@fuzdev/fuz_app 0.110.0 → 0.111.0

package/dist/auth/role_grant_queries.js

@@ -7,7 +7,30 @@
  * @module
  */
 import { assert_row } from '../db/assert_row.js';
-import { ROLE_GRANT_OFFER_SCOPE_KIND_GLOBAL_TOKEN, ROLE_GRANT_OFFER_SCOPE_SENTINEL_UUID } from './role_grant_offer_ddl.js';
+import { columns_sql, qualify_columns } from '../db/sql_columns.js';
+import { ROLE_GRANT_OFFER_COLUMNS, ROLE_GRANT_OFFER_SCOPE_KIND_GLOBAL_TOKEN, ROLE_GRANT_OFFER_SCOPE_SENTINEL_UUID, ROLE_GRANT_OFFER_WITH_GRANTOR_SELECT } from './role_grant_offer_ddl.js';
+/**
+ * The full `role_grant` column set, named explicitly so a row read fails loud
+ * on schema drift (see `ACCOUNT_COLUMNS` in `auth/account_queries.ts` for the
+ * outage class). Column order follows `RoleGrant` — the frozen `fuz_auth` v0
+ * body plus the appended `scope_kind` / `scope_id` / `revoked_reason` /
+ * `source_offer_id` columns. Keep in sync with `RoleGrant` and the
+ * `role_grant` migration chain in `auth/auth_ddl.ts`.
+ */
+export const ROLE_GRANT_COLUMNS = [
+    'id',
+    'actor_id',
+    'role',
+    'scope_kind',
+    'scope_id',
+    'created_at',
+    'expires_at',
+    'revoked_at',
+    'revoked_by',
+    'revoked_reason',
+    'granted_by',
+    'source_offer_id'
+];
 /**
  * Grant a role_grant to an actor.
  * Idempotent — if an active role_grant already exists for this actor, role, and
@@ -39,7 +62,7 @@ export const query_create_role_grant = async (deps, input) => {
 		 )
 		   WHERE revoked_at IS NULL
 		 DO NOTHING
-		 RETURNING *`, [
+		 RETURNING ${columns_sql(ROLE_GRANT_COLUMNS)}`, [
         input.actor_id,
         input.role,
         input.scope_kind ?? null,
@@ -51,7 +74,7 @@ export const query_create_role_grant = async (deps, input) => {
     if (inserted)
         return inserted;
     // Active role_grant already exists — return it (idempotent grant).
-    const existing = await deps.db.query_one(`SELECT * FROM role_grant
+    const existing = await deps.db.query_one(`SELECT ${columns_sql(ROLE_GRANT_COLUMNS)} FROM role_grant
 		 WHERE actor_id = $1
 		   AND role = $2
 		   AND scope_kind IS NOT DISTINCT FROM $3
@@ -59,6 +82,15 @@ export const query_create_role_grant = async (deps, input) => {
 		   AND revoked_at IS NULL`, [input.actor_id, input.role, input.scope_kind ?? null, input.scope_id ?? null]);
     return assert_row(existing, 'idempotent role_grant grant');
 };
+/**
+ * Find a role_grant by id, regardless of revoked / expired state.
+ *
+ * Unscoped by design — the one caller is `query_accept_offer`'s race-loser
+ * path, which resolves an already-accepted offer's `resulting_role_grant_id`
+ * (a row the offer's own IDOR guard has already vouched for). Authority
+ * checks stay at the call site.
+ */
+export const query_role_grant_by_id = async (deps, id) => deps.db.query_one(`SELECT ${columns_sql(ROLE_GRANT_COLUMNS)} FROM role_grant WHERE id = $1`, [id]);
 /**
  * Look up the role of an active role_grant (constrained to a specific
  * actor) plus the actor's `account_id`.
@@ -136,11 +168,9 @@ export const query_revoke_role_grant = async (deps, role_grant_id, actor_id, rev
 			  AND o.declined_at IS NULL
 			  AND o.retracted_at IS NULL
 			  AND o.superseded_at IS NULL
-			RETURNING o.*
+			RETURNING ${qualify_columns(ROLE_GRANT_OFFER_COLUMNS, 'o')}
 		)
-		SELECT u.*, grantor.account_id AS from_account_id
-		FROM updated u
-		JOIN actor grantor ON grantor.id = u.from_actor_id`, [actor_id, revoked.role, revoked.scope_id]);
+		${ROLE_GRANT_OFFER_WITH_GRANTOR_SELECT}`, [actor_id, revoked.role, revoked.scope_id]);
     return {
         id: revoked.id,
         role: revoked.role,
@@ -153,7 +183,7 @@ export const query_revoke_role_grant = async (deps, role_grant_id, actor_id, rev
  * Find all active (non-revoked, non-expired) role_grants for an actor.
  */
 export const query_role_grant_find_active_for_actor = async (deps, actor_id) => {
-    return deps.db.query(`SELECT * FROM role_grant
+    return deps.db.query(`SELECT ${columns_sql(ROLE_GRANT_COLUMNS)} FROM role_grant
 		 WHERE actor_id = $1
 		   AND revoked_at IS NULL
 		   AND (expires_at IS NULL OR expires_at > NOW())
@@ -284,7 +314,7 @@ export const query_count_active_accounts_with_global_role = async (deps, role) =
  * List all role_grants for an actor (including revoked/expired).
  */
 export const query_role_grant_list_for_actor = async (deps, actor_id) => {
-    return deps.db.query(`SELECT * FROM role_grant WHERE actor_id = $1 ORDER BY created_at DESC`, [actor_id]);
+    return deps.db.query(`SELECT ${columns_sql(ROLE_GRANT_COLUMNS)} FROM role_grant WHERE actor_id = $1 ORDER BY created_at DESC`, [actor_id]);
 };
 /**
  * Find the account ID of an account that holds an active role_grant for a given role.
@@ -366,11 +396,9 @@ export const query_role_grant_revoke_for_scope = async (deps, scope_id, revoked_
 			  AND o.declined_at IS NULL
 			  AND o.retracted_at IS NULL
 			  AND o.superseded_at IS NULL
-			RETURNING o.*
+			RETURNING ${qualify_columns(ROLE_GRANT_OFFER_COLUMNS, 'o')}
 		)
-		SELECT u.*, grantor.account_id AS from_account_id
-		FROM updated u
-		JOIN actor grantor ON grantor.id = u.from_actor_id`, [scope_id]);
+		${ROLE_GRANT_OFFER_WITH_GRANTOR_SELECT}`, [scope_id]);
     return { revoked, superseded_offers };
 };
 /**
@@ -420,10 +448,8 @@ export const query_role_grant_revoke_role = async (deps, actor_id, role, revoked
 			  AND o.declined_at IS NULL
 			  AND o.retracted_at IS NULL
 			  AND o.superseded_at IS NULL
-			RETURNING o.*
+			RETURNING ${qualify_columns(ROLE_GRANT_OFFER_COLUMNS, 'o')}
 		)
-		SELECT u.*, grantor.account_id AS from_account_id
-		FROM updated u
-		JOIN actor grantor ON grantor.id = u.from_actor_id`, [actor_id, role]);
+		${ROLE_GRANT_OFFER_WITH_GRANTOR_SELECT}`, [actor_id, role]);
     return { revoked, superseded_offers };
 };

package/dist/auth/session_queries.d.ts

@@ -43,6 +43,17 @@ export declare const generate_session_token: () => string;
  * @mutates `auth_session` table - inserts a row keyed by `token_hash`
  */
 export declare const query_create_session: (deps: QueryDeps, token_hash: string, account_id: string, expires_at: Date) => Promise<void>;
+/**
+ * The full `auth_session` column set, named explicitly so a row read fails
+ * loud on schema drift — `SELECT *` would silently carry a dropped or
+ * leftover column into the strict-validated wire shapes (see
+ * `ACCOUNT_COLUMNS` in `auth/account_queries.ts` for the outage class this
+ * discipline exists to prevent; the Rust twin already names columns at every
+ * session site). Keep in sync with `AuthSession` and the migration chain's
+ * end state — not the frozen v0 DDL in `auth/auth_ddl.ts`, which still
+ * creates `last_seen_at` for the appended drop migration to remove.
+ */
+export declare const AUTH_SESSION_COLUMNS: readonly ["id", "account_id", "created_at", "expires_at"];
 /**
  * Get a session if it exists, is not expired, and has not been revoked.
  *
@@ -132,9 +143,7 @@ export declare const query_session_enforce_limit: (deps: QueryDeps, account_id:
  * List all active sessions across all accounts with usernames.
  *
  * Ordered by `created_at DESC` (newest session first), matching the
- * per-account listing. `last_seen_at` is still selected for the wire shape
- * but is decorative — nothing updates it post-mint (it always equals
- * `created_at`); it is slated for removal on its own twin migration.
+ * per-account listing.
  *
  * @param deps - query dependencies
  * @param limit - maximum entries to return

package/dist/auth/session_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAA2B,CAAC;AAEjE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,KAAG,SAElD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAAO,MAEzC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,EAClB,YAAY,IAAI,KACd,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,WAAW,GAAG,SAAS,CAKjC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,IAAI,CAEd,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,KAChB,OAAO,CAAC,OAAO,CAMjB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAU,KACR,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAK5B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,2BAA2B,GACvC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAc,MAAM,KAClB,OAAO,CAAC,MAAM,CAYhB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,cAAW,KACT,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CASnD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,MAAM,CAKnF,CAAC"}
+{"version":3,"file":"session_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAA2B,CAAC;AAEjE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,KAAG,SAElD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAAO,MAEzC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,EAClB,YAAY,IAAI,KACd,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,2DAKoB,CAAC;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,WAAW,GAAG,SAAS,CAKjC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,IAAI,CAEd,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,KAChB,OAAO,CAAC,OAAO,CAMjB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAU,KACR,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAK5B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,2BAA2B,GACvC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAc,MAAM,KAClB,OAAO,CAAC,MAAM,CAYhB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,cAAW,KACT,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CASnD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,MAAM,CAKnF,CAAC"}

package/dist/auth/session_queries.js

@@ -8,6 +8,7 @@
  */
 import { hash_blake3 } from '@fuzdev/fuz_util/hash_blake3.ts';
 import { generate_random_base64url } from '../crypto.js';
+import { columns_sql, qualify_columns } from '../db/sql_columns.js';
 /**
  * Session lifetime in milliseconds (30 days).
  *
@@ -53,6 +54,22 @@ export const query_create_session = async (deps, token_hash, account_id, expires
         expires_at.toISOString()
     ]);
 };
+/**
+ * The full `auth_session` column set, named explicitly so a row read fails
+ * loud on schema drift — `SELECT *` would silently carry a dropped or
+ * leftover column into the strict-validated wire shapes (see
+ * `ACCOUNT_COLUMNS` in `auth/account_queries.ts` for the outage class this
+ * discipline exists to prevent; the Rust twin already names columns at every
+ * session site). Keep in sync with `AuthSession` and the migration chain's
+ * end state — not the frozen v0 DDL in `auth/auth_ddl.ts`, which still
+ * creates `last_seen_at` for the appended drop migration to remove.
+ */
+export const AUTH_SESSION_COLUMNS = [
+    'id',
+    'account_id',
+    'created_at',
+    'expires_at'
+];
 /**
  * Get a session if it exists, is not expired, and has not been revoked.
  *
@@ -60,7 +77,7 @@ export const query_create_session = async (deps, token_hash, account_id, expires
  * @param token_hash - blake3 hash of the session token
  */
 export const query_session_get_valid = async (deps, token_hash) => {
-    return deps.db.query_one(`SELECT * FROM auth_session WHERE id = $1 AND expires_at > NOW()`, [token_hash]);
+    return deps.db.query_one(`SELECT ${columns_sql(AUTH_SESSION_COLUMNS)} FROM auth_session WHERE id = $1 AND expires_at > NOW()`, [token_hash]);
 };
 /**
  * Revoke (delete) a session by its token hash, with no account scoping.
@@ -106,7 +123,7 @@ export const query_session_revoke_all_for_account = async (deps, account_id) =>
  * List sessions for an account, newest first.
  */
 export const query_session_list_for_account = async (deps, account_id, limit = 50) => {
-    return deps.db.query(`SELECT * FROM auth_session WHERE account_id = $1 ORDER BY created_at DESC LIMIT $2`, [account_id, limit]);
+    return deps.db.query(`SELECT ${columns_sql(AUTH_SESSION_COLUMNS)} FROM auth_session WHERE account_id = $1 ORDER BY created_at DESC LIMIT $2`, [account_id, limit]);
 };
 /**
  * Enforce a per-account session limit by evicting the oldest sessions.
@@ -163,16 +180,14 @@ export const query_session_enforce_limit = async (deps, account_id, max_sessions
  * List all active sessions across all accounts with usernames.
  *
  * Ordered by `created_at DESC` (newest session first), matching the
- * per-account listing. `last_seen_at` is still selected for the wire shape
- * but is decorative — nothing updates it post-mint (it always equals
- * `created_at`); it is slated for removal on its own twin migration.
+ * per-account listing.
  *
  * @param deps - query dependencies
  * @param limit - maximum entries to return
  * @returns active sessions joined with account usernames, newest first
  */
 export const query_session_list_all_active = async (deps, limit = 200) => {
-    return deps.db.query(`SELECT s.id, s.account_id, s.created_at, s.expires_at, s.last_seen_at, a.username
+    return deps.db.query(`SELECT ${qualify_columns(AUTH_SESSION_COLUMNS, 's')}, a.username
 		 FROM auth_session s
 		 JOIN account a ON a.id = s.account_id
 		 WHERE s.expires_at > NOW()

package/dist/db/CLAUDE.md

@@ -27,6 +27,10 @@ the code.
 - `assert_row.ts` — `assert_row(row, context)` for INSERT … RETURNING.
 - `pg_error.ts` — `pg_error_code` (SQLSTATE extractor for `pg`/PGlite errors), `is_pg_unique_violation` (Postgres `23505`).
 - `sql_identifier.ts` — `assert_valid_sql_identifier`.
+- `sql_columns.ts` — `columns_sql` / `qualify_columns` / `omit_columns`,
+  the derivation helpers every `*_COLUMNS` projection const's variants
+  (alias-qualified JOIN reads, the client-safe `minus token_hash` listing)
+  are built from, so the drift guard on the base const covers them.
 - `status.ts` — CLI DB status utility.
 - `schema_ready.ts` — `/ready` deploy-gate core: `query_public_columns`
   (keeps `schema_version`, unlike `query_schema_snapshot`), pure
@@ -98,6 +102,17 @@ child_id`, fractional-index keyed): `query_cell_item_insert` (throws
   `target_id`), bitmap-OR over `idx_audit_log_metadata` (the `jsonb_path_ops`
   GIN the `audit_log_metadata_gin_index` auth migration ships).
 
+**Named projections** (rationale + helpers: ../../../docs/architecture.md
+§Query Modules). The consts on this side: `CELL_COLUMNS`,
+`CELL_GRANT_COLUMNS`, `CELL_FIELD_COLUMNS`, `CELL_ITEM_COLUMNS`, `FACT_COLUMNS`
+(the meta read derives `minus bytes`). The derived `grant_count` stays an
+appended expression in the exported `cell_row_projection(alias)` rather than a
+`CELL_COLUMNS` entry, so the const is exactly the table's column set. Column
+order twins the Rust `fuz_cell` `*_COLUMNS` consts. Every const is pinned to
+the live schema — and every public table forced to carry a const or a named
+exemption — by `src/test/db/column_projections.db.test.ts`; the cell
+`*_queries.db.test.ts` files pin the aliased JOIN reads and `grant_count`.
+
 ## Fact layer
 
 Content-addressed byte store. Cells reference facts by blake3 hash

package/dist/db/cell_audit_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_audit_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_audit_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAoBnD,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,SAAS,EACf,SAAS,IAAI,EACb,SAAS,oBAAoB,KAC3B,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAwB9B,CAAC"}
+{"version":3,"file":"cell_audit_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_audit_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAoBnD,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,SAAS,EACf,SAAS,IAAI,EACb,SAAS,oBAAoB,KAC3B,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAwB9B,CAAC"}

package/dist/db/cell_audit_queries.js

@@ -12,6 +12,8 @@
  *
  * @module
  */
+import { AUDIT_LOG_COLUMNS } from '../auth/audit_log_queries.js';
+import { columns_sql } from './sql_columns.js';
 /**
  * Metadata-jsonb keys cell-domain events use to name the cell. This
  * array is the **only** source these key strings can come from —
@@ -51,5 +53,5 @@ export const query_audit_log_list_by_cell = async (deps, cell_id, options) => {
     const where = `WHERE ${conditions.join(' AND ')}`;
     const limit_placeholder = `$${i++}`;
     params.push(options.limit);
-    return deps.db.query(`SELECT * FROM audit_log ${where} ORDER BY seq DESC LIMIT ${limit_placeholder}`, params);
+    return deps.db.query(`SELECT ${columns_sql(AUDIT_LOG_COLUMNS)} FROM audit_log ${where} ORDER BY seq DESC LIMIT ${limit_placeholder}`, params);
 };

package/dist/db/cell_field_queries.d.ts

@@ -25,6 +25,13 @@ export interface CellFieldRow {
     target_id: Uuid;
     created_at: Date;
 }
+/**
+ * The full `cell_field` column set, named explicitly so a row read fails
+ * loud on schema drift (see `CELL_COLUMNS` in `db/cell_queries.ts`). Column
+ * order mirrors the Rust twin's `field_columns(alias)` (`fuz_cell`). Keep in
+ * sync with `CellFieldRow` and the `cell_field` DDL in `db/cell_ddl.ts`.
+ */
+export declare const CELL_FIELD_COLUMNS: readonly ["source_id", "name", "target_id", "created_at"];
 /** Input for `query_cell_field_set`. */
 export interface CellFieldSetQueryInput {
     source_id: Uuid;
@@ -76,7 +83,9 @@ export declare const query_cell_field_delete: (deps: QueryDeps, source_id: Uuid,
  *
  * @param deps - query deps
  * @param source_id - source cell id
- * @returns matching rows, oldest first by name (lex order)
+ * @param options - `limit` caps the row count; `name_after` resumes after a
+ *   name (keyset pagination)
+ * @returns matching rows in lex `name` order
  */
 export declare const query_cell_field_list_for_source: (deps: QueryDeps, source_id: Uuid, options?: {
     limit?: number;
@@ -97,7 +106,7 @@ export declare const query_cell_field_list_for_source: (deps: QueryDeps, source_
  * @param deps - query deps
  * @param target_id - target cell id
  * @param options - `limit` caps the row count
- * @returns matching rows, oldest first by source created_at
+ * @returns matching rows, oldest field first (by the field row's `created_at`)
  */
 export declare const query_cell_field_list_for_target: (deps: QueryDeps, target_id: Uuid, options?: {
     limit?: number;

package/dist/db/cell_field_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_field_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_field_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAGnD,kDAAkD;AAClD,MAAM,WAAW,YAAY;IAC5B,SAAS,EAAE,IAAI,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,IAAI,CAAC;CACjB;AAED,wCAAwC;AACxC,MAAM,WAAW,sBAAsB;IACtC,SAAS,EAAE,IAAI,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,IAAI,CAAC;CAChB;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,OAAO,sBAAsB,KAC3B,OAAO,CAAC,YAAY,CAUtB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,WAAW,IAAI,EACf,MAAM,MAAM,KACV,OAAO,CAAC,YAAY,GAAG,IAAI,CAM7B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,WAAW,IAAI,EACf,MAAM,MAAM,KACV,OAAO,CAAC,YAAY,GAAG,IAAI,CAM7B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,WAAW,IAAI,EACf,UAAU;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,KAC/C,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAa7B,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,WAAW,IAAI,EACf,UAAU;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,KAC1B,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAS5B,CAAC"}
+{"version":3,"file":"cell_field_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_field_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAInD,kDAAkD;AAClD,MAAM,WAAW,YAAY;IAC5B,SAAS,EAAE,IAAI,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,IAAI,CAAC;CACjB;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,2DAKuB,CAAC;AAEvD,wCAAwC;AACxC,MAAM,WAAW,sBAAsB;IACtC,SAAS,EAAE,IAAI,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,IAAI,CAAC;CAChB;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,OAAO,sBAAsB,KAC3B,OAAO,CAAC,YAAY,CAUtB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,WAAW,IAAI,EACf,MAAM,MAAM,KACV,OAAO,CAAC,YAAY,GAAG,IAAI,CAM7B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,WAAW,IAAI,EACf,MAAM,MAAM,KACV,OAAO,CAAC,YAAY,GAAG,IAAI,CAO7B,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,WAAW,IAAI,EACf,UAAU;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,KAC/C,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAa7B,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,WAAW,IAAI,EACf,UAAU;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,KAC1B,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAS5B,CAAC"}

package/dist/db/cell_field_queries.js

@@ -17,6 +17,19 @@
  * @module
  */
 import { assert_row } from './assert_row.js';
+import { columns_sql, qualify_columns } from './sql_columns.js';
+/**
+ * The full `cell_field` column set, named explicitly so a row read fails
+ * loud on schema drift (see `CELL_COLUMNS` in `db/cell_queries.ts`). Column
+ * order mirrors the Rust twin's `field_columns(alias)` (`fuz_cell`). Keep in
+ * sync with `CellFieldRow` and the `cell_field` DDL in `db/cell_ddl.ts`.
+ */
+export const CELL_FIELD_COLUMNS = [
+    'source_id',
+    'name',
+    'target_id',
+    'created_at'
+];
 /**
  * Insert or update a field row.
  *
@@ -35,7 +48,7 @@ export const query_cell_field_set = async (deps, input) => {
 		 VALUES ($1, $2, $3)
 		 ON CONFLICT (source_id, name)
 		 DO UPDATE SET target_id = EXCLUDED.target_id, created_at = NOW()
-		 RETURNING *`, [input.source_id, input.name, input.target_id]);
+		 RETURNING ${columns_sql(CELL_FIELD_COLUMNS)}`, [input.source_id, input.name, input.target_id]);
     return assert_row(row, 'INSERT INTO cell_field');
 };
 /**
@@ -51,7 +64,7 @@ export const query_cell_field_set = async (deps, input) => {
  * @returns the row or `null` when not found
  */
 export const query_cell_field_get = async (deps, source_id, name) => {
-    const row = await deps.db.query_one(`SELECT * FROM cell_field WHERE source_id = $1 AND name = $2`, [source_id, name]);
+    const row = await deps.db.query_one(`SELECT ${columns_sql(CELL_FIELD_COLUMNS)} FROM cell_field WHERE source_id = $1 AND name = $2`, [source_id, name]);
     return row ?? null;
 };
 /**
@@ -63,7 +76,8 @@ export const query_cell_field_get = async (deps, source_id, name) => {
  * @mutates `cell_field` - deletes one row
  */
 export const query_cell_field_delete = async (deps, source_id, name) => {
-    const row = await deps.db.query_one(`DELETE FROM cell_field WHERE source_id = $1 AND name = $2 RETURNING *`, [source_id, name]);
+    const row = await deps.db.query_one(`DELETE FROM cell_field WHERE source_id = $1 AND name = $2
+		 RETURNING ${columns_sql(CELL_FIELD_COLUMNS)}`, [source_id, name]);
     return row ?? null;
 };
 /**
@@ -75,12 +89,14 @@ export const query_cell_field_delete = async (deps, source_id, name) => {
  *
  * @param deps - query deps
  * @param source_id - source cell id
- * @returns matching rows, oldest first by name (lex order)
+ * @param options - `limit` caps the row count; `name_after` resumes after a
+ *   name (keyset pagination)
+ * @returns matching rows in lex `name` order
  */
 export const query_cell_field_list_for_source = async (deps, source_id, options) => {
     const limit = options?.limit ?? null;
     const name_after = options?.name_after ?? null;
-    return deps.db.query(`SELECT f.* FROM cell_field f
+    return deps.db.query(`SELECT ${qualify_columns(CELL_FIELD_COLUMNS, 'f')} FROM cell_field f
 		 JOIN cell t ON t.id = f.target_id
 		 WHERE f.source_id = $1
 		   AND t.deleted_at IS NULL
@@ -103,9 +119,9 @@ export const query_cell_field_list_for_source = async (deps, source_id, options)
  * @param deps - query deps
  * @param target_id - target cell id
  * @param options - `limit` caps the row count
- * @returns matching rows, oldest first by source created_at
+ * @returns matching rows, oldest field first (by the field row's `created_at`)
  */
-export const query_cell_field_list_for_target = async (deps, target_id, options) => deps.db.query(`SELECT f.* FROM cell_field f
+export const query_cell_field_list_for_target = async (deps, target_id, options) => deps.db.query(`SELECT ${qualify_columns(CELL_FIELD_COLUMNS, 'f')} FROM cell_field f
 		 JOIN cell s ON s.id = f.source_id
 		 WHERE f.target_id = $1
 		   AND s.deleted_at IS NULL

package/dist/db/cell_grant_queries.d.ts

@@ -35,6 +35,13 @@ export interface CellGrantRow {
     granted_by: Uuid | null;
     created_at: Date;
 }
+/**
+ * The full `cell_grant` column set, named explicitly so a row read fails
+ * loud on schema drift (see `CELL_COLUMNS` in `db/cell_queries.ts`). Column
+ * order mirrors the Rust twin's `grant_columns(alias)` (`fuz_cell`). Keep in
+ * sync with `CellGrantRow` and the `cell_grant` DDL in `db/cell_ddl.ts`.
+ */
+export declare const CELL_GRANT_COLUMNS: readonly ["id", "cell_id", "level", "actor_id", "role", "scope_id", "granted_by", "created_at"];
 /**
  * Discriminated principal input for `query_cell_grant_create`. Wire
  * and query shapes are aligned — actor-shaped principals carry a
@@ -121,6 +128,7 @@ export declare const query_cell_grant_list_for_cells: (deps: QueryDeps, cell_ids
  * granted access. Returns grants for the given cells that match the caller's
  * identity or role_grant set.
  *
+ * @param deps - query deps
  * @param cell_ids - cells to fetch grants for
  * @param caller_actor_id - actor id of the caller (null for unauth)
  * @param role_grant_roles - active role_grant roles (parallel array)
@@ -128,5 +136,5 @@ export declare const query_cell_grant_list_for_cells: (deps: QueryDeps, cell_ids
  * @returns matching grants (may include grants the caller doesn't match; caller's
  * list handler must filter when returning to the API)
  */
-export declare const query_cell_grants_for_caller_in_cells: (deps: QueryDeps, cell_ids: Array<Uuid>, caller_actor_id: Uuid | null, role_grant_roles: Array<string>, role_grant_scope_ids: Array<Uuid | null>) => Promise<Array<CellGrantRow>>;
+export declare const query_cell_grants_for_caller_in_cells: (deps: QueryDeps, cell_ids: ReadonlyArray<Uuid>, caller_actor_id: Uuid | null, role_grant_roles: ReadonlyArray<string>, role_grant_scope_ids: ReadonlyArray<Uuid | null>) => Promise<Array<CellGrantRow>>;
 //# sourceMappingURL=cell_grant_queries.d.ts.map

package/dist/db/cell_grant_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_grant_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_grant_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGzE,kDAAkD;AAClD,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,IAAI,CAAC;IACd,KAAK,EAAE,cAAc,CAAC;IACtB,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,MAAM,4BAA4B,GACvC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,CAAC;AAE3F,2CAA2C;AAC3C,MAAM,WAAW,yBAAyB;IACzC,OAAO,EAAE,IAAI,CAAC;IACd,KAAK,EAAE,cAAc,CAAC;IACtB,SAAS,EAAE,4BAA4B,CAAC;IACxC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,OAAO,yBAAyB,KAC9B,OAAO,CAAC,YAAY,CAsBtB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,UAAU,IAAI,KACZ,OAAO,CAAC,YAAY,GAAG,IAAI,CAK7B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,UAAU,IAAI,KACZ,OAAO,CAAC,YAAY,GAAG,IAAI,CAM7B,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,SAAS,IAAI,KACX,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAM5B,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,+BAA+B,GAC3C,MAAM,SAAS,EACf,UAAU,aAAa,CAAC,IAAI,CAAC,KAC3B,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAQ7B,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qCAAqC,GACjD,MAAM,SAAS,EACf,UAAU,KAAK,CAAC,IAAI,CAAC,EACrB,iBAAiB,IAAI,GAAG,IAAI,EAC5B,kBAAkB,KAAK,CAAC,MAAM,CAAC,EAC/B,sBAAsB,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,KACtC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAmB7B,CAAC"}
+{"version":3,"file":"cell_grant_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_grant_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAIzE,kDAAkD;AAClD,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,IAAI,CAAC;IACd,KAAK,EAAE,cAAc,CAAC;IACtB,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,CAAC;CACjB;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,iGASuB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,MAAM,4BAA4B,GACvC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,CAAC;AAE3F,2CAA2C;AAC3C,MAAM,WAAW,yBAAyB;IACzC,OAAO,EAAE,IAAI,CAAC;IACd,KAAK,EAAE,cAAc,CAAC;IACtB,SAAS,EAAE,4BAA4B,CAAC;IACxC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,OAAO,yBAAyB,KAC9B,OAAO,CAAC,YAAY,CAsBtB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,UAAU,IAAI,KACZ,OAAO,CAAC,YAAY,GAAG,IAAI,CAM7B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,UAAU,IAAI,KACZ,OAAO,CAAC,YAAY,GAAG,IAAI,CAM7B,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,SAAS,IAAI,KACX,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAM5B,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,+BAA+B,GAC3C,MAAM,SAAS,EACf,UAAU,aAAa,CAAC,IAAI,CAAC,KAC3B,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAQ7B,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC,GACjD,MAAM,SAAS,EACf,UAAU,aAAa,CAAC,IAAI,CAAC,EAC7B,iBAAiB,IAAI,GAAG,IAAI,EAC5B,kBAAkB,aAAa,CAAC,MAAM,CAAC,EACvC,sBAAsB,aAAa,CAAC,IAAI,GAAG,IAAI,CAAC,KAC9C,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAmB7B,CAAC"}

package/dist/db/cell_grant_queries.js

@@ -22,6 +22,23 @@
  * @module
  */
 import { assert_row } from './assert_row.js';
+import { columns_sql, qualify_columns } from './sql_columns.js';
+/**
+ * The full `cell_grant` column set, named explicitly so a row read fails
+ * loud on schema drift (see `CELL_COLUMNS` in `db/cell_queries.ts`). Column
+ * order mirrors the Rust twin's `grant_columns(alias)` (`fuz_cell`). Keep in
+ * sync with `CellGrantRow` and the `cell_grant` DDL in `db/cell_ddl.ts`.
+ */
+export const CELL_GRANT_COLUMNS = [
+    'id',
+    'cell_id',
+    'level',
+    'actor_id',
+    'role',
+    'scope_id',
+    'granted_by',
+    'created_at'
+];
 /**
  * Insert a grant, or update the existing row's `level` + `granted_by` when
  * one already exists for the same `(cell_id, principal)` pair.
@@ -43,14 +60,14 @@ export const query_cell_grant_create = async (deps, input) => {
 			 VALUES ($1, $2, $3, $4)
 			 ON CONFLICT (cell_id, actor_id) WHERE actor_id IS NOT NULL
 			 DO UPDATE SET level = EXCLUDED.level, granted_by = EXCLUDED.granted_by
-			 RETURNING *`, [cell_id, level, principal.actor_id, granted_by]);
+			 RETURNING ${columns_sql(CELL_GRANT_COLUMNS)}`, [cell_id, level, principal.actor_id, granted_by]);
         return assert_row(row, 'INSERT INTO cell_grant (actor)');
     }
     const row = await deps.db.query_one(`INSERT INTO cell_grant (cell_id, level, role, scope_id, granted_by)
 		 VALUES ($1, $2, $3, $4, $5)
 		 ON CONFLICT (cell_id, role, scope_id) WHERE role IS NOT NULL
 		 DO UPDATE SET level = EXCLUDED.level, granted_by = EXCLUDED.granted_by
-		 RETURNING *`, [cell_id, level, principal.role, principal.scope_id, granted_by]);
+		 RETURNING ${columns_sql(CELL_GRANT_COLUMNS)}`, [cell_id, level, principal.role, principal.scope_id, granted_by]);
     return assert_row(row, 'INSERT INTO cell_grant (role)');
 };
 /**
@@ -61,9 +78,7 @@ export const query_cell_grant_create = async (deps, input) => {
  * @returns the row or `null` when not found
  */
 export const query_cell_grant_get = async (deps, grant_id) => {
-    const row = await deps.db.query_one(`SELECT * FROM cell_grant WHERE id = $1`, [
-        grant_id
-    ]);
+    const row = await deps.db.query_one(`SELECT ${columns_sql(CELL_GRANT_COLUMNS)} FROM cell_grant WHERE id = $1`, [grant_id]);
     return row ?? null;
 };
 /**
@@ -79,7 +94,7 @@ export const query_cell_grant_get = async (deps, grant_id) => {
  * @mutates `cell_grant` - deletes one row
  */
 export const query_cell_grant_delete = async (deps, grant_id) => {
-    const row = await deps.db.query_one(`DELETE FROM cell_grant WHERE id = $1 RETURNING *`, [grant_id]);
+    const row = await deps.db.query_one(`DELETE FROM cell_grant WHERE id = $1 RETURNING ${columns_sql(CELL_GRANT_COLUMNS)}`, [grant_id]);
     return row ?? null;
 };
 /**
@@ -92,7 +107,7 @@ export const query_cell_grant_delete = async (deps, grant_id) => {
  * @param cell_id - cell id
  * @returns matching rows
  */
-export const query_cell_grant_list_for_cell = async (deps, cell_id) => deps.db.query(`SELECT * FROM cell_grant
+export const query_cell_grant_list_for_cell = async (deps, cell_id) => deps.db.query(`SELECT ${columns_sql(CELL_GRANT_COLUMNS)} FROM cell_grant
 		 WHERE cell_id = $1
 		 ORDER BY created_at ASC`, [cell_id]);
 /**
@@ -109,7 +124,7 @@ export const query_cell_grant_list_for_cell = async (deps, cell_id) => deps.db.q
 export const query_cell_grant_list_for_cells = async (deps, cell_ids) => {
     if (cell_ids.length === 0)
         return [];
-    return deps.db.query(`SELECT * FROM cell_grant
+    return deps.db.query(`SELECT ${columns_sql(CELL_GRANT_COLUMNS)} FROM cell_grant
 		 WHERE cell_id = ANY($1::uuid[])
 		 ORDER BY cell_id, created_at ASC`, [cell_ids]);
 };
@@ -119,6 +134,7 @@ export const query_cell_grant_list_for_cells = async (deps, cell_ids) => {
  * granted access. Returns grants for the given cells that match the caller's
  * identity or role_grant set.
  *
+ * @param deps - query deps
  * @param cell_ids - cells to fetch grants for
  * @param caller_actor_id - actor id of the caller (null for unauth)
  * @param role_grant_roles - active role_grant roles (parallel array)
@@ -130,7 +146,7 @@ export const query_cell_grants_for_caller_in_cells = async (deps, cell_ids, call
     if (cell_ids.length === 0) {
         return [];
     }
-    return deps.db.query(`SELECT g.* FROM cell_grant g
+    return deps.db.query(`SELECT ${qualify_columns(CELL_GRANT_COLUMNS, 'g')} FROM cell_grant g
 		 WHERE g.cell_id = ANY($1::uuid[])
 		   AND (
 		     g.actor_id = $2

package/dist/db/cell_item_queries.d.ts

@@ -28,6 +28,13 @@ export interface CellItemRow {
     child_id: Uuid;
     created_at: Date;
 }
+/**
+ * The full `cell_item` column set, named explicitly so a row read fails
+ * loud on schema drift (see `CELL_COLUMNS` in `db/cell_queries.ts`). Column
+ * order mirrors the Rust twin's `item_columns(alias)` (`fuz_cell`). Keep in
+ * sync with `CellItemRow` and the `cell_item` DDL in `db/cell_ddl.ts`.
+ */
+export declare const CELL_ITEM_COLUMNS: readonly ["parent_id", "position", "child_id", "created_at"];
 /** Input for `query_cell_item_insert`. */
 export interface CellItemInsertQueryInput {
     parent_id: Uuid;
@@ -83,7 +90,11 @@ export declare const query_cell_item_delete: (deps: QueryDeps, parent_id: Uuid,
  * cells don't surface; the parent filter is the caller's responsibility
  * (gated upstream by `can_view_cell(parent)`).
  *
- * @param limit - optional row cap (passes through to SQL `LIMIT`)
+ * @param deps - query deps
+ * @param parent_id - parent cell id
+ * @param options - `limit` caps the row count (passes through to SQL `LIMIT`);
+ *   `position_after` resumes after a position (keyset pagination)
+ * @returns matching rows in lex `position` order
  */
 export declare const query_cell_item_list_for_parent: (deps: QueryDeps, parent_id: Uuid, options?: {
     limit?: number;

package/dist/db/cell_item_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_item_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_item_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAGnD,iDAAiD;AACjD,MAAM,WAAW,WAAW;IAC3B,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,IAAI,CAAC;IACf,UAAU,EAAE,IAAI,CAAC;CACjB;AAED,0CAA0C;AAC1C,MAAM,WAAW,wBAAwB;IACxC,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,IAAI,CAAC;CACf;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,OAAO,wBAAwB,KAC7B,OAAO,CAAC,WAAW,CAQrB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,WAAW,IAAI,EACf,UAAU,MAAM,KACd,OAAO,CAAC,WAAW,GAAG,IAAI,CAM5B,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,WAAW,IAAI,EACf,cAAc,MAAM,EACpB,cAAc,MAAM,KAClB,OAAO,CAAC,WAAW,GAAG,IAAI,CAS5B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,WAAW,IAAI,EACf,UAAU,MAAM,KACd,OAAO,CAAC,WAAW,GAAG,IAAI,CAM5B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,+BAA+B,GAC3C,MAAM,SAAS,EACf,WAAW,IAAI,EACf,UAAU;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,KACnD,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAa5B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,UAAU,IAAI,EACd,UAAU;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,KAC1B,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAS3B,CAAC"}
+{"version":3,"file":"cell_item_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_item_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAInD,iDAAiD;AACjD,MAAM,WAAW,WAAW;IAC3B,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,IAAI,CAAC;IACf,UAAU,EAAE,IAAI,CAAC;CACjB;AAED;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,8DAKuB,CAAC;AAEtD,0CAA0C;AAC1C,MAAM,WAAW,wBAAwB;IACxC,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,IAAI,CAAC;CACf;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,OAAO,wBAAwB,KAC7B,OAAO,CAAC,WAAW,CAQrB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,WAAW,IAAI,EACf,UAAU,MAAM,KACd,OAAO,CAAC,WAAW,GAAG,IAAI,CAM5B,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,WAAW,IAAI,EACf,cAAc,MAAM,EACpB,cAAc,MAAM,KAClB,OAAO,CAAC,WAAW,GAAG,IAAI,CAS5B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,WAAW,IAAI,EACf,UAAU,MAAM,KACd,OAAO,CAAC,WAAW,GAAG,IAAI,CAO5B,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,+BAA+B,GAC3C,MAAM,SAAS,EACf,WAAW,IAAI,EACf,UAAU;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,KACnD,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAa5B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,UAAU,IAAI,EACd,UAAU;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,KAC1B,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAS3B,CAAC"}