@fuzdev/fuz_app 0.110.1 → 0.111.0

package/dist/db/cell_item_queries.js

@@ -20,6 +20,19 @@
  * @module
  */
 import { assert_row } from './assert_row.js';
+import { columns_sql, qualify_columns } from './sql_columns.js';
+/**
+ * The full `cell_item` column set, named explicitly so a row read fails
+ * loud on schema drift (see `CELL_COLUMNS` in `db/cell_queries.ts`). Column
+ * order mirrors the Rust twin's `item_columns(alias)` (`fuz_cell`). Keep in
+ * sync with `CellItemRow` and the `cell_item` DDL in `db/cell_ddl.ts`.
+ */
+export const CELL_ITEM_COLUMNS = [
+    'parent_id',
+    'position',
+    'child_id',
+    'created_at'
+];
 /**
  * Insert one item row at the caller-supplied `position`.
  *
@@ -34,7 +47,7 @@ import { assert_row } from './assert_row.js';
 export const query_cell_item_insert = async (deps, input) => {
     const row = await deps.db.query_one(`INSERT INTO cell_item (parent_id, position, child_id)
 		 VALUES ($1, $2, $3)
-		 RETURNING *`, [input.parent_id, input.position, input.child_id]);
+		 RETURNING ${columns_sql(CELL_ITEM_COLUMNS)}`, [input.parent_id, input.position, input.child_id]);
     return assert_row(row, 'INSERT INTO cell_item');
 };
 /**
@@ -44,7 +57,7 @@ export const query_cell_item_insert = async (deps, input) => {
  * @returns the row or `null` when not found
  */
 export const query_cell_item_get = async (deps, parent_id, position) => {
-    const row = await deps.db.query_one(`SELECT * FROM cell_item WHERE parent_id = $1 AND position = $2`, [parent_id, position]);
+    const row = await deps.db.query_one(`SELECT ${columns_sql(CELL_ITEM_COLUMNS)} FROM cell_item WHERE parent_id = $1 AND position = $2`, [parent_id, position]);
     return row ?? null;
 };
 /**
@@ -64,7 +77,7 @@ export const query_cell_item_move = async (deps, parent_id, position_old, positi
     const row = await deps.db.query_one(`UPDATE cell_item
 		 SET position = $3
 		 WHERE parent_id = $1 AND position = $2
-		 RETURNING *`, [parent_id, position_old, position_new]);
+		 RETURNING ${columns_sql(CELL_ITEM_COLUMNS)}`, [parent_id, position_old, position_new]);
     return row ?? null;
 };
 /**
@@ -76,7 +89,8 @@ export const query_cell_item_move = async (deps, parent_id, position_old, positi
  * @mutates `cell_item` - deletes one row
  */
 export const query_cell_item_delete = async (deps, parent_id, position) => {
-    const row = await deps.db.query_one(`DELETE FROM cell_item WHERE parent_id = $1 AND position = $2 RETURNING *`, [parent_id, position]);
+    const row = await deps.db.query_one(`DELETE FROM cell_item WHERE parent_id = $1 AND position = $2
+		 RETURNING ${columns_sql(CELL_ITEM_COLUMNS)}`, [parent_id, position]);
     return row ?? null;
 };
 /**
@@ -86,12 +100,16 @@ export const query_cell_item_delete = async (deps, parent_id, position) => {
  * cells don't surface; the parent filter is the caller's responsibility
  * (gated upstream by `can_view_cell(parent)`).
  *
- * @param limit - optional row cap (passes through to SQL `LIMIT`)
+ * @param deps - query deps
+ * @param parent_id - parent cell id
+ * @param options - `limit` caps the row count (passes through to SQL `LIMIT`);
+ *   `position_after` resumes after a position (keyset pagination)
+ * @returns matching rows in lex `position` order
  */
 export const query_cell_item_list_for_parent = async (deps, parent_id, options) => {
     const limit = options?.limit ?? null;
     const position_after = options?.position_after ?? null;
-    return deps.db.query(`SELECT i.* FROM cell_item i
+    return deps.db.query(`SELECT ${qualify_columns(CELL_ITEM_COLUMNS, 'i')} FROM cell_item i
 		 JOIN cell c ON c.id = i.child_id
 		 WHERE i.parent_id = $1
 		   AND c.deleted_at IS NULL
@@ -111,7 +129,7 @@ export const query_cell_item_list_for_parent = async (deps, parent_id, options)
  * inbound-linked child can't force an unbounded fetch + per-parent authz
  * pass on the public, IP-rate-limited reverse endpoint.
  */
-export const query_cell_item_list_for_child = async (deps, child_id, options) => deps.db.query(`SELECT i.* FROM cell_item i
+export const query_cell_item_list_for_child = async (deps, child_id, options) => deps.db.query(`SELECT ${qualify_columns(CELL_ITEM_COLUMNS, 'i')} FROM cell_item i
 		 JOIN cell p ON p.id = i.parent_id
 		 WHERE i.child_id = $1
 		   AND p.deleted_at IS NULL

package/dist/db/cell_queries.d.ts

@@ -56,6 +56,35 @@ export interface CellRow {
     updated_by: Uuid | null;
     grant_count: number;
 }
+/**
+ * The full `cell` column set, named explicitly so a row read fails loud on
+ * schema drift — a `SELECT *` silently omits a dropped column and the
+ * `deleted_at IS NULL`-shaped predicates on the hydrated row then misread
+ * `undefined` (see `ACCOUNT_COLUMNS` in `auth/account_queries.ts` for the
+ * outage class). Column order mirrors the Rust twin's `cell_columns(alias)`
+ * (`fuz_cell`), which decodes the same projection positionally. The derived
+ * `grant_count` is not a column — `cell_row_projection` appends it. Keep
+ * in sync with `CellRow` and the `cell` DDL in `db/cell_ddl.ts`.
+ */
+export declare const CELL_COLUMNS: readonly ["id", "data", "kind", "visibility", "path", "refs", "parent_id", "root_id", "moderation", "created_at", "updated_at", "deleted_at", "created_by", "updated_by"];
+/**
+ * The full `CellRow` projection — `CELL_COLUMNS` qualified by `alias` plus
+ * the derived `grant_count` (a correlated subquery against `cell_grant`,
+ * served by `idx_cell_grant_cell`) — used by every cell-row SELECT /
+ * RETURNING. `alias` is the row qualifier: the table name (`'cell'`) for
+ * single-table reads + `RETURNING`, the query alias (`'c'`) for
+ * `query_cell_list`. Twin of `fuz_cell`'s `cell_columns(alias)`.
+ *
+ * `::int` narrows the count from `bigint` so the JS row hydrates a `number`
+ * rather than a bigint primitive — counts on a single cell are trivially
+ * within int32.
+ *
+ * Exported for consumers writing their own cell-row reads: `CELL_COLUMNS`
+ * alone hydrates a row without `grant_count`, which typechecks as a
+ * `CellRow` but fails at `to_cell_json` — this is the projection that
+ * actually produces one.
+ */
+export declare const cell_row_projection: (alias: string) => string;
 /**
  * Input for `query_cell_create`. `refs` is derived from `data`. `kind` is
  * the write-once capability axis (`cell.kind` column) — set here at INSERT

package/dist/db/cell_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAGjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,OAAO;IACvB,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,cAAc,CAAC;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACpB;AAgBD;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,OAAO,oBAAoB,KACzB,OAAO,CAAC,OAAO,CAoBjB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,KACrC,OAAO,CAAC,OAAO,GAAG,IAAI,CAUxB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,MAAM,MAAM,KACV,OAAO,CAAC,OAAO,GAAG,IAAI,CAQxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,KAAK,aAAa,CAAC,IAAI,CAAC,KACtB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQxB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,OAAO,eAAe,KACpB,OAAO,CAAC,OAAO,GAAG,IAAI,CA4BxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAE,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,KACpC,OAAO,CAAC,OAAO,CAWjB,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,IAAI,IAAI,EACR,YAAY,MAAM,EAClB,SAAS;IAAE,qBAAqB,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,KACnE,OAAO,CAAC,OAAO,GAAG,IAAI,CAYxB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,MAAM,MAAM,EACZ,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CASvB,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,SAAS,EACf,UAAU,IAAI,EACd,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQvB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,eAAe,GAC3B,MAAM,SAAS,EACf,QAAQ,cAAc,KACpB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CA4DxB,CAAC;AAqGF,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC9B,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,4EAA4E;IAC5E,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf,0EAA0E;IAC1E,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,OAAO,CAAC,EAAE,IAAI,CAAC;IACf;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB;;;;OAIG;IACH,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,aAAa,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACzD;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,yCAAyC;IACzC,QAAQ,CAAC,EAAE,YAAY,GAAG,YAAY,CAAC;IACvC,sCAAsC;IACtC,eAAe,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,iBAAiB;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B"}
+{"version":3,"file":"cell_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAIjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,OAAO;IACvB,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,cAAc,CAAC;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,2KAegD,CAAC;AAE1E;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,mBAAmB,GAAI,OAAO,MAAM,KAAG,MACyE,CAAC;AAE9H;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,OAAO,oBAAoB,KACzB,OAAO,CAAC,OAAO,CAoBjB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,KACrC,OAAO,CAAC,OAAO,GAAG,IAAI,CAUxB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,MAAM,MAAM,KACV,OAAO,CAAC,OAAO,GAAG,IAAI,CAQxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,KAAK,aAAa,CAAC,IAAI,CAAC,KACtB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQxB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,OAAO,eAAe,KACpB,OAAO,CAAC,OAAO,GAAG,IAAI,CA4BxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAE,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,KACpC,OAAO,CAAC,OAAO,CAWjB,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,IAAI,IAAI,EACR,YAAY,MAAM,EAClB,SAAS;IAAE,qBAAqB,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,KACnE,OAAO,CAAC,OAAO,GAAG,IAAI,CAYxB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,MAAM,MAAM,EACZ,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CASvB,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,SAAS,EACf,UAAU,IAAI,EACd,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQvB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,eAAe,GAC3B,MAAM,SAAS,EACf,QAAQ,cAAc,KACpB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CA4DxB,CAAC;AAqGF,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC9B,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,4EAA4E;IAC5E,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf,0EAA0E;IAC1E,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,OAAO,CAAC,EAAE,IAAI,CAAC;IACf;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB;;;;OAIG;IACH,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,aAAa,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACzD;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,yCAAyC;IACzC,QAAQ,CAAC,EAAE,YAAY,GAAG,YAAY,CAAC;IACvC,sCAAsC;IACtC,eAAe,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,iBAAiB;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B"}

package/dist/db/cell_queries.js

@@ -22,18 +22,51 @@
  */
 import { fact_hash_extract_refs } from '@fuzdev/fuz_util/fact_hash.ts';
 import { assert_row } from './assert_row.js';
+import { qualify_columns } from './sql_columns.js';
 /**
- * SQL fragment for the `grant_count` projection — correlated subquery
- * against `cell_grant`. Inlined in every cell-row SELECT / RETURNING so
- * `CellRow` carries the count uniformly. Pass the cell alias used in
- * the outer query (`'cell'` for table-name references, `'c'` for the
- * aliased form in `query_cell_list`).
+ * The full `cell` column set, named explicitly so a row read fails loud on
+ * schema drift — a `SELECT *` silently omits a dropped column and the
+ * `deleted_at IS NULL`-shaped predicates on the hydrated row then misread
+ * `undefined` (see `ACCOUNT_COLUMNS` in `auth/account_queries.ts` for the
+ * outage class). Column order mirrors the Rust twin's `cell_columns(alias)`
+ * (`fuz_cell`), which decodes the same projection positionally. The derived
+ * `grant_count` is not a column — `cell_row_projection` appends it. Keep
+ * in sync with `CellRow` and the `cell` DDL in `db/cell_ddl.ts`.
+ */
+export const CELL_COLUMNS = [
+    'id',
+    'data',
+    'kind',
+    'visibility',
+    'path',
+    'refs',
+    'parent_id',
+    'root_id',
+    'moderation',
+    'created_at',
+    'updated_at',
+    'deleted_at',
+    'created_by',
+    'updated_by'
+];
+/**
+ * The full `CellRow` projection — `CELL_COLUMNS` qualified by `alias` plus
+ * the derived `grant_count` (a correlated subquery against `cell_grant`,
+ * served by `idx_cell_grant_cell`) — used by every cell-row SELECT /
+ * RETURNING. `alias` is the row qualifier: the table name (`'cell'`) for
+ * single-table reads + `RETURNING`, the query alias (`'c'`) for
+ * `query_cell_list`. Twin of `fuz_cell`'s `cell_columns(alias)`.
+ *
+ * `::int` narrows the count from `bigint` so the JS row hydrates a `number`
+ * rather than a bigint primitive — counts on a single cell are trivially
+ * within int32.
  *
- * `::int` narrows from `bigint` to `int` so the JS row hydrates as a
- * `number` rather than a bigint primitive — counts on a single cell are
- * trivially within int32.
+ * Exported for consumers writing their own cell-row reads: `CELL_COLUMNS`
+ * alone hydrates a row without `grant_count`, which typechecks as a
+ * `CellRow` but fails at `to_cell_json` — this is the projection that
+ * actually produces one.
  */
-const grant_count_projection = (cell_alias) => `(SELECT COUNT(*)::int FROM cell_grant WHERE cell_id = ${cell_alias}.id) AS grant_count`;
+export const cell_row_projection = (alias) => `${qualify_columns(CELL_COLUMNS, alias)}, (SELECT COUNT(*)::int FROM cell_grant WHERE cell_id = ${alias}.id) AS grant_count`;
 /**
  * Insert a cell row, deriving `refs` from `data`.
  *
@@ -53,7 +86,7 @@ export const query_cell_create = async (deps, input) => {
     const row = await deps.db.query_one(`INSERT INTO cell
 		   (data, kind, visibility, path, refs, parent_id, root_id, moderation, created_by)
 		 VALUES ($1::jsonb, $2, COALESCE($3::cell_visibility, 'private'::cell_visibility), $4, $5::text[], $6, $7, $8, $9)
-		 RETURNING *, ${grant_count_projection('cell')}`, [
+		 RETURNING ${cell_row_projection('cell')}`, [
         JSON.stringify(input.data),
         input.kind ?? null,
         input.visibility ?? null,
@@ -76,7 +109,7 @@ export const query_cell_create = async (deps, input) => {
  */
 export const query_cell_get = async (deps, id, options) => {
     const include_deleted = options?.include_deleted === true;
-    const row = await deps.db.query_one(`SELECT *, ${grant_count_projection('cell')}
+    const row = await deps.db.query_one(`SELECT ${cell_row_projection('cell')}
 		 FROM cell
 		 WHERE id = $1
 		   AND ($2::bool OR deleted_at IS NULL)`, [id, include_deleted]);
@@ -92,7 +125,7 @@ export const query_cell_get = async (deps, id, options) => {
  * @returns the row or `null` when not found
  */
 export const query_cell_get_by_path = async (deps, path) => {
-    const row = await deps.db.query_one(`SELECT *, ${grant_count_projection('cell')}
+    const row = await deps.db.query_one(`SELECT ${cell_row_projection('cell')}
 		 FROM cell
 		 WHERE path = $1 AND deleted_at IS NULL`, [path]);
     return row ?? null;
@@ -111,7 +144,7 @@ export const query_cell_get_by_path = async (deps, path) => {
 export const query_cell_load_many = async (deps, ids) => {
     if (ids.length === 0)
         return [];
-    return deps.db.query(`SELECT *, ${grant_count_projection('cell')}
+    return deps.db.query(`SELECT ${cell_row_projection('cell')}
 		 FROM cell
 		 WHERE id = ANY($1::uuid[]) AND deleted_at IS NULL`, [ids]);
 };
@@ -140,7 +173,7 @@ export const query_cell_update = async (deps, id, patch) => {
 		   visibility = CASE WHEN $9::bool THEN $10::cell_visibility ELSE visibility END,
 		   updated_at = NOW()
 		 WHERE id = $1 AND deleted_at IS NULL
-		 RETURNING *, ${grant_count_projection('cell')}`, [
+		 RETURNING ${cell_row_projection('cell')}`, [
         id,
         data_provided,
         data_provided ? JSON.stringify(patch.data) : null,
@@ -199,7 +232,7 @@ export const query_cell_set_moderation = async (deps, id, moderation, options) =
 		   updated_by = $4,
 		   updated_at = NOW()
 		 WHERE id = $1 AND deleted_at IS NULL
-		 RETURNING *, ${grant_count_projection('cell')}`, [id, moderation, options.set_visibility_public, options.updated_by ?? null]);
+		 RETURNING ${cell_row_projection('cell')}`, [id, moderation, options.set_visibility_public, options.updated_by ?? null]);
     return row ?? null;
 };
 /**
@@ -211,7 +244,7 @@ export const query_cell_set_moderation = async (deps, id, moderation, options) =
  * @param options - pagination
  * @returns matching active rows
  */
-export const query_cell_list_by_kind = async (deps, kind, options) => deps.db.query(`SELECT *, ${grant_count_projection('cell')}
+export const query_cell_list_by_kind = async (deps, kind, options) => deps.db.query(`SELECT ${cell_row_projection('cell')}
 		 FROM cell
 		 WHERE kind = $1
 		   AND deleted_at IS NULL
@@ -226,7 +259,7 @@ export const query_cell_list_by_kind = async (deps, kind, options) => deps.db.qu
  * @param options - pagination
  * @returns matching active rows
  */
-export const query_cell_list_by_creator = async (deps, actor_id, options) => deps.db.query(`SELECT *, ${grant_count_projection('cell')}
+export const query_cell_list_by_creator = async (deps, actor_id, options) => deps.db.query(`SELECT ${cell_row_projection('cell')}
 		 FROM cell
 		 WHERE created_by = $1 AND deleted_at IS NULL
 		 ORDER BY created_at DESC
@@ -365,7 +398,7 @@ const CALLER_ROLE_GRANTS_CTE = `WITH caller_role_grants AS (
 	 )`;
 /** General `cell_list` SQL: cell-driven scan, full visibility predicate. */
 const build_general_sql = (order_column, order_direction) => `${CALLER_ROLE_GRANTS_CTE}
-	 SELECT c.*, ${grant_count_projection('c')} FROM cell c
+	 SELECT ${cell_row_projection('c')} FROM cell c
 	 WHERE ($1::bool OR c.deleted_at IS NULL)
 	   AND ($2::text IS NULL OR c.kind = $2::text)
 	   AND ($14::cell_visibility IS NULL OR c.visibility = $14::cell_visibility)
@@ -403,7 +436,7 @@ const build_general_sql = (order_column, order_direction) => `${CALLER_ROLE_GRAN
  * "what's shared with me" wants their grant footprint, not every cell.
  */
 const build_shared_with_sql = (order_column, order_direction) => `${CALLER_ROLE_GRANTS_CTE}
-	 SELECT c.*, ${grant_count_projection('c')} FROM cell c
+	 SELECT ${cell_row_projection('c')} FROM cell c
 	 WHERE ($1::bool OR c.deleted_at IS NULL)
 	   AND ($2::text IS NULL OR c.kind = $2::text)
 	   AND ($14::cell_visibility IS NULL OR c.visibility = $14::cell_visibility)
@@ -422,7 +455,7 @@ const build_shared_with_sql = (order_column, order_direction) => `${CALLER_ROLE_
 	   -- $6 (viewer_is_admin) intentionally not consulted: an admin
 	   -- asking "what's shared with me" wants their grant footprint, not
 	   -- every cell. Cast-only reference keeps the param's type known to
-	   -- the planner so the shared 14-param positional layout stays valid.
+	   -- the planner so the shared 16-param positional layout stays valid.
 	   AND $6::bool IS NOT NULL
 	 ORDER BY c.${order_column} ${order_direction} NULLS LAST
 	 LIMIT $8 OFFSET $9`;

package/dist/db/fact_queries.d.ts

@@ -22,6 +22,13 @@ export interface FactRow {
     size: number | string;
     created_at: Date;
 }
+/**
+ * The full `fact` column set, named explicitly so a row read fails loud on
+ * schema drift (see `ACCOUNT_COLUMNS` in `auth/account_queries.ts` for the
+ * outage class). Keep in sync with `FactRow` and the `fact` DDL in
+ * `db/fact_ddl.ts`.
+ */
+export declare const FACT_COLUMNS: readonly ["hash", "bytes", "external_url", "content_type", "size", "created_at"];
 /** Subset returned by metadata-only queries (no `bytes` payload). */
 export interface FactMetaRow {
     hash: FactHash;

package/dist/db/fact_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fact_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/fact_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAEjE,0CAA0C;AAC1C,MAAM,WAAW,OAAO;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAK5B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,UAAU,EAAE,IAAI,CAAC;CACjB;AAED,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,QAAQ,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAE5B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,UAAU,EAAE,IAAI,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,SAAS,EACf,OAAO;IACN,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;CACb,KACC,OAAO,CAAC,OAAO,CASjB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,aAAa,QAAQ,EACrB,eAAe,KAAK,CAAC,QAAQ,CAAC,KAC5B,OAAO,CAAC,IAAI,CAQd,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,GAAU,MAAM,SAAS,EAAE,MAAM,QAAQ,KAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAO5F,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,MAAM,QAAQ,KACZ,OAAO,CAAC,WAAW,GAAG,IAAI,CAO5B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,cAAc,GAAU,MAAM,SAAS,EAAE,MAAM,QAAQ,KAAG,OAAO,CAAC,OAAO,CAMrF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,aAAa,QAAQ,KACnB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAMzB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,MAAM,QAAQ,KACZ,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAQ9D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,QAAQ,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,YAAY,IAAI,GAAG,IAAI,EACvB,cAAc,MAAM,KAClB,OAAO,CAAC,qBAAqB,CA2C/B,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,EACf,YAAY,IAAI,KACd,OAAO,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAiB9E,CAAC"}
+{"version":3,"file":"fact_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/fact_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAGjE,0CAA0C;AAC1C,MAAM,WAAW,OAAO;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAK5B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,UAAU,EAAE,IAAI,CAAC;CACjB;AAED;;;;;GAKG;AACH,eAAO,MAAM,YAAY,kFAOwB,CAAC;AAKlD,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,QAAQ,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAE5B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,UAAU,EAAE,IAAI,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,SAAS,EACf,OAAO;IACN,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;CACb,KACC,OAAO,CAAC,OAAO,CASjB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,aAAa,QAAQ,EACrB,eAAe,KAAK,CAAC,QAAQ,CAAC,KAC5B,OAAO,CAAC,IAAI,CAQd,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,GAAU,MAAM,SAAS,EAAE,MAAM,QAAQ,KAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAO5F,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,MAAM,QAAQ,KACZ,OAAO,CAAC,WAAW,GAAG,IAAI,CAO5B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,cAAc,GAAU,MAAM,SAAS,EAAE,MAAM,QAAQ,KAAG,OAAO,CAAC,OAAO,CAMrF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,aAAa,QAAQ,KACnB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAMzB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,MAAM,QAAQ,KACZ,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAQ9D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,QAAQ,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,YAAY,IAAI,GAAG,IAAI,EACvB,cAAc,MAAM,KAClB,OAAO,CAAC,qBAAqB,CA2C/B,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,EACf,YAAY,IAAI,KACd,OAAO,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAiB9E,CAAC"}

package/dist/db/fact_queries.js

@@ -11,6 +11,23 @@
  *
  * @module
  */
+import { columns_sql, omit_columns } from './sql_columns.js';
+/**
+ * The full `fact` column set, named explicitly so a row read fails loud on
+ * schema drift (see `ACCOUNT_COLUMNS` in `auth/account_queries.ts` for the
+ * outage class). Keep in sync with `FactRow` and the `fact` DDL in
+ * `db/fact_ddl.ts`.
+ */
+export const FACT_COLUMNS = [
+    'hash',
+    'bytes',
+    'external_url',
+    'content_type',
+    'size',
+    'created_at'
+];
+/** `FACT_COLUMNS` minus the payload — the `FactMetaRow` projection. */
+const FACT_META_COLUMNS = omit_columns(FACT_COLUMNS, 'bytes');
 /**
  * Idempotently insert a fact row.
  *
@@ -44,7 +61,7 @@ export const query_put_fact_refs = async (deps, source_hash, target_hashes) => {
  * `FactStore.get`; cheaper accessors live below.
  */
 export const query_get_fact = async (deps, hash) => {
-    const row = await deps.db.query_one(`SELECT hash, bytes, external_url, content_type, size, created_at
+    const row = await deps.db.query_one(`SELECT ${columns_sql(FACT_COLUMNS)}
 		 FROM fact WHERE hash = $1`, [hash]);
     return row ?? null;
 };
@@ -52,7 +69,7 @@ export const query_get_fact = async (deps, hash) => {
  * Fetch metadata only — skips the (potentially large) `bytes` column.
  */
 export const query_get_fact_meta = async (deps, hash) => {
-    const row = await deps.db.query_one(`SELECT hash, external_url, content_type, size, created_at
+    const row = await deps.db.query_one(`SELECT ${columns_sql(FACT_META_COLUMNS)}
 		 FROM fact WHERE hash = $1`, [hash]);
     return row ?? null;
 };

package/dist/db/schema_ready.d.ts

@@ -47,9 +47,14 @@ export type ExpectedSchema = Record<string, ReadonlyArray<string>>;
  * never-migrated DB then correctly fails readiness instead of passing on an
  * empty expectation.
  *
+ * @param db - the database to introspect
+ * @param options - `table` narrows the scan to one relation (the drift guard's
+ *   one-table question); omitted, every `public` relation is returned
  * @returns relation name → sorted column names
  */
-export declare const query_public_columns: (db: Db) => Promise<Record<string, Array<string>>>;
+export declare const query_public_columns: (db: Db, options?: {
+    table?: string;
+}) => Promise<Record<string, Array<string>>>;
 /** Columns the live DB is missing for a table the expected schema declares. */
 export interface MissingColumns {
     table: string;

package/dist/db/schema_ready.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema_ready.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/schema_ready.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAElC,iFAAiF;AACjF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;AAOnE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,GAAU,IAAI,EAAE,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAWxF,CAAC;AAEF,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACvB;AAED,uCAAuC;AACvC,MAAM,WAAW,iBAAiB;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,+CAA+C;IAC/C,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,6EAA6E;IAC7E,eAAe,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;CACvC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAC9B,IAAI,EAAE,EACN,UAAU,cAAc,KACtB,OAAO,CAAC,iBAAiB,CAmB3B,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,GAAI,OAAO,iBAAiB,KAAG,MAO9D,CAAC;AAEF,sFAAsF;AACtF,eAAO,MAAM,WAAW;;;CAGd,CAAC"}
+{"version":3,"file":"schema_ready.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/schema_ready.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAElC,iFAAiF;AACjF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;AAOnE;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,oBAAoB,GAChC,IAAI,EAAE,EACN,UAAU;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,KAC1B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAavC,CAAC;AAEF,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACvB;AAED,uCAAuC;AACvC,MAAM,WAAW,iBAAiB;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,+CAA+C;IAC/C,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,6EAA6E;IAC7E,eAAe,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;CACvC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAC9B,IAAI,EAAE,EACN,UAAU,cAAc,KACtB,OAAO,CAAC,iBAAiB,CAmB3B,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,GAAI,OAAO,iBAAiB,KAAG,MAO9D,CAAC;AAEF,sFAAsF;AACtF,eAAO,MAAM,WAAW;;;CAGd,CAAC"}

package/dist/db/schema_ready.js

@@ -44,12 +44,16 @@
  * never-migrated DB then correctly fails readiness instead of passing on an
  * empty expectation.
  *
+ * @param db - the database to introspect
+ * @param options - `table` narrows the scan to one relation (the drift guard's
+ *   one-table question); omitted, every `public` relation is returned
  * @returns relation name → sorted column names
  */
-export const query_public_columns = async (db) => {
+export const query_public_columns = async (db, options) => {
     const rows = await db.query(`SELECT table_name, column_name FROM information_schema.columns
 		 WHERE table_schema = 'public'
-		 ORDER BY table_name, column_name`);
+		   AND ($1::text IS NULL OR table_name = $1)
+		 ORDER BY table_name, column_name`, [options?.table ?? null]);
     const by_table = {};
     for (const { table_name, column_name } of rows) {
         (by_table[table_name] ??= []).push(column_name);

package/dist/db/sql_columns.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Helpers for the named-column projection consts (`ACCOUNT_COLUMNS`,
+ * `CELL_COLUMNS`, …) — per-table column-name arrays that every table read
+ * projects through so a dropped or leftover column fails loud instead of
+ * vanishing under `SELECT *`.
+ *
+ * Each query module exports its table's const and derives every projection
+ * it needs from it at the read site — `columns_sql` for single-table reads,
+ * `qualify_columns` for reads that alias the table, `omit_columns` for a
+ * client-safe subset — rather than spelling a second column list, so the
+ * drift guard on the base const (`assert_columns_match_live` in
+ * `testing/db.ts`) covers every derived projection too. Twin of the Rust
+ * spine's `*_COLUMNS` consts + `fuz_db::qualify_columns`.
+ *
+ * Placement rule: a const lives in its table's query module. When two query
+ * modules project the same table (the revoke cascades in
+ * `auth/role_grant_queries.ts` supersede `role_grant_offer` rows while the
+ * offer module's accept path writes `role_grant` rows), it lives in the
+ * table's `*_ddl.ts` instead — the module both already import — so the query
+ * modules stay acyclic.
+ *
+ * Column arrays are literal consts; the alias passed to `qualify_columns` is
+ * the only input these helpers treat as dynamic (and validate). Each const
+ * also carries `satisfies ReadonlyArray<keyof Row>` so a column name the row
+ * type doesn't know is a compile error.
+ *
+ * @module
+ */
+/**
+ * Render a `*_COLUMNS` const as a SQL select list, in projection order.
+ *
+ * @param columns - the column names
+ * @returns `a, b, c`
+ */
+export declare const columns_sql: (columns: ReadonlyArray<string>) => string;
+/**
+ * Render a `*_COLUMNS` const as a SQL select list with every column qualified
+ * by a table alias, for reads that alias the table (JOINs, the `c`-aliased
+ * `cell_list` scan).
+ *
+ * The alias is interpolated into SQL, so it must be a plain identifier —
+ * every in-repo call passes a literal, but a consumer threading a computed
+ * alias through gets a thrown error instead of a malformed (or injectable)
+ * projection.
+ *
+ * @param columns - the column names
+ * @param alias - the table alias or name to prefix each column with
+ * @returns `alias.a, alias.b, alias.c`
+ * @throws Error when `alias` is not a valid SQL identifier
+ */
+export declare const qualify_columns: (columns: ReadonlyArray<string>, alias: string) => string;
+/**
+ * Drop named columns from a `*_COLUMNS` const, preserving projection order —
+ * for a read that deliberately narrows the row (a client-safe listing, a
+ * metadata read that skips a payload column).
+ *
+ * With an `as const` column array the omitted names are checked at compile
+ * time; the runtime check covers plain `string[]` consts (a consumer's).
+ *
+ * @param columns - the column names
+ * @param omitted - column names to leave out
+ * @returns the columns without the omitted ones, in projection order
+ * @throws Error when an omitted name isn't in the list — a typo here would
+ *   silently keep the column it meant to hide
+ */
+export declare const omit_columns: <T extends string>(columns: ReadonlyArray<T>, ...omitted: Array<NoInfer<T>>) => ReadonlyArray<T>;
+//# sourceMappingURL=sql_columns.d.ts.map

package/dist/db/sql_columns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql_columns.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/sql_columns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,SAAS,aAAa,CAAC,MAAM,CAAC,KAAG,MAA4B,CAAC;AAE1F;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,eAAe,GAAI,SAAS,aAAa,CAAC,MAAM,CAAC,EAAE,OAAO,MAAM,KAAG,MAG/E,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY,GAAI,CAAC,SAAS,MAAM,EAC5C,SAAS,aAAa,CAAC,CAAC,CAAC,EACzB,GAAG,SAAS,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAC3B,aAAa,CAAC,CAAC,CAOjB,CAAC"}

package/dist/db/sql_columns.js

@@ -0,0 +1,77 @@
+/**
+ * Helpers for the named-column projection consts (`ACCOUNT_COLUMNS`,
+ * `CELL_COLUMNS`, …) — per-table column-name arrays that every table read
+ * projects through so a dropped or leftover column fails loud instead of
+ * vanishing under `SELECT *`.
+ *
+ * Each query module exports its table's const and derives every projection
+ * it needs from it at the read site — `columns_sql` for single-table reads,
+ * `qualify_columns` for reads that alias the table, `omit_columns` for a
+ * client-safe subset — rather than spelling a second column list, so the
+ * drift guard on the base const (`assert_columns_match_live` in
+ * `testing/db.ts`) covers every derived projection too. Twin of the Rust
+ * spine's `*_COLUMNS` consts + `fuz_db::qualify_columns`.
+ *
+ * Placement rule: a const lives in its table's query module. When two query
+ * modules project the same table (the revoke cascades in
+ * `auth/role_grant_queries.ts` supersede `role_grant_offer` rows while the
+ * offer module's accept path writes `role_grant` rows), it lives in the
+ * table's `*_ddl.ts` instead — the module both already import — so the query
+ * modules stay acyclic.
+ *
+ * Column arrays are literal consts; the alias passed to `qualify_columns` is
+ * the only input these helpers treat as dynamic (and validate). Each const
+ * also carries `satisfies ReadonlyArray<keyof Row>` so a column name the row
+ * type doesn't know is a compile error.
+ *
+ * @module
+ */
+import { assert_valid_sql_identifier } from './sql_identifier.js';
+/**
+ * Render a `*_COLUMNS` const as a SQL select list, in projection order.
+ *
+ * @param columns - the column names
+ * @returns `a, b, c`
+ */
+export const columns_sql = (columns) => columns.join(', ');
+/**
+ * Render a `*_COLUMNS` const as a SQL select list with every column qualified
+ * by a table alias, for reads that alias the table (JOINs, the `c`-aliased
+ * `cell_list` scan).
+ *
+ * The alias is interpolated into SQL, so it must be a plain identifier —
+ * every in-repo call passes a literal, but a consumer threading a computed
+ * alias through gets a thrown error instead of a malformed (or injectable)
+ * projection.
+ *
+ * @param columns - the column names
+ * @param alias - the table alias or name to prefix each column with
+ * @returns `alias.a, alias.b, alias.c`
+ * @throws Error when `alias` is not a valid SQL identifier
+ */
+export const qualify_columns = (columns, alias) => {
+    assert_valid_sql_identifier(alias);
+    return columns_sql(columns.map((c) => `${alias}.${c}`));
+};
+/**
+ * Drop named columns from a `*_COLUMNS` const, preserving projection order —
+ * for a read that deliberately narrows the row (a client-safe listing, a
+ * metadata read that skips a payload column).
+ *
+ * With an `as const` column array the omitted names are checked at compile
+ * time; the runtime check covers plain `string[]` consts (a consumer's).
+ *
+ * @param columns - the column names
+ * @param omitted - column names to leave out
+ * @returns the columns without the omitted ones, in projection order
+ * @throws Error when an omitted name isn't in the list — a typo here would
+ *   silently keep the column it meant to hide
+ */
+export const omit_columns = (columns, ...omitted) => {
+    for (const o of omitted) {
+        if (!columns.includes(o)) {
+            throw new Error(`omit_columns: "${o}" is not in the column list "${columns.join(', ')}"`);
+        }
+    }
+    return columns.filter((c) => !omitted.includes(c));
+};

package/dist/db/sql_identifier.d.ts

@@ -1,10 +1,11 @@
 /**
- * SQL identifier validation for dynamic DDL queries.
+ * SQL identifier validation for the places an identifier must be
+ * interpolated rather than parameterized.
  *
- * PostgreSQL DDL operations (DROP TABLE, TRUNCATE, ALTER) do not support
- * parameterized table/column names — only values can be parameterized.
- * This validator ensures identifiers are safe for string interpolation
- * in those specific cases.
+ * PostgreSQL parameterizes values only — table and column names in DDL
+ * (DROP TABLE, TRUNCATE, ALTER) and the alias `qualify_columns` prefixes
+ * onto a projection (`db/sql_columns.ts`) have to be string-interpolated.
+ * This validator ensures such identifiers are safe to interpolate.
  *
  * @module
  */

package/dist/db/sql_identifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sql_identifier.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/sql_identifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;GAGG;AACH,eAAO,MAAM,oBAAoB,QAA6B,CAAC;AAE/D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B,GAAI,MAAM,MAAM,KAAG,MAK1D,CAAC"}
+{"version":3,"file":"sql_identifier.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/sql_identifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;GAGG;AACH,eAAO,MAAM,oBAAoB,QAA6B,CAAC;AAE/D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B,GAAI,MAAM,MAAM,KAAG,MAK1D,CAAC"}

package/dist/db/sql_identifier.js

@@ -1,10 +1,11 @@
 /**
- * SQL identifier validation for dynamic DDL queries.
+ * SQL identifier validation for the places an identifier must be
+ * interpolated rather than parameterized.
  *
- * PostgreSQL DDL operations (DROP TABLE, TRUNCATE, ALTER) do not support
- * parameterized table/column names — only values can be parameterized.
- * This validator ensures identifiers are safe for string interpolation
- * in those specific cases.
+ * PostgreSQL parameterizes values only — table and column names in DDL
+ * (DROP TABLE, TRUNCATE, ALTER) and the alias `qualify_columns` prefixes
+ * onto a projection (`db/sql_columns.ts`) have to be string-interpolated.
+ * This validator ensures such identifiers are safe to interpolate.
  *
  * @module
  */

package/dist/http/CLAUDE.md

@@ -71,7 +71,7 @@ interface RouteContext {
 ```
 
 - **`route.db`** — handler's main DB work. Wrapped in a transaction when `transaction: true` (default for non-GET); routes that opt out (`transaction: false`, e.g. signup / bootstrap) get the pool here directly and may call `route.db.transaction(...)` for their own scope.
-- **`route.pending_effects`** — direct push for eager fire-and-forget pool writes (audit, session touch, api-token usage tracking).
+- **`route.pending_effects`** — direct push for eager fire-and-forget pool writes (audit, api-token usage tracking).
 - **`route.post_commit_effects`** — do not push directly; reach for `emit_after_commit` from `http/pending_effects.ts`. The helper pushes a thunk that the flush middleware invokes after the handler returns, closing the microtask-ordering window that an eager `Promise.resolve().then(fn)` leaves open inside the wrapping `db.transaction`.
 
 Pool-level fire-and-forget writes (audit logs, etc.) run through the bound

package/dist/http/route_spec.d.ts

@@ -83,8 +83,8 @@ export interface RouteContext {
     db: Db;
     /**
      * Eager fire-and-forget queue — push the in-flight `Promise<void>` for
-     * pool writes already running (audit emits, session touch, api-token
-     * usage tracking). The flush middleware drains via
+     * pool writes already running (audit emits, api-token usage
+     * tracking). The flush middleware drains via
      * `flush_pending_effects` after the handler returns.
      */
     pending_effects: Array<Promise<void>>;