toSqliteDateTime() in functions/utils/authAttempts.js is a private (unexported) helper — the invariant test added in the golden-snapshot PR has to reach it indirectly through checkAuthRateLimit's windowStart binding. That test is faithful (exercises the real code path), but a direct unit test would be cleaner and the helper is documented in CLAUDE.md as the canonical normalizer for the SEC-F1 datetime bug class, so it's worth exposing. Add export to the function and give it a direct toSqliteDateTime unit test (format assertion + a T-separator negative case). Trivial, low-risk.
toSqliteDateTime()infunctions/utils/authAttempts.jsis a private (unexported) helper — the invariant test added in the golden-snapshot PR has to reach it indirectly throughcheckAuthRateLimit'swindowStartbinding. That test is faithful (exercises the real code path), but a direct unit test would be cleaner and the helper is documented in CLAUDE.md as the canonical normalizer for the SEC-F1 datetime bug class, so it's worth exposing. Addexportto the function and give it a directtoSqliteDateTimeunit test (format assertion + a T-separator negative case). Trivial, low-risk.