@fuzdev/fuz_app 0.110.1 → 0.112.0

package/dist/auth/session_queries.js

@@ -8,6 +8,7 @@
  */
 import { hash_blake3 } from '@fuzdev/fuz_util/hash_blake3.ts';
 import { generate_random_base64url } from '../crypto.js';
+import { columns_sql, iso8601_timestamp_expr, qualify_columns } from '../db/sql_columns.js';
 /**
  * Session lifetime in milliseconds (30 days).
  *
@@ -53,6 +54,27 @@ export const query_create_session = async (deps, token_hash, account_id, expires
         expires_at.toISOString()
     ]);
 };
+/**
+ * The full `auth_session` column set, named explicitly so a row read fails
+ * loud on schema drift — `SELECT *` would silently carry a dropped or
+ * leftover column into the strict-validated wire shapes (see
+ * `ACCOUNT_COLUMNS` in `auth/account_queries.ts` for the outage class this
+ * discipline exists to prevent; the Rust twin already names columns at every
+ * session site). Keep in sync with `AuthSession` and the migration chain's
+ * end state — not the frozen v0 DDL in `auth/auth_ddl.ts`, which still
+ * creates `last_seen_at` for the appended drop migration to remove.
+ */
+export const AUTH_SESSION_COLUMNS = [
+    'id',
+    'account_id',
+    'created_at',
+    'expires_at'
+];
+/** The `auth_session` timestamp override, by row qualifier (`''` bare, `s` for the admin listing's JOIN). */
+const auth_session_expr = iso8601_timestamp_expr(AUTH_SESSION_COLUMNS, [
+    'created_at',
+    'expires_at'
+]);
 /**
  * Get a session if it exists, is not expired, and has not been revoked.
  *
@@ -60,7 +82,7 @@ export const query_create_session = async (deps, token_hash, account_id, expires
  * @param token_hash - blake3 hash of the session token
  */
 export const query_session_get_valid = async (deps, token_hash) => {
-    return deps.db.query_one(`SELECT * FROM auth_session WHERE id = $1 AND expires_at > NOW()`, [token_hash]);
+    return deps.db.query_one(`SELECT ${columns_sql(AUTH_SESSION_COLUMNS, auth_session_expr(''))} FROM auth_session WHERE id = $1 AND expires_at > NOW()`, [token_hash]);
 };
 /**
  * Revoke (delete) a session by its token hash, with no account scoping.
@@ -106,7 +128,7 @@ export const query_session_revoke_all_for_account = async (deps, account_id) =>
  * List sessions for an account, newest first.
  */
 export const query_session_list_for_account = async (deps, account_id, limit = 50) => {
-    return deps.db.query(`SELECT * FROM auth_session WHERE account_id = $1 ORDER BY created_at DESC LIMIT $2`, [account_id, limit]);
+    return deps.db.query(`SELECT ${columns_sql(AUTH_SESSION_COLUMNS, auth_session_expr(''))} FROM auth_session WHERE account_id = $1 ORDER BY auth_session.created_at DESC LIMIT $2`, [account_id, limit]);
 };
 /**
  * Enforce a per-account session limit by evicting the oldest sessions.
@@ -163,16 +185,14 @@ export const query_session_enforce_limit = async (deps, account_id, max_sessions
  * List all active sessions across all accounts with usernames.
  *
  * Ordered by `created_at DESC` (newest session first), matching the
- * per-account listing. `last_seen_at` is still selected for the wire shape
- * but is decorative — nothing updates it post-mint (it always equals
- * `created_at`); it is slated for removal on its own twin migration.
+ * per-account listing.
  *
  * @param deps - query dependencies
  * @param limit - maximum entries to return
  * @returns active sessions joined with account usernames, newest first
  */
 export const query_session_list_all_active = async (deps, limit = 200) => {
-    return deps.db.query(`SELECT s.id, s.account_id, s.created_at, s.expires_at, s.last_seen_at, a.username
+    return deps.db.query(`SELECT ${qualify_columns(AUTH_SESSION_COLUMNS, 's', auth_session_expr('s'))}, a.username
 		 FROM auth_session s
 		 JOIN account a ON a.id = s.account_id
 		 WHERE s.expires_at > NOW()

package/dist/db/CLAUDE.md

@@ -27,6 +27,29 @@ the code.
 - `assert_row.ts` — `assert_row(row, context)` for INSERT … RETURNING.
 - `pg_error.ts` — `pg_error_code` (SQLSTATE extractor for `pg`/PGlite errors), `is_pg_unique_violation` (Postgres `23505`).
 - `sql_identifier.ts` — `assert_valid_sql_identifier`.
+- `sql_columns.ts` — `columns_sql` / `qualify_columns` / `omit_columns`,
+  the derivation helpers every `*_COLUMNS` projection const's variants
+  (alias-qualified JOIN reads, the client-safe `minus token_hash` listing)
+  are built from, so the drift guard on the base const covers them. Both
+  renderers take an optional `ColumnExpr` — a per-column expression
+  override, twin of the third argument to `fuz_db::qualify_columns` — and
+  alias an overridden column back to its own name (TS reads rows by name;
+  the Rust twin decodes positionally and needs no output name). The one
+  override in this repo is `iso8601_timestamp_column(alias, column)`, twin
+  of `fuz_db::iso8601_timestamp_column` down to the format literal
+  (`to_char(… AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS"Z"')`): every
+  timestamp that reaches the wire projects through it, so both spines
+  serialize the same instant to the same 20-character second-precision UTC
+  string. Each query module builds its override once with
+  `iso8601_timestamp_expr(TABLE_COLUMNS, [...timestamp columns])` — typed
+  against the const, checked at load — and passes `expr(alias)` at each
+  read. `timestamp.ts` (`to_iso8601_seconds` / `ISO8601_SECONDS`) is that
+  shape for stamps minted in TS rather than read from a row. A cascade's
+  inner `RETURNING` inside a `WITH updated AS (…)` stays raw — the outer
+  select formats, and `to_char` over already-formatted text would fail.
+  `fact`'s store rows are the deliberate exception: `PgFactStore` feeds
+  `FactMeta.created_at`, a `Date` in the `@fuzdev/fuz_util` `FactStore`
+  contract, and nothing serializes it.
 - `status.ts` — CLI DB status utility.
 - `schema_ready.ts` — `/ready` deploy-gate core: `query_public_columns`
   (keeps `schema_version`, unlike `query_schema_snapshot`), pure
@@ -98,6 +121,17 @@ child_id`, fractional-index keyed): `query_cell_item_insert` (throws
   `target_id`), bitmap-OR over `idx_audit_log_metadata` (the `jsonb_path_ops`
   GIN the `audit_log_metadata_gin_index` auth migration ships).
 
+**Named projections** (rationale + helpers: ../../../docs/architecture.md
+§Query Modules). The consts on this side: `CELL_COLUMNS`,
+`CELL_GRANT_COLUMNS`, `CELL_FIELD_COLUMNS`, `CELL_ITEM_COLUMNS`, `FACT_COLUMNS`
+(the meta read derives `minus bytes`). The derived `grant_count` stays an
+appended expression in the exported `cell_row_projection(alias)` rather than a
+`CELL_COLUMNS` entry, so the const is exactly the table's column set. Column
+order twins the Rust `fuz_cell` / `fuz_fact` `*_COLUMNS` consts. Every const is pinned to
+the live schema — and every public table forced to carry a const or a named
+exemption — by `src/test/db/column_projections.db.test.ts`; the cell
+`*_queries.db.test.ts` files pin the aliased JOIN reads and `grant_count`.
+
 ## Fact layer
 
 Content-addressed byte store. Cells reference facts by blake3 hash

package/dist/db/cell_audit_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_audit_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_audit_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAoBnD,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,SAAS,EACf,SAAS,IAAI,EACb,SAAS,oBAAoB,KAC3B,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAwB9B,CAAC"}
+{"version":3,"file":"cell_audit_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_audit_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAoBnD,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,SAAS,EACf,SAAS,IAAI,EACb,SAAS,oBAAoB,KAC3B,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAwB9B,CAAC"}

package/dist/db/cell_audit_queries.js

@@ -12,6 +12,8 @@
  *
  * @module
  */
+import { AUDIT_LOG_COLUMNS, audit_log_expr } from '../auth/audit_log_queries.js';
+import { columns_sql } from './sql_columns.js';
 /**
  * Metadata-jsonb keys cell-domain events use to name the cell. This
  * array is the **only** source these key strings can come from —
@@ -51,5 +53,5 @@ export const query_audit_log_list_by_cell = async (deps, cell_id, options) => {
     const where = `WHERE ${conditions.join(' AND ')}`;
     const limit_placeholder = `$${i++}`;
     params.push(options.limit);
-    return deps.db.query(`SELECT * FROM audit_log ${where} ORDER BY seq DESC LIMIT ${limit_placeholder}`, params);
+    return deps.db.query(`SELECT ${columns_sql(AUDIT_LOG_COLUMNS, audit_log_expr(''))} FROM audit_log ${where} ORDER BY seq DESC LIMIT ${limit_placeholder}`, params);
 };

package/dist/db/cell_field_queries.d.ts

@@ -23,8 +23,15 @@ export interface CellFieldRow {
     source_id: Uuid;
     name: string;
     target_id: Uuid;
-    created_at: Date;
+    created_at: string;
 }
+/**
+ * The full `cell_field` column set, named explicitly so a row read fails
+ * loud on schema drift (see `CELL_COLUMNS` in `db/cell_queries.ts`). Column
+ * order mirrors the Rust twin's `field_columns(alias)` (`fuz_cell`). Keep in
+ * sync with `CellFieldRow` and the `cell_field` DDL in `db/cell_ddl.ts`.
+ */
+export declare const CELL_FIELD_COLUMNS: readonly ["source_id", "name", "target_id", "created_at"];
 /** Input for `query_cell_field_set`. */
 export interface CellFieldSetQueryInput {
     source_id: Uuid;
@@ -76,7 +83,9 @@ export declare const query_cell_field_delete: (deps: QueryDeps, source_id: Uuid,
  *
  * @param deps - query deps
  * @param source_id - source cell id
- * @returns matching rows, oldest first by name (lex order)
+ * @param options - `limit` caps the row count; `name_after` resumes after a
+ *   name (keyset pagination)
+ * @returns matching rows in lex `name` order
  */
 export declare const query_cell_field_list_for_source: (deps: QueryDeps, source_id: Uuid, options?: {
     limit?: number;
@@ -97,7 +106,7 @@ export declare const query_cell_field_list_for_source: (deps: QueryDeps, source_
  * @param deps - query deps
  * @param target_id - target cell id
  * @param options - `limit` caps the row count
- * @returns matching rows, oldest first by source created_at
+ * @returns matching rows, oldest field first (by the field row's `created_at`)
  */
 export declare const query_cell_field_list_for_target: (deps: QueryDeps, target_id: Uuid, options?: {
     limit?: number;

package/dist/db/cell_field_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_field_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_field_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAGnD,kDAAkD;AAClD,MAAM,WAAW,YAAY;IAC5B,SAAS,EAAE,IAAI,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,IAAI,CAAC;CACjB;AAED,wCAAwC;AACxC,MAAM,WAAW,sBAAsB;IACtC,SAAS,EAAE,IAAI,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,IAAI,CAAC;CAChB;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,OAAO,sBAAsB,KAC3B,OAAO,CAAC,YAAY,CAUtB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,WAAW,IAAI,EACf,MAAM,MAAM,KACV,OAAO,CAAC,YAAY,GAAG,IAAI,CAM7B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,WAAW,IAAI,EACf,MAAM,MAAM,KACV,OAAO,CAAC,YAAY,GAAG,IAAI,CAM7B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,WAAW,IAAI,EACf,UAAU;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,KAC/C,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAa7B,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,WAAW,IAAI,EACf,UAAU;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,KAC1B,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAS5B,CAAC"}
+{"version":3,"file":"cell_field_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_field_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAInD,kDAAkD;AAClD,MAAM,WAAW,YAAY;IAC5B,SAAS,EAAE,IAAI,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,2DAKuB,CAAC;AAKvD,wCAAwC;AACxC,MAAM,WAAW,sBAAsB;IACtC,SAAS,EAAE,IAAI,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,IAAI,CAAC;CAChB;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,OAAO,sBAAsB,KAC3B,OAAO,CAAC,YAAY,CAUtB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,WAAW,IAAI,EACf,MAAM,MAAM,KACV,OAAO,CAAC,YAAY,GAAG,IAAI,CAM7B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,WAAW,IAAI,EACf,MAAM,MAAM,KACV,OAAO,CAAC,YAAY,GAAG,IAAI,CAO7B,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,WAAW,IAAI,EACf,UAAU;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,KAC/C,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAa7B,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,WAAW,IAAI,EACf,UAAU;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,KAC1B,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAS5B,CAAC"}

package/dist/db/cell_field_queries.js

@@ -17,6 +17,21 @@
  * @module
  */
 import { assert_row } from './assert_row.js';
+import { columns_sql, iso8601_timestamp_expr, qualify_columns } from './sql_columns.js';
+/**
+ * The full `cell_field` column set, named explicitly so a row read fails
+ * loud on schema drift (see `CELL_COLUMNS` in `db/cell_queries.ts`). Column
+ * order mirrors the Rust twin's `field_columns(alias)` (`fuz_cell`). Keep in
+ * sync with `CellFieldRow` and the `cell_field` DDL in `db/cell_ddl.ts`.
+ */
+export const CELL_FIELD_COLUMNS = [
+    'source_id',
+    'name',
+    'target_id',
+    'created_at'
+];
+/** The `cell_field` timestamp override, by row qualifier (`''` bare, `f` for the cell-joined reads). */
+const cell_field_expr = iso8601_timestamp_expr(CELL_FIELD_COLUMNS, ['created_at']);
 /**
  * Insert or update a field row.
  *
@@ -35,7 +50,7 @@ export const query_cell_field_set = async (deps, input) => {
 		 VALUES ($1, $2, $3)
 		 ON CONFLICT (source_id, name)
 		 DO UPDATE SET target_id = EXCLUDED.target_id, created_at = NOW()
-		 RETURNING *`, [input.source_id, input.name, input.target_id]);
+		 RETURNING ${columns_sql(CELL_FIELD_COLUMNS, cell_field_expr(''))}`, [input.source_id, input.name, input.target_id]);
     return assert_row(row, 'INSERT INTO cell_field');
 };
 /**
@@ -51,7 +66,7 @@ export const query_cell_field_set = async (deps, input) => {
  * @returns the row or `null` when not found
  */
 export const query_cell_field_get = async (deps, source_id, name) => {
-    const row = await deps.db.query_one(`SELECT * FROM cell_field WHERE source_id = $1 AND name = $2`, [source_id, name]);
+    const row = await deps.db.query_one(`SELECT ${columns_sql(CELL_FIELD_COLUMNS, cell_field_expr(''))} FROM cell_field WHERE source_id = $1 AND name = $2`, [source_id, name]);
     return row ?? null;
 };
 /**
@@ -63,7 +78,8 @@ export const query_cell_field_get = async (deps, source_id, name) => {
  * @mutates `cell_field` - deletes one row
  */
 export const query_cell_field_delete = async (deps, source_id, name) => {
-    const row = await deps.db.query_one(`DELETE FROM cell_field WHERE source_id = $1 AND name = $2 RETURNING *`, [source_id, name]);
+    const row = await deps.db.query_one(`DELETE FROM cell_field WHERE source_id = $1 AND name = $2
+		 RETURNING ${columns_sql(CELL_FIELD_COLUMNS, cell_field_expr(''))}`, [source_id, name]);
     return row ?? null;
 };
 /**
@@ -75,12 +91,14 @@ export const query_cell_field_delete = async (deps, source_id, name) => {
  *
  * @param deps - query deps
  * @param source_id - source cell id
- * @returns matching rows, oldest first by name (lex order)
+ * @param options - `limit` caps the row count; `name_after` resumes after a
+ *   name (keyset pagination)
+ * @returns matching rows in lex `name` order
  */
 export const query_cell_field_list_for_source = async (deps, source_id, options) => {
     const limit = options?.limit ?? null;
     const name_after = options?.name_after ?? null;
-    return deps.db.query(`SELECT f.* FROM cell_field f
+    return deps.db.query(`SELECT ${qualify_columns(CELL_FIELD_COLUMNS, 'f', cell_field_expr('f'))} FROM cell_field f
 		 JOIN cell t ON t.id = f.target_id
 		 WHERE f.source_id = $1
 		   AND t.deleted_at IS NULL
@@ -103,9 +121,9 @@ export const query_cell_field_list_for_source = async (deps, source_id, options)
  * @param deps - query deps
  * @param target_id - target cell id
  * @param options - `limit` caps the row count
- * @returns matching rows, oldest first by source created_at
+ * @returns matching rows, oldest field first (by the field row's `created_at`)
  */
-export const query_cell_field_list_for_target = async (deps, target_id, options) => deps.db.query(`SELECT f.* FROM cell_field f
+export const query_cell_field_list_for_target = async (deps, target_id, options) => deps.db.query(`SELECT ${qualify_columns(CELL_FIELD_COLUMNS, 'f', cell_field_expr('f'))} FROM cell_field f
 		 JOIN cell s ON s.id = f.source_id
 		 WHERE f.target_id = $1
 		   AND s.deleted_at IS NULL

package/dist/db/cell_grant_queries.d.ts

@@ -33,8 +33,15 @@ export interface CellGrantRow {
     role: string | null;
     scope_id: Uuid | null;
     granted_by: Uuid | null;
-    created_at: Date;
+    created_at: string;
 }
+/**
+ * The full `cell_grant` column set, named explicitly so a row read fails
+ * loud on schema drift (see `CELL_COLUMNS` in `db/cell_queries.ts`). Column
+ * order mirrors the Rust twin's `grant_columns(alias)` (`fuz_cell`). Keep in
+ * sync with `CellGrantRow` and the `cell_grant` DDL in `db/cell_ddl.ts`.
+ */
+export declare const CELL_GRANT_COLUMNS: readonly ["id", "cell_id", "level", "actor_id", "role", "scope_id", "granted_by", "created_at"];
 /**
  * Discriminated principal input for `query_cell_grant_create`. Wire
  * and query shapes are aligned — actor-shaped principals carry a
@@ -121,6 +128,7 @@ export declare const query_cell_grant_list_for_cells: (deps: QueryDeps, cell_ids
  * granted access. Returns grants for the given cells that match the caller's
  * identity or role_grant set.
  *
+ * @param deps - query deps
  * @param cell_ids - cells to fetch grants for
  * @param caller_actor_id - actor id of the caller (null for unauth)
  * @param role_grant_roles - active role_grant roles (parallel array)
@@ -128,5 +136,5 @@ export declare const query_cell_grant_list_for_cells: (deps: QueryDeps, cell_ids
  * @returns matching grants (may include grants the caller doesn't match; caller's
  * list handler must filter when returning to the API)
  */
-export declare const query_cell_grants_for_caller_in_cells: (deps: QueryDeps, cell_ids: Array<Uuid>, caller_actor_id: Uuid | null, role_grant_roles: Array<string>, role_grant_scope_ids: Array<Uuid | null>) => Promise<Array<CellGrantRow>>;
+export declare const query_cell_grants_for_caller_in_cells: (deps: QueryDeps, cell_ids: ReadonlyArray<Uuid>, caller_actor_id: Uuid | null, role_grant_roles: ReadonlyArray<string>, role_grant_scope_ids: ReadonlyArray<Uuid | null>) => Promise<Array<CellGrantRow>>;
 //# sourceMappingURL=cell_grant_queries.d.ts.map

package/dist/db/cell_grant_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_grant_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_grant_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGzE,kDAAkD;AAClD,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,IAAI,CAAC;IACd,KAAK,EAAE,cAAc,CAAC;IACtB,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,MAAM,4BAA4B,GACvC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,CAAC;AAE3F,2CAA2C;AAC3C,MAAM,WAAW,yBAAyB;IACzC,OAAO,EAAE,IAAI,CAAC;IACd,KAAK,EAAE,cAAc,CAAC;IACtB,SAAS,EAAE,4BAA4B,CAAC;IACxC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,OAAO,yBAAyB,KAC9B,OAAO,CAAC,YAAY,CAsBtB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,UAAU,IAAI,KACZ,OAAO,CAAC,YAAY,GAAG,IAAI,CAK7B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,UAAU,IAAI,KACZ,OAAO,CAAC,YAAY,GAAG,IAAI,CAM7B,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,SAAS,IAAI,KACX,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAM5B,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,+BAA+B,GAC3C,MAAM,SAAS,EACf,UAAU,aAAa,CAAC,IAAI,CAAC,KAC3B,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAQ7B,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qCAAqC,GACjD,MAAM,SAAS,EACf,UAAU,KAAK,CAAC,IAAI,CAAC,EACrB,iBAAiB,IAAI,GAAG,IAAI,EAC5B,kBAAkB,KAAK,CAAC,MAAM,CAAC,EAC/B,sBAAsB,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,KACtC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAmB7B,CAAC"}
+{"version":3,"file":"cell_grant_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_grant_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAIzE,kDAAkD;AAClD,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,IAAI,CAAC;IACd,KAAK,EAAE,cAAc,CAAC;IACtB,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,iGASuB,CAAC;AAKvD;;;;;GAKG;AACH,MAAM,MAAM,4BAA4B,GACvC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,CAAC;AAE3F,2CAA2C;AAC3C,MAAM,WAAW,yBAAyB;IACzC,OAAO,EAAE,IAAI,CAAC;IACd,KAAK,EAAE,cAAc,CAAC;IACtB,SAAS,EAAE,4BAA4B,CAAC;IACxC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,OAAO,yBAAyB,KAC9B,OAAO,CAAC,YAAY,CAsBtB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,UAAU,IAAI,KACZ,OAAO,CAAC,YAAY,GAAG,IAAI,CAM7B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,UAAU,IAAI,KACZ,OAAO,CAAC,YAAY,GAAG,IAAI,CAM7B,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,SAAS,IAAI,KACX,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAM5B,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,+BAA+B,GAC3C,MAAM,SAAS,EACf,UAAU,aAAa,CAAC,IAAI,CAAC,KAC3B,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAQ7B,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC,GACjD,MAAM,SAAS,EACf,UAAU,aAAa,CAAC,IAAI,CAAC,EAC7B,iBAAiB,IAAI,GAAG,IAAI,EAC5B,kBAAkB,aAAa,CAAC,MAAM,CAAC,EACvC,sBAAsB,aAAa,CAAC,IAAI,GAAG,IAAI,CAAC,KAC9C,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAmB7B,CAAC"}

package/dist/db/cell_grant_queries.js

@@ -22,6 +22,25 @@
  * @module
  */
 import { assert_row } from './assert_row.js';
+import { columns_sql, iso8601_timestamp_expr, qualify_columns } from './sql_columns.js';
+/**
+ * The full `cell_grant` column set, named explicitly so a row read fails
+ * loud on schema drift (see `CELL_COLUMNS` in `db/cell_queries.ts`). Column
+ * order mirrors the Rust twin's `grant_columns(alias)` (`fuz_cell`). Keep in
+ * sync with `CellGrantRow` and the `cell_grant` DDL in `db/cell_ddl.ts`.
+ */
+export const CELL_GRANT_COLUMNS = [
+    'id',
+    'cell_id',
+    'level',
+    'actor_id',
+    'role',
+    'scope_id',
+    'granted_by',
+    'created_at'
+];
+/** The `cell_grant` timestamp override, by row qualifier (`''` bare, `g` for the cell-joined reads). */
+const cell_grant_expr = iso8601_timestamp_expr(CELL_GRANT_COLUMNS, ['created_at']);
 /**
  * Insert a grant, or update the existing row's `level` + `granted_by` when
  * one already exists for the same `(cell_id, principal)` pair.
@@ -43,14 +62,14 @@ export const query_cell_grant_create = async (deps, input) => {
 			 VALUES ($1, $2, $3, $4)
 			 ON CONFLICT (cell_id, actor_id) WHERE actor_id IS NOT NULL
 			 DO UPDATE SET level = EXCLUDED.level, granted_by = EXCLUDED.granted_by
-			 RETURNING *`, [cell_id, level, principal.actor_id, granted_by]);
+			 RETURNING ${columns_sql(CELL_GRANT_COLUMNS, cell_grant_expr(''))}`, [cell_id, level, principal.actor_id, granted_by]);
         return assert_row(row, 'INSERT INTO cell_grant (actor)');
     }
     const row = await deps.db.query_one(`INSERT INTO cell_grant (cell_id, level, role, scope_id, granted_by)
 		 VALUES ($1, $2, $3, $4, $5)
 		 ON CONFLICT (cell_id, role, scope_id) WHERE role IS NOT NULL
 		 DO UPDATE SET level = EXCLUDED.level, granted_by = EXCLUDED.granted_by
-		 RETURNING *`, [cell_id, level, principal.role, principal.scope_id, granted_by]);
+		 RETURNING ${columns_sql(CELL_GRANT_COLUMNS, cell_grant_expr(''))}`, [cell_id, level, principal.role, principal.scope_id, granted_by]);
     return assert_row(row, 'INSERT INTO cell_grant (role)');
 };
 /**
@@ -61,9 +80,7 @@ export const query_cell_grant_create = async (deps, input) => {
  * @returns the row or `null` when not found
  */
 export const query_cell_grant_get = async (deps, grant_id) => {
-    const row = await deps.db.query_one(`SELECT * FROM cell_grant WHERE id = $1`, [
-        grant_id
-    ]);
+    const row = await deps.db.query_one(`SELECT ${columns_sql(CELL_GRANT_COLUMNS, cell_grant_expr(''))} FROM cell_grant WHERE id = $1`, [grant_id]);
     return row ?? null;
 };
 /**
@@ -79,7 +96,7 @@ export const query_cell_grant_get = async (deps, grant_id) => {
  * @mutates `cell_grant` - deletes one row
  */
 export const query_cell_grant_delete = async (deps, grant_id) => {
-    const row = await deps.db.query_one(`DELETE FROM cell_grant WHERE id = $1 RETURNING *`, [grant_id]);
+    const row = await deps.db.query_one(`DELETE FROM cell_grant WHERE id = $1 RETURNING ${columns_sql(CELL_GRANT_COLUMNS, cell_grant_expr(''))}`, [grant_id]);
     return row ?? null;
 };
 /**
@@ -92,9 +109,9 @@ export const query_cell_grant_delete = async (deps, grant_id) => {
  * @param cell_id - cell id
  * @returns matching rows
  */
-export const query_cell_grant_list_for_cell = async (deps, cell_id) => deps.db.query(`SELECT * FROM cell_grant
+export const query_cell_grant_list_for_cell = async (deps, cell_id) => deps.db.query(`SELECT ${columns_sql(CELL_GRANT_COLUMNS, cell_grant_expr(''))} FROM cell_grant
 		 WHERE cell_id = $1
-		 ORDER BY created_at ASC`, [cell_id]);
+		 ORDER BY cell_grant.created_at ASC`, [cell_id]);
 /**
  * List all grants across a set of cells, ordered by cell then creation.
  * Used by the strict relation-read filter to test `can_view_cell` per
@@ -109,9 +126,9 @@ export const query_cell_grant_list_for_cell = async (deps, cell_id) => deps.db.q
 export const query_cell_grant_list_for_cells = async (deps, cell_ids) => {
     if (cell_ids.length === 0)
         return [];
-    return deps.db.query(`SELECT * FROM cell_grant
+    return deps.db.query(`SELECT ${columns_sql(CELL_GRANT_COLUMNS, cell_grant_expr(''))} FROM cell_grant
 		 WHERE cell_id = ANY($1::uuid[])
-		 ORDER BY cell_id, created_at ASC`, [cell_ids]);
+		 ORDER BY cell_grant.cell_id, cell_grant.created_at ASC`, [cell_ids]);
 };
 /**
  * Load grants that admit the caller (by actor or role-scoped role_grants) across
@@ -119,6 +136,7 @@ export const query_cell_grant_list_for_cells = async (deps, cell_ids) => {
  * granted access. Returns grants for the given cells that match the caller's
  * identity or role_grant set.
  *
+ * @param deps - query deps
  * @param cell_ids - cells to fetch grants for
  * @param caller_actor_id - actor id of the caller (null for unauth)
  * @param role_grant_roles - active role_grant roles (parallel array)
@@ -130,7 +148,7 @@ export const query_cell_grants_for_caller_in_cells = async (deps, cell_ids, call
     if (cell_ids.length === 0) {
         return [];
     }
-    return deps.db.query(`SELECT g.* FROM cell_grant g
+    return deps.db.query(`SELECT ${qualify_columns(CELL_GRANT_COLUMNS, 'g', cell_grant_expr('g'))} FROM cell_grant g
 		 WHERE g.cell_id = ANY($1::uuid[])
 		   AND (
 		     g.actor_id = $2

package/dist/db/cell_item_queries.d.ts

@@ -26,8 +26,15 @@ export interface CellItemRow {
     parent_id: Uuid;
     position: string;
     child_id: Uuid;
-    created_at: Date;
+    created_at: string;
 }
+/**
+ * The full `cell_item` column set, named explicitly so a row read fails
+ * loud on schema drift (see `CELL_COLUMNS` in `db/cell_queries.ts`). Column
+ * order mirrors the Rust twin's `item_columns(alias)` (`fuz_cell`). Keep in
+ * sync with `CellItemRow` and the `cell_item` DDL in `db/cell_ddl.ts`.
+ */
+export declare const CELL_ITEM_COLUMNS: readonly ["parent_id", "position", "child_id", "created_at"];
 /** Input for `query_cell_item_insert`. */
 export interface CellItemInsertQueryInput {
     parent_id: Uuid;
@@ -83,7 +90,11 @@ export declare const query_cell_item_delete: (deps: QueryDeps, parent_id: Uuid,
  * cells don't surface; the parent filter is the caller's responsibility
  * (gated upstream by `can_view_cell(parent)`).
  *
- * @param limit - optional row cap (passes through to SQL `LIMIT`)
+ * @param deps - query deps
+ * @param parent_id - parent cell id
+ * @param options - `limit` caps the row count (passes through to SQL `LIMIT`);
+ *   `position_after` resumes after a position (keyset pagination)
+ * @returns matching rows in lex `position` order
  */
 export declare const query_cell_item_list_for_parent: (deps: QueryDeps, parent_id: Uuid, options?: {
     limit?: number;

package/dist/db/cell_item_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_item_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_item_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAGnD,iDAAiD;AACjD,MAAM,WAAW,WAAW;IAC3B,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,IAAI,CAAC;IACf,UAAU,EAAE,IAAI,CAAC;CACjB;AAED,0CAA0C;AAC1C,MAAM,WAAW,wBAAwB;IACxC,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,IAAI,CAAC;CACf;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,OAAO,wBAAwB,KAC7B,OAAO,CAAC,WAAW,CAQrB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,WAAW,IAAI,EACf,UAAU,MAAM,KACd,OAAO,CAAC,WAAW,GAAG,IAAI,CAM5B,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,WAAW,IAAI,EACf,cAAc,MAAM,EACpB,cAAc,MAAM,KAClB,OAAO,CAAC,WAAW,GAAG,IAAI,CAS5B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,WAAW,IAAI,EACf,UAAU,MAAM,KACd,OAAO,CAAC,WAAW,GAAG,IAAI,CAM5B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,+BAA+B,GAC3C,MAAM,SAAS,EACf,WAAW,IAAI,EACf,UAAU;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,KACnD,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAa5B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,UAAU,IAAI,EACd,UAAU;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,KAC1B,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAS3B,CAAC"}
+{"version":3,"file":"cell_item_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_item_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAInD,iDAAiD;AACjD,MAAM,WAAW,WAAW;IAC3B,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,IAAI,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,8DAKuB,CAAC;AAKtD,0CAA0C;AAC1C,MAAM,WAAW,wBAAwB;IACxC,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,IAAI,CAAC;CACf;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,OAAO,wBAAwB,KAC7B,OAAO,CAAC,WAAW,CAQrB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,WAAW,IAAI,EACf,UAAU,MAAM,KACd,OAAO,CAAC,WAAW,GAAG,IAAI,CAM5B,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,WAAW,IAAI,EACf,cAAc,MAAM,EACpB,cAAc,MAAM,KAClB,OAAO,CAAC,WAAW,GAAG,IAAI,CAS5B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,WAAW,IAAI,EACf,UAAU,MAAM,KACd,OAAO,CAAC,WAAW,GAAG,IAAI,CAO5B,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,+BAA+B,GAC3C,MAAM,SAAS,EACf,WAAW,IAAI,EACf,UAAU;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,KACnD,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAa5B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,UAAU,IAAI,EACd,UAAU;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,KAC1B,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAS3B,CAAC"}

package/dist/db/cell_item_queries.js

@@ -20,6 +20,21 @@
  * @module
  */
 import { assert_row } from './assert_row.js';
+import { columns_sql, iso8601_timestamp_expr, qualify_columns } from './sql_columns.js';
+/**
+ * The full `cell_item` column set, named explicitly so a row read fails
+ * loud on schema drift (see `CELL_COLUMNS` in `db/cell_queries.ts`). Column
+ * order mirrors the Rust twin's `item_columns(alias)` (`fuz_cell`). Keep in
+ * sync with `CellItemRow` and the `cell_item` DDL in `db/cell_ddl.ts`.
+ */
+export const CELL_ITEM_COLUMNS = [
+    'parent_id',
+    'position',
+    'child_id',
+    'created_at'
+];
+/** The `cell_item` timestamp override, by row qualifier (`''` bare, `i` for the cell-joined reads). */
+const cell_item_expr = iso8601_timestamp_expr(CELL_ITEM_COLUMNS, ['created_at']);
 /**
  * Insert one item row at the caller-supplied `position`.
  *
@@ -34,7 +49,7 @@ import { assert_row } from './assert_row.js';
 export const query_cell_item_insert = async (deps, input) => {
     const row = await deps.db.query_one(`INSERT INTO cell_item (parent_id, position, child_id)
 		 VALUES ($1, $2, $3)
-		 RETURNING *`, [input.parent_id, input.position, input.child_id]);
+		 RETURNING ${columns_sql(CELL_ITEM_COLUMNS, cell_item_expr(''))}`, [input.parent_id, input.position, input.child_id]);
     return assert_row(row, 'INSERT INTO cell_item');
 };
 /**
@@ -44,7 +59,7 @@ export const query_cell_item_insert = async (deps, input) => {
  * @returns the row or `null` when not found
  */
 export const query_cell_item_get = async (deps, parent_id, position) => {
-    const row = await deps.db.query_one(`SELECT * FROM cell_item WHERE parent_id = $1 AND position = $2`, [parent_id, position]);
+    const row = await deps.db.query_one(`SELECT ${columns_sql(CELL_ITEM_COLUMNS, cell_item_expr(''))} FROM cell_item WHERE parent_id = $1 AND position = $2`, [parent_id, position]);
     return row ?? null;
 };
 /**
@@ -64,7 +79,7 @@ export const query_cell_item_move = async (deps, parent_id, position_old, positi
     const row = await deps.db.query_one(`UPDATE cell_item
 		 SET position = $3
 		 WHERE parent_id = $1 AND position = $2
-		 RETURNING *`, [parent_id, position_old, position_new]);
+		 RETURNING ${columns_sql(CELL_ITEM_COLUMNS, cell_item_expr(''))}`, [parent_id, position_old, position_new]);
     return row ?? null;
 };
 /**
@@ -76,7 +91,8 @@ export const query_cell_item_move = async (deps, parent_id, position_old, positi
  * @mutates `cell_item` - deletes one row
  */
 export const query_cell_item_delete = async (deps, parent_id, position) => {
-    const row = await deps.db.query_one(`DELETE FROM cell_item WHERE parent_id = $1 AND position = $2 RETURNING *`, [parent_id, position]);
+    const row = await deps.db.query_one(`DELETE FROM cell_item WHERE parent_id = $1 AND position = $2
+		 RETURNING ${columns_sql(CELL_ITEM_COLUMNS, cell_item_expr(''))}`, [parent_id, position]);
     return row ?? null;
 };
 /**
@@ -86,12 +102,16 @@ export const query_cell_item_delete = async (deps, parent_id, position) => {
  * cells don't surface; the parent filter is the caller's responsibility
  * (gated upstream by `can_view_cell(parent)`).
  *
- * @param limit - optional row cap (passes through to SQL `LIMIT`)
+ * @param deps - query deps
+ * @param parent_id - parent cell id
+ * @param options - `limit` caps the row count (passes through to SQL `LIMIT`);
+ *   `position_after` resumes after a position (keyset pagination)
+ * @returns matching rows in lex `position` order
  */
 export const query_cell_item_list_for_parent = async (deps, parent_id, options) => {
     const limit = options?.limit ?? null;
     const position_after = options?.position_after ?? null;
-    return deps.db.query(`SELECT i.* FROM cell_item i
+    return deps.db.query(`SELECT ${qualify_columns(CELL_ITEM_COLUMNS, 'i', cell_item_expr('i'))} FROM cell_item i
 		 JOIN cell c ON c.id = i.child_id
 		 WHERE i.parent_id = $1
 		   AND c.deleted_at IS NULL
@@ -111,7 +131,7 @@ export const query_cell_item_list_for_parent = async (deps, parent_id, options)
  * inbound-linked child can't force an unbounded fetch + per-parent authz
  * pass on the public, IP-rate-limited reverse endpoint.
  */
-export const query_cell_item_list_for_child = async (deps, child_id, options) => deps.db.query(`SELECT i.* FROM cell_item i
+export const query_cell_item_list_for_child = async (deps, child_id, options) => deps.db.query(`SELECT ${qualify_columns(CELL_ITEM_COLUMNS, 'i', cell_item_expr('i'))} FROM cell_item i
 		 JOIN cell p ON p.id = i.parent_id
 		 WHERE i.child_id = $1
 		   AND p.deleted_at IS NULL

package/dist/db/cell_queries.d.ts

@@ -49,13 +49,42 @@ export interface CellRow {
     parent_id: Uuid | null;
     root_id: Uuid | null;
     moderation: string | null;
-    created_at: Date;
-    updated_at: Date | null;
-    deleted_at: Date | null;
+    created_at: string;
+    updated_at: string | null;
+    deleted_at: string | null;
     created_by: Uuid | null;
     updated_by: Uuid | null;
     grant_count: number;
 }
+/**
+ * The full `cell` column set, named explicitly so a row read fails loud on
+ * schema drift — a `SELECT *` silently omits a dropped column and the
+ * `deleted_at IS NULL`-shaped predicates on the hydrated row then misread
+ * `undefined` (see `ACCOUNT_COLUMNS` in `auth/account_queries.ts` for the
+ * outage class). Column order mirrors the Rust twin's `cell_columns(alias)`
+ * (`fuz_cell`), which decodes the same projection positionally. The derived
+ * `grant_count` is not a column — `cell_row_projection` appends it. Keep
+ * in sync with `CellRow` and the `cell` DDL in `db/cell_ddl.ts`.
+ */
+export declare const CELL_COLUMNS: readonly ["id", "data", "kind", "visibility", "path", "refs", "parent_id", "root_id", "moderation", "created_at", "updated_at", "deleted_at", "created_by", "updated_by"];
+/**
+ * The full `CellRow` projection — `CELL_COLUMNS` qualified by `alias` plus
+ * the derived `grant_count` (a correlated subquery against `cell_grant`,
+ * served by `idx_cell_grant_cell`) — used by every cell-row SELECT /
+ * RETURNING. `alias` is the row qualifier: the table name (`'cell'`) for
+ * single-table reads + `RETURNING`, the query alias (`'c'`) for
+ * `query_cell_list`. Twin of `fuz_cell`'s `cell_columns(alias)`.
+ *
+ * `::int` narrows the count from `bigint` so the JS row hydrates a `number`
+ * rather than a bigint primitive — counts on a single cell are trivially
+ * within int32.
+ *
+ * Exported for consumers writing their own cell-row reads: `CELL_COLUMNS`
+ * alone hydrates a row without `grant_count`, which typechecks as a
+ * `CellRow` but fails at `to_cell_json` — this is the projection that
+ * actually produces one.
+ */
+export declare const cell_row_projection: (alias: string) => string;
 /**
  * Input for `query_cell_create`. `refs` is derived from `data`. `kind` is
  * the write-once capability axis (`cell.kind` column) — set here at INSERT

package/dist/db/cell_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAGjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,OAAO;IACvB,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,cAAc,CAAC;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACpB;AAgBD;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,OAAO,oBAAoB,KACzB,OAAO,CAAC,OAAO,CAoBjB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,KACrC,OAAO,CAAC,OAAO,GAAG,IAAI,CAUxB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,MAAM,MAAM,KACV,OAAO,CAAC,OAAO,GAAG,IAAI,CAQxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,KAAK,aAAa,CAAC,IAAI,CAAC,KACtB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQxB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,OAAO,eAAe,KACpB,OAAO,CAAC,OAAO,GAAG,IAAI,CA4BxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAE,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,KACpC,OAAO,CAAC,OAAO,CAWjB,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,IAAI,IAAI,EACR,YAAY,MAAM,EAClB,SAAS;IAAE,qBAAqB,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,KACnE,OAAO,CAAC,OAAO,GAAG,IAAI,CAYxB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,MAAM,MAAM,EACZ,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CASvB,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,SAAS,EACf,UAAU,IAAI,EACd,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQvB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,eAAe,GAC3B,MAAM,SAAS,EACf,QAAQ,cAAc,KACpB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CA4DxB,CAAC;AAqGF,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC9B,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,4EAA4E;IAC5E,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf,0EAA0E;IAC1E,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,OAAO,CAAC,EAAE,IAAI,CAAC;IACf;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB;;;;OAIG;IACH,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,aAAa,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACzD;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,yCAAyC;IACzC,QAAQ,CAAC,EAAE,YAAY,GAAG,YAAY,CAAC;IACvC,sCAAsC;IACtC,eAAe,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,iBAAiB;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B"}
+{"version":3,"file":"cell_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAIjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,OAAO;IACvB,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,cAAc,CAAC;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,2KAegD,CAAC;AAK1E;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,mBAAmB,GAAI,OAAO,MAAM,KAAG,MAC2F,CAAC;AAEhJ;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,OAAO,oBAAoB,KACzB,OAAO,CAAC,OAAO,CAoBjB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,KACrC,OAAO,CAAC,OAAO,GAAG,IAAI,CAUxB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,MAAM,MAAM,KACV,OAAO,CAAC,OAAO,GAAG,IAAI,CAQxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,KAAK,aAAa,CAAC,IAAI,CAAC,KACtB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQxB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,OAAO,eAAe,KACpB,OAAO,CAAC,OAAO,GAAG,IAAI,CA4BxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAE,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,KACpC,OAAO,CAAC,OAAO,CAWjB,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,IAAI,IAAI,EACR,YAAY,MAAM,EAClB,SAAS;IAAE,qBAAqB,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,KACnE,OAAO,CAAC,OAAO,GAAG,IAAI,CAYxB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,MAAM,MAAM,EACZ,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CASvB,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,SAAS,EACf,UAAU,IAAI,EACd,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQvB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,eAAe,GAC3B,MAAM,SAAS,EACf,QAAQ,cAAc,KACpB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CA4DxB,CAAC;AAqGF,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC9B,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,4EAA4E;IAC5E,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf,0EAA0E;IAC1E,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,OAAO,CAAC,EAAE,IAAI,CAAC;IACf;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB;;;;OAIG;IACH,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,aAAa,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACzD;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,yCAAyC;IACzC,QAAQ,CAAC,EAAE,YAAY,GAAG,YAAY,CAAC;IACvC,sCAAsC;IACtC,eAAe,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,iBAAiB;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B"}