@fuzdev/fuz_app 0.95.0 → 0.96.0

package/dist/auth/account_queries.d.ts

@@ -159,14 +159,29 @@ export declare const query_account_has_any: (deps: QueryDeps) => Promise<boolean
  */
 export declare const query_create_actor: (deps: QueryDeps, account_id: string, name: string) => Promise<Actor>;
 /**
- * List every actor on an account, ordered by `created_at`.
- *
- * Used by `resolve_acting_actor` to resolve the acting actor for a
- * request: 1 actor picks transparently, multiple require an explicit
- * `acting` field on the request payload. For lookups by id, use
+ * List every actor on an account, ordered by `created_at`, **including
+ * soft-deleted (tombstoned) rows**.
+ *
+ * Used by the admin/snapshot handlers (`account_delete` / `account_purge` /
+ * `account_undelete`) that must enumerate every actor that ever existed on
+ * the account to snapshot names into per-actor audit events. For the
+ * acting-actor resolution path — which must never resolve a tombstoned
+ * actor — use `query_active_actors_by_account`. For lookups by id, use
  * `query_actor_by_id` instead.
  */
 export declare const query_actors_by_account: (deps: QueryDeps, account_id: string) => Promise<Array<Actor>>;
+/**
+ * List **active** (non-tombstoned) actors on an account, ordered by
+ * `created_at`.
+ *
+ * Filters `deleted_at IS NULL` so a soft-deleted actor can never be resolved
+ * as the acting actor (and carry its `role_grants` into the role gate). Used
+ * by `resolve_acting_actor` to resolve the acting actor for a request: 1
+ * actor picks transparently, multiple require an explicit `acting` field on
+ * the request payload. The admin/snapshot handlers that legitimately need
+ * tombstoned rows stay on the unfiltered `query_actors_by_account`.
+ */
+export declare const query_active_actors_by_account: (deps: QueryDeps, account_id: string) => Promise<Array<Actor>>;
 /**
  * Find an actor by id.
  */

package/dist/auth/account_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAEN,KAAK,OAAO,EACZ,KAAK,KAAK,EACV,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,MAAM,qBAAqB,CAAC;AAqB7B;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,OAAO,kBAAkB,KACvB,OAAO,CAAC,OAAO,CAQjB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,IAAI,MAAM,KACR,OAAO,CAAC,OAAO,GAAG,SAAS,CAK7B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,UAAU,MAAM,KACd,OAAO,CAAC,OAAO,GAAG,SAAS,CAK7B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,OAAO,MAAM,KACX,OAAO,CAAC,OAAO,GAAG,SAAS,CAK7B,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,kCAAkC,GAC9C,MAAM,SAAS,EACf,OAAO,MAAM,KACX,OAAO,CAAC,OAAO,GAAG,SAAS,CAS7B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,IAAI,MAAM,EACV,eAAe,MAAM,EACrB,YAAY,MAAM,GAAG,IAAI,EACzB,eAAe,MAAM,KACnB,OAAO,CAAC,OAAO,CAQjB,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,IAAI,MAAM,EACV,YAAY,MAAM,GAAG,IAAI,KACvB,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAO7C,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,IAAI,MAAM,KACR,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAK7C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,IAAI,MAAM,EACV,YAAY,MAAM,GAAG,IAAI,KACvB,OAAO,CAAC,OAAO,CAQjB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,IAAI,MAAM,KACR,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAO7C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAAU,MAAM,SAAS,EAAE,IAAI,MAAM,KAAG,OAAO,CAAC,OAAO,CAQvF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,OAAO,CAK5E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAC9B,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,MAAM,MAAM,KACV,OAAO,CAAC,KAAK,CAMf,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAKtB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,MAAM,KACR,OAAO,CAAC,KAAK,GAAG,SAAS,CAE3B,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,GAC3C,MAAM,SAAS,EACf,OAAO,kBAAkB,KACvB,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAC,CAI1C,CAAC;AA2BF,8CAA8C;AAC9C,MAAM,WAAW,uBAAuB;IACvC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,wBAAwB,GACpC,MAAM,SAAS,EACf,UAAU,uBAAuB,KAC/B,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CA8GtC,CAAC"}
+{"version":3,"file":"account_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAEN,KAAK,OAAO,EACZ,KAAK,KAAK,EACV,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,MAAM,qBAAqB,CAAC;AAqB7B;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,OAAO,kBAAkB,KACvB,OAAO,CAAC,OAAO,CAQjB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,IAAI,MAAM,KACR,OAAO,CAAC,OAAO,GAAG,SAAS,CAK7B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,UAAU,MAAM,KACd,OAAO,CAAC,OAAO,GAAG,SAAS,CAK7B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,OAAO,MAAM,KACX,OAAO,CAAC,OAAO,GAAG,SAAS,CAK7B,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,kCAAkC,GAC9C,MAAM,SAAS,EACf,OAAO,MAAM,KACX,OAAO,CAAC,OAAO,GAAG,SAAS,CAS7B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,IAAI,MAAM,EACV,eAAe,MAAM,EACrB,YAAY,MAAM,GAAG,IAAI,EACzB,eAAe,MAAM,KACnB,OAAO,CAAC,OAAO,CAQjB,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,IAAI,MAAM,EACV,YAAY,MAAM,GAAG,IAAI,KACvB,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAO7C,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,IAAI,MAAM,KACR,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAK7C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,IAAI,MAAM,EACV,YAAY,MAAM,GAAG,IAAI,KACvB,OAAO,CAAC,OAAO,CAQjB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,IAAI,MAAM,KACR,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAO7C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAAU,MAAM,SAAS,EAAE,IAAI,MAAM,KAAG,OAAO,CAAC,OAAO,CAQvF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,OAAO,CAK5E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAC9B,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,MAAM,MAAM,KACV,OAAO,CAAC,KAAK,CAMf,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAKtB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAKtB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,MAAM,KACR,OAAO,CAAC,KAAK,GAAG,SAAS,CAE3B,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,GAC3C,MAAM,SAAS,EACf,OAAO,kBAAkB,KACvB,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAC,CAI1C,CAAC;AA2BF,8CAA8C;AAC9C,MAAM,WAAW,uBAAuB;IACvC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,wBAAwB,GACpC,MAAM,SAAS,EACf,UAAU,uBAAuB,KAC/B,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CA8GtC,CAAC"}

package/dist/auth/account_queries.js

@@ -218,16 +218,33 @@ export const query_create_actor = async (deps, account_id, name) => {
     return assert_row(row, 'INSERT INTO actor');
 };
 /**
- * List every actor on an account, ordered by `created_at`.
+ * List every actor on an account, ordered by `created_at`, **including
+ * soft-deleted (tombstoned) rows**.
  *
- * Used by `resolve_acting_actor` to resolve the acting actor for a
- * request: 1 actor picks transparently, multiple require an explicit
- * `acting` field on the request payload. For lookups by id, use
+ * Used by the admin/snapshot handlers (`account_delete` / `account_purge` /
+ * `account_undelete`) that must enumerate every actor that ever existed on
+ * the account to snapshot names into per-actor audit events. For the
+ * acting-actor resolution path — which must never resolve a tombstoned
+ * actor — use `query_active_actors_by_account`. For lookups by id, use
  * `query_actor_by_id` instead.
  */
 export const query_actors_by_account = async (deps, account_id) => {
     return deps.db.query(`SELECT * FROM actor WHERE account_id = $1 ORDER BY created_at ASC, id ASC`, [account_id]);
 };
+/**
+ * List **active** (non-tombstoned) actors on an account, ordered by
+ * `created_at`.
+ *
+ * Filters `deleted_at IS NULL` so a soft-deleted actor can never be resolved
+ * as the acting actor (and carry its `role_grants` into the role gate). Used
+ * by `resolve_acting_actor` to resolve the acting actor for a request: 1
+ * actor picks transparently, multiple require an explicit `acting` field on
+ * the request payload. The admin/snapshot handlers that legitimately need
+ * tombstoned rows stay on the unfiltered `query_actors_by_account`.
+ */
+export const query_active_actors_by_account = async (deps, account_id) => {
+    return deps.db.query(`SELECT * FROM actor WHERE account_id = $1 AND deleted_at IS NULL ORDER BY created_at ASC, id ASC`, [account_id]);
+};
 /**
  * Find an actor by id.
  */

package/dist/auth/request_context.js

@@ -36,7 +36,7 @@
  */
 import { is_role_grant_active } from './account_schema.js';
 import { hash_session_token, session_touch_fire_and_forget, query_session_get_valid, } from './session_queries.js';
-import { query_account_by_id, query_actor_by_id, query_actors_by_account, } from './account_queries.js';
+import { query_account_by_id, query_actor_by_id, query_active_actors_by_account, } from './account_queries.js';
 import { query_role_grant_find_active_for_actor } from './role_grant_queries.js';
 import { ACCOUNT_ID_KEY, AUTH_API_TOKEN_ID_KEY, CREDENTIAL_TYPE_KEY, TEST_CONTEXT_PRESET_KEY, } from '../hono_context.js';
 import { is_public_auth, needs_actor } from '../http/auth_shape.js';
@@ -174,7 +174,7 @@ export const has_any_scoped_role = (ctx, roles, scope_id, now = new Date()) => {
  * @param acting_actor_id - the requested acting actor id, or `undefined`
  */
 export const resolve_acting_actor = async (deps, account_id, acting_actor_id) => {
-    const actors = await query_actors_by_account(deps, account_id);
+    const actors = await query_active_actors_by_account(deps, account_id);
     if (actors.length === 0)
         return { ok: false, reason: 'no_actors' };
     if (acting_actor_id == null) {

package/dist/db/CLAUDE.md

@@ -15,9 +15,12 @@ the code.
 - `db.ts` — `Db` abstraction over pg + PGlite, `query` / `query_one` /
   `transaction`, `no_nested_transaction` guard.
 - `create_db.ts` — URL-based driver auto-detection (`postgres` /
-  `pglite-file` / `pglite-memory`); registers the int8 parser so
-  `BIGSERIAL` columns read as JS numbers.
-- `db_pg.ts` / `db_pglite.ts` — driver adapters.
+  `pglite-file` / `pglite-memory`).
+- `db_pg.ts` / `db_pglite.ts` — driver adapters. `db_pg.ts` also exports
+  `register_pg_type_parsers`, the shared int8→number coercion (so
+  `BIGSERIAL` columns read as JS numbers, matching PGlite) — called by both
+  `create_db` and the test pg factory (`testing/db.ts`) so prod and tests
+  read the same wire shape from one registration site.
 - `migrate.ts` — advisory-lock migration runner (`run_migrations`,
   `baseline`), `Migration` / `MigrationNamespace` / `MigrationError`.
 - `query_deps.ts` — `QueryDeps = {db}`, the first param to every `query_*`.

package/dist/db/cell_queries.js

@@ -394,8 +394,15 @@ const build_shared_with_sql = (order_column, order_direction) => `${CALLER_ROLE_
  * Returns `null` (rather than `[]`) when no refs are present — the column
  * is nullable and the `idx_cell_refs` partial index is `WHERE refs IS NOT
  * NULL`, so an empty array would force every cell into the index.
+ *
+ * Sorts the deduped refs lexicographically so the stored `text[]` is
+ * deterministic and byte-identical to the Rust twin (`fuz_cell`'s
+ * `extract_refs`, which sorts the same `blake3:`-prefixed element form).
+ * The shared `fact_hash_extract_refs` deliberately preserves traversal
+ * order per its contract, so the sort lives here at the storage boundary,
+ * not in the util.
  */
 const derive_refs = (data) => {
     const refs = fact_hash_extract_refs(data);
-    return refs.length > 0 ? refs : null;
+    return refs.length > 0 ? refs.sort() : null;
 };

package/dist/db/create_db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create_db.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/create_db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAC,EAAE,EAAE,MAAM,EAAC,MAAM,SAAS,CAAC;AAIxC,yCAAyC;AACzC,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,EAAE,CAAC;IACP,iFAAiF;IACjF,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,GAAU,cAAc,MAAM,KAAG,OAAO,CAAC,cAAc,CA6C5E,CAAC"}
+{"version":3,"file":"create_db.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/create_db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAC,EAAE,EAAE,MAAM,EAAC,MAAM,SAAS,CAAC;AAIxC,yCAAyC;AACzC,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,EAAE,CAAC;IACP,iFAAiF;IACjF,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,GAAU,cAAc,MAAM,KAAG,OAAO,CAAC,cAAc,CAiC5E,CAAC"}

package/dist/db/create_db.js

@@ -12,7 +12,7 @@
  *
  * @module
  */
-import { create_pg_db } from './db_pg.js';
+import { create_pg_db, register_pg_type_parsers } from './db_pg.js';
 import { create_pglite_db } from './db_pglite.js';
 /**
  * Create a database connection based on a URL.
@@ -32,19 +32,7 @@ import { create_pglite_db } from './db_pglite.js';
 export const create_db = async (database_url) => {
     if (database_url.startsWith('postgres://') || database_url.startsWith('postgresql://')) {
         const { default: pg } = await import('pg');
-        // Parse int8 (BIGINT) as a JS number. pg defaults to returning int8
-        // as a string to avoid 2^53 precision loss; our only int8 column
-        // today (`audit_log.seq`) stays well under that bound, and reading
-        // as number keeps the wire shape uniform across the SERIAL→BIGSERIAL
-        // widening.
-        //
-        // CAVEAT: pg.types.setTypeParser mutates pg.types globally — every
-        // pg.Pool in the process inherits the coercion, including pools the
-        // consumer constructs against unrelated databases. Any future int8
-        // column that could legitimately exceed 2^53 (file sizes, byte
-        // offsets) will silently round; if one lands, localize via a
-        // per-pool `types` override instead of widening this global parser.
-        pg.types.setTypeParser(20, (val) => Number(val));
+        await register_pg_type_parsers();
         const pool = new pg.Pool({ connectionString: database_url });
         const { db, close } = create_pg_db(pool);
         return {

package/dist/db/db_pg.d.ts

@@ -2,13 +2,41 @@
  * PostgreSQL driver adapter for `Db`.
  *
  * Provides `create_pg_db()` to construct a `Db` backed by a `pg.Pool`.
- * Only imports `pg` types — the actual `pg` package is dynamically imported
- * by callers (e.g., `create_db`) that construct the `Pool`.
+ * Statically imports only `pg` types; the `pg` runtime is dynamically
+ * imported where needed — by callers (e.g., `create_db`) that construct the
+ * `Pool`, and by `register_pg_type_parsers` to reach `pg.types`. pglite-only
+ * consumers never reach either path, so `pg` stays an optional peer dep.
  *
  * @module
  */
 import type { Pool } from 'pg';
 import { type DbDriverResult } from './db.js';
+/**
+ * Register the shared pg type-parser overrides on the module-global `pg.types`.
+ *
+ * Dynamically imports the `pg` runtime (so pglite-only consumers, who never
+ * call this, don't need `pg` installed) and coerces int8 (`BIGINT`, OID 20)
+ * to a JS number. pg defaults to returning
+ * int8 as a string to avoid 2^53 precision loss; our int8 columns today
+ * (`audit_log.seq`, `cell_history.id`, `fact.size`) stay well under that
+ * bound, and reading as a number keeps the wire shape uniform with PGlite —
+ * which returns int8 as a number — so `AuditLogEvent.seq` and friends
+ * validate identically across both drivers.
+ *
+ * Both `create_db` (production) and the test pg factory (`testing/db.ts`)
+ * register through this single site so test and prod read the same shape; a
+ * divergence here is exactly the test/prod write-semantics gap the parser
+ * exists to close.
+ *
+ * CAVEAT: `setTypeParser` mutates `pg.types` globally — every `pg.Pool` in
+ * the process inherits the coercion, including pools the consumer constructs
+ * against unrelated databases. Any future int8 column that could legitimately
+ * exceed 2^53 (byte offsets, counters) will silently round; if one lands,
+ * localize via a per-pool `types` override instead of widening this global.
+ *
+ * @mutates `pg.types` - registers the int8 parser on the global pg type registry
+ */
+export declare const register_pg_type_parsers: () => Promise<void>;
 /**
  * Create a `Db` backed by a `pg.Pool`.
  *

package/dist/db/db_pg.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db_pg.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/db_pg.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,IAAI,CAAC;AAE7B,OAAO,EAA4B,KAAK,cAAc,EAAC,MAAM,SAAS,CAAC;AA2BvE;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,GAAI,MAAM,IAAI,KAAG,cAGxC,CAAC"}
+{"version":3,"file":"db_pg.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/db_pg.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,IAAI,CAAC;AAE7B,OAAO,EAA4B,KAAK,cAAc,EAAC,MAAM,SAAS,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,wBAAwB,QAAa,OAAO,CAAC,IAAI,CAG7D,CAAC;AA2BF;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,GAAI,MAAM,IAAI,KAAG,cAGxC,CAAC"}

package/dist/db/db_pg.js

@@ -2,12 +2,43 @@
  * PostgreSQL driver adapter for `Db`.
  *
  * Provides `create_pg_db()` to construct a `Db` backed by a `pg.Pool`.
- * Only imports `pg` types — the actual `pg` package is dynamically imported
- * by callers (e.g., `create_db`) that construct the `Pool`.
+ * Statically imports only `pg` types; the `pg` runtime is dynamically
+ * imported where needed — by callers (e.g., `create_db`) that construct the
+ * `Pool`, and by `register_pg_type_parsers` to reach `pg.types`. pglite-only
+ * consumers never reach either path, so `pg` stays an optional peer dep.
  *
  * @module
  */
 import { Db, no_nested_transaction } from './db.js';
+/**
+ * Register the shared pg type-parser overrides on the module-global `pg.types`.
+ *
+ * Dynamically imports the `pg` runtime (so pglite-only consumers, who never
+ * call this, don't need `pg` installed) and coerces int8 (`BIGINT`, OID 20)
+ * to a JS number. pg defaults to returning
+ * int8 as a string to avoid 2^53 precision loss; our int8 columns today
+ * (`audit_log.seq`, `cell_history.id`, `fact.size`) stay well under that
+ * bound, and reading as a number keeps the wire shape uniform with PGlite —
+ * which returns int8 as a number — so `AuditLogEvent.seq` and friends
+ * validate identically across both drivers.
+ *
+ * Both `create_db` (production) and the test pg factory (`testing/db.ts`)
+ * register through this single site so test and prod read the same shape; a
+ * divergence here is exactly the test/prod write-semantics gap the parser
+ * exists to close.
+ *
+ * CAVEAT: `setTypeParser` mutates `pg.types` globally — every `pg.Pool` in
+ * the process inherits the coercion, including pools the consumer constructs
+ * against unrelated databases. Any future int8 column that could legitimately
+ * exceed 2^53 (byte offsets, counters) will silently round; if one lands,
+ * localize via a per-pool `types` override instead of widening this global.
+ *
+ * @mutates `pg.types` - registers the int8 parser on the global pg type registry
+ */
+export const register_pg_type_parsers = async () => {
+    const { types } = await import('pg');
+    types.setTypeParser(20, (val) => Number(val));
+};
 /**
  * Create a transaction implementation for a `pg.Pool`.
  *

package/dist/db/fact_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fact_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/fact_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,iBAAiB,CAAC;AAE/C,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,+BAA+B,CAAC;AAE5D,0CAA0C;AAC1C,MAAM,WAAW,OAAO;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,UAAU,EAAE,IAAI,CAAC;CACjB;AAED,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,QAAQ,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,UAAU,EAAE,IAAI,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,SAAS,EACf,OAAO;IACN,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;CACb,KACC,OAAO,CAAC,OAAO,CASjB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,aAAa,QAAQ,EACrB,eAAe,KAAK,CAAC,QAAQ,CAAC,KAC5B,OAAO,CAAC,IAAI,CAQd,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,GAAU,MAAM,SAAS,EAAE,MAAM,QAAQ,KAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAO5F,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,MAAM,QAAQ,KACZ,OAAO,CAAC,WAAW,GAAG,IAAI,CAO5B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,cAAc,GAAU,MAAM,SAAS,EAAE,MAAM,QAAQ,KAAG,OAAO,CAAC,OAAO,CAMrF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,aAAa,QAAQ,KACnB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAMzB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,MAAM,QAAQ,KACZ,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAC,GAAG,IAAI,CAQ5D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,QAAQ,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,YAAY,IAAI,GAAG,IAAI,EACvB,cAAc,MAAM,KAClB,OAAO,CAAC,qBAAqB,CAwC/B,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,EACf,YAAY,IAAI,KACd,OAAO,CAAC,KAAK,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAC,CAAC,CAiB5E,CAAC"}
+{"version":3,"file":"fact_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/fact_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,iBAAiB,CAAC;AAE/C,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,+BAA+B,CAAC;AAE5D,0CAA0C;AAC1C,MAAM,WAAW,OAAO;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAK5B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,UAAU,EAAE,IAAI,CAAC;CACjB;AAED,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,QAAQ,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAE5B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,UAAU,EAAE,IAAI,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,SAAS,EACf,OAAO;IACN,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;CACb,KACC,OAAO,CAAC,OAAO,CASjB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,aAAa,QAAQ,EACrB,eAAe,KAAK,CAAC,QAAQ,CAAC,KAC5B,OAAO,CAAC,IAAI,CAQd,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,GAAU,MAAM,SAAS,EAAE,MAAM,QAAQ,KAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAO5F,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,MAAM,QAAQ,KACZ,OAAO,CAAC,WAAW,GAAG,IAAI,CAO5B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,cAAc,GAAU,MAAM,SAAS,EAAE,MAAM,QAAQ,KAAG,OAAO,CAAC,OAAO,CAMrF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,aAAa,QAAQ,KACnB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAMzB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,MAAM,QAAQ,KACZ,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAC,GAAG,IAAI,CAQ5D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,QAAQ,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,YAAY,IAAI,GAAG,IAAI,EACvB,cAAc,MAAM,KAClB,OAAO,CAAC,qBAAqB,CAwC/B,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,EACf,YAAY,IAAI,KACd,OAAO,CAAC,KAAK,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAC,CAAC,CAiB5E,CAAC"}

package/dist/server/serve_fact_route.d.ts

@@ -63,6 +63,18 @@
  * is the doc cell, so serving goes view-doc-cell → doc-cell-refs-include-hash
  * → serve.
  *
+ * ## Untrusted-content hardening
+ *
+ * Fact bytes are served with a producer-supplied `content_type` emitted
+ * verbatim, inline. To stop a fact stored as (or sniffable to) `text/html`
+ * from executing as stored XSS for any reader of a referencing cell, **every**
+ * served-fact response carries `X-Content-Type-Options: nosniff` +
+ * `Content-Security-Policy: default-src 'none'; sandbox` (the
+ * `FACT_SECURITY_HEADERS` set, applied in all three serve branches). The same
+ * pair, byte-identical, is set by the Rust twin (`fuz_fact_serving::serve`).
+ * `Content-Disposition: attachment` is deliberately **not** added — it would
+ * force-download and break legitimate inline image rendering.
+ *
  * ## Defense-in-depth
  *
  * The `external_url` regex is re-validated before issuing

package/dist/server/serve_fact_route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve_fact_route.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/serve_fact_route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyEG;AAMH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAepD,OAAO,EAAsC,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAE1F,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,iBAAiB,CAAC;AAsC7C,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;CACZ;AAwGD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,+BAA+B,KACtC,SA8CF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,SAgCF,CAAC"}
+{"version":3,"file":"serve_fact_route.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/serve_fact_route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AAMH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAepD,OAAO,EAAsC,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAE1F,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,iBAAiB,CAAC;AAkE7C,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;CACZ;AA2GD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,+BAA+B,KACtC,SA8CF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,SAgCF,CAAC"}

package/dist/server/serve_fact_route.js

@@ -63,6 +63,18 @@
  * is the doc cell, so serving goes view-doc-cell → doc-cell-refs-include-hash
  * → serve.
  *
+ * ## Untrusted-content hardening
+ *
+ * Fact bytes are served with a producer-supplied `content_type` emitted
+ * verbatim, inline. To stop a fact stored as (or sniffable to) `text/html`
+ * from executing as stored XSS for any reader of a referencing cell, **every**
+ * served-fact response carries `X-Content-Type-Options: nosniff` +
+ * `Content-Security-Policy: default-src 'none'; sandbox` (the
+ * `FACT_SECURITY_HEADERS` set, applied in all three serve branches). The same
+ * pair, byte-identical, is set by the Rust twin (`fuz_fact_serving::serve`).
+ * `Content-Disposition: attachment` is deliberately **not** added — it would
+ * force-download and break legitimate inline image rendering.
+ *
  * ## Defense-in-depth
  *
  * The `external_url` regex is re-validated before issuing
@@ -92,6 +104,31 @@ import { can_view_cell } from '../auth/cell_authorize.js';
 import { parse_file_fact_url } from '../db/file_fact_url.js';
 /** `Cache-Control` for fact responses — 5 min revocation window. */
 const CACHE_CONTROL = 'private, max-age=300';
+/**
+ * `X-Content-Type-Options` for fact responses — block MIME sniffing so an
+ * `application/octet-stream` fact can't be sniffed into executable HTML.
+ */
+const X_CONTENT_TYPE_OPTIONS = 'nosniff';
+/**
+ * `Content-Security-Policy` for fact responses. Fact bytes carry a
+ * producer-supplied `content_type` served verbatim inline, so a fact stored as
+ * (or sniffable to) `text/html` would otherwise execute as stored XSS for any
+ * reader of a referencing cell. `default-src 'none'; sandbox` neutralizes
+ * script execution and sub-resource loads even when a fact is rendered inline;
+ * harmless for directly-served images (they load no sub-resources). The same
+ * pair, byte-identical, is set by the Rust twin (`fuz_fact_serving::serve`).
+ */
+const CONTENT_SECURITY_POLICY = "default-src 'none'; sandbox";
+/**
+ * The untrusted-content hardening headers applied to every served-fact
+ * response across all three branches (embedded, `X-Accel-Redirect`,
+ * disk-stream). `Content-Disposition: attachment` is deliberately omitted — it
+ * would force-download and break legitimate inline image rendering.
+ */
+const FACT_SECURITY_HEADERS = {
+    'X-Content-Type-Options': X_CONTENT_TYPE_OPTIONS,
+    'Content-Security-Policy': CONTENT_SECURITY_POLICY,
+};
 /**
  * Path-param schema for the bare-hash route. Matching the canonical
  * fact-hash form here pushes malformed-hash 400s through the framework's
@@ -150,6 +187,7 @@ const serve_fact_bytes = async (c, route, hash, config) => {
             'Content-Type': content_type,
             'Content-Length': size,
             'Cache-Control': CACHE_CONTROL,
+            ...FACT_SECURITY_HEADERS,
         });
     }
     // External — defense-in-depth re-validate the URL before trusting it
@@ -167,6 +205,7 @@ const serve_fact_bytes = async (c, route, hash, config) => {
             'Content-Length': size,
             'Cache-Control': CACHE_CONTROL,
             'X-Accel-Redirect': `${x_accel_redirect_prefix}${shard}/${rest}`,
+            ...FACT_SECURITY_HEADERS,
         });
     }
     // Dev / tests: stream from disk. `createReadStream` errors land on the
@@ -178,6 +217,7 @@ const serve_fact_bytes = async (c, route, hash, config) => {
         'Content-Type': content_type,
         'Content-Length': size,
         'Cache-Control': CACHE_CONTROL,
+        ...FACT_SECURITY_HEADERS,
     });
 };
 /**

package/dist/testing/cross_backend/cell_crud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsD9B,OAAO,KAAK,EAAC,wBAAwB,EAAC,MAAM,YAAY,CAAC;AAGzD,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IAwSlF,CAAC"}
+{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsD9B,OAAO,KAAK,EAAC,wBAAwB,EAAC,MAAM,YAAY,CAAC;AAGzD,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IA6VlF,CAAC"}

package/dist/testing/cross_backend/cell_crud.js

@@ -83,6 +83,29 @@ export const describe_cell_crud_cross_tests = (options) => {
             assert.ok(!gone.ok, 'deleted cell still readable');
             assert.strictEqual(error_reason(gone), 'cell_not_found');
         });
+        test_if(capabilities.cell_crud, 'refs are deduped and lexicographically sorted (deterministic, cross-impl-identical)', async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'cell_refs_owner' });
+            const t = fixture.fresh_transport();
+            const owner_headers = owner.create_session_headers();
+            // Three valid distinct fact hashes that sort a < b < c, embedded in
+            // `data` in a deliberately unsorted, nested, duplicated order. Both
+            // spines must derive `refs` as the sorted [a, b, c] regardless of
+            // traversal order or `HashSet` iteration — the byte-identical
+            // cross-backend contract (Rust `extract_refs` ↔ TS `derive_refs`).
+            const ref_a = `blake3:${'a'.repeat(64)}`;
+            const ref_b = `blake3:${'b'.repeat(64)}`;
+            const ref_c = `blake3:${'c'.repeat(64)}`;
+            const sorted = [ref_a, ref_b, ref_c];
+            const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note', cover: ref_c, nested: { attachments: [ref_b, ref_a, ref_b] } } }, owner_headers), CellCreateOutput);
+            assert.deepStrictEqual(created.cell.refs, sorted, 'create did not return sorted refs');
+            // Read it back — the stored column round-trips sorted too.
+            const got = expect_output(await cross_rpc_call(t, rpc_path, 'cell_get', { id: created.cell.id }, owner_headers), CellGetOutput);
+            assert.deepStrictEqual(got.cell.refs, sorted, 'get did not return sorted refs');
+            // Update reorders the embedded refs — the new column is still sorted.
+            const updated = expect_output(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id: created.cell.id, data: { refs: [ref_b, ref_c, ref_a] } }, owner_headers), CellUpdateOutput);
+            assert.deepStrictEqual(updated.cell.refs, sorted, 'update did not return sorted refs');
+        });
         test_if(capabilities.cell_crud, 'anon sees public cells only; private is 404', async () => {
             const fixture = await setup_test();
             const owner = await fixture.create_account({ username: 'cell_anon_owner' });

package/dist/testing/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/db.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA8B7B,OAAO,KAAK,EAAC,EAAE,EAAC,MAAM,aAAa,CAAC;AAKpC;;GAEG;AACH,eAAO,MAAM,KAAK,SAA4B,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,GAAU,IAAI,EAAE,KAAG,OAAO,CAAC,IAAI,CAGvD,CAAC;AAMF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,GAAI,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,KAAG,SAkB7E,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iBAAiB,GAC7B,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,EACtC,WAAW,MAAM,KACf,SA2DF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,UAQhC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,UAAyC,CAAC;AAEvF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB,GAAU,IAAI,EAAE,KAAG,OAAO,CAAC,IAAI,CAG3D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,GAC9B,WAAW,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,EACvC,iBAAiB,KAAK,CAAC,MAAM,CAAC,KAC5B,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,IAAI,KAAK,IAAI,CAwBzD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAAI,WAAW,KAAK,CAAC,SAAS,CAAC,KAAG,IAMnE,CAAC"}
+{"version":3,"file":"db.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/db.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA8B7B,OAAO,KAAK,EAAC,EAAE,EAAC,MAAM,aAAa,CAAC;AAKpC;;GAEG;AACH,eAAO,MAAM,KAAK,SAA4B,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,GAAU,IAAI,EAAE,KAAG,OAAO,CAAC,IAAI,CAGvD,CAAC;AAMF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,GAAI,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,KAAG,SAkB7E,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iBAAiB,GAC7B,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,EACtC,WAAW,MAAM,KACf,SAgEF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,UAQhC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,UAAyC,CAAC;AAEvF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB,GAAU,IAAI,EAAE,KAAG,OAAO,CAAC,IAAI,CAG3D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,GAC9B,WAAW,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,EACvC,iBAAiB,KAAK,CAAC,MAAM,CAAC,KAC5B,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,IAAI,KAAK,IAAI,CAwBzD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAAI,WAAW,KAAK,CAAC,SAAS,CAAC,KAAG,IAMnE,CAAC"}

package/dist/testing/db.js

@@ -26,7 +26,7 @@ import { describe, beforeAll, beforeEach, afterAll } from 'vitest';
 import { to_error_message } from '@fuzdev/fuz_util/error.ts';
 import { create_pglite_db } from '../db/db_pglite.js';
 import { assert_valid_sql_identifier } from '../db/sql_identifier.js';
-import { create_pg_db } from '../db/db_pg.js';
+import { create_pg_db, register_pg_type_parsers } from '../db/db_pg.js';
 /**
  * CI detection — `CI=true` is set automatically by GitHub Actions, GitLab CI, etc.
  */
@@ -121,6 +121,11 @@ export const create_pg_factory = (init_schema, test_url) => {
                 pool_ref = null;
             }
             const { Pool } = await import('pg');
+            // Mirror production's int8→number coercion (`create_db`) so the
+            // test pg pool reads `BIGSERIAL` columns (e.g. `audit_log.seq`)
+            // as numbers like PGlite does — without this the pg leg of a
+            // `.db.test.ts` sees `seq` as a string and wire-schema parses fail.
+            await register_pg_type_parsers();
             const pool = new Pool({ connectionString: test_url });
             pool_ref = pool;
             const { db } = create_pg_db(pool);

package/dist/testing/middleware.js

@@ -13,7 +13,7 @@ import { Hono } from 'hono';
 import { Logger } from '@fuzdev/fuz_util/log.ts';
 import { create_bearer_auth_middleware } from '../auth/bearer_auth.js';
 import { query_validate_api_token } from '../auth/api_token_queries.js';
-import { query_account_by_id, query_actor_by_id, query_actors_by_account, } from '../auth/account_queries.js';
+import { query_account_by_id, query_actor_by_id, query_active_actors_by_account, } from '../auth/account_queries.js';
 import { query_role_grant_find_active_for_actor } from '../auth/role_grant_queries.js';
 import { create_proxy_middleware } from '../http/proxy.js';
 import { get_client_ip } from '../http/client_ip.js';
@@ -29,7 +29,7 @@ vi.mock('../auth/api_token_queries.js', () => ({
 vi.mock('../auth/account_queries.js', () => ({
     query_account_by_id: vi.fn(),
     query_actor_by_id: vi.fn(),
-    query_actors_by_account: vi.fn(),
+    query_active_actors_by_account: vi.fn(),
 }));
 vi.mock('../auth/role_grant_queries.js', () => ({
     query_role_grant_find_active_for_actor: vi.fn(),
@@ -52,7 +52,7 @@ export const create_bearer_auth_mocks = (tc) => {
     const mock_validate = vi.mocked(query_validate_api_token);
     const mock_find_by_id = vi.mocked(query_account_by_id);
     const mock_find_actor_by_id = vi.mocked(query_actor_by_id);
-    const mock_find_actors_by_account = vi.mocked(query_actors_by_account);
+    const mock_find_actors_by_account = vi.mocked(query_active_actors_by_account);
     const mock_find_active_for_actor = vi.mocked(query_role_grant_find_active_for_actor);
     mock_validate
         .mockReset()
@@ -211,7 +211,7 @@ export const create_test_middleware_stack_app = (options) => {
     const mock_validate = vi.mocked(query_validate_api_token);
     const mock_find_by_id = vi.mocked(query_account_by_id);
     const mock_find_actor_by_id = vi.mocked(query_actor_by_id);
-    const mock_find_actors_by_account = vi.mocked(query_actors_by_account);
+    const mock_find_actors_by_account = vi.mocked(query_active_actors_by_account);
     const mock_find_active_for_actor = vi.mocked(query_role_grant_find_active_for_actor);
     mock_validate.mockReset().mockImplementation(() => Promise.resolve(undefined));
     mock_find_by_id.mockReset().mockImplementation(() => Promise.resolve(undefined));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.95.0",
+  "version": "0.96.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",
@@ -23,6 +23,10 @@
     "deploy": "gro deploy"
   },
   "type": "module",
+  "imports": {
+    "#lib/*": "./src/lib/*",
+    "#routes/*": "./src/routes/*"
+  },
   "engines": {
     "node": ">=24.14"
   },
@@ -79,7 +83,7 @@
     "@hono/node-server": "^1.19.14",
     "@hono/node-ws": "^1.3.1",
     "@node-rs/argon2": "^2.0.2",
-    "@ryanatkn/eslint-config": "^0.12.1",
+    "@ryanatkn/eslint-config": "^0.12.2",
     "@sveltejs/acorn-typescript": "^1.0.9",
     "@sveltejs/adapter-static": "^3.0.10",
     "@sveltejs/kit": "^2.63.0",