@haverstack/record-adapter-do-sqlite 0.26.0 → 0.28.0

package/dist/index.js

@@ -1,5 +1,5 @@
-import { StackNotFoundError, StackConflictError, applyMergePatch, assertOneSurface, StackVersionConflictError, StackBadRequestError, NATIVE_SORT_FIELDS } from '@haverstack/core';
-import { OwnerMismatchError, contentSortEntry, parseContentFilterKey, contentSortKey } from '@haverstack/core/adapter';
+import { StackConflictError, applyMergePatch, StackNotFoundError, StackVersionConflictError, StackBadRequestError, NATIVE_SORT_FIELDS } from '@haverstack/core';
+import { OwnerMismatchError, softDeletedRefusal, sameAssociationSet, ElementSetMovedError, contentSortEntry, constantSortEntry, contentSortKey, parseContentFilterKey } from '@haverstack/core/adapter';
 
 // ../sqlite-shared/dist/schema.js
 var RECORD_SCHEMA_SQL = `
@@ -20,41 +20,43 @@ var RECORD_SCHEMA_SQL = `
     unlisted_at INTEGER
   ) STRICT;
 
-  -- Every edge a record carries, authority and data alike: a permission
-  -- entry has element identity and a delta the same shape as a tag's, so
-  -- it earns the same table and the same durability tier. The permissions
-  -- and associations fields are projections over it, partitioned by
-  -- kind. See docs/spec/access-control.md \xA7 Record-level permissions.
-  --
-  -- A relationship's target is (related_scope, related_id) plus one
-  -- qualifier: related_stack for a record in another stack, related_ns for
-  -- a foreign namespace. All four are in the primary key, so two targets
-  -- differing only by namespace are two associations. A permission's
-  -- grantee reuses them \u2014 related_scope 'entity' or 'group', related_id the
-  -- DID or group id \u2014 plus related_role, which only a group grantee sets
-  -- and which is in the key because member and admin name two different
-  -- sets of people.
-  --
-  -- attachment_record_id stays out of the primary key: it annotates a
-  -- reference rather than naming one, so re-pointing it updates the row an
-  -- an amendAssociations() add lands on instead of writing a second reference to the same
-  -- file. See docs/spec/attachments.md \xA7 Naming the upload a reference came from.
-  --
-  -- The primary key leads with record_id, so its implicit index already
-  -- serves every by-record read and delete; the indexes below exist only
-  -- for the filter directions it cannot answer.
+  -- A record's data associations: tags, attachments and relationships.
+  -- Its permissions are in their own table below, so no predicate over this
+  -- one can match a grantee as a relationship target.
   CREATE TABLE IF NOT EXISTS associations (
     record_id     TEXT NOT NULL REFERENCES records(id),
-    kind          TEXT NOT NULL CHECK (kind IN ('tag', 'attachment', 'relationship', 'permission', 'anyone')),
+    kind          TEXT NOT NULL CHECK (kind IN ('tag', 'attachment', 'relationship')),
     label         TEXT NOT NULL,
     file_id       TEXT NOT NULL DEFAULT '',
-    related_scope TEXT NOT NULL DEFAULT '' CHECK (related_scope IN ('', 'record', 'entity', 'external', 'group')),
+    -- A relationship target is (related_scope, related_id) qualified by
+    -- related_ns (a foreign namespace) or related_stack (another stack).
+    -- All are in the key, so targets differing only by a qualifier are
+    -- distinct associations.
+    related_scope TEXT NOT NULL DEFAULT '' CHECK (related_scope IN ('', 'record', 'entity', 'external')),
     related_id    TEXT NOT NULL DEFAULT '',
     related_ns    TEXT NOT NULL DEFAULT '',
     related_stack TEXT NOT NULL DEFAULT '',
-    related_role  TEXT NOT NULL DEFAULT '' CHECK (related_role IN ('', 'member', 'admin')),
+    -- Out of the key: it annotates a reference rather than naming one, so
+    -- re-pointing it updates the existing row. See docs/spec/attachments.md
+    -- \xA7 Naming the upload a reference came from.
     attachment_record_id TEXT NOT NULL DEFAULT '',
-    PRIMARY KEY (record_id, kind, label, file_id, related_scope, related_id, related_ns, related_stack, related_role)
+    -- Leads with record_id, so its implicit index serves every by-record
+    -- read and delete; the indexes below cover only the filter directions.
+    PRIMARY KEY (record_id, kind, label, file_id, related_scope, related_id, related_ns, related_stack)
+  ) STRICT;
+
+  -- Who reaches a record, one row per element. An 'anyone' row names no
+  -- grantee; a group grantee's role is in the key, because member and
+  -- admin name two different sets of people.
+  -- See docs/spec/access-control.md \xA7 Record-level permissions.
+  CREATE TABLE IF NOT EXISTS permissions (
+    record_id    TEXT NOT NULL REFERENCES records(id),
+    kind         TEXT NOT NULL CHECK (kind IN ('permission', 'anyone')),
+    label        TEXT NOT NULL CHECK (label IN ('read', 'write')),
+    grantee_kind TEXT NOT NULL DEFAULT '' CHECK (grantee_kind IN ('', 'entity', 'group')),
+    grantee_id   TEXT NOT NULL DEFAULT '',
+    role         TEXT NOT NULL DEFAULT '' CHECK (role IN ('', 'member', 'admin')),
+    PRIMARY KEY (record_id, kind, label, grantee_kind, grantee_id, role)
   ) STRICT;
 
   -- Content and the type it is read under. No parent_id, unlisted_at or
@@ -116,7 +118,6 @@ var RECORD_SCHEMA_SQL = `
 
   -- One row per top-level scalar content field a record holds a value at:
   -- what it orders as, and the file it references. See
-  -- docs/spec/adapters.md \xA7 Adapter backends and
   -- docs/spec/data-model.md \xA7 Sorting by a content field.
   --
   -- value_rank is 0 for a numeric value and 1 for a text one \u2014 the same
@@ -133,14 +134,11 @@ var RECORD_SCHEMA_SQL = `
     PRIMARY KEY (record_id, field)
   ) STRICT;
 
-  -- Indexes. Each filter column continues into (created_at, id) \u2014 the
-  -- default ordering and its tiebreak \u2014 because these columns are
-  -- low-cardinality by design, and a narrow index on one leaves the
-  -- planner sorting the whole matching set before it can honor LIMIT.
-  --
-  -- deleted_at and unlisted_at deliberately have none: nothing searches
-  -- for the rows they mark, and an index on a column every query tests
-  -- for IS NULL only lures the planner off the one answering ORDER BY.
+  -- Each filter column continues into (created_at, id), the default order
+  -- and its tiebreak: these columns are low-cardinality, and a narrow index
+  -- leaves the planner sorting every match before it can honor LIMIT.
+  -- deleted_at and unlisted_at get none: an index on a column every query
+  -- tests IS NULL only lures the planner off the one answering ORDER BY.
   CREATE INDEX IF NOT EXISTS idx_records_type_id      ON records(type_id, created_at, id);
   CREATE INDEX IF NOT EXISTS idx_records_parent_id    ON records(parent_id, created_at, id);
   CREATE INDEX IF NOT EXISTS idx_records_entity_id    ON records(entity_id, created_at, id);
@@ -160,6 +158,11 @@ var RECORD_SCHEMA_SQL = `
   CREATE INDEX IF NOT EXISTS idx_assoc_related      ON associations(kind, related_scope, related_ns, related_id, record_id);
   CREATE INDEX IF NOT EXISTS idx_types_base_id      ON types(base_id, version);
 
+  -- The permissions key with record_id moved last, so a scoped query reads
+  -- the records carrying an element straight out of the index.
+  CREATE INDEX IF NOT EXISTS idx_permissions_element
+    ON permissions(kind, label, grantee_kind, grantee_id, role, record_id);
+
   -- The whole content ordering, in index order, for one field at a time:
   -- a content-sorted page is an ordered walk of a slice of this index.
   CREATE INDEX IF NOT EXISTS idx_content_index_sort
@@ -181,71 +184,6 @@ var applyRecordSchema = (exec, opts) => {
   exec.exec(RECORD_SCHEMA_SQL);
   exec.exec(FTS5_SCHEMA_SQL);
 };
-var SORT_FIELDS = NATIVE_SORT_FIELDS;
-var toBase64 = (text) => {
-  const bytes = new TextEncoder().encode(text);
-  let binary = "";
-  for (const byte of bytes)
-    binary += String.fromCharCode(byte);
-  return btoa(binary);
-};
-var fromBase64 = (cursor) => {
-  const binary = atob(cursor);
-  const bytes = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++)
-    bytes[i] = binary.charCodeAt(i);
-  return new TextDecoder().decode(bytes);
-};
-var encodeCursor = (decoded) => toBase64(JSON.stringify(decoded.kind === "absent" ? { k: decoded.kind, f: decoded.field, i: decoded.id } : { k: decoded.kind, f: decoded.field, i: decoded.id, v: decoded.value }));
-var decodeCursor = (cursor) => {
-  const malformed = () => new StackBadRequestError(`Invalid cursor: malformed "${cursor}"`);
-  let parsed;
-  try {
-    parsed = JSON.parse(fromBase64(cursor));
-  } catch {
-    throw malformed();
-  }
-  if (!parsed || typeof parsed !== "object")
-    throw malformed();
-  const { k, f, i, v } = parsed;
-  if (typeof f !== "string" || !f || typeof i !== "string")
-    throw malformed();
-  if (k === "absent")
-    return { kind: "absent", field: f, id: i };
-  if (k === "text") {
-    if (typeof v !== "string")
-      throw malformed();
-    return { kind: "text", field: f, value: v, id: i };
-  }
-  if (k === "num" || k === "native") {
-    if (typeof v !== "number" || !isFinite(v)) {
-      throw new StackBadRequestError(`Invalid cursor: non-numeric sort value`);
-    }
-    if (k === "native") {
-      if (!SORT_FIELDS.includes(f)) {
-        throw new StackBadRequestError(`Invalid cursor: unknown sort field "${f}"`);
-      }
-      return { kind: "native", field: f, value: v, id: i };
-    }
-    return { kind: "num", field: f, value: v, id: i };
-  }
-  throw malformed();
-};
-var getSortField = (query) => query.sort?.field ?? "createdAt";
-var getSortColumn = (field) => field === "createdAt" ? "created_at" : field === "updatedAt" ? "updated_at" : "version";
-var makeCursor = (record, sort, kindOf) => {
-  const contentField = sort?.contentField;
-  if (contentField === void 0) {
-    const field = getSortField({ sort });
-    const value = field === "updatedAt" ? record.updatedAt.getTime() : field === "version" ? record.version : record.createdAt.getTime();
-    return encodeCursor({ kind: "native", field, value, id: record.id });
-  }
-  const kind = kindOf?.(record, contentField);
-  const entry = kind ? contentSortEntry(kind, record.content[contentField]) : null;
-  if (!entry)
-    return encodeCursor({ kind: "absent", field: contentField, id: record.id });
-  return entry.kind === "num" ? encodeCursor({ kind: "num", field: contentField, value: entry.num, id: record.id }) : encodeCursor({ kind: "text", field: contentField, value: entry.text, id: record.id });
-};
 
 // ../sqlite-shared/dist/fts5.js
 var OUTSIDE_PHRASE_DISALLOWED = /[^\p{L}\p{N}\p{M}_\s()"]/gu;
@@ -259,7 +197,7 @@ var sanitizeFts5Query = (query, maxDepth = 2) => {
   clean = clean.replace(/\bNEAR\s*\(/gi, "(");
   clean = clean.replace(/"[^"]*"|[^"]+/g, (span) => span.startsWith('"') ? span : span.replace(OUTSIDE_PHRASE_DISALLOWED, " "));
   clean = collapseWhitespace(clean);
-  clean = clean.replace(/(?:^|\(\s*)NOT\s+/gi, (m) => m.replace(/NOT\s+/i, ""));
+  clean = clean.replace(/"[^"]*"?|(^|\(\s*)NOT\s+/gi, (m, lead) => lead ?? m);
   let currentDepth = 0;
   let inPhrase = false;
   let result = "";
@@ -326,61 +264,277 @@ var restoreImplicitAnd = (query) => withPhrasesMasked(query, (masked) => masked.
   const next = /^\s*([\p{L}\p{N}_]+)/u.exec(whole.slice(offset + match.length));
   return next && isOperator(next[1]) ? match : ") AND ";
 }).replace(new RegExp(String.raw`(?<!${OPERAND_CHAR})(${OPERAND_CHAR}+)\s*(?=\()`, "gu"), (match, word) => isOperator(word) ? match : `${word} AND `));
-var fts5Strategy = {
-  /** Index a record that has no FTS entry yet (used right after an INSERT). */
-  insert(exec, recordId, content) {
-    exec.run(`INSERT INTO records_fts(rowid, content) SELECT rowid, ? FROM records WHERE id = ?`, [
-      content,
-      recordId
-    ]);
-  },
-  /**
-   * Remove a record's FTS entry. MUST be called before the records row's
-   * content changes or the row is deleted — see the note above.
-   */
-  remove(exec, recordId) {
-    const row = exec.get("SELECT rowid, content FROM records WHERE id = ?", [recordId]);
-    if (!row)
-      return;
-    exec.run(`INSERT INTO records_fts(records_fts, rowid, content) VALUES('delete', ?, ?)`, [
-      row.rowid,
-      row.content
-    ]);
+
+// ../sqlite-shared/dist/executor.js
+var isForeignKeyViolation = (err) => err instanceof Error && err.message.includes("FOREIGN KEY constraint failed");
+var isUniqueConstraintViolation = (err) => err instanceof Error && err.message.includes("UNIQUE constraint failed");
+
+// ../sqlite-shared/dist/config.js
+var CONFIG_ROW_SQL = `SELECT content FROM records WHERE id = '_config'`;
+var insertConfigRecord = (exec, entityId, timezone) => {
+  const now = Date.now();
+  exec.run(`INSERT INTO records (id, type_id, created_at, updated_at, content, version)
+     VALUES ('_config', '_config@1', ?, ?, ?, 1)`, [now, now, JSON.stringify({ entityId, timezone })]);
+  return { entityId, timezone };
+};
+var tryReadStackConfig = (exec) => {
+  const row = exec.get(CONFIG_ROW_SQL);
+  if (!row)
+    return null;
+  const content = JSON.parse(row.content);
+  return { entityId: content.entityId, timezone: content.timezone };
+};
+var toBase64 = (text) => {
+  const bytes = new TextEncoder().encode(text);
+  let binary = "";
+  for (const byte of bytes)
+    binary += String.fromCharCode(byte);
+  return btoa(binary);
+};
+var fromBase64 = (cursor) => {
+  const binary = atob(cursor);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++)
+    bytes[i] = binary.charCodeAt(i);
+  return new TextDecoder().decode(bytes);
+};
+var encodeCursor = (decoded) => toBase64(JSON.stringify(decoded.kind === "absent" ? { k: decoded.kind, f: decoded.field, i: decoded.id } : { k: decoded.kind, f: decoded.field, i: decoded.id, v: decoded.value }));
+var decodeCursor = (cursor) => {
+  const malformed = () => new StackBadRequestError(`Invalid cursor: malformed "${cursor}"`);
+  let parsed;
+  try {
+    parsed = JSON.parse(fromBase64(cursor));
+  } catch {
+    throw malformed();
+  }
+  if (!parsed || typeof parsed !== "object")
+    throw malformed();
+  const { k, f, i, v } = parsed;
+  if (typeof f !== "string" || !f || typeof i !== "string")
+    throw malformed();
+  if (k === "absent")
+    return { kind: "absent", field: f, id: i };
+  if (k === "text") {
+    if (typeof v !== "string")
+      throw malformed();
+    return { kind: "text", field: f, value: v, id: i };
+  }
+  if (k === "num" || k === "native") {
+    if (typeof v !== "number" || !isFinite(v)) {
+      throw new StackBadRequestError(`Invalid cursor: non-numeric sort value`);
+    }
+    if (k === "native") {
+      if (!NATIVE_SORT_FIELDS.includes(f)) {
+        throw new StackBadRequestError(`Invalid cursor: unknown sort field "${f}"`);
+      }
+      return { kind: "native", field: f, value: v, id: i };
+    }
+    return { kind: "num", field: f, value: v, id: i };
+  }
+  throw malformed();
+};
+var byTypeDescriptor = (byType) => JSON.stringify(Object.entries(byType).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0));
+var getSortColumn = (field) => field === "createdAt" ? "created_at" : field === "updatedAt" ? "updated_at" : "version";
+var makeCursor = (record, sort, kindOf2) => {
+  const byType = sort.contentFieldByType;
+  if (byType) {
+    const field2 = byTypeDescriptor(byType);
+    const key = Object.hasOwn(byType, record.typeId) ? byType[record.typeId] : void 0;
+    const kind2 = key?.field === void 0 ? void 0 : kindOf2?.(record, key.field);
+    const entry2 = key?.field !== void 0 ? kind2 && contentSortEntry(kind2, record.content[key.field]) : key && constantSortEntry(key.value ?? null);
+    return encodeEntry(field2, entry2 || null, record.id);
+  }
+  const { contentField, field } = sort;
+  if (field !== void 0) {
+    const value = field === "updatedAt" ? record.updatedAt.getTime() : field === "version" ? record.version : record.createdAt.getTime();
+    return encodeCursor({ kind: "native", field, value, id: record.id });
   }
+  const kind = kindOf2?.(record, contentField);
+  const entry = kind ? contentSortEntry(kind, record.content[contentField]) : null;
+  return encodeEntry(contentField, entry, record.id);
+};
+var encodeEntry = (field, entry, id) => {
+  if (!entry)
+    return encodeCursor({ kind: "absent", field, id });
+  return entry.kind === "num" ? encodeCursor({ kind: "num", field, value: entry.num, id }) : encodeCursor({ kind: "text", field, value: entry.text, id });
+};
+
+// ../sqlite-shared/dist/mappers.js
+var toMs = (d) => d.getTime();
+var actorFromColumns = (subject, principal) => subject == null ? void 0 : {
+  subjectId: subject,
+  ...principal != null && { principalId: principal }
+};
+var fromMs = (ms) => new Date(ms);
+var rowToRecord = (row, associations, permissions) => {
+  const record = {
+    id: row.id,
+    typeId: row.type_id,
+    createdAt: fromMs(row.created_at),
+    updatedAt: fromMs(row.updated_at),
+    content: JSON.parse(row.content),
+    version: row.version
+  };
+  if (row.parent_id != null)
+    record.parentId = row.parent_id;
+  if (row.app_id != null)
+    record.appId = row.app_id;
+  const createdBy = actorFromColumns(row.entity_id, row.principal_id);
+  if (createdBy)
+    record.createdBy = createdBy;
+  const updatedBy = actorFromColumns(row.updated_by, row.updated_via);
+  if (updatedBy)
+    record.updatedBy = updatedBy;
+  if (row.deleted_at != null)
+    record.deletedAt = fromMs(row.deleted_at);
+  if (row.unlisted_at != null)
+    record.unlistedAt = fromMs(row.unlisted_at);
+  if (associations.length)
+    record.associations = associations;
+  if (permissions.length)
+    record.permissions = permissions;
+  return record;
+};
+var rowToAssociation = (row) => {
+  if (row.kind === "tag") {
+    return { kind: "tag", label: row.label };
+  }
+  if (row.kind === "attachment") {
+    const attachmentRecordId = row.attachment_record_id;
+    return {
+      kind: "attachment",
+      label: row.label,
+      fileId: row.file_id,
+      // Stored as '' when absent, like every other optional column here —
+      // the field is omitted rather than served empty, so a round trip
+      // produces the association the caller wrote.
+      ...attachmentRecordId && { attachmentRecordId }
+    };
+  }
+  return {
+    kind: "relationship",
+    label: row.label,
+    target: rowToTarget(row)
+  };
+};
+var associationKeyColumns = (a) => {
+  if (a.kind === "attachment")
+    return [a.fileId, "", "", "", ""];
+  if (a.kind !== "relationship")
+    return ["", "", "", "", ""];
+  const t = a.target;
+  if (t.kind === "entity")
+    return ["", "entity", t.entityId, "", ""];
+  if (t.kind === "external")
+    return ["", "external", t.id, t.ns, ""];
+  return ["", "record", t.recordId, "", t.stackUrl ?? ""];
+};
+var permissionKeyColumns = (p) => {
+  if (p.kind === "anyone")
+    return ["", "", ""];
+  const g = p.grantee;
+  return g.kind === "entity" ? ["entity", g.entityId, ""] : ["group", g.groupId, g.role];
+};
+var rowToPermission = (row) => {
+  if (row.kind === "anyone")
+    return { kind: "anyone", label: "read" };
+  const id = row.grantee_id;
+  return {
+    kind: "permission",
+    label: row.label,
+    grantee: row.grantee_kind === "group" ? { kind: "group", groupId: id, role: row.role } : { kind: "entity", entityId: id }
+  };
+};
+var rowToTarget = (row) => {
+  const id = row.related_id;
+  if (row.related_scope === "entity")
+    return { kind: "entity", entityId: id };
+  if (row.related_scope === "external") {
+    return { kind: "external", ns: row.related_ns, id };
+  }
+  const stackUrl = row.related_stack;
+  return { kind: "record", recordId: id, ...stackUrl && { stackUrl } };
+};
+var rowToType = (row) => {
+  const t = {
+    id: row.id,
+    baseId: row.base_id,
+    version: row.version,
+    name: row.name,
+    schema: JSON.parse(row.schema),
+    schemaHash: row.schema_hash,
+    createdAt: fromMs(row.created_at)
+  };
+  if (row.migrates_from)
+    t.migratesFrom = row.migrates_from;
+  return t;
+};
+var rowToVersion = (row) => {
+  const v = {
+    version: row.version,
+    typeId: row.type_id,
+    content: JSON.parse(row.content),
+    updatedAt: fromMs(row.updated_at)
+  };
+  const createdBy = actorFromColumns(row.entity_id, row.principal_id);
+  if (createdBy)
+    v.createdBy = createdBy;
+  const updatedBy = actorFromColumns(row.updated_by, row.updated_via);
+  if (updatedBy)
+    v.updatedBy = updatedBy;
+  return v;
+};
+var rowToJournalEntry = (row) => {
+  const e = {
+    seq: row.seq,
+    at: fromMs(row.at),
+    kind: row.kind,
+    ops: JSON.parse(row.ops),
+    version: row.version,
+    typeId: row.type_id
+  };
+  if (row.parent_id != null)
+    e.parentId = row.parent_id;
+  if (row.previous_parent_id != null) {
+    e.previousParentId = row.previous_parent_id === "" ? null : row.previous_parent_id;
+  }
+  if (row.actor != null)
+    e.actor = JSON.parse(row.actor);
+  if (row.associations != null)
+    e.associations = JSON.parse(row.associations);
+  return e;
 };
 
 // ../sqlite-shared/dist/query.js
-var atBudget = (page, rows) => ({
+var atBudget = (page, rows2) => ({
   sql: page.sql,
-  params: [...page.params, rows]
+  params: [...page.params, rows2]
 });
-var sqlDirection = (query) => {
-  const dir = query.sort ? query.sort.direction : "desc";
-  if (dir !== "asc" && dir !== "desc") {
-    throw new StackBadRequestError(`Invalid sort direction "${dir}": expected "asc" or "desc".`);
-  }
-  return dir === "asc" ? "ASC" : "DESC";
+var sqlDirection = (query) => query.sort.direction === "asc" ? "ASC" : "DESC";
+var spread = (alias) => `CASE ${alias}.type WHEN 'array' THEN ${alias}.value WHEN 'object' THEN json_array(json(${alias}.value)) WHEN 'true' THEN '[true]' WHEN 'false' THEN '[false]' ELSE json_array(${alias}.value) END`;
+var members = (alias) => `CASE WHEN ${alias}.t = 'object' THEN ${alias}.v ELSE '{}' END`;
+var emptyStatement = () => ({
+  tables: [],
+  tableParams: [],
+  conditions: ["r.id != '_config'"],
+  params: []
+});
+var rows = (s, columns, tuples) => {
+  const name = `t${s.tables.length}`;
+  s.tables.push(`${name} AS MATERIALIZED ${rowsTable(columns)}`);
+  s.tableParams.push(JSON.stringify(tuples));
+  return name;
 };
-var spread = (alias) => `CASE WHEN ${alias}.type = 'array' THEN ${alias}.value WHEN ${alias}.type = 'object' THEN json_array(json(${alias}.value)) ELSE json_array(${alias}.value) END`;
-var members = (alias) => `CASE WHEN ${alias}.type = 'object' THEN ${alias}.value ELSE '{}' END`;
-var contentPathExists = (segments, leaf, params, nextAlias) => {
-  let key = nextAlias();
-  let value = nextAlias();
-  const from = [`json_each(r.content) AS ${key}`, `json_each(${spread(key)}) AS ${value}`];
-  const where = [`${key}.key = ?`];
-  params.push(segments[0]);
-  for (const segment of segments.slice(1)) {
-    key = nextAlias();
-    from.push(`json_each(${members(value)}) AS ${key}`);
-    value = nextAlias();
-    from.push(`json_each(${spread(key)}) AS ${value}`);
-    where.push(`${key}.key = ?`);
-    params.push(segment);
-  }
-  where.push(leaf(value));
-  return `EXISTS (SELECT 1 FROM ${from.join(", ")} WHERE ${where.join(" AND ")})`;
+var rowsTable = (columns) => {
+  const named = columns.map((column, i) => `json_extract(value, '$[${i}]') AS ${column}`);
+  return `(SELECT ${named.join(", ")} FROM json_each(?))`;
+};
+var CONDITION_COLUMNS = ["scope", "path", "op", "val", "kind"];
+var kindOf = (type) => `CASE ${type} WHEN 'integer' THEN 'number' WHEN 'real' THEN 'number' ELSE ${type} END`;
+var holds = (c, r) => {
+  const depth = `json_array_length(${c}.path)`;
+  return `(WITH RECURSIVE w(d, v, t) AS (SELECT 0, ${r}.content, 'object' UNION ALL SELECT w.d + 1, e.value, e.type FROM w JOIN json_each(${members("w")}) m JOIN json_each(${spread("m")}) e WHERE w.d < ${depth} AND m.key = json_extract(${c}.path, '$[' || w.d || ']')) SELECT CASE ${c}.op WHEN 'equals' THEN IFNULL(MAX(${kindOf("w.t")} = ${c}.kind AND w.v = ${c}.val), 0) WHEN 'present' THEN IFNULL(MAX(w.t != 'null'), 0) WHEN 'isNull' THEN IFNULL(MAX(w.t = 'null'), 0) OR NOT IFNULL(MAX(w.t != 'null'), 0) END FROM w WHERE w.d = ${depth})`;
 };
-var equalsLeaf = (alias) => `${alias}.type NOT IN ('object', 'array') AND ${alias}.value = ?`;
 var SORT_ALIAS = "cs";
 var cursorMismatch = (cursor, field) => new StackBadRequestError(`Cursor sort field "${cursor.field}" does not match query sort field "${field}"`);
 var nativeCursor = (cursor, field) => {
@@ -393,16 +547,77 @@ var contentCursor = (cursor, field) => {
     throw cursorMismatch(cursor, field);
   return cursor;
 };
-var recordConditions = (query) => {
-  const conditions = ["r.id != '_config'"];
-  const params = [];
+var valueKind = (value) => {
+  if (typeof value === "boolean")
+    return `${value}`;
+  if (typeof value === "number")
+    return "number";
+  return typeof value === "string" ? "text" : null;
+};
+var contentRows = (scope, predicate) => {
+  const row = (key, op, value = null) => {
+    const path = parseContentFilterKey(key);
+    return [scope, path, op, value, valueKind(value)];
+  };
+  return [
+    ...Object.entries(predicate.content ?? {}).map(([key, value]) => (
+      // undefined is the same absence null names — JSON drops it on the way
+      // over the wire, so treating it as a value would make an in-process
+      // query and its wire equivalent disagree.
+      value === null || value === void 0 ? row(key, "isNull") : row(key, "equals", value)
+    )),
+    ...(predicate.contentPresent ?? []).map((key) => row(key, "present"))
+  ];
+};
+var inList = (s, column, values) => {
+  if (values.length === 1) {
+    s.params.push(values[0]);
+    return `${column} = ?`;
+  }
+  const table = rows(s, ["value"], values.map((value) => [value]));
+  return `${column} IN (SELECT value FROM ${table})`;
+};
+var familyRange = (baseId) => [`${baseId}@`, `${baseId}A`];
+var withinFamily = (column, lo, hi) => `(${column} >= ${lo} AND ${column} < ${hi})`;
+var inFamily = (column, baseId) => ({
+  sql: withinFamily(column, "?", "?"),
+  params: familyRange(baseId)
+});
+var inFamilies = (s, record, baseIds) => {
+  if (baseIds.length === 1) {
+    const one = inFamily(`${record}.type_id`, baseIds[0]);
+    s.params.push(...one.params);
+    return one.sql;
+  }
+  const table = rows(s, ["lo", "hi"], baseIds.map(familyRange));
+  return `${record}.id IN (SELECT fr.id FROM ${table} f JOIN records fr ON ${withinFamily("fr.type_id", "f.lo", "f.hi")})`;
+};
+var carriesPermissions = (s, sets) => {
+  const elements = rows(s, ["set_index", "set_size", "kind", "label", "grantee_kind", "grantee_id", "role"], sets.flatMap((set, i) => set.map((p) => [i, set.length, p.kind, p.label, ...permissionKeyColumns(p)])));
+  return `r.id IN (SELECT p.record_id FROM ${elements} e JOIN permissions p ON p.kind = e.kind AND p.label = e.label AND p.grantee_kind = e.grantee_kind AND p.grantee_id = e.grantee_id AND p.role = e.role GROUP BY p.record_id, e.set_index HAVING COUNT(*) = MAX(e.set_size))`;
+};
+var reachConditions = (s, reach) => {
+  if (reach.fence)
+    s.conditions.push(inFamilies(s, "r", reach.fence));
+  const within = reach.within;
+  if (within) {
+    const arms = [inFamilies(s, "r", within.baseIds)];
+    if (within.authored) {
+      s.params.push(within.authored.subjectId);
+      arms.push(`(r.entity_id = ? AND ${inFamilies(s, "r", within.authored.baseIds)})`);
+    }
+    arms.push(carriesPermissions(s, within.permissions));
+    s.conditions.push(`(${arms.join(" OR ")})`);
+  }
+};
+var recordConditions = (query, reach) => {
+  const s = emptyStatement();
+  const { conditions, params } = s;
   const f = query.filter ?? {};
   const inFilter = (column, value) => {
     if (value === void 0)
       return;
-    const values = Array.isArray(value) ? value : [value];
-    conditions.push(`r.${column} IN (${values.map(() => "?").join(",")})`);
-    params.push(...values);
+    conditions.push(inList(s, `r.${column}`, Array.isArray(value) ? value : [value]));
   };
   const rangeFilter = (column, range) => {
     if (range?.after) {
@@ -420,7 +635,12 @@ var recordConditions = (query) => {
   if (!f.includeUnlisted) {
     conditions.push("r.unlisted_at IS NULL");
   }
+  if (reach)
+    reachConditions(s, reach);
   inFilter("type_id", f.typeId);
+  if (f.baseId !== void 0) {
+    conditions.push(inFamilies(s, "r", Array.isArray(f.baseId) ? f.baseId : [f.baseId]));
+  }
   if (f.parentId !== void 0) {
     if (f.parentId === null) {
       conditions.push("r.parent_id IS NULL");
@@ -436,10 +656,10 @@ var recordConditions = (query) => {
   rangeFilter("updated_at", f.updatedAt);
   const hasAssociation = (kind, clauses) => `r.id IN (SELECT a.record_id FROM associations a WHERE a.kind = '${kind}'` + clauses.map((c) => ` AND ${c}`).join("") + `)`;
   if (f.tags?.length) {
-    for (const tag of f.tags) {
-      conditions.push(hasAssociation("tag", ["a.label = ?"]));
-      params.push(tag);
-    }
+    const tags = [...new Set(f.tags)];
+    const label = inList(s, "a.label", tags);
+    conditions.push(`r.id IN (SELECT a.record_id FROM associations a WHERE a.kind = 'tag' AND ${label} GROUP BY a.record_id HAVING COUNT(DISTINCT a.label) = ?)`);
+    params.push(tags.length);
   }
   if (f.attachment) {
     const clauses = [];
@@ -485,28 +705,17 @@ var recordConditions = (query) => {
     }
     conditions.push(hasAssociation("relationship", clauses));
   }
-  if (f.content) {
-    let aliasSeq = 0;
-    const nextAlias = () => `cp${aliasSeq++}`;
-    for (const [key, value] of Object.entries(f.content)) {
-      const segments = parseContentFilterKey(key);
-      if (value === null || value === void 0) {
-        const isNull = contentPathExists(segments, (a) => `${a}.value IS NULL`, params, nextAlias);
-        const anyValue = contentPathExists(segments, (a) => `${a}.value IS NOT NULL`, params, nextAlias);
-        conditions.push(`(${isNull} OR NOT ${anyValue})`);
-      } else {
-        const match = contentPathExists(segments, equalsLeaf, params, nextAlias);
-        params.push(value);
-        conditions.push(match);
-      }
-    }
+  const content = contentRows(null, f);
+  if (f.contentByType) {
+    const arms = Object.entries(f.contentByType);
+    const typeIds = arms.map(([typeId]) => typeId);
+    conditions.push(inList(s, "r.type_id", typeIds));
+    for (const [typeId, arm] of arms)
+      content.push(...contentRows(typeId, arm));
   }
-  if (f.contentPresent?.length) {
-    let aliasSeq = 0;
-    const nextAlias = () => `pp${aliasSeq++}`;
-    for (const key of f.contentPresent) {
-      conditions.push(contentPathExists(parseContentFilterKey(key), (a) => `${a}.value IS NOT NULL`, params, nextAlias));
-    }
+  if (content.length > 0) {
+    const table = rows(s, CONDITION_COLUMNS, content);
+    conditions.push(`NOT EXISTS (SELECT 1 FROM ${table} c WHERE (c.scope IS NULL OR c.scope = r.type_id) AND NOT ${holds("c", "r")})`);
   }
   if (f.search) {
     const sanitized = sanitizeFts5Query(f.search);
@@ -517,7 +726,7 @@ var recordConditions = (query) => {
       conditions.push("0");
     }
   }
-  return { conditions, params };
+  return s;
 };
 var presentCursorCondition = (cursor, op, params) => {
   if (cursor.kind === "num") {
@@ -528,225 +737,193 @@ var presentCursorCondition = (cursor, op, params) => {
   params.push(key, key, cursor.value, cursor.value, cursor.id);
   return `(${SORT_ALIAS}.value_rank ${op} 1 OR (${SORT_ALIAS}.value_rank = 1 AND (${SORT_ALIAS}.text_key ${op} ? OR (${SORT_ALIAS}.text_key = ? AND (${SORT_ALIAS}.text_value ${op} ? OR (${SORT_ALIAS}.text_value = ? AND ${SORT_ALIAS}.record_id ${op} ?))))))`;
 };
-var statement = (select, from, conditions, params, tail = "") => ({
-  sql: `SELECT ${select} FROM ${from} WHERE ${conditions.join(" AND ")}${tail}`,
-  params
-});
-var buildQueryPlan = (query) => {
+var statement = (s, from, tail) => {
+  const select = `SELECT r.* FROM ${from} WHERE ${s.conditions.join(" AND ")}${tail}`;
+  const sql = s.tables.length === 0 ? select : `WITH ${s.tables.join(", ")} ${select}`;
+  return { sql, params: [...s.tableParams, ...s.params] };
+};
+var buildQueryPlan = (query, reach) => {
   const dir = sqlDirection(query);
   const op = dir === "ASC" ? ">" : "<";
   const decoded = query.cursor ? decodeCursor(query.cursor) : null;
-  const contentField = query.sort?.contentField;
-  if (contentField === void 0) {
-    const { conditions, params } = recordConditions(query);
-    const col = getSortColumn(getSortField(query));
+  if (query.sort.contentFieldByType) {
+    return byTypePlan(query, reach, query.sort.contentFieldByType, dir, op, decoded);
+  }
+  const { contentField, field } = query.sort;
+  if (field !== void 0) {
+    const where = recordConditions(query, reach);
+    const col = getSortColumn(field);
     if (decoded) {
-      const cursor2 = nativeCursor(decoded, getSortField(query));
-      conditions.push(`(r.${col} ${op} ? OR (r.${col} = ? AND r.id ${op} ?))`);
-      params.push(cursor2.value, cursor2.value, cursor2.id);
+      const cursor2 = nativeCursor(decoded, field);
+      where.conditions.push(`(r.${col} ${op} ? OR (r.${col} = ? AND r.id ${op} ?))`);
+      where.params.push(cursor2.value, cursor2.value, cursor2.id);
     }
-    return [
-      statement("r.*", "records r", conditions, params, ` ORDER BY r.${col} ${dir}, r.id ${dir} LIMIT ?`)
-    ];
+    return [statement(where, "records r", ` ORDER BY r.${col} ${dir}, r.id ${dir} LIMIT ?`)];
   }
   const cursor = decoded ? contentCursor(decoded, contentField) : null;
   const pages = [];
   if (cursor?.kind !== "absent") {
-    const { conditions, params } = recordConditions(query);
+    const where = recordConditions(query, reach);
     const from = `content_index ${SORT_ALIAS} JOIN records r ON r.id = ${SORT_ALIAS}.record_id`;
-    conditions.push(`${SORT_ALIAS}.field = ?`);
-    params.push(contentField);
+    where.conditions.push(`${SORT_ALIAS}.field = ?`);
+    where.params.push(contentField);
     if (cursor)
-      conditions.push(presentCursorCondition(cursor, op, params));
+      where.conditions.push(presentCursorCondition(cursor, op, where.params));
     const order = `${SORT_ALIAS}.value_rank ${dir}, ${SORT_ALIAS}.num_value ${dir}, ${SORT_ALIAS}.text_key ${dir}, ${SORT_ALIAS}.text_value ${dir}, ${SORT_ALIAS}.record_id ${dir}`;
-    pages.push(statement("r.*", from, conditions, params, ` ORDER BY ${order} LIMIT ?`));
+    pages.push(statement(where, from, ` ORDER BY ${order} LIMIT ?`));
   }
   {
-    const { conditions, params } = recordConditions(query);
-    conditions.push(`NOT EXISTS (SELECT 1 FROM content_index ${SORT_ALIAS} WHERE ${SORT_ALIAS}.record_id = r.id AND ${SORT_ALIAS}.field = ?)`);
-    params.push(contentField);
+    const where = recordConditions(query, reach);
+    where.conditions.push(`NOT EXISTS (SELECT 1 FROM content_index ${SORT_ALIAS} WHERE ${SORT_ALIAS}.record_id = r.id AND ${SORT_ALIAS}.field = ?)`);
+    where.params.push(contentField);
     if (cursor?.kind === "absent") {
-      conditions.push(`r.id ${op} ?`);
-      params.push(cursor.id);
+      where.conditions.push(`r.id ${op} ?`);
+      where.params.push(cursor.id);
     }
-    pages.push(statement("r.*", "records r", conditions, params, ` ORDER BY r.id ${dir} LIMIT ?`));
+    pages.push(statement(where, "records r", ` ORDER BY r.id ${dir} LIMIT ?`));
   }
   return pages;
 };
-
-// ../sqlite-shared/dist/mappers.js
-var toMs = (d) => d.getTime();
-var actorFromColumns = (subject, principal) => subject == null ? void 0 : {
-  subjectId: subject,
-  ...principal != null && { principalId: principal }
+var byTypePlan = (query, reach, byType, dir, op, decoded) => {
+  const cursor = decoded ? contentCursor(decoded, byTypeDescriptor(byType)) : null;
+  const fields = [];
+  const constants = [];
+  for (const [typeId, key] of Object.entries(byType)) {
+    if (key.field !== void 0) {
+      fields.push([typeId, key.field]);
+      continue;
+    }
+    const entry = constantSortEntry(key.value ?? null);
+    if (entry)
+      constants.push([typeId, entry]);
+  }
+  const pages = [];
+  if (cursor?.kind !== "absent" && fields.length + constants.length > 0) {
+    const where = recordConditions(query, reach);
+    const sources = [];
+    if (fields.length > 0) {
+      const byField = rows(where, ["type_id", "field"], fields);
+      sources.push(`SELECT ci.record_id AS record_id, ci.value_rank AS value_rank, ci.num_value AS num_value, ci.text_key AS text_key, ci.text_value AS text_value FROM ${byField} f JOIN content_index ci ON ci.field = f.field JOIN records t ON t.id = ci.record_id AND t.type_id = f.type_id`);
+    }
+    if (constants.length > 0) {
+      const byConstant = rows(where, ["type_id", "value_rank", "num_value", "text_key", "text_value"], constants.map(([typeId, entry]) => entry.kind === "num" ? [typeId, 0, entry.num, null, null] : [typeId, 1, null, entry.key, entry.text]));
+      sources.push(`SELECT t.id AS record_id, k.value_rank AS value_rank, k.num_value AS num_value, k.text_key AS text_key, k.text_value AS text_value FROM ${byConstant} k JOIN records t ON t.type_id = k.type_id`);
+    }
+    if (cursor)
+      where.conditions.push(presentCursorCondition(cursor, op, where.params));
+    const from = `(${sources.join(" UNION ALL ")}) ${SORT_ALIAS} JOIN records r ON r.id = ${SORT_ALIAS}.record_id`;
+    const order = `${SORT_ALIAS}.value_rank ${dir}, ${SORT_ALIAS}.num_value ${dir}, ${SORT_ALIAS}.text_key ${dir}, ${SORT_ALIAS}.text_value ${dir}, ${SORT_ALIAS}.record_id ${dir}`;
+    pages.push(statement(where, from, ` ORDER BY ${order} LIMIT ?`));
+  }
+  {
+    const where = recordConditions(query, reach);
+    if (fields.length > 0) {
+      const byField = rows(where, ["type_id", "field"], fields);
+      where.conditions.push(`NOT EXISTS (SELECT 1 FROM ${byField} f JOIN content_index ${SORT_ALIAS} ON ${SORT_ALIAS}.record_id = r.id AND ${SORT_ALIAS}.field = f.field WHERE f.type_id = r.type_id)`);
+    }
+    if (constants.length > 0) {
+      const typeIds = constants.map(([typeId]) => typeId);
+      where.conditions.push(`NOT (${inList(where, "r.type_id", typeIds)})`);
+    }
+    if (cursor?.kind === "absent") {
+      where.conditions.push(`r.id ${op} ?`);
+      where.params.push(cursor.id);
+    }
+    pages.push(statement(where, "records r", ` ORDER BY r.id ${dir} LIMIT ?`));
+  }
+  return pages;
 };
-var fromMs = (ms) => new Date(ms);
-var partitionAssociations = (associations) => ({
-  associations: associations.filter((a) => a.kind !== "permission" && a.kind !== "anyone"),
-  permissions: associations.filter((a) => a.kind === "permission" || a.kind === "anyone")
-});
-var rowToRecord = (row, associations) => {
-  const record = {
-    id: row.id,
-    typeId: row.type_id,
-    createdAt: fromMs(row.created_at),
-    updatedAt: fromMs(row.updated_at),
-    content: JSON.parse(row.content),
-    version: row.version
-  };
-  if (row.parent_id != null)
-    record.parentId = row.parent_id;
-  if (row.app_id != null)
-    record.appId = row.app_id;
-  const createdBy = actorFromColumns(row.entity_id, row.principal_id);
-  if (createdBy)
-    record.createdBy = createdBy;
-  const updatedBy = actorFromColumns(row.updated_by, row.updated_via);
-  if (updatedBy)
-    record.updatedBy = updatedBy;
-  if (row.deleted_at != null)
-    record.deletedAt = fromMs(row.deleted_at);
-  if (row.unlisted_at != null)
-    record.unlistedAt = fromMs(row.unlisted_at);
-  const partitioned = partitionAssociations(associations);
-  if (partitioned.associations.length)
-    record.associations = partitioned.associations;
-  if (partitioned.permissions.length)
-    record.permissions = partitioned.permissions;
-  return record;
+var SearchIndex = class {
+  exec;
+  constructor(exec) {
+    this.exec = exec;
+  }
+  /** Index a record that has no FTS entry yet (used right after an INSERT). */
+  insert(recordId, content) {
+    this.exec.run(`INSERT INTO records_fts(rowid, content) SELECT rowid, ? FROM records WHERE id = ?`, [content, recordId]);
+  }
+  /**
+   * Remove a record's FTS entry. MUST be called before the records row's
+   * content changes or the row is deleted — see the note above.
+   */
+  remove(recordId) {
+    const row = this.exec.get("SELECT rowid, content FROM records WHERE id = ?", [recordId]);
+    if (!row)
+      return;
+    this.exec.run(`INSERT INTO records_fts(records_fts, rowid, content) VALUES('delete', ?, ?)`, [
+      row.rowid,
+      row.content
+    ]);
+  }
 };
-var rowToAssociation = (row) => {
-  if (row.kind === "tag") {
-    return { kind: "tag", label: row.label };
+var indexedFieldKinds = (schema) => {
+  const kinds = /* @__PURE__ */ new Map();
+  for (const [field, def] of Object.entries(schema)) {
+    if (!def.kind || def.kind === "array" || def.kind === "object")
+      continue;
+    kinds.set(field, def.kind);
   }
-  if (row.kind === "anyone") {
-    return { kind: "anyone", label: "read" };
+  return kinds;
+};
+var ContentIndex = class {
+  exec;
+  fieldsByType = /* @__PURE__ */ new Map();
+  constructor(exec) {
+    this.exec = exec;
   }
-  if (row.kind === "permission") {
-    return {
-      kind: "permission",
-      label: row.label,
-      grantee: rowToGrantee(row)
-    };
+  /** Prime the cache from a type as it is saved. */
+  rememberType(type) {
+    this.fieldsByType.set(type.id, indexedFieldKinds(type.schema));
   }
-  if (row.kind === "attachment") {
-    const attachmentRecordId = row.attachment_record_id;
-    return {
-      kind: "attachment",
-      label: row.label,
-      fileId: row.file_id,
-      // Stored as '' when absent, like every other optional column here —
-      // the field is omitted rather than served empty, so a round trip
-      // produces the association the caller wrote.
-      ...attachmentRecordId && { attachmentRecordId }
-    };
+  /**
+   * Replace a record's rows with what its content currently holds, on every
+   * write that can change content or typeId, so neither the ordering nor the
+   * file-reference lookup can drift from the record. A field holding no
+   * orderable value gets no row at all, which is what puts the record at the
+   * end of a sort on that field.
+   */
+  sync(recordId, typeId, content) {
+    this.remove(recordId);
+    for (const [field, kind] of this.fieldsOf(typeId)) {
+      const entry = contentSortEntry(kind, content[field]);
+      if (!entry)
+        continue;
+      const sql = `INSERT OR IGNORE INTO content_index
+          (record_id, field, value_rank, num_value, text_key, text_value, file_id)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`;
+      if (entry.kind === "num") {
+        this.exec.run(sql, [recordId, field, 0, entry.num, null, null, null]);
+      } else {
+        const fileId = kind === "file-ref" ? entry.text : null;
+        this.exec.run(sql, [recordId, field, 1, null, entry.key, entry.text, fileId]);
+      }
+    }
   }
-  return {
-    kind: "relationship",
-    label: row.label,
-    target: rowToTarget(row)
-  };
-};
-var associationKeyColumns = (a) => {
-  if (a.kind === "attachment")
-    return [a.fileId, "", "", "", "", ""];
-  if (a.kind === "permission") {
-    const g = a.grantee;
-    return g.kind === "entity" ? ["", "entity", g.entityId, "", "", ""] : ["", "group", g.groupId, "", "", g.role];
+  remove(recordId) {
+    this.exec.run("DELETE FROM content_index WHERE record_id = ?", [recordId]);
   }
-  if (a.kind !== "relationship")
-    return ["", "", "", "", "", ""];
-  const t = a.target;
-  if (t.kind === "entity")
-    return ["", "entity", t.entityId, "", "", ""];
-  if (t.kind === "external")
-    return ["", "external", t.id, t.ns, "", ""];
-  return ["", "record", t.recordId, "", t.stackUrl ?? "", ""];
-};
-var rowToGrantee = (row) => row.related_scope === "group" ? {
-  kind: "group",
-  groupId: row.related_id,
-  role: row.related_role
-} : { kind: "entity", entityId: row.related_id };
-var rowToTarget = (row) => {
-  const id = row.related_id;
-  if (row.related_scope === "entity")
-    return { kind: "entity", entityId: id };
-  if (row.related_scope === "external") {
-    return { kind: "external", ns: row.related_ns, id };
+  /** The declared kind of a type's top-level `field`, if it has one. */
+  kindOf(typeId, field) {
+    return this.fieldsOf(typeId).get(field);
   }
-  const stackUrl = row.related_stack;
-  return { kind: "record", recordId: id, ...stackUrl && { stackUrl } };
-};
-var rowToType = (row) => {
-  const t = {
-    id: row.id,
-    baseId: row.base_id,
-    version: row.version,
-    name: row.name,
-    schema: JSON.parse(row.schema),
-    schemaHash: row.schema_hash,
-    createdAt: fromMs(row.created_at)
-  };
-  if (row.migrates_from)
-    t.migratesFrom = row.migrates_from;
-  return t;
-};
-var rowToVersion = (row) => {
-  const v = {
-    version: row.version,
-    typeId: row.type_id,
-    content: JSON.parse(row.content),
-    updatedAt: fromMs(row.updated_at)
-  };
-  const createdBy = actorFromColumns(row.entity_id, row.principal_id);
-  if (createdBy)
-    v.createdBy = createdBy;
-  const updatedBy = actorFromColumns(row.updated_by, row.updated_via);
-  if (updatedBy)
-    v.updatedBy = updatedBy;
-  return v;
-};
-var rowToJournalEntry = (row) => {
-  const e = {
-    seq: row.seq,
-    at: fromMs(row.at),
-    kind: row.kind,
-    ops: JSON.parse(row.ops),
-    version: row.version,
-    typeId: row.type_id
-  };
-  if (row.parent_id != null)
-    e.parentId = row.parent_id;
-  if (row.previous_parent_id != null) {
-    e.previousParentId = row.previous_parent_id === "" ? null : row.previous_parent_id;
+  /**
+   * From the cache, falling back to a `types` lookup only for a typeId this
+   * process hasn't seen via rememberType() yet, e.g. right after open().
+   */
+  fieldsOf(typeId) {
+    const cached = this.fieldsByType.get(typeId);
+    if (cached)
+      return cached;
+    const typeRow = this.exec.get("SELECT schema FROM types WHERE id = ?", [
+      typeId
+    ]);
+    const fields = typeRow ? indexedFieldKinds(JSON.parse(typeRow.schema)) : /* @__PURE__ */ new Map();
+    this.fieldsByType.set(typeId, fields);
+    return fields;
   }
-  if (row.actor != null)
-    e.actor = JSON.parse(row.actor);
-  if (row.associations != null)
-    e.associations = JSON.parse(row.associations);
-  return e;
 };
 
-// ../sqlite-shared/dist/executor.js
-var isForeignKeyViolation = (err) => err instanceof Error && err.message.includes("FOREIGN KEY constraint failed");
-var isUniqueConstraintViolation = (err) => err instanceof Error && err.message.includes("UNIQUE constraint failed");
-
-// ../sqlite-shared/dist/config.js
-var CONFIG_ROW_SQL = `SELECT content FROM records WHERE id = '_config'`;
-var insertConfigRecord = (exec, entityId, timezone) => {
-  const now = Date.now();
-  exec.run(`INSERT INTO records (id, type_id, created_at, updated_at, content, version)
-     VALUES ('_config', '_config@1', ?, ?, ?, 1)`, [now, now, JSON.stringify({ entityId, timezone })]);
-  return { entityId, timezone };
-};
-var tryReadStackConfig = (exec) => {
-  const row = exec.get(CONFIG_ROW_SQL);
-  if (!row)
-    return null;
-  const content = JSON.parse(row.content);
-  return { entityId: content.entityId, timezone: content.timezone };
-};
+// ../sqlite-shared/dist/record-logic.js
 var asStackBadRequestError = (query, run) => {
   try {
     return run();
@@ -757,6 +934,7 @@ var asStackBadRequestError = (query, run) => {
   }
 };
 var versionConflict = (id, expected, actual) => new StackVersionConflictError(`Record "${id}" is at version ${actual}, expected ${expected}`, id, expected, actual);
+var recordNotFound = (id) => new StackNotFoundError(`Record not found: "${id}"`);
 var VERSION_COLUMNS = [
   "type_id",
   "content",
@@ -775,44 +953,20 @@ var versionRowValues = (version) => [
   version.updatedBy?.subjectId ?? null,
   version.updatedBy?.principalId ?? null
 ];
-var indexedFieldKinds = (schema) => {
-  const kinds = /* @__PURE__ */ new Map();
-  for (const [field, def] of Object.entries(schema)) {
-    if (!def.kind || def.kind === "array" || def.kind === "object")
-      continue;
-    kinds.set(field, def.kind);
-  }
-  return kinds;
-};
-var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
-  deps;
-  /**
-   * Per-typeId cache of the fields content_index covers and their declared
-   * kinds, so syncContentIndex() doesn't hit the `types` table and
-   * re-parse schema JSON on every write. Populated eagerly in saveType()
-   * and lazily via getIndexedFields().
-   */
-  indexedFieldsByType = /* @__PURE__ */ new Map();
-  constructor(deps) {
-    this.deps = deps;
-  }
-  get exec() {
-    return this.deps.exec;
-  }
-  /**
-   * Precondition check for a mutation that has already read the record —
-   * either because it can't fold the check into its own statement
-   * (purgeRecord: children reference the row, so the DELETE can't
-   * carry it), or because it has to settle the precondition *before*
-   * fts5Strategy.remove() runs, which needs the records row still holding
-   * the old content. In the latter case versionedUpdate() re-checks it
-   * inside the statement, and that is the enforcement; this is what lets
-   * the work before it be skipped.
-   */
-  checkExpectedVersion(record, expectedVersion) {
-    if (expectedVersion === void 0 || record.version === expectedVersion)
+var SharedSqlRecordLogic = class {
+  exec;
+  searchIndex;
+  contentIndex;
+  constructor({ exec }) {
+    this.exec = exec;
+    this.searchIndex = new SearchIndex(exec);
+    this.contentIndex = new ContentIndex(exec);
+  }
+  /** Check `ifVersion` against a version read inside the caller's transaction. */
+  checkExpectedVersion(id, actual, expected) {
+    if (expected === void 0 || actual === expected)
       return;
-    throw versionConflict(record.id, expectedVersion, record.version);
+    throw versionConflict(id, expected, actual);
   }
   /**
    * Called after a version-gated statement affected zero rows.
@@ -821,23 +975,43 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
    * the actual current version for the caller to act on).
    */
   throwVersionConflict(id, expectedVersion) {
-    const row = this.exec.get("SELECT version FROM records WHERE id = ?", [
-      id
-    ]);
+    const version = this.currentVersion(id);
+    if (version === void 0)
+      throw recordNotFound(id);
+    throw versionConflict(id, expectedVersion, version);
+  }
+  /**
+   * An aspect write's record, inside its transaction: missing is not found,
+   * a tombstone is refused, and anything else answers its version.
+   */
+  liveVersion(id) {
+    const row = this.exec.get("SELECT version, deleted_at FROM records WHERE id = ?", [id]);
     if (!row)
-      throw new StackNotFoundError(`Record not found: "${id}"`);
-    throw versionConflict(id, expectedVersion, row.version);
+      throw recordNotFound(id);
+    if (row.deleted_at !== null)
+      throw softDeletedRefusal(id);
+    return row.version;
+  }
+  currentVersion(id) {
+    return this.exec.get("SELECT version FROM records WHERE id = ?", [id])?.version;
   }
   /**
-   * The one shape every mutating UPDATE in this class has: whatever columns
-   * the caller is changing, then the version bump and the actor/timestamp
-   * stamp that every mutation owes, gated on the opt-in `ifVersion`
-   * precondition and failing loudly when nothing matched.
-   *
-   * The guard rides in the WHERE clause even where the caller has already
-   * checked the version against a record it read: that read is outside this
-   * statement, so a writer slipping in between the two is caught here
-   * rather than silently overwritten.
+   * What a mutation builds on, read inside its transaction so nothing can
+   * land between the read and the write: a patch applied to an earlier read
+   * would overwrite whatever changed since. Throws for a missing record or
+   * a failed `ifVersion`.
+   */
+  readForWrite(id, ifVersion) {
+    const row = this.exec.get("SELECT version, type_id, content FROM records WHERE id = ?", [id]);
+    if (!row)
+      throw recordNotFound(id);
+    this.checkExpectedVersion(id, row.version, ifVersion);
+    return { typeId: row.type_id, content: JSON.parse(row.content) };
+  }
+  /**
+   * Every version-bumping UPDATE. The `ifVersion` guard rides in the WHERE
+   * clause, so a write that reads nothing first (a soft delete, an
+   * undelete) enforces it with no separate read.
    */
   versionedUpdate(id, sets, values, opts, now = toMs(/* @__PURE__ */ new Date())) {
     const guarded = opts.ifVersion !== void 0;
@@ -853,15 +1027,9 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
       this.throwVersionConflict(id, opts.ifVersion);
   }
   /**
-   * Read a record back after its own mutation committed, for the caller to
-   * return. Its absence is not a "not found" for the caller to handle — the
-   * mutation just succeeded against it — so it fails as the invariant
-   * breach it would be.
-   *
-   * Synchronous, via readRecord() rather than getRecord(), so the read
-   * cannot be separated from the commit by anything: an async caller
-   * returning this still hands back a record read in the same tick its
-   * transaction committed. See readRecord() for why that matters.
+   * Read a record back after its own mutation committed. Absence here is an
+   * invariant breach, not a "not found". Synchronous, so nothing can run
+   * between the commit and the read — see readRecord().
    */
   reread(id, verb) {
     const updated = this.readRecord(id);
@@ -873,16 +1041,10 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
   // Records
   // -------------------------------------------------------
   /**
-   * A duplicate id hits the `records` PK — mapped to StackConflictError
-   * instead of surfacing the raw engine exception, mirroring saveVersion's
-   * collision mapping below.
-   *
-   * One transaction, because a record and the four tables that describe it
-   * are one fact. A half-applied create is worse than a failed one: the
-   * call raises, so the caller believes nothing landed, while the records
-   * row survives to fail their retry on the PK — and the row it leaves is
-   * invisible to `filter.search` and mis-ordered by `sort.contentField`
-   * until something writes it again.
+   * One transaction, because a record and the tables that describe it are
+   * one fact: a half-applied create raises, so the caller believes nothing
+   * landed, while the surviving row fails their retry on the PK and is
+   * missing from both indexes. A duplicate id maps to StackConflictError.
    */
   async createRecord(record, opts = {}) {
     this.exec.transaction(() => {
@@ -913,11 +1075,12 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
         }
         throw err;
       }
-      const edges = [...record.associations ?? [], ...record.permissions ?? []];
-      if (edges.length)
-        this.insertAssociations(record.id, edges);
-      fts5Strategy.insert(this.exec, record.id, JSON.stringify(record.content));
-      this.syncContentIndex(record.id, record.typeId, record.content);
+      if (record.associations?.length)
+        this.insertAssociations(record.id, record.associations);
+      if (record.permissions?.length)
+        this.insertPermissions(record.id, record.permissions);
+      this.searchIndex.insert(record.id, JSON.stringify(record.content));
+      this.contentIndex.sync(record.id, record.typeId, record.content);
       this.appendJournal(record.id, opts.journal);
     });
     return record;
@@ -926,97 +1089,62 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
     return this.readRecord(id);
   }
   /**
-   * The synchronous read behind getRecord(). Callers inside exec.transaction()
-   * use this one: an `await` inside that callback yields the microtask queue
-   * mid-transaction, and the next operation to run would try to open one of
-   * its own — transaction() requires a synchronous callback for exactly this
-   * reason (see SqlExecutor.transaction).
-   *
-   * The same synchrony is what lets the post-commit reads below report the
-   * version their own mutation produced: reread() calls this directly, so
-   * nothing interleaves between the commit and the read even though the
-   * method returning it is async. A backend that made these reads genuinely
-   * asynchronous would open that window, and a concurrent mutation could be
-   * reported under this one's verb.
+   * The synchronous read behind getRecord(), for use inside
+   * exec.transaction(), whose callback can't await. reread() relies on the
+   * same synchrony: nothing interleaves between a commit and its read, so a
+   * concurrent mutation is never reported under this one's verb.
    */
   readRecord(id) {
     const row = this.exec.get("SELECT * FROM records WHERE id = ?", [id]);
-    if (!row)
-      return null;
-    const associations = this.getAssociationsForRecord(id);
-    return rowToRecord(row, associations);
+    return row ? this.hydrate([row])[0] : null;
   }
   /**
-   * Apply a change set in one transaction: one UPDATE over the record row
-   * with only the columns the change set names, the association set
-   * replaced when it carries one, and the snapshot written alongside — so
-   * one call is one version whatever it moved.
-   *
-   * `opts.bumpsVersion: false` is a change set that touches only
-   * `associations`, `parentId` and/or `unlisted` — Stack computes this from
-   * which ops the set actually moves. Such a write still lands its columns,
-   * but leaves `version`, `updatedAt` and the actor stamps exactly as they
-   * stood and takes no snapshot. `ifVersion`, if given, is re-checked
-   * synchronously inside the transaction — the CAS guard the bumping path
-   * gets from its UPDATE's WHERE clause, restated as a read because the
-   * UPDATE here carries no version predicate. See
-   * docs/spec/versioning.md § Version history.
-   *
-   * The ifVersion check for a bumping write is standalone rather than
-   * folded into the UPDATE alone, because a content change needs
-   * fts.remove() to run *before* the records-table content changes. The
-   * guard is still in the UPDATE's WHERE, so a writer that slipped in
-   * between the read and the write is caught there rather than overwriting.
+   * Records rows with their associations and permissions attached: one
+   * statement per element table for the whole list, so a page costs three
+   * reads however many records it holds.
    */
-  async mutateRecord(id, changes, opts = {}) {
-    const existing = await this.getRecord(id);
-    if (!existing)
-      throw new StackNotFoundError(`Record not found: "${id}"`);
-    this.checkExpectedVersion(existing, opts.ifVersion);
-    const now = toMs(/* @__PURE__ */ new Date());
-    const sets = [];
-    const values = [];
-    if (changes.parentId !== void 0) {
-      sets.push("parent_id = ?");
-      values.push(changes.parentId);
-    }
-    if (changes.unlisted !== void 0) {
-      sets.push("unlisted_at = ?");
-      values.push(changes.unlisted ? now : null);
-    }
-    if (opts.bumpsVersion === false) {
-      this.exec.transaction(() => {
-        const current = this.readRecord(id);
-        if (!current)
-          throw new StackNotFoundError(`Record not found: "${id}"`);
-        this.checkExpectedVersion(current, opts.ifVersion);
-        if (sets.length > 0) {
-          this.exec.run(`UPDATE records SET ${sets.join(", ")} WHERE id = ?`, [...values, id]);
-        }
-        this.replaceAssociationHalves(id, changes);
-        this.appendJournal(id, opts.journal);
-      });
-      return this.reread(id, "mutateRecord");
-    }
-    const merged = changes.contentPatch ? applyMergePatch(existing.content, changes.contentPatch) : void 0;
-    if (merged !== void 0) {
-      sets.unshift("content = ?");
-      values.unshift(JSON.stringify(merged));
-    }
+  hydrate(rows2) {
+    const ids = rows2.map((row) => row.id);
+    const associations = this.elementsByRecord("associations", ids, rowToAssociation);
+    const permissions = this.elementsByRecord("permissions", ids, rowToPermission);
+    return rows2.map((row) => rowToRecord(row, associations.get(row.id) ?? [], permissions.get(row.id) ?? []));
+  }
+  /**
+   * The patch applies to the content as it stands when the write lands,
+   * read inside the same transaction.
+   */
+  async patchContent(id, patch, opts = {}) {
     this.exec.transaction(() => {
+      const current = this.readForWrite(id, opts.ifVersion);
       if (opts.snapshot)
         this.snapshotBeforeMutation(id, opts.snapshot);
-      if (merged !== void 0)
-        fts5Strategy.remove(this.exec, id);
-      this.versionedUpdate(id, sets, values, opts, now);
-      this.replaceAssociationHalves(id, changes);
-      if (merged !== void 0) {
-        fts5Strategy.insert(this.exec, id, JSON.stringify(merged));
-        this.syncContentIndex(id, existing.typeId, merged);
+      this.rewriteContent(id, current.typeId, applyMergePatch(current.content, patch), opts);
+      this.appendJournal(id, opts.journal);
+    });
+    return this.reread(id, "patchContent");
+  }
+  async setParent(id, parentId, opts = {}) {
+    return this.aspectUpdate(id, "parent_id = ?", parentId, opts, "setParent");
+  }
+  /** Stamped fresh: `Stack` hands this only a transition. */
+  async setUnlisted(id, unlisted, opts = {}) {
+    return this.aspectUpdate(id, "unlisted_at = ?", unlisted ? toMs(/* @__PURE__ */ new Date()) : null, opts, "setUnlisted");
+  }
+  /**
+   * One records column that never bumps. The tombstone refusal and the
+   * `ifVersion` guard ride in the WHERE clause, as on a versioned update.
+   */
+  aspectUpdate(id, set, value, opts, verb) {
+    const guarded = opts.ifVersion !== void 0;
+    this.exec.transaction(() => {
+      const changed = this.exec.run(`UPDATE records SET ${set}
+         WHERE id = ? AND deleted_at IS NULL${guarded ? " AND version = ?" : ""}`, [value, id, ...guarded ? [opts.ifVersion] : []]);
+      if (changed === 0) {
+        throw versionConflict(id, opts.ifVersion, this.liveVersion(id));
       }
       this.appendJournal(id, opts.journal);
     });
-    return this.reread(id, "mutateRecord");
+    return this.reread(id, verb);
   }
   async deleteRecord(id, opts = {}) {
     if (opts.purge) {
@@ -1032,27 +1160,24 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
     return this.reread(id, "deleteRecord");
   }
   /**
-   * Deletes a record's FTS entry, associations, versions, file-refs, sort
-   * index rows, and row, returning the record as it stood — the last copy that will ever
-   * exist, read here so that nothing can overtake it between the read and
-   * the deletes. Null when there was no such record. No write() call —
-   * callers batch it. ifVersion is checked first so a lost CAS race
-   * leaves nothing touched (children reference the row, so the check can't
-   * fold into the final DELETE).
+   * Delete a record and everything that refers to it, returning the record
+   * as it stood (null if there was none). Read here, inside the caller's
+   * transaction, so nothing can overtake the last copy that will ever exist.
    */
   purgeRecord(id, ifVersion) {
     const purged = this.readRecord(id);
     if (!purged) {
       if (ifVersion !== void 0)
-        throw new StackNotFoundError(`Record not found: "${id}"`);
+        throw recordNotFound(id);
       return null;
     }
-    this.checkExpectedVersion(purged, ifVersion);
-    fts5Strategy.remove(this.exec, id);
+    this.checkExpectedVersion(id, purged.version, ifVersion);
+    this.searchIndex.remove(id);
     this.exec.run("DELETE FROM associations WHERE record_id = ?", [id]);
+    this.exec.run("DELETE FROM permissions WHERE record_id = ?", [id]);
     this.exec.run("DELETE FROM versions WHERE record_id = ?", [id]);
     this.exec.run("DELETE FROM journal WHERE record_id = ?", [id]);
-    this.exec.run("DELETE FROM content_index WHERE record_id = ?", [id]);
+    this.contentIndex.remove(id);
     this.exec.run("DELETE FROM records WHERE id = ?", [id]);
     return purged;
   }
@@ -1066,14 +1191,11 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
     return this.reread(id, "undelete");
   }
   async restoreVersion(id, version, opts = {}) {
-    const existing = await this.getRecord(id);
-    if (!existing)
-      throw new StackNotFoundError(`Record not found: "${id}"`);
-    this.checkExpectedVersion(existing, opts.ifVersion);
-    const target = await this.getVersion(id, version);
-    if (!target)
-      throw new StackNotFoundError(`Version not found: "${id}"@${version}`);
     this.exec.transaction(() => {
+      this.readForWrite(id, opts.ifVersion);
+      const target = this.readVersion(id, version);
+      if (!target)
+        throw new StackNotFoundError(`Version not found: "${id}"@${version}`);
       if (opts.snapshot)
         this.snapshotBeforeMutation(id, opts.snapshot);
       this.rewriteContent(id, target.typeId, target.content, opts);
@@ -1082,11 +1204,8 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
     return this.reread(id, "restoreVersion");
   }
   async commitMigration(id, toTypeId, content, opts = {}) {
-    const existing = await this.getRecord(id);
-    if (!existing)
-      throw new StackNotFoundError(`Record not found: "${id}"`);
-    this.checkExpectedVersion(existing, opts.ifVersion);
     this.exec.transaction(() => {
+      this.readForWrite(id, opts.ifVersion);
       if (opts.snapshot)
         this.snapshotBeforeMutation(id, opts.snapshot);
       this.rewriteContent(id, toTypeId, content, opts);
@@ -1095,51 +1214,47 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
     return this.reread(id, "commitMigration");
   }
   /**
-   * Replace a record's type and content wholesale — what restoreVersion and
-   * commitMigration each do, differing only in where the content came from.
-   *
-   * The order is the constraint: fts5Strategy.remove() has to read the old
-   * content off the records row, so it runs before the UPDATE, and the
-   * re-index runs after. Every caller must already sit inside
-   * exec.transaction() — a failure between the two halves would otherwise
-   * leave the record unindexed.
+   * Replace a record's type and content wholesale. Unindex, write, re-index,
+   * in that order (docs/spec/adapters.md § The search index is unindexed
+   * before the row moves); callers must be inside exec.transaction().
    */
   rewriteContent(id, typeId, content, opts) {
     const json = JSON.stringify(content);
-    fts5Strategy.remove(this.exec, id);
+    this.searchIndex.remove(id);
     this.versionedUpdate(id, ["type_id = ?", "content = ?"], [typeId, json], opts);
-    fts5Strategy.insert(this.exec, id, json);
-    this.syncContentIndex(id, typeId, content);
+    this.searchIndex.insert(id, json);
+    this.contentIndex.sync(id, typeId, content);
+  }
+  queryRecords(query) {
+    return this.page(query);
   }
-  async queryRecords(query) {
-    const limit = query.limit ?? 50;
+  queryReadable(query, reach) {
+    return this.page(query, reach);
+  }
+  /** `reach`, when given, is one more condition of every statement in the plan. */
+  async page(query, reach) {
+    const { limit } = query;
     const fetch = limit + 1;
-    const rows = [];
-    for (const page2 of buildQueryPlan(query)) {
-      const budget = fetch - rows.length;
+    const rows2 = [];
+    for (const page2 of buildQueryPlan(query, reach)) {
+      const budget = fetch - rows2.length;
       if (budget <= 0)
         break;
       const statement2 = atBudget(page2, budget);
-      rows.push(...asStackBadRequestError(query, () => this.exec.all(statement2.sql, statement2.params)));
+      rows2.push(...asStackBadRequestError(query, () => this.exec.all(statement2.sql, statement2.params)));
     }
-    const hasMore = rows.length > limit;
-    const page = hasMore ? rows.slice(0, limit) : rows;
-    const records = page.map((row) => {
-      const associations = this.getAssociationsForRecord(row.id);
-      return rowToRecord(row, associations);
-    });
+    const hasMore = rows2.length > limit;
+    const page = hasMore ? rows2.slice(0, limit) : rows2;
+    const records = this.hydrate(page);
     const lastRecord = records[records.length - 1];
-    const cursor = hasMore && lastRecord ? makeCursor(lastRecord, query.sort, (record, field) => this.sortFieldKind(record, field)) : null;
+    const cursor = hasMore && lastRecord ? makeCursor(lastRecord, query.sort, (record, field) => this.contentIndex.kindOf(record.typeId, field)) : null;
     return { records, cursor };
   }
   /**
-   * Atomically verify fileId is unreferenced, then purge its
-   * metadata records across every typeId in `metadataTypeIds` (see
-   * deleteUnreferencedAttachmentRecords on the adapter contract). A real
-   * SQL transaction of synchronous calls — no `await` between the check
-   * and the deletes, so nothing interleaves.
+   * The reference check and the purges share one synchronous transaction,
+   * so nothing can add a reference between the two.
    */
-  async deleteUnreferencedAttachmentRecords(fileId, metadataTypeIds) {
+  async deleteUnreferencedAttachmentRecords(fileId, metadataBaseId) {
     return this.exec.transaction(() => {
       const referenced = this.exec.all(`SELECT 1 as found FROM associations WHERE kind = 'attachment' AND file_id = ?
          UNION ALL
@@ -1148,11 +1263,9 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
       if (referenced.length) {
         throw new StackConflictError("Attachment is still referenced by one or more records");
       }
-      if (metadataTypeIds.length === 0)
-        return [];
-      const placeholders = metadataTypeIds.map(() => "?").join(", ");
+      const family = inFamily("type_id", metadataBaseId);
       const metaRows = this.exec.all(`SELECT id FROM records
-         WHERE type_id IN (${placeholders}) AND json_extract(content, '$.fileId') = ?`, [...metadataTypeIds, fileId]);
+         WHERE ${family.sql} AND json_extract(content, '$.fileId') = ?`, [...family.params, fileId]);
       const deleted = [];
       for (const row of metaRows) {
         const purged = this.purgeRecord(row.id);
@@ -1172,10 +1285,13 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
       conditions.push("version < ?");
       values.push(query.beforeVersion);
     }
-    const rows = this.exec.all(`SELECT * FROM versions WHERE ${conditions.join(" AND ")} ORDER BY version DESC${query.limit !== void 0 ? " LIMIT ?" : ""}`, query.limit !== void 0 ? [...values, query.limit] : values);
-    return rows.map(rowToVersion);
+    const rows2 = this.exec.all(`SELECT * FROM versions WHERE ${conditions.join(" AND ")} ORDER BY version DESC${query.limit !== void 0 ? " LIMIT ?" : ""}`, query.limit !== void 0 ? [...values, query.limit] : values);
+    return rows2.map(rowToVersion);
   }
   async getVersion(id, version) {
+    return this.readVersion(id, version);
+  }
+  readVersion(id, version) {
     const row = this.exec.get("SELECT * FROM versions WHERE record_id = ? AND version = ?", [id, version]);
     return row ? rowToVersion(row) : null;
   }
@@ -1229,10 +1345,7 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
     } catch (err) {
       if (!(err instanceof StackConflictError))
         throw err;
-      const row = this.exec.get("SELECT version FROM records WHERE id = ?", [
-        id
-      ]);
-      if (!row || row.version !== version.version)
+      if (this.currentVersion(id) !== version.version)
         throw err;
       this.overwriteVersionRow(id, version);
     }
@@ -1241,21 +1354,17 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
   // Change journal
   // -------------------------------------------------------
   /**
-   * Append one entry, stamping the record-derived half off the row as it
-   * now stands — so every caller must already sit inside the same
-   * transaction as the write it describes, after that write has landed.
-   *
-   * `seq` is allocated here, from the log's own max, rather than computed
-   * by the caller. That is what spares this table the collision healing
-   * versions needs: nothing outside this statement ever holds a seq it
-   * expects to be free. See docs/spec/journal.md § Ordering.
+   * Append one entry, stamped from the row as it now stands, so callers run
+   * this inside their write's transaction, after the write. `seq` is
+   * allocated in the INSERT itself, so no caller ever holds one it expects
+   * to be free. See docs/spec/journal.md § Ordering.
    */
   appendJournal(recordId, entry) {
     if (!entry)
       return;
     const row = this.exec.get("SELECT version, type_id, parent_id FROM records WHERE id = ?", [recordId]);
     if (!row)
-      throw new StackNotFoundError(`Record not found: "${recordId}"`);
+      throw recordNotFound(recordId);
     this.exec.run(`INSERT INTO journal
         (record_id, seq, at, kind, ops, version, type_id, parent_id,
          previous_parent_id, actor, associations)
@@ -1279,7 +1388,7 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
   }
   async getJournal(id, query = {}) {
     if (!this.exec.get("SELECT 1 FROM records WHERE id = ?", [id])) {
-      throw new StackNotFoundError(`Record not found: "${id}"`);
+      throw recordNotFound(id);
     }
     const conditions = ["record_id = ?"];
     const values = [id];
@@ -1287,8 +1396,8 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
       conditions.push("seq > ?");
       values.push(query.afterSeq);
     }
-    const rows = this.exec.all(`SELECT * FROM journal WHERE ${conditions.join(" AND ")} ORDER BY seq ASC${query.limit !== void 0 ? " LIMIT ?" : ""}`, query.limit !== void 0 ? [...values, query.limit] : values);
-    return rows.map(rowToJournalEntry);
+    const rows2 = this.exec.all(`SELECT * FROM journal WHERE ${conditions.join(" AND ")} ORDER BY seq ASC${query.limit !== void 0 ? " LIMIT ?" : ""}`, query.limit !== void 0 ? [...values, query.limit] : values);
+    return rows2.map(rowToJournalEntry);
   }
   // -------------------------------------------------------
   // Types
@@ -1306,174 +1415,152 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
       type.migratesFrom ?? null,
       toMs(type.createdAt)
     ]);
-    const schema = type.schema;
-    this.indexedFieldsByType.set(type.id, indexedFieldKinds(schema));
+    this.contentIndex.rememberType(type);
   }
   async getType(id) {
     const row = this.exec.get("SELECT * FROM types WHERE id = ?", [id]);
     return row ? rowToType(row) : null;
   }
   async listTypes() {
-    const rows = this.exec.all("SELECT * FROM types ORDER BY base_id, version");
-    return rows.map(rowToType);
+    const rows2 = this.exec.all("SELECT * FROM types ORDER BY base_id, version");
+    return rows2.map(rowToType);
   }
   // -------------------------------------------------------
   // Associations
   // -------------------------------------------------------
   /**
-   * Never bumps `version`/`updatedAt` and never snapshots — see
-   * StackRecordAdapter.amendAssociations(). The records row is untouched
-   * entirely; only the associations table changes, in one transaction:
-   * removes first, then adds.
+   * A write to one of a record's two element tables, inside a transaction
+   * that first checks the record exists, is not soft-deleted, is at
+   * `ifVersion`, and that the table holds `expectSet`. Never bumps and
+   * never snapshots.
    */
-  async amendAssociations(recordId, changes, opts = {}) {
-    assertOneSurface(changes);
+  elementWrite(id, table, opts, write, verb) {
     this.exec.transaction(() => {
-      if (!this.readRecord(recordId))
-        throw new StackNotFoundError(`Record not found: "${recordId}"`);
-      for (const change of changes) {
-        if (change.op !== "remove")
-          continue;
-        const { association } = change;
-        this.exec.run(`DELETE FROM associations
-       WHERE record_id = ?
-         AND kind = ?
-         AND label = ?
-         AND file_id       = ?
-         AND related_scope = ?
-         AND related_id    = ?
-         AND related_ns    = ?
-         AND related_stack = ?
-         AND related_role  = ?`, [recordId, association.kind, association.label, ...associationKeyColumns(association)]);
+      this.checkExpectedVersion(id, this.liveVersion(id), opts.ifVersion);
+      if (opts.expectSet) {
+        const map = table === "associations" ? rowToAssociation : rowToPermission;
+        const stored = this.elementsByRecord(table, [id], map).get(id) ?? [];
+        if (!sameAssociationSet(stored, opts.expectSet))
+          throw new ElementSetMovedError(id);
       }
-      const adds = changes.flatMap((c) => c.op === "add" ? [c.association] : []);
-      if (adds.length)
-        this.insertAssociations(recordId, adds);
-      this.appendJournal(recordId, opts.journal);
+      write();
+      this.appendJournal(id, opts.journal);
     });
-    return this.reread(recordId, "amendAssociations");
+    return this.reread(id, verb);
   }
-  /** The kinds each change-set key replaces, and nothing else. */
-  static DATA_KINDS = ["tag", "attachment", "relationship"];
-  static AUTHORITY_KINDS = ["permission", "anyone"];
-  /**
-   * Apply a change set's two association keys, each replacing only within
-   * its own half of the partition. That partition is the whole reason a
-   * tag write cannot drop an ACL: the `associations` key deletes data
-   * kinds alone, so the authority rows beside them are never in scope.
-   * Caller-transactional, like every write below.
-   * See docs/spec/access-control.md § Record-level permissions.
-   */
-  replaceAssociationHalves(recordId, changes) {
-    if (changes.associations !== void 0) {
-      this.replaceAssociations(recordId, changes.associations, _SharedSqlRecordLogic.DATA_KINDS);
-    }
-    if (changes.permissions !== void 0) {
-      this.replaceAssociations(recordId, changes.permissions, _SharedSqlRecordLogic.AUTHORITY_KINDS);
-    }
+  async editAssociations(id, edits, opts = {}) {
+    return this.elementWrite(id, "associations", opts, () => {
+      for (const edit of edits) {
+        if (edit.op !== "remove")
+          continue;
+        const association = edit.association;
+        this.exec.run(`DELETE FROM associations
+             WHERE record_id = ? AND kind = ? AND label = ?
+               AND file_id = ? AND related_scope = ? AND related_id = ?
+               AND related_ns = ? AND related_stack = ?`, [id, association.kind, association.label, ...associationKeyColumns(association)]);
+      }
+      this.insertAssociations(id, addsOf(edits));
+    }, "editAssociations");
+  }
+  async setAssociations(id, associations, opts = {}) {
+    return this.elementWrite(id, "associations", opts, () => {
+      this.exec.run("DELETE FROM associations WHERE record_id = ?", [id]);
+      this.insertAssociations(id, associations);
+    }, "setAssociations");
+  }
+  /** editAssociations() over the permissions table. */
+  async editAccess(id, edits, opts = {}) {
+    return this.elementWrite(id, "permissions", opts, () => {
+      for (const edit of edits) {
+        if (edit.op !== "remove")
+          continue;
+        const permission = edit.association;
+        this.exec.run(`DELETE FROM permissions
+             WHERE record_id = ? AND kind = ? AND label = ?
+               AND grantee_kind = ? AND grantee_id = ? AND role = ?`, [id, permission.kind, permission.label, ...permissionKeyColumns(permission)]);
+      }
+      this.insertPermissions(id, addsOf(edits));
+    }, "editAccess");
   }
-  /**
-   * Swap one half of a record's association set wholesale — the "replace,
-   * don't merge" semantics a change set's association list carries.
-   */
-  replaceAssociations(recordId, associations, kinds) {
-    this.exec.run(`DELETE FROM associations WHERE record_id = ? AND kind IN (${kinds.map(() => "?").join(", ")})`, [recordId, ...kinds]);
-    if (associations.length)
-      this.insertAssociations(recordId, associations);
+  async setAccess(id, permissions, opts = {}) {
+    return this.elementWrite(id, "permissions", opts, () => {
+      this.exec.run("DELETE FROM permissions WHERE record_id = ?", [id]);
+      this.insertPermissions(id, permissions);
+    }, "setAccess");
   }
   /**
-   * Upserts on association identity: the primary key decides which row a
-   * write lands on, and `attachment_record_id` — outside it — is whatever
-   * the incoming association says, so re-pointing one costs no second row.
-   *
-   * FK enforcement (PRAGMA_FOREIGN_KEYS_ON) means inserting an
-   * association against a record that doesn't exist throws — mapped
-   * here to StackNotFoundError so amendAssociations() on a nonexistent record
-   * fails loudly instead of silently creating an orphan row.
+   * Upserts on association identity, so re-pointing `attachment_record_id`
+   * (outside the key) costs no second row. A missing record trips the
+   * foreign key, reported as StackNotFoundError rather than an orphan row.
    */
   insertAssociations(recordId, associations) {
     for (const assoc of associations) {
-      try {
-        this.exec.run(`INSERT INTO associations
+      this.insertRow(recordId, () => this.exec.run(`INSERT INTO associations
             (record_id, kind, label, file_id, related_scope, related_id, related_ns,
-             related_stack, related_role, attachment_record_id)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+             related_stack, attachment_record_id)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
            ON CONFLICT DO UPDATE SET attachment_record_id = excluded.attachment_record_id`, [
-          recordId,
-          assoc.kind,
-          assoc.label,
-          ...associationKeyColumns(assoc),
-          assoc.kind === "attachment" ? assoc.attachmentRecordId ?? "" : ""
-        ]);
-      } catch (err) {
-        if (isForeignKeyViolation(err)) {
-          throw new StackNotFoundError(`Record not found: "${recordId}"`);
-        }
-        throw err;
-      }
+        recordId,
+        assoc.kind,
+        assoc.label,
+        ...associationKeyColumns(assoc),
+        assoc.kind === "attachment" ? assoc.attachmentRecordId ?? "" : ""
+      ]));
     }
   }
-  getAssociationsForRecord(recordId) {
-    const rows = this.exec.all("SELECT * FROM associations WHERE record_id = ?", [recordId]);
-    return rows.map(rowToAssociation);
+  /** Every column is in the key, so a repeated element is the same row. */
+  insertPermissions(recordId, permissions) {
+    for (const p of permissions) {
+      this.insertRow(recordId, () => this.exec.run(`INSERT INTO permissions (record_id, kind, label, grantee_kind, grantee_id, role)
+           VALUES (?, ?, ?, ?, ?, ?)
+           ON CONFLICT DO NOTHING`, [recordId, p.kind, p.label, ...permissionKeyColumns(p)]));
+    }
   }
-  /**
-   * The fields content_index covers for typeId, from the in-memory cache
-   * — falling back to a `types` lookup (and populating the cache) only for
-   * a typeId this process hasn't seen via saveType() yet, e.g. right after
-   * open().
-   */
-  getIndexedFields(typeId) {
-    const cached = this.indexedFieldsByType.get(typeId);
-    if (cached)
-      return cached;
-    const typeRow = this.exec.get("SELECT schema FROM types WHERE id = ?", [
-      typeId
-    ]);
-    const fields = typeRow ? indexedFieldKinds(JSON.parse(typeRow.schema)) : /* @__PURE__ */ new Map();
-    this.indexedFieldsByType.set(typeId, fields);
-    return fields;
+  insertRow(recordId, insert) {
+    try {
+      insert();
+    } catch (err) {
+      if (isForeignKeyViolation(err))
+        throw recordNotFound(recordId);
+      throw err;
+    }
   }
   /**
-   * Replace a record's content_index rows with what its content currently
-   * holds, on every write that can change content or typeId, so neither
-   * the ordering nor the file-reference lookup can drift from the record.
-   * A field holding no orderable value gets no row at all, which is what
-   * puts the record at the end of a sort on that field.
+   * One element table's rows for every record in `ids`, in primary-key
+   * order — the order a single record's read has always had.
    */
-  syncContentIndex(recordId, typeId, content) {
-    this.exec.run("DELETE FROM content_index WHERE record_id = ?", [recordId]);
-    for (const [field, kind] of this.getIndexedFields(typeId)) {
-      const entry = contentSortEntry(kind, content[field]);
-      if (!entry)
-        continue;
-      const sql = `INSERT OR IGNORE INTO content_index
-          (record_id, field, value_rank, num_value, text_key, text_value, file_id)
-         VALUES (?, ?, ?, ?, ?, ?, ?)`;
-      if (entry.kind === "num") {
-        this.exec.run(sql, [recordId, field, 0, entry.num, null, null, null]);
-      } else {
-        const fileId = kind === "file-ref" ? entry.text : null;
-        this.exec.run(sql, [recordId, field, 1, null, entry.key, entry.text, fileId]);
-      }
+  elementsByRecord(table, ids, map) {
+    const byRecord = /* @__PURE__ */ new Map();
+    const rows2 = this.exec.all(`WITH ids AS MATERIALIZED ${rowsTable(["id"])}
+       SELECT * FROM ${table} WHERE record_id IN (SELECT id FROM ids)
+       ORDER BY ${table === "associations" ? ASSOCIATION_KEY : PERMISSION_KEY}`, [JSON.stringify(ids.map((id) => [id]))]);
+    for (const row of rows2) {
+      const id = row.record_id;
+      const list = byRecord.get(id);
+      if (list)
+        list.push(map(row));
+      else
+        byRecord.set(id, [map(row)]);
     }
-  }
-  /** The declared kind of a record's top-level `field`, if it has one. */
-  sortFieldKind(record, field) {
-    return this.getIndexedFields(record.typeId).get(field);
+    return byRecord;
   }
 };
+var ASSOCIATION_KEY = "record_id, kind, label, file_id, related_scope, related_id, related_ns, related_stack";
+var PERMISSION_KEY = "record_id, kind, label, grantee_kind, grantee_id, role";
+var addsOf = (edits) => edits.flatMap((e) => e.op === "add" ? [e.association] : []);
 
 // ../sqlite-shared/dist/record-adapter.js
 var SQLITE_RECORD_CAPABILITIES = {
   filter: {
     content: "path",
     contentPresent: true,
+    contentByType: true,
     search: true
   },
   sort: {
     fields: ["createdAt", "updatedAt", "version"],
-    contentField: true
+    contentField: true,
+    contentFieldByType: true
   },
   limits: {
     attachmentBytes: null,
@@ -1499,8 +1586,14 @@ var SharedSqlRecordAdapter = class {
   getRecord(id) {
     return this.record.getRecord(id);
   }
-  mutateRecord(id, changes, opts) {
-    return this.record.mutateRecord(id, changes, opts);
+  patchContent(id, patch, opts) {
+    return this.record.patchContent(id, patch, opts);
+  }
+  setParent(id, parentId, opts) {
+    return this.record.setParent(id, parentId, opts);
+  }
+  setUnlisted(id, unlisted, opts) {
+    return this.record.setUnlisted(id, unlisted, opts);
   }
   deleteRecord(id, opts) {
     return this.record.deleteRecord(id, opts);
@@ -1517,8 +1610,11 @@ var SharedSqlRecordAdapter = class {
   queryRecords(query) {
     return this.record.queryRecords(query);
   }
-  deleteUnreferencedAttachmentRecords(fileId, metadataTypeIds) {
-    return this.record.deleteUnreferencedAttachmentRecords(fileId, metadataTypeIds);
+  queryReadable(query, reach) {
+    return this.record.queryReadable(query, reach);
+  }
+  deleteUnreferencedAttachmentRecords(fileId, metadataBaseId) {
+    return this.record.deleteUnreferencedAttachmentRecords(fileId, metadataBaseId);
   }
   // -------------------------------------------------------
   // Versions
@@ -1551,10 +1647,19 @@ var SharedSqlRecordAdapter = class {
     return this.record.listTypes();
   }
   // -------------------------------------------------------
-  // Associations
+  // Associations and permissions
   // -------------------------------------------------------
-  amendAssociations(recordId, changes, opts) {
-    return this.record.amendAssociations(recordId, changes, opts);
+  editAssociations(id, edits, opts) {
+    return this.record.editAssociations(id, edits, opts);
+  }
+  setAssociations(id, associations, opts) {
+    return this.record.setAssociations(id, associations, opts);
+  }
+  editAccess(id, edits, opts) {
+    return this.record.editAccess(id, edits, opts);
+  }
+  setAccess(id, permissions, opts) {
+    return this.record.setAccess(id, permissions, opts);
   }
 };
 
@@ -1575,8 +1680,8 @@ var DurableObjectSqliteExecutor = class {
     return cursor.rowsWritten;
   }
   get(sql, params = []) {
-    const rows = this.sql.exec(sql, ...params).toArray();
-    return rows[0];
+    const rows2 = this.sql.exec(sql, ...params).toArray();
+    return rows2[0];
   }
   all(sql, params = []) {
     return this.sql.exec(sql, ...params).toArray();