
+ *
+ * Login throttling and client-IP resolution are wired-but-never-crossed: the
+ * in-process `describe_rate_limiting_tests` covers the limiter, and the
+ * `fuz_http` / proxy middleware unit tests cover XFF resolution, but no case
+ * exercised either over a real socket on both impls — the limiter is nulled
+ * on every standard cross backend and the resolved client IP has no
+ * wire-observable downstream there. This dedicated suite spawns a backend
+ * with the login limiters enabled + the loopback proxy trusted (see
+ * `global_setup_login_security.ts`), then pins two properties end-to-end:
+ *
+ * - **per-IP login limit fires** — the first `default_login_ip_rate_limit`
+ *   failed logins from one forwarded IP each return `401`, and the next
+ *   returns `429` with the canonical `{error: "rate_limit_exceeded",
+ *   retry_after}` body **and** a `Retry-After: ceil(retry_after)` header. The
+ *   429 wire shape is the cross-impl contract — TS `rate_limit_exceeded_response`
+ *   and Rust `route_response::rate_limit_exceeded` must agree.
+ * - **trusted-proxy / XFF resolution is honored** — distinct
+ *   `X-Forwarded-For` IPs get independent buckets: after exhausting one
+ *   forwarded IP to `429`, a *different* forwarded IP is unaffected (`401`,
+ *   not `429`). A backend that ignored XFF and keyed on the (loopback) TCP
+ *   peer would 429 the fresh-IP request too — so the `401` proves the limiter
+ *   keys on the resolved `X-Forwarded-For` client IP.
+ *
+ * **Determinism without a limiter reset.** Limiter state is in-memory and the
+ * per-test `_testing_reset` wipes only the DB, never the buckets — so each
+ * case uses its own forwarded IP and its own (non-existent) username, keeping
+ * every bucket independent across cases and across the two impls (separate
+ * processes). The login floor is zeroed on both spines, so the failed-login
+ * loop stays fast.
+ *
+ * Both surfaces are flat REST (`POST /api/account/login`) on every spine, so
+ * this is an imperative suite (not a `conformance_table` row) — the sibling of
+ * `origin.ts` / `identity_parity.ts`. Cross-process only: the limiter+proxy
+ * wiring is the point, and the in-process counterparts already exist
+ * (`describe_rate_limiting_tests` + the proxy middleware tests). Cited
+ * property: `docs/security.md` §"Rate Limiting" + §"Trusted Proxy / Client IP".
+ *
+ * `$lib`-free by contract (relative specifiers only), like the sibling
+ * cross-backend suites.
+ *
+ * @module
+ */
+import { describe, test, assert } from 'vitest';
+import { ERROR_RATE_LIMIT_EXCEEDED } from '../../http/error_schemas.js';
+import { default_login_account_rate_limit, default_login_ip_rate_limit } from '../../rate_limiter.js';
+/**
+ * RFC 5737 TEST-NET-3 (`203.0.113.0/24`) documentation addresses — guaranteed
+ * non-routable, so they never collide with a real client IP. One per bucket the
+ * suite needs; distinct across cases so no case inherits another's count (the
+ * limiter is not reset between cases). Spoofed via `X-Forwarded-For`; the
+ * loopback TCP peer is trusted, so the rightmost untrusted hop (these) is the
+ * resolved client IP.
+ */
+const XFF_IP_LIMIT = '203.0.113.1';
+const XFF_SEGREGATION_EXHAUST = '203.0.113.2';
+const XFF_SEGREGATION_FRESH = '203.0.113.3';
+/** A non-routable, non-existent identifier — login resolves to the not-found path (records the bucket, returns 401). */
+const PROBE_PASSWORD = 'login_security_wrong_password';
+export const describe_login_security_cross_tests = (options) => {
+    const { setup_test } = options;
+    const login_path = options.login_path ?? '/api/account/login';
+    /** Per-IP cap shared by both impls (TS `default_login_ip_rate_limit`, Rust `DEFAULT_LOGIN_IP_RATE_LIMIT`). */
+    const ip_limit = default_login_ip_rate_limit.max_attempts;
+    // The XFF-segregation case enables both limiters (one flag drives both), so
+    // the per-account bucket is live too. After exhausting an IP, the shared
+    // username holds exactly `ip_limit` account records, so the fresh-IP probe
+    // only stays a 401 (not 429) while the account cap sits above the IP cap.
+    // Assert the ordering so a future cap change fails loud here instead of as a
+    // confusing 429-instead-of-401 mid-case.
+    assert(default_login_account_rate_limit.max_attempts > ip_limit, 'login-security XFF segregation needs the per-account cap above the per-IP cap');
+    /**
+     * POST a login with the given `X-Forwarded-For` on a fresh (cookie-jar-free)
+     * transport — wrong password against a non-existent username, so the handler
+     * clears origin + input validation, records the resolved-IP bucket, and
+     * returns `401` (or `429` once the bucket trips). Always reads the body so
+     * the cross-process socket releases.
+     */
+    const attempt = async (fixture, forwarded_for, username) => {
+        const res = await fixture.fresh_transport()(login_path, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', 'x-forwarded-for': forwarded_for },
+            body: JSON.stringify({ username, password: PROBE_PASSWORD }),
+        });
+        const body = (await res.json().catch(() => undefined));
+        return {
+            status: res.status,
+            error: typeof body?.error === 'string' ? body.error : undefined,
+            retry_after: typeof body?.retry_after === 'number' ? body.retry_after : undefined,
+            retry_after_header: res.headers.get('retry-after'),
+        };
+    };
+    describe('login rate limiting + trusted-proxy parity', () => {
+        test(`per-IP login limit fires 429 + Retry-After after ${ip_limit} attempts from one forwarded IP`, async () => {
+            const fixture = await setup_test();
+            // The first `ip_limit` failed logins from one forwarded IP each clear the
+            // limiter (a normal 401), recording against the resolved client IP.
+            for (let i = 0; i < ip_limit; i++) {
+                const r = await attempt(fixture, XFF_IP_LIMIT, 'probe_ip_limit');
+                assert.strictEqual(r.status, 401, `attempt ${i + 1}/${ip_limit} must be a normal 401, not rate-limited`);
+            }
+            // The next request from the SAME forwarded IP trips the per-IP bucket.
+            const limited = await attempt(fixture, XFF_IP_LIMIT, 'probe_ip_limit');
+            assert.strictEqual(limited.status, 429, `attempt ${ip_limit + 1} must be 429`);
+            assert.strictEqual(limited.error, ERROR_RATE_LIMIT_EXCEEDED, '429 body must carry the canonical rate_limit_exceeded reason');
+            assert(limited.retry_after !== undefined && limited.retry_after > 0, '429 body must carry a positive numeric retry_after');
+            assert(limited.retry_after_header !== null, 'Retry-After header must be present on the 429');
+            assert.strictEqual(Number(limited.retry_after_header), Math.ceil(limited.retry_after), 'Retry-After header must equal ceil(retry_after)');
+        });
+        test('distinct X-Forwarded-For IPs get independent buckets (XFF resolution honored)', async () => {
+            const fixture = await setup_test();
+            // Exhaust one forwarded IP to its cap (own username, so the per-account
+            // bucket never confounds — these stay well under the account cap).
+            for (let i = 0; i < ip_limit; i++) {
+                await attempt(fixture, XFF_SEGREGATION_EXHAUST, 'probe_xff');
+            }
+            const exhausted = await attempt(fixture, XFF_SEGREGATION_EXHAUST, 'probe_xff');
+            assert.strictEqual(exhausted.status, 429, 'the exhausted forwarded IP must be rate-limited');
+            // A DIFFERENT forwarded IP is a fresh bucket → not limited. If the backend
+            // ignored XFF and keyed on the loopback TCP peer, this would land in the
+            // already-exhausted peer bucket and 429 — so a 401 proves the limiter keys
+            // on the resolved X-Forwarded-For client IP.
+            const fresh = await attempt(fixture, XFF_SEGREGATION_FRESH, 'probe_xff');
+            assert.strictEqual(fresh.status, 401, "a fresh forwarded IP must not inherit another IP's limit");
+        });
+    });
+};

package/dist/testing/cross_backend/rust_spine_stub_backend_config.d.ts

@@ -23,6 +23,23 @@ export interface SpineStubBackendConfigOptions {
      * var. When neither is set the preset throws.
      */
     readonly binary_path?: string;
+    /**
+     * Enable the per-IP + per-account login rate limiters on the stub
+     * (`FUZ_LOGIN_RATE_LIMIT_ENABLED=true`). Off by default — the standard cross
+     * suites fire many loopback logins a live limiter would 429. Set `true` only
+     * for the dedicated login-security cross project (`global_setup_login_security.ts`).
+     * Pair with `trusted_proxies` so the limiter keys on the resolved
+     * `X-Forwarded-For` client IP. Mirrors `TsSpineBackendConfigOptions.enable_login_rate_limit`.
+     */
+    readonly enable_login_rate_limit?: boolean;
+    /**
+     * Comma-separated trusted-proxy allowlist passed as `FUZ_TRUSTED_PROXIES`
+     * (e.g. `'127.0.0.1,::1'`). Unset by default (the stub leaves XFF parsing
+     * off, keying on the raw TCP peer). The login-security project sets the
+     * loopback set so the limiter keys on the `X-Forwarded-For` client IP — the
+     * TS spine binary wires the equivalent set unconditionally.
+     */
+    readonly trusted_proxies?: string;
 }
 /**
  * Build the `BackendConfig` for `testing_spine_stub`. Resolves the binary

package/dist/testing/cross_backend/rust_spine_stub_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuC9B,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAQvD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAenG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAwCF,CAAC"}
+{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuC9B,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AASvD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAenG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aA+CF,CAAC"}

package/dist/testing/cross_backend/rust_spine_stub_backend_config.js

@@ -36,7 +36,7 @@ import '../assert_dev_env.js';
 import { fileURLToPath } from 'node:url';
 import { build_test_backend_paths } from './build_test_backend_paths.js';
 import { SPINE_EXPECTED_SCHEMA_URL } from './default_spine_surface.js';
-import { make_default_rust_backend_config, rust_default_capabilities, } from './default_backend_configs.js';
+import { LOGIN_RATE_LIMIT_ENABLED_ENV, make_default_rust_backend_config, rust_default_capabilities, } from './default_backend_configs.js';
 /** Env var naming the prebuilt `testing_spine_stub` binary. Required when `binary_path` is omitted. */
 export const RUST_SPINE_STUB_BIN_ENV = 'FUZ_TESTING_RUST_SPINE_STUB_BIN';
 /**
@@ -74,7 +74,7 @@ export const RUST_SPINE_STUB_DEFAULT_DATABASE_URL = 'postgres://localhost/fuz_ap
  * @throws Error when no binary path is available.
  */
 export const rust_spine_stub_backend_config = (options = {}) => {
-    const { port = RUST_SPINE_STUB_DEFAULT_PORT, database_url = RUST_SPINE_STUB_DEFAULT_DATABASE_URL, binary_path = process.env[RUST_SPINE_STUB_BIN_ENV], } = options;
+    const { port = RUST_SPINE_STUB_DEFAULT_PORT, database_url = RUST_SPINE_STUB_DEFAULT_DATABASE_URL, binary_path = process.env[RUST_SPINE_STUB_BIN_ENV], enable_login_rate_limit, trusted_proxies, } = options;
     if (!binary_path) {
         throw new Error(`rust_spine_stub_backend_config: no binary path — set ${RUST_SPINE_STUB_BIN_ENV} to a prebuilt ` +
             '`testing_spine_stub` binary (build it with `cargo build -p testing_spine_stub --release`) ' +
@@ -105,6 +105,11 @@ export const rust_spine_stub_backend_config = (options = {}) => {
             // file the TS spine reads, so the two backends share one cross-impl
             // contract.
             [RUST_SPINE_STUB_EXPECTED_SCHEMA_PATH_ENV]: fileURLToPath(SPINE_EXPECTED_SCHEMA_URL),
+            // Login-security project opt-ins (off by default): enable the login
+            // limiters + trust the loopback proxy so the limiter keys on the
+            // resolved `X-Forwarded-For` IP. The stub reads both directly.
+            ...(enable_login_rate_limit ? { [LOGIN_RATE_LIMIT_ENABLED_ENV]: 'true' } : {}),
+            ...(trusted_proxies !== undefined ? { FUZ_TRUSTED_PROXIES: trusted_proxies } : {}),
         },
     });
 };

package/dist/testing/cross_backend/ts_spine_backend_config.d.ts

@@ -47,6 +47,17 @@ export interface TsSpineBackendConfigOptions {
     readonly port?: number;
     /** Database URL. Default `'memory://'` (in-memory PGlite). */
     readonly database_url?: string;
+    /**
+     * Enable the per-IP + per-account login rate limiters on the spawned binary
+     * (`FUZ_LOGIN_RATE_LIMIT_ENABLED=true`). Off by default — the standard cross
+     * suites fire many loopback logins a live limiter would 429. Set `true` only
+     * for the dedicated login-security cross project (`global_setup_login_security.ts`),
+     * which drives the 429 + `Retry-After` path and XFF-keyed bucketing over the
+     * wire (`login_security.ts`). The binary always wires `trusted_proxies` for
+     * `127.0.0.1`/`::1`, so the limiter keys on the resolved `X-Forwarded-For`
+     * client IP. Mirrors `SpineStubBackendConfigOptions.enable_login_rate_limit`.
+     */
+    readonly enable_login_rate_limit?: boolean;
 }
 /**
  * `BackendConfig` for the Node TS spine binary — spawned via `gro run`

package/dist/testing/cross_backend/ts_spine_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAOvD,8GAA8G;AAC9G,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAE3D;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAyB3D,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAgBF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAgBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aA6BF,CAAC"}
+{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAQvD,8GAA8G;AAC9G,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAE3D;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAyB3D,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAC3C;AAWD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAmBF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAmBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAgCF,CAAC"}

package/dist/testing/cross_backend/ts_spine_backend_config.js

@@ -1,6 +1,6 @@
 import '../assert_dev_env.js';
 import { build_test_backend_paths } from './build_test_backend_paths.js';
-import { make_default_ts_backend_config, ts_default_capabilities, } from './default_backend_configs.js';
+import { LOGIN_RATE_LIMIT_ENABLED_ENV, make_default_ts_backend_config, ts_default_capabilities, } from './default_backend_configs.js';
 /** Env var naming the backend root dir; `{dir}/run/daemon_token` must match `bootstrap.daemon_token_path`. */
 export const TS_SPINE_DIR_ENV = 'FUZ_TESTING_TS_SPINE_DIR';
 /**
@@ -47,12 +47,19 @@ export const TS_SPINE_NODE_ENTRY = 'src/test/cross_backend/testing_spine_server_
 export const TS_SPINE_DENO_ENTRY = 'src/test/cross_backend/testing_spine_server_deno.ts';
 /** Entry module spawned for the Bun TS spine binary. */
 export const TS_SPINE_BUN_ENTRY = 'src/test/cross_backend/testing_spine_server_bun.ts';
+/**
+ * `extra_env` carrying the login-rate-limit toggle when enabled. The TS binary
+ * reads `FUZ_LOGIN_RATE_LIMIT_ENABLED` directly (a test-only flag, not in
+ * `BaseServerEnv`); the same env-var name the Rust spine-stub reads, so one
+ * backend-config option drives both impls.
+ */
+const login_rate_limit_env = (enable) => enable ? { [LOGIN_RATE_LIMIT_ENABLED_ENV]: 'true' } : {};
 /**
  * `BackendConfig` for the Node TS spine binary — spawned via `gro run`
  * (Gro's TS loader resolves the `$lib`-free entry's relative imports).
  */
 export const ts_spine_node_backend_config = (options = {}) => {
-    const { port = TS_SPINE_NODE_DEFAULT_PORT, database_url } = options;
+    const { port = TS_SPINE_NODE_DEFAULT_PORT, database_url, enable_login_rate_limit } = options;
     const name = 'ts_spine_node';
     const paths = build_test_backend_paths(name);
     return {
@@ -62,7 +69,10 @@ export const ts_spine_node_backend_config = (options = {}) => {
             start_command: ['gro', 'run', TS_SPINE_NODE_ENTRY],
             database_url,
             paths,
-            extra_env: { [TS_SPINE_DIR_ENV]: paths.root },
+            extra_env: {
+                [TS_SPINE_DIR_ENV]: paths.root,
+                ...login_rate_limit_env(enable_login_rate_limit),
+            },
             capabilities: ts_spine_capabilities,
         }),
         sse_path: TS_SPINE_SSE_PATH,
@@ -75,7 +85,7 @@ export const ts_spine_node_backend_config = (options = {}) => {
  * the Node path), and `Bun.serve` + `hono/bun` need no extra deps.
  */
 export const ts_spine_bun_backend_config = (options = {}) => {
-    const { port = TS_SPINE_BUN_DEFAULT_PORT, database_url } = options;
+    const { port = TS_SPINE_BUN_DEFAULT_PORT, database_url, enable_login_rate_limit } = options;
     const name = 'ts_spine_bun';
     const paths = build_test_backend_paths(name);
     return {
@@ -85,7 +95,10 @@ export const ts_spine_bun_backend_config = (options = {}) => {
             start_command: ['bun', 'run', TS_SPINE_BUN_ENTRY],
             database_url,
             paths,
-            extra_env: { [TS_SPINE_DIR_ENV]: paths.root },
+            extra_env: {
+                [TS_SPINE_DIR_ENV]: paths.root,
+                ...login_rate_limit_env(enable_login_rate_limit),
+            },
             capabilities: ts_spine_bun_capabilities,
         }),
         sse_path: TS_SPINE_SSE_PATH,
@@ -103,7 +116,7 @@ export const ts_spine_bun_backend_config = (options = {}) => {
  * built package; this binary tests live source instead.)
  */
 export const ts_spine_deno_backend_config = (options = {}) => {
-    const { port = TS_SPINE_DENO_DEFAULT_PORT, database_url } = options;
+    const { port = TS_SPINE_DENO_DEFAULT_PORT, database_url, enable_login_rate_limit } = options;
     const name = 'ts_spine_deno';
     const paths = build_test_backend_paths(name);
     return {
@@ -126,7 +139,10 @@ export const ts_spine_deno_backend_config = (options = {}) => {
             ],
             database_url,
             paths,
-            extra_env: { [TS_SPINE_DIR_ENV]: paths.root },
+            extra_env: {
+                [TS_SPINE_DIR_ENV]: paths.root,
+                ...login_rate_limit_env(enable_login_rate_limit),
+            },
             capabilities: ts_spine_capabilities,
         }),
         sse_path: TS_SPINE_SSE_PATH,

package/dist/testing/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/db.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA6B7B,OAAO,KAAK,EAAC,EAAE,EAAC,MAAM,aAAa,CAAC;AAKpC;;GAEG;AACH,eAAO,MAAM,KAAK,SAA4B,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,GAAU,IAAI,EAAE,KAAG,OAAO,CAAC,IAAI,CAGvD,CAAC;AAMF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,GAAI,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,KAAG,SAkB7E,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iBAAiB,GAC7B,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,EACtC,WAAW,MAAM,KACf,SA2DF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,UAQhC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,UAAyC,CAAC;AAEvF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB,GAAU,IAAI,EAAE,KAAG,OAAO,CAAC,IAAI,CAG3D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,GAC9B,WAAW,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,EACvC,iBAAiB,KAAK,CAAC,MAAM,CAAC,KAC5B,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,IAAI,KAAK,IAAI,CAwBzD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAAI,WAAW,KAAK,CAAC,SAAS,CAAC,KAAG,IAMnE,CAAC"}
+{"version":3,"file":"db.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/db.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA8B7B,OAAO,KAAK,EAAC,EAAE,EAAC,MAAM,aAAa,CAAC;AAKpC;;GAEG;AACH,eAAO,MAAM,KAAK,SAA4B,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,GAAU,IAAI,EAAE,KAAG,OAAO,CAAC,IAAI,CAGvD,CAAC;AAMF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,GAAI,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,KAAG,SAkB7E,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iBAAiB,GAC7B,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,EACtC,WAAW,MAAM,KACf,SA2DF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,UAQhC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,UAAyC,CAAC;AAEvF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB,GAAU,IAAI,EAAE,KAAG,OAAO,CAAC,IAAI,CAG3D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,GAC9B,WAAW,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,EACvC,iBAAiB,KAAK,CAAC,MAAM,CAAC,KAC5B,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,IAAI,KAAK,IAAI,CAwBzD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAAI,WAAW,KAAK,CAAC,SAAS,CAAC,KAAG,IAMnE,CAAC"}

package/dist/testing/db.js

@@ -23,6 +23,7 @@ import './assert_dev_env.js';
  * @module
  */
 import { describe, beforeAll, beforeEach, afterAll } from 'vitest';
+import { to_error_message } from '@fuzdev/fuz_util/error.js';
 import { create_pglite_db } from '../db/db_pglite.js';
 import { assert_valid_sql_identifier } from '../db/sql_identifier.js';
 import { create_pg_db } from '../db/db_pg.js';
@@ -133,7 +134,7 @@ export const create_pg_factory = (init_schema, test_url) => {
             }
             catch (error) {
                 await pool.end();
-                const msg = error instanceof Error ? error.message : String(error);
+                const msg = to_error_message(error);
                 if (msg.includes('does not exist')) {
                     const db_name = test_url.split('/').pop()?.split('?')[0] ?? 'test_db';
                     throw new Error(`Database "${db_name}" does not exist. Create it with: createdb ${db_name}`);

package/dist/ui/AdminSurface.svelte

@@ -8,6 +8,8 @@
 	 * @module
 	 */
 
+	import {to_error_message} from '@fuzdev/fuz_util/error.js';
+
 	import type {AppSurface} from '../http/surface.js';
 	import SurfaceExplorer from './SurfaceExplorer.svelte';
 	import {ui_fetch} from './ui_fetch.js';
@@ -27,7 +29,7 @@
 			}
 			surface = await res.json();
 		} catch (e) {
-			error = e instanceof Error ? e.message : 'Unknown error';
+			error = to_error_message(e, 'Unknown error');
 		} finally {
 			loading = false;
 		}

package/dist/ui/AdminSurface.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdminSurface.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminSurface.svelte"],"names":[],"mappings":"AA8DA,QAAA,MAAM,YAAY,2DAAwC,CAAC;AAC3D,KAAK,YAAY,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;AACpD,eAAe,YAAY,CAAC"}
+{"version":3,"file":"AdminSurface.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminSurface.svelte"],"names":[],"mappings":"AAkEA,QAAA,MAAM,YAAY,2DAAwC,CAAC;AAC3D,KAAK,YAAY,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;AACpD,eAAe,YAAY,CAAC"}

package/dist/ui/async_slot.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"async_slot.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/async_slot.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAEH,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,2BAA2B,CAAC;AAE3D,MAAM,WAAW,gBAAgB,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM;IAC9C;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,CAAC;IACZ;;;;;OAKG;IACH,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,CAAC,CAAC;IAC9B;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IAC1B;;;;OAIG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,qBAAa,SAAS,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,MAAM;;IAC1C,MAAM,EAAE,WAAW,CAAyB;IAC5C,IAAI,EAAE,CAAC,GAAG,SAAS,CAAwC;IAC3D,KAAK,EAAE,CAAC,GAAG,IAAI,CAAoB;IACnC,sFAAsF;IACtF,UAAU,EAAE,OAAO,CAAoB;IAEvC,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAuC;IAChE,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAuC;IAChE,mDAAmD;IACnD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAuC;IAClE,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAuC;gBAcnD,OAAO,GAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAM;IAUhD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,GAAG,CACR,EAAE,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,EACvC,OAAO,GAAE,UAAe,GACtB,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IA8DzB;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI;IAM7B;;;;;;;;;;;OAWG;IACH,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI;IASlB;;;;;;OAMG;IACH,KAAK,IAAI,IAAI;CAQb"}
+{"version":3,"file":"async_slot.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/async_slot.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAEH,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,2BAA2B,CAAC;AAG3D,MAAM,WAAW,gBAAgB,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM;IAC9C;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,CAAC;IACZ;;;;;OAKG;IACH,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,CAAC,CAAC;IAC9B;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IAC1B;;;;OAIG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,qBAAa,SAAS,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,MAAM;;IAC1C,MAAM,EAAE,WAAW,CAAyB;IAC5C,IAAI,EAAE,CAAC,GAAG,SAAS,CAAwC;IAC3D,KAAK,EAAE,CAAC,GAAG,IAAI,CAAoB;IACnC,sFAAsF;IACtF,UAAU,EAAE,OAAO,CAAoB;IAEvC,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAuC;IAChE,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAuC;IAChE,mDAAmD;IACnD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAuC;IAClE,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAuC;gBAcnD,OAAO,GAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAM;IAUhD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,GAAG,CACR,EAAE,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,EACvC,OAAO,GAAE,UAAe,GACtB,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IA8DzB;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI;IAM7B;;;;;;;;;;;OAWG;IACH,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI;IASlB;;;;;;OAMG;IACH,KAAK,IAAI,IAAI;CAQb"}

package/dist/ui/async_slot.svelte.js

@@ -58,6 +58,7 @@
  *
  * @module
  */
+import { to_error_message } from '@fuzdev/fuz_util/error.js';
 /**
  * Reactive container for a single async operation.
  *
@@ -238,4 +239,4 @@ export class AsyncSlot {
         this.#has_succeeded = false;
     }
 }
-const default_map_error = (e) => e instanceof Error ? e.message : 'Request failed';
+const default_map_error = (e) => to_error_message(e, 'Request failed');

package/dist/ui/auth_state.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/auth_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAKH,OAAO,EACN,KAAK,gBAAgB,EAErB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,MAAM,2BAA2B,CAAC;AAEnC;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;CAA8B,CAAC;AAE9D,qBAAa,SAAS;IACrB,SAAS,UAAqB;IAC9B,QAAQ,UAAqB;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC/C,OAAO,EAAE,cAAc,GAAG,IAAI,CAAoB;IAClD,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAoB;IAClD,WAAW,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAkB;IAC1D,QAAQ,CAAC,kBAAkB,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAEtD;IACF,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAwD;IAErF,gEAAgE;IAChE,eAAe,UAAqB;IAEpC;;;;;;;;OAQG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IA6BpC;;;;;;;OAOG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAwCjE;;;;;OAKG;IACG,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiCpF;;;;;;;OAOG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA4ClF;;;;;OAKG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAW7B"}
+{"version":3,"file":"auth_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/auth_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAMH,OAAO,EACN,KAAK,gBAAgB,EAErB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,MAAM,2BAA2B,CAAC;AAEnC;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;CAA8B,CAAC;AAE9D,qBAAa,SAAS;IACrB,SAAS,UAAqB;IAC9B,QAAQ,UAAqB;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC/C,OAAO,EAAE,cAAc,GAAG,IAAI,CAAoB;IAClD,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAoB;IAClD,WAAW,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAkB;IAC1D,QAAQ,CAAC,kBAAkB,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAEtD;IACF,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAwD;IAErF,gEAAgE;IAChE,eAAe,UAAqB;IAEpC;;;;;;;;OAQG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IA6BpC;;;;;;;OAOG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAwCjE;;;;;OAKG;IACG,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiCpF;;;;;;;OAOG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA4ClF;;;;;OAKG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAW7B"}

package/dist/ui/auth_state.svelte.js

@@ -31,6 +31,7 @@
  *
  * @module
  */
+import { to_error_message } from '@fuzdev/fuz_util/error.js';
 import { create_context } from '@fuzdev/fuz_ui/context_helpers.js';
 import { ui_fetch } from './ui_fetch.js';
 import { is_role_grant_active, } from '../auth/account_schema.js';
@@ -133,7 +134,7 @@ export class AuthState {
             return false;
         }
         catch (e) {
-            this.verify_error = e instanceof Error ? e.message : 'Connection failed';
+            this.verify_error = to_error_message(e, 'Connection failed');
             return false;
         }
         finally {
@@ -171,7 +172,7 @@ export class AuthState {
             return false;
         }
         catch (e) {
-            this.verify_error = e instanceof Error ? e.message : 'Connection failed';
+            this.verify_error = to_error_message(e, 'Connection failed');
             return false;
         }
         finally {
@@ -225,7 +226,7 @@ export class AuthState {
             return false;
         }
         catch (e) {
-            this.verify_error = e instanceof Error ? e.message : 'Connection failed';
+            this.verify_error = to_error_message(e, 'Connection failed');
             return false;
         }
         finally {

package/dist/ui/table_state.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"table_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/table_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAC,SAAS,EAAC,MAAM,wBAAwB,CAAC;AAGjD,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,sBAAsB,CAAC;AAErD,mEAAmE;AACnE,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC,qBAAa,UAAU;IACtB,QAAQ,CAAC,IAAI,0BAAyB;IAEtC,UAAU,EAAE,MAAM,CAAkB;IACpC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAkB;IAC5C,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAkB;IACtD,KAAK,SAAiB;IACtB,MAAM,SAAiB;IACvB,KAAK,SAAmB;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC9C,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC3C,YAAY,EAAE,MAAM,GAAG,IAAI,CAAoB;IAG/C,QAAQ,CAAC,aAAa,SAAoD;IAC1E,QAAQ,CAAC,WAAW,SAAkE;IACtF,QAAQ,CAAC,QAAQ,UAA6B;IAC9C,QAAQ,CAAC,QAAQ,UAAmD;IAEpE;;;;;OAKG;IACG,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,SAAI,EAAE,KAAK,SAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBvE,OAAO,IAAI,IAAI;IAIf,OAAO,IAAI,IAAI;IAIf;;;;;;;OAOG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;CAoChE"}
+{"version":3,"file":"table_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/table_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAIH,OAAO,EAAC,SAAS,EAAC,MAAM,wBAAwB,CAAC;AAGjD,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,sBAAsB,CAAC;AAErD,mEAAmE;AACnE,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC,qBAAa,UAAU;IACtB,QAAQ,CAAC,IAAI,0BAAyB;IAEtC,UAAU,EAAE,MAAM,CAAkB;IACpC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAkB;IAC5C,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAkB;IACtD,KAAK,SAAiB;IACtB,MAAM,SAAiB;IACvB,KAAK,SAAmB;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC9C,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC3C,YAAY,EAAE,MAAM,GAAG,IAAI,CAAoB;IAG/C,QAAQ,CAAC,aAAa,SAAoD;IAC1E,QAAQ,CAAC,WAAW,SAAkE;IACtF,QAAQ,CAAC,QAAQ,UAA6B;IAC9C,QAAQ,CAAC,QAAQ,UAAmD;IAEpE;;;;;OAKG;IACG,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,SAAI,EAAE,KAAK,SAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBvE,OAAO,IAAI,IAAI;IAIf,OAAO,IAAI,IAAI;IAIf;;;;;;;OAOG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;CAoChE"}

package/dist/ui/table_state.svelte.js

@@ -39,6 +39,7 @@
  *
  * @module
  */
+import { to_error_message } from '@fuzdev/fuz_util/error.js';
 import { AsyncSlot } from './async_slot.svelte.js';
 import { parse_response_error, ui_fetch } from './ui_fetch.js';
 import { format_value } from './ui_format.js';
@@ -124,7 +125,7 @@ export class TableState {
             return true;
         }
         catch (e) {
-            this.delete_error = e instanceof Error ? e.message : 'Delete failed';
+            this.delete_error = to_error_message(e, 'Delete failed');
             return false;
         }
         finally {