@haverstack/record-adapter-do-sqlite 0.27.0 → 0.29.0

package/dist/index.js

@@ -1,9 +1,17 @@
-import { StackConflictError, applyMergePatch, StackNotFoundError, assertOneSurface, StackVersionConflictError, StackBadRequestError, NATIVE_SORT_FIELDS } from '@haverstack/core';
-import { OwnerMismatchError, AUTHORITY_ASSOCIATION_KINDS, contentSortEntry, partitionAssociations, constantSortEntry, contentSortKey, parseContentFilterKey } from '@haverstack/core/adapter';
+import { OwnerMismatchError, newStoreSeed, softDeletedRefusal, sameAssociationSet, ElementSetMovedError, FormatMismatchError, contentSortEntry, constantSortEntry, contentSortKey, parseContentFilterKey } from '@haverstack/core/adapter';
+import { StackConflictError, applyMergePatch, StackNotFoundError, StackVersionConflictError, StackBadRequestError, NATIVE_SORT_FIELDS } from '@haverstack/core';
 
 // ../sqlite-shared/dist/schema.js
+var FORMAT_VERSION = 1;
 var RECORD_SCHEMA_SQL = `
-  CREATE TABLE IF NOT EXISTS records (
+  -- Which layout this store is, in its one row, so an export names the one
+  -- a reader holds. See docs/spec/portability.md \xA7 The portable format.
+  CREATE TABLE format (
+    id      INTEGER PRIMARY KEY CHECK (id = 1),
+    version INTEGER NOT NULL
+  ) STRICT;
+
+  CREATE TABLE records (
     id          TEXT PRIMARY KEY,
     type_id     TEXT NOT NULL,
     created_at  INTEGER NOT NULL,
@@ -20,41 +28,50 @@ var RECORD_SCHEMA_SQL = `
     unlisted_at INTEGER
   ) STRICT;
 
-  -- Every edge a record carries, authority and data alike: a permission
-  -- has element identity and a delta shaped like a tag's, so it earns the
-  -- same table. The permissions and associations fields are projections
-  -- over it, partitioned by kind.
-  -- See docs/spec/access-control.md \xA7 Record-level permissions.
-  CREATE TABLE IF NOT EXISTS associations (
+  -- A record's data associations: tags, attachments and relationships.
+  -- Its permissions are in their own table below, so no predicate over this
+  -- one can match a grantee as a relationship target.
+  CREATE TABLE associations (
     record_id     TEXT NOT NULL REFERENCES records(id),
-    kind          TEXT NOT NULL CHECK (kind IN ('tag', 'attachment', 'relationship', 'permission', 'anyone')),
+    kind          TEXT NOT NULL CHECK (kind IN ('tag', 'attachment', 'relationship')),
     label         TEXT NOT NULL,
     file_id       TEXT NOT NULL DEFAULT '',
     -- A relationship target is (related_scope, related_id) qualified by
-    -- related_ns (a foreign namespace) or related_stack (another stack); a
-    -- permission's grantee reuses scope and id. All are in the key, so
-    -- targets differing only by a qualifier are distinct associations.
-    related_scope TEXT NOT NULL DEFAULT '' CHECK (related_scope IN ('', 'record', 'entity', 'external', 'group')),
+    -- related_ns (a foreign namespace) or related_stack (another stack).
+    -- All are in the key, so targets differing only by a qualifier are
+    -- distinct associations.
+    related_scope TEXT NOT NULL DEFAULT '' CHECK (related_scope IN ('', 'record', 'entity', 'external')),
     related_id    TEXT NOT NULL DEFAULT '',
     related_ns    TEXT NOT NULL DEFAULT '',
     related_stack TEXT NOT NULL DEFAULT '',
-    -- Set only by a group grantee; in the key because member and admin name
-    -- two different sets of people.
-    related_role  TEXT NOT NULL DEFAULT '' CHECK (related_role IN ('', 'member', 'admin')),
     -- Out of the key: it annotates a reference rather than naming one, so
     -- re-pointing it updates the existing row. See docs/spec/attachments.md
     -- \xA7 Naming the upload a reference came from.
     attachment_record_id TEXT NOT NULL DEFAULT '',
     -- Leads with record_id, so its implicit index serves every by-record
     -- read and delete; the indexes below cover only the filter directions.
-    PRIMARY KEY (record_id, kind, label, file_id, related_scope, related_id, related_ns, related_stack, related_role)
+    PRIMARY KEY (record_id, kind, label, file_id, related_scope, related_id, related_ns, related_stack)
+  ) STRICT;
+
+  -- Who reaches a record, one row per element. An 'anyone' row names no
+  -- grantee; a group grantee's role is in the key, because member and
+  -- admin name two different sets of people.
+  -- See docs/spec/access-control.md \xA7 Record-level permissions.
+  CREATE TABLE permissions (
+    record_id    TEXT NOT NULL REFERENCES records(id),
+    kind         TEXT NOT NULL CHECK (kind IN ('permission', 'anyone')),
+    label        TEXT NOT NULL CHECK (label IN ('read', 'write')),
+    grantee_kind TEXT NOT NULL DEFAULT '' CHECK (grantee_kind IN ('', 'entity', 'group')),
+    grantee_id   TEXT NOT NULL DEFAULT '',
+    role         TEXT NOT NULL DEFAULT '' CHECK (role IN ('', 'member', 'admin')),
+    PRIMARY KEY (record_id, kind, label, grantee_kind, grantee_id, role)
   ) STRICT;
 
   -- Content and the type it is read under. No parent_id, unlisted_at or
   -- associations column: none of those aspects bumps version, so no
   -- version ever snapshots one. See
   -- docs/spec/versioning.md \xA7 Version history.
-  CREATE TABLE IF NOT EXISTS versions (
+  CREATE TABLE versions (
     record_id   TEXT NOT NULL REFERENCES records(id),
     version     INTEGER NOT NULL,
     type_id     TEXT NOT NULL,
@@ -72,7 +89,7 @@ var RECORD_SCHEMA_SQL = `
   -- by design \u2014 content lives on a versions row, and copying it here
   -- would make the journal the larger of the two stores.
   -- See docs/spec/journal.md.
-  CREATE TABLE IF NOT EXISTS journal (
+  CREATE TABLE journal (
     record_id   TEXT NOT NULL REFERENCES records(id),
     seq         INTEGER NOT NULL,
     at          INTEGER NOT NULL,
@@ -96,7 +113,7 @@ var RECORD_SCHEMA_SQL = `
     PRIMARY KEY (record_id, seq)
   ) STRICT;
 
-  CREATE TABLE IF NOT EXISTS types (
+  CREATE TABLE types (
     id            TEXT PRIMARY KEY,
     base_id       TEXT NOT NULL,
     version       INTEGER NOT NULL,
@@ -114,7 +131,7 @@ var RECORD_SCHEMA_SQL = `
   -- value_rank is 0 for a numeric value and 1 for a text one \u2014 the same
   -- split as "num_value IS NULL", but non-null, so one index can carry
   -- the whole ordering. file_id is set only for a 'file-ref' field.
-  CREATE TABLE IF NOT EXISTS content_index (
+  CREATE TABLE content_index (
     record_id  TEXT NOT NULL REFERENCES records(id),
     field      TEXT NOT NULL,
     value_rank INTEGER NOT NULL CHECK (value_rank IN (0, 1)),
@@ -130,34 +147,39 @@ var RECORD_SCHEMA_SQL = `
   -- leaves the planner sorting every match before it can honor LIMIT.
   -- deleted_at and unlisted_at get none: an index on a column every query
   -- tests IS NULL only lures the planner off the one answering ORDER BY.
-  CREATE INDEX IF NOT EXISTS idx_records_type_id      ON records(type_id, created_at, id);
-  CREATE INDEX IF NOT EXISTS idx_records_parent_id    ON records(parent_id, created_at, id);
-  CREATE INDEX IF NOT EXISTS idx_records_entity_id    ON records(entity_id, created_at, id);
-  CREATE INDEX IF NOT EXISTS idx_records_app_id       ON records(app_id, created_at, id);
-  CREATE INDEX IF NOT EXISTS idx_records_principal_id ON records(principal_id, created_at, id);
-  CREATE INDEX IF NOT EXISTS idx_records_created_at   ON records(created_at, id);
-  CREATE INDEX IF NOT EXISTS idx_records_updated_at   ON records(updated_at, id);
-  CREATE INDEX IF NOT EXISTS idx_records_version      ON records(version, id);
+  CREATE INDEX idx_records_type_id      ON records(type_id, created_at, id);
+  CREATE INDEX idx_records_parent_id    ON records(parent_id, created_at, id);
+  CREATE INDEX idx_records_entity_id    ON records(entity_id, created_at, id);
+  CREATE INDEX idx_records_app_id       ON records(app_id, created_at, id);
+  CREATE INDEX idx_records_principal_id ON records(principal_id, created_at, id);
+  CREATE INDEX idx_records_created_at   ON records(created_at, id);
+  CREATE INDEX idx_records_updated_at   ON records(updated_at, id);
+  CREATE INDEX idx_records_version      ON records(version, id);
 
   -- Each association index ends with record_id so the semi-joins in
   -- query.ts read the matching record ids out of the index alone.
   -- idx_assoc_related carries related_ns ahead of related_id because a
   -- record- or entity-scoped target always stores '' there, which
   -- buildQueryPlan states explicitly to keep the prefix contiguous.
-  CREATE INDEX IF NOT EXISTS idx_assoc_kind_label   ON associations(kind, label, record_id);
-  CREATE INDEX IF NOT EXISTS idx_assoc_kind_file_id ON associations(kind, file_id, record_id);
-  CREATE INDEX IF NOT EXISTS idx_assoc_related      ON associations(kind, related_scope, related_ns, related_id, record_id);
-  CREATE INDEX IF NOT EXISTS idx_types_base_id      ON types(base_id, version);
+  CREATE INDEX idx_assoc_kind_label   ON associations(kind, label, record_id);
+  CREATE INDEX idx_assoc_kind_file_id ON associations(kind, file_id, record_id);
+  CREATE INDEX idx_assoc_related      ON associations(kind, related_scope, related_ns, related_id, record_id);
+  CREATE INDEX idx_types_base_id      ON types(base_id, version);
+
+  -- The permissions key with record_id moved last, so a scoped query reads
+  -- the records carrying an element straight out of the index.
+  CREATE INDEX idx_permissions_element
+    ON permissions(kind, label, grantee_kind, grantee_id, role, record_id);
 
   -- The whole content ordering, in index order, for one field at a time:
   -- a content-sorted page is an ordered walk of a slice of this index.
-  CREATE INDEX IF NOT EXISTS idx_content_index_sort
+  CREATE INDEX idx_content_index_sort
     ON content_index(field, value_rank, num_value, text_key, text_value, record_id);
-  CREATE INDEX IF NOT EXISTS idx_content_index_file
+  CREATE INDEX idx_content_index_file
     ON content_index(file_id, record_id) WHERE file_id IS NOT NULL;
 `;
 var FTS5_SCHEMA_SQL = `
-  CREATE VIRTUAL TABLE IF NOT EXISTS records_fts USING fts5(
+  CREATE VIRTUAL TABLE records_fts USING fts5(
     content,
     content='records',
     content_rowid='rowid',
@@ -165,10 +187,11 @@ var FTS5_SCHEMA_SQL = `
   );
 `;
 var PRAGMA_FOREIGN_KEYS_ON = `PRAGMA foreign_keys = ON;`;
-var applyRecordSchema = (exec, opts) => {
+var PRAGMA_JOURNAL_MODE_WAL = `PRAGMA journal_mode = WAL;`;
+var applyConnectionPragmas = (exec, opts) => {
   exec.exec(PRAGMA_FOREIGN_KEYS_ON);
-  exec.exec(RECORD_SCHEMA_SQL);
-  exec.exec(FTS5_SCHEMA_SQL);
+  if (opts.wal)
+    exec.exec(PRAGMA_JOURNAL_MODE_WAL);
 };
 
 // ../sqlite-shared/dist/fts5.js
@@ -254,22 +277,6 @@ var restoreImplicitAnd = (query) => withPhrasesMasked(query, (masked) => masked.
 // ../sqlite-shared/dist/executor.js
 var isForeignKeyViolation = (err) => err instanceof Error && err.message.includes("FOREIGN KEY constraint failed");
 var isUniqueConstraintViolation = (err) => err instanceof Error && err.message.includes("UNIQUE constraint failed");
-
-// ../sqlite-shared/dist/config.js
-var CONFIG_ROW_SQL = `SELECT content FROM records WHERE id = '_config'`;
-var insertConfigRecord = (exec, entityId, timezone) => {
-  const now = Date.now();
-  exec.run(`INSERT INTO records (id, type_id, created_at, updated_at, content, version)
-     VALUES ('_config', '_config@1', ?, ?, ?, 1)`, [now, now, JSON.stringify({ entityId, timezone })]);
-  return { entityId, timezone };
-};
-var tryReadStackConfig = (exec) => {
-  const row = exec.get(CONFIG_ROW_SQL);
-  if (!row)
-    return null;
-  const content = JSON.parse(row.content);
-  return { entityId: content.entityId, timezone: content.timezone };
-};
 var toBase64 = (text) => {
   const bytes = new TextEncoder().encode(text);
   let binary = "";
@@ -320,24 +327,22 @@ var decodeCursor = (cursor) => {
   throw malformed();
 };
 var byTypeDescriptor = (byType) => JSON.stringify(Object.entries(byType).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0));
-var getSortField = (query) => query.sort?.field ?? "createdAt";
 var getSortColumn = (field) => field === "createdAt" ? "created_at" : field === "updatedAt" ? "updated_at" : "version";
-var makeCursor = (record, sort, kindOf) => {
-  const byType = sort?.contentFieldByType;
+var makeCursor = (record, sort, kindOf2) => {
+  const byType = sort.contentFieldByType;
   if (byType) {
-    const field = byTypeDescriptor(byType);
+    const field2 = byTypeDescriptor(byType);
     const key = Object.hasOwn(byType, record.typeId) ? byType[record.typeId] : void 0;
-    const kind2 = key?.field === void 0 ? void 0 : kindOf?.(record, key.field);
+    const kind2 = key?.field === void 0 ? void 0 : kindOf2?.(record, key.field);
     const entry2 = key?.field !== void 0 ? kind2 && contentSortEntry(kind2, record.content[key.field]) : key && constantSortEntry(key.value ?? null);
-    return encodeEntry(field, entry2 || null, record.id);
+    return encodeEntry(field2, entry2 || null, record.id);
   }
-  const contentField = sort?.contentField;
-  if (contentField === void 0) {
-    const field = getSortField({ sort });
+  const { contentField, field } = sort;
+  if (field !== void 0) {
     const value = field === "updatedAt" ? record.updatedAt.getTime() : field === "version" ? record.version : record.createdAt.getTime();
     return encodeCursor({ kind: "native", field, value, id: record.id });
   }
-  const kind = kindOf?.(record, contentField);
+  const kind = kindOf2?.(record, contentField);
   const entry = kind ? contentSortEntry(kind, record.content[contentField]) : null;
   return encodeEntry(contentField, entry, record.id);
 };
@@ -347,38 +352,182 @@ var encodeEntry = (field, entry, id) => {
   return entry.kind === "num" ? encodeCursor({ kind: "num", field, value: entry.num, id }) : encodeCursor({ kind: "text", field, value: entry.text, id });
 };
 
+// ../sqlite-shared/dist/mappers.js
+var toMs = (d) => d.getTime();
+var actorFromColumns = (subject, principal) => subject == null ? void 0 : {
+  subjectId: subject,
+  ...principal != null && { principalId: principal }
+};
+var fromMs = (ms) => new Date(ms);
+var rowToRecord = (row, associations, permissions) => {
+  const record = {
+    id: row.id,
+    typeId: row.type_id,
+    createdAt: fromMs(row.created_at),
+    updatedAt: fromMs(row.updated_at),
+    content: JSON.parse(row.content),
+    version: row.version
+  };
+  if (row.parent_id != null)
+    record.parentId = row.parent_id;
+  if (row.app_id != null)
+    record.appId = row.app_id;
+  const createdBy = actorFromColumns(row.entity_id, row.principal_id);
+  if (createdBy)
+    record.createdBy = createdBy;
+  const updatedBy = actorFromColumns(row.updated_by, row.updated_via);
+  if (updatedBy)
+    record.updatedBy = updatedBy;
+  if (row.deleted_at != null)
+    record.deletedAt = fromMs(row.deleted_at);
+  if (row.unlisted_at != null)
+    record.unlistedAt = fromMs(row.unlisted_at);
+  if (associations.length)
+    record.associations = associations;
+  if (permissions.length)
+    record.permissions = permissions;
+  return record;
+};
+var rowToAssociation = (row) => {
+  if (row.kind === "tag") {
+    return { kind: "tag", label: row.label };
+  }
+  if (row.kind === "attachment") {
+    const attachmentRecordId = row.attachment_record_id;
+    return {
+      kind: "attachment",
+      label: row.label,
+      fileId: row.file_id,
+      // Stored as '' when absent, like every other optional column here —
+      // the field is omitted rather than served empty, so a round trip
+      // produces the association the caller wrote.
+      ...attachmentRecordId && { attachmentRecordId }
+    };
+  }
+  return {
+    kind: "relationship",
+    label: row.label,
+    target: rowToTarget(row)
+  };
+};
+var associationKeyColumns = (a) => {
+  if (a.kind === "attachment")
+    return [a.fileId, "", "", "", ""];
+  if (a.kind !== "relationship")
+    return ["", "", "", "", ""];
+  const t = a.target;
+  if (t.kind === "entity")
+    return ["", "entity", t.entityId, "", ""];
+  if (t.kind === "external")
+    return ["", "external", t.id, t.ns, ""];
+  return ["", "record", t.recordId, "", t.stackUrl ?? ""];
+};
+var permissionKeyColumns = (p) => {
+  if (p.kind === "anyone")
+    return ["", "", ""];
+  const g = p.grantee;
+  return g.kind === "entity" ? ["entity", g.entityId, ""] : ["group", g.groupId, g.role];
+};
+var rowToPermission = (row) => {
+  if (row.kind === "anyone")
+    return { kind: "anyone", label: "read" };
+  const id = row.grantee_id;
+  return {
+    kind: "permission",
+    label: row.label,
+    grantee: row.grantee_kind === "group" ? { kind: "group", groupId: id, role: row.role } : { kind: "entity", entityId: id }
+  };
+};
+var rowToTarget = (row) => {
+  const id = row.related_id;
+  if (row.related_scope === "entity")
+    return { kind: "entity", entityId: id };
+  if (row.related_scope === "external") {
+    return { kind: "external", ns: row.related_ns, id };
+  }
+  const stackUrl = row.related_stack;
+  return { kind: "record", recordId: id, ...stackUrl && { stackUrl } };
+};
+var rowToType = (row) => {
+  const t = {
+    id: row.id,
+    baseId: row.base_id,
+    version: row.version,
+    name: row.name,
+    schema: JSON.parse(row.schema),
+    schemaHash: row.schema_hash,
+    createdAt: fromMs(row.created_at)
+  };
+  if (row.migrates_from)
+    t.migratesFrom = row.migrates_from;
+  return t;
+};
+var rowToVersion = (row) => {
+  const v = {
+    version: row.version,
+    typeId: row.type_id,
+    content: JSON.parse(row.content),
+    updatedAt: fromMs(row.updated_at)
+  };
+  const createdBy = actorFromColumns(row.entity_id, row.principal_id);
+  if (createdBy)
+    v.createdBy = createdBy;
+  const updatedBy = actorFromColumns(row.updated_by, row.updated_via);
+  if (updatedBy)
+    v.updatedBy = updatedBy;
+  return v;
+};
+var rowToJournalEntry = (row) => {
+  const e = {
+    seq: row.seq,
+    at: fromMs(row.at),
+    kind: row.kind,
+    ops: JSON.parse(row.ops),
+    version: row.version,
+    typeId: row.type_id
+  };
+  if (row.parent_id != null)
+    e.parentId = row.parent_id;
+  if (row.previous_parent_id != null) {
+    e.previousParentId = row.previous_parent_id === "" ? null : row.previous_parent_id;
+  }
+  if (row.actor != null)
+    e.actor = JSON.parse(row.actor);
+  if (row.associations != null)
+    e.associations = JSON.parse(row.associations);
+  return e;
+};
+
 // ../sqlite-shared/dist/query.js
-var atBudget = (page, rows) => ({
+var atBudget = (page, rows2) => ({
   sql: page.sql,
-  params: [...page.params, rows]
+  params: [...page.params, rows2]
 });
-var sqlDirection = (query) => {
-  const dir = query.sort ? query.sort.direction : "desc";
-  if (dir !== "asc" && dir !== "desc") {
-    throw new StackBadRequestError(`Invalid sort direction "${dir}": expected "asc" or "desc".`);
-  }
-  return dir === "asc" ? "ASC" : "DESC";
+var sqlDirection = (query) => query.sort.direction === "asc" ? "ASC" : "DESC";
+var spread = (alias) => `CASE ${alias}.type WHEN 'array' THEN ${alias}.value WHEN 'object' THEN json_array(json(${alias}.value)) WHEN 'true' THEN '[true]' WHEN 'false' THEN '[false]' ELSE json_array(${alias}.value) END`;
+var members = (alias) => `CASE WHEN ${alias}.t = 'object' THEN ${alias}.v ELSE '{}' END`;
+var emptyStatement = () => ({
+  tables: [],
+  tableParams: [],
+  conditions: ["r.id != '_config'"],
+  params: []
+});
+var rows = (s, columns, tuples) => {
+  const name = `t${s.tables.length}`;
+  s.tables.push(`${name} AS MATERIALIZED ${rowsTable(columns)}`);
+  s.tableParams.push(JSON.stringify(tuples));
+  return name;
 };
-var spread = (alias) => `CASE WHEN ${alias}.type = 'array' THEN ${alias}.value WHEN ${alias}.type = 'object' THEN json_array(json(${alias}.value)) ELSE json_array(${alias}.value) END`;
-var members = (alias) => `CASE WHEN ${alias}.type = 'object' THEN ${alias}.value ELSE '{}' END`;
-var contentPathExists = (segments, leaf, params, nextAlias) => {
-  let key = nextAlias();
-  let value = nextAlias();
-  const from = [`json_each(r.content) AS ${key}`, `json_each(${spread(key)}) AS ${value}`];
-  const where = [`${key}.key = ?`];
-  params.push(segments[0]);
-  for (const segment of segments.slice(1)) {
-    key = nextAlias();
-    from.push(`json_each(${members(value)}) AS ${key}`);
-    value = nextAlias();
-    from.push(`json_each(${spread(key)}) AS ${value}`);
-    where.push(`${key}.key = ?`);
-    params.push(segment);
-  }
-  where.push(leaf(value));
-  return `EXISTS (SELECT 1 FROM ${from.join(", ")} WHERE ${where.join(" AND ")})`;
+var rowsTable = (columns) => {
+  const named = columns.map((column, i) => `json_extract(value, '$[${i}]') AS ${column}`);
+  return `(SELECT ${named.join(", ")} FROM json_each(?))`;
+};
+var CONDITION_COLUMNS = ["scope", "path", "op", "val", "kind"];
+var kindOf = (type) => `CASE ${type} WHEN 'integer' THEN 'number' WHEN 'real' THEN 'number' ELSE ${type} END`;
+var holds = (c, r) => {
+  const depth = `json_array_length(${c}.path)`;
+  return `(WITH RECURSIVE w(d, v, t) AS (SELECT 0, ${r}.content, 'object' UNION ALL SELECT w.d + 1, e.value, e.type FROM w JOIN json_each(${members("w")}) m JOIN json_each(${spread("m")}) e WHERE w.d < ${depth} AND m.key = json_extract(${c}.path, '$[' || w.d || ']')) SELECT CASE ${c}.op WHEN 'equals' THEN IFNULL(MAX(${kindOf("w.t")} = ${c}.kind AND w.v = ${c}.val), 0) WHEN 'present' THEN IFNULL(MAX(w.t != 'null'), 0) WHEN 'isNull' THEN IFNULL(MAX(w.t = 'null'), 0) OR NOT IFNULL(MAX(w.t != 'null'), 0) END FROM w WHERE w.d = ${depth})`;
 };
-var equalsLeaf = (alias) => `${alias}.type NOT IN ('object', 'array') AND ${alias}.value = ?`;
 var SORT_ALIAS = "cs";
 var cursorMismatch = (cursor, field) => new StackBadRequestError(`Cursor sort field "${cursor.field}" does not match query sort field "${field}"`);
 var nativeCursor = (cursor, field) => {
@@ -391,37 +540,77 @@ var contentCursor = (cursor, field) => {
     throw cursorMismatch(cursor, field);
   return cursor;
 };
-var contentConditions = (predicate, params, nextAlias) => {
-  const conditions = [];
-  for (const [key, value] of Object.entries(predicate.content ?? {})) {
-    const segments = parseContentFilterKey(key);
-    if (value === null || value === void 0) {
-      const isNull = contentPathExists(segments, (a) => `${a}.value IS NULL`, params, nextAlias);
-      const anyValue = contentPathExists(segments, (a) => `${a}.value IS NOT NULL`, params, nextAlias);
-      conditions.push(`(${isNull} OR NOT ${anyValue})`);
-    } else {
-      const match = contentPathExists(segments, equalsLeaf, params, nextAlias);
-      params.push(value);
-      conditions.push(match);
-    }
+var valueKind = (value) => {
+  if (typeof value === "boolean")
+    return `${value}`;
+  if (typeof value === "number")
+    return "number";
+  return typeof value === "string" ? "text" : null;
+};
+var contentRows = (scope, predicate) => {
+  const row = (key, op, value = null) => {
+    const path = parseContentFilterKey(key);
+    return [scope, path, op, value, valueKind(value)];
+  };
+  return [
+    ...Object.entries(predicate.content ?? {}).map(([key, value]) => (
+      // undefined is the same absence null names — JSON drops it on the way
+      // over the wire, so treating it as a value would make an in-process
+      // query and its wire equivalent disagree.
+      value === null || value === void 0 ? row(key, "isNull") : row(key, "equals", value)
+    )),
+    ...(predicate.contentPresent ?? []).map((key) => row(key, "present"))
+  ];
+};
+var inList = (s, column, values) => {
+  if (values.length === 1) {
+    s.params.push(values[0]);
+    return `${column} = ?`;
   }
-  for (const key of predicate.contentPresent ?? []) {
-    conditions.push(contentPathExists(parseContentFilterKey(key), (a) => `${a}.value IS NOT NULL`, params, nextAlias));
+  const table = rows(s, ["value"], values.map((value) => [value]));
+  return `${column} IN (SELECT value FROM ${table})`;
+};
+var familyRange = (baseId) => [`${baseId}@`, `${baseId}A`];
+var withinFamily = (column, lo, hi) => `(${column} >= ${lo} AND ${column} < ${hi})`;
+var inFamily = (column, baseId) => ({
+  sql: withinFamily(column, "?", "?"),
+  params: familyRange(baseId)
+});
+var inFamilies = (s, record, baseIds) => {
+  if (baseIds.length === 1) {
+    const one = inFamily(`${record}.type_id`, baseIds[0]);
+    s.params.push(...one.params);
+    return one.sql;
+  }
+  const table = rows(s, ["lo", "hi"], baseIds.map(familyRange));
+  return `${record}.id IN (SELECT fr.id FROM ${table} f JOIN records fr ON ${withinFamily("fr.type_id", "f.lo", "f.hi")})`;
+};
+var carriesPermissions = (s, sets) => {
+  const elements = rows(s, ["set_index", "set_size", "kind", "label", "grantee_kind", "grantee_id", "role"], sets.flatMap((set, i) => set.map((p) => [i, set.length, p.kind, p.label, ...permissionKeyColumns(p)])));
+  return `r.id IN (SELECT p.record_id FROM ${elements} e JOIN permissions p ON p.kind = e.kind AND p.label = e.label AND p.grantee_kind = e.grantee_kind AND p.grantee_id = e.grantee_id AND p.role = e.role GROUP BY p.record_id, e.set_index HAVING COUNT(*) = MAX(e.set_size))`;
+};
+var reachConditions = (s, reach) => {
+  if (reach.fence)
+    s.conditions.push(inFamilies(s, "r", reach.fence));
+  const within = reach.within;
+  if (within) {
+    const arms = [inFamilies(s, "r", within.baseIds)];
+    if (within.authored) {
+      s.params.push(within.authored.subjectId);
+      arms.push(`(r.entity_id = ? AND ${inFamilies(s, "r", within.authored.baseIds)})`);
+    }
+    arms.push(carriesPermissions(s, within.permissions));
+    s.conditions.push(`(${arms.join(" OR ")})`);
   }
-  return conditions;
 };
-var recordConditions = (query) => {
-  const conditions = ["r.id != '_config'"];
-  const params = [];
+var recordConditions = (query, reach) => {
+  const s = emptyStatement();
+  const { conditions, params } = s;
   const f = query.filter ?? {};
-  let aliasSeq = 0;
-  const nextContentAlias = () => `cp${aliasSeq++}`;
   const inFilter = (column, value) => {
     if (value === void 0)
       return;
-    const values = Array.isArray(value) ? value : [value];
-    conditions.push(`r.${column} IN (${values.map(() => "?").join(",")})`);
-    params.push(...values);
+    conditions.push(inList(s, `r.${column}`, Array.isArray(value) ? value : [value]));
   };
   const rangeFilter = (column, range) => {
     if (range?.after) {
@@ -439,7 +628,12 @@ var recordConditions = (query) => {
   if (!f.includeUnlisted) {
     conditions.push("r.unlisted_at IS NULL");
   }
+  if (reach)
+    reachConditions(s, reach);
   inFilter("type_id", f.typeId);
+  if (f.baseId !== void 0) {
+    conditions.push(inFamilies(s, "r", Array.isArray(f.baseId) ? f.baseId : [f.baseId]));
+  }
   if (f.parentId !== void 0) {
     if (f.parentId === null) {
       conditions.push("r.parent_id IS NULL");
@@ -455,10 +649,10 @@ var recordConditions = (query) => {
   rangeFilter("updated_at", f.updatedAt);
   const hasAssociation = (kind, clauses) => `r.id IN (SELECT a.record_id FROM associations a WHERE a.kind = '${kind}'` + clauses.map((c) => ` AND ${c}`).join("") + `)`;
   if (f.tags?.length) {
-    for (const tag of f.tags) {
-      conditions.push(hasAssociation("tag", ["a.label = ?"]));
-      params.push(tag);
-    }
+    const tags = [...new Set(f.tags)];
+    const label = inList(s, "a.label", tags);
+    conditions.push(`r.id IN (SELECT a.record_id FROM associations a WHERE a.kind = 'tag' AND ${label} GROUP BY a.record_id HAVING COUNT(DISTINCT a.label) = ?)`);
+    params.push(tags.length);
   }
   if (f.attachment) {
     const clauses = [];
@@ -504,15 +698,17 @@ var recordConditions = (query) => {
     }
     conditions.push(hasAssociation("relationship", clauses));
   }
-  if (f.content || f.contentPresent?.length) {
-    conditions.push(...contentConditions(f, params, nextContentAlias));
-  }
+  const content = contentRows(null, f);
   if (f.contentByType) {
-    const arms = Object.entries(f.contentByType).map(([typeId, arm]) => {
-      params.push(typeId);
-      return ["r.type_id = ?", ...contentConditions(arm, params, nextContentAlias)].join(" AND ");
-    });
-    conditions.push(`(${arms.map((arm) => `(${arm})`).join(" OR ")})`);
+    const arms = Object.entries(f.contentByType);
+    const typeIds = arms.map(([typeId]) => typeId);
+    conditions.push(inList(s, "r.type_id", typeIds));
+    for (const [typeId, arm] of arms)
+      content.push(...contentRows(typeId, arm));
+  }
+  if (content.length > 0) {
+    const table = rows(s, CONDITION_COLUMNS, content);
+    conditions.push(`NOT EXISTS (SELECT 1 FROM ${table} c WHERE (c.scope IS NULL OR c.scope = r.type_id) AND NOT ${holds("c", "r")})`);
   }
   if (f.search) {
     const sanitized = sanitizeFts5Query(f.search);
@@ -523,7 +719,7 @@ var recordConditions = (query) => {
       conditions.push("0");
     }
   }
-  return { conditions, params };
+  return s;
 };
 var presentCursorCondition = (cursor, op, params) => {
   if (cursor.kind === "num") {
@@ -534,56 +730,54 @@ var presentCursorCondition = (cursor, op, params) => {
   params.push(key, key, cursor.value, cursor.value, cursor.id);
   return `(${SORT_ALIAS}.value_rank ${op} 1 OR (${SORT_ALIAS}.value_rank = 1 AND (${SORT_ALIAS}.text_key ${op} ? OR (${SORT_ALIAS}.text_key = ? AND (${SORT_ALIAS}.text_value ${op} ? OR (${SORT_ALIAS}.text_value = ? AND ${SORT_ALIAS}.record_id ${op} ?))))))`;
 };
-var statement = (select, from, conditions, params, tail = "") => ({
-  sql: `SELECT ${select} FROM ${from} WHERE ${conditions.join(" AND ")}${tail}`,
-  params
-});
-var buildQueryPlan = (query) => {
+var statement = (s, from, tail) => {
+  const select = `SELECT r.* FROM ${from} WHERE ${s.conditions.join(" AND ")}${tail}`;
+  const sql = s.tables.length === 0 ? select : `WITH ${s.tables.join(", ")} ${select}`;
+  return { sql, params: [...s.tableParams, ...s.params] };
+};
+var buildQueryPlan = (query, reach) => {
   const dir = sqlDirection(query);
   const op = dir === "ASC" ? ">" : "<";
   const decoded = query.cursor ? decodeCursor(query.cursor) : null;
-  if (query.sort?.contentFieldByType) {
-    return byTypePlan(query, query.sort.contentFieldByType, dir, op, decoded);
+  if (query.sort.contentFieldByType) {
+    return byTypePlan(query, reach, query.sort.contentFieldByType, dir, op, decoded);
   }
-  const contentField = query.sort?.contentField;
-  if (contentField === void 0) {
-    const { conditions, params } = recordConditions(query);
-    const field = getSortField(query);
+  const { contentField, field } = query.sort;
+  if (field !== void 0) {
+    const where = recordConditions(query, reach);
     const col = getSortColumn(field);
     if (decoded) {
       const cursor2 = nativeCursor(decoded, field);
-      conditions.push(`(r.${col} ${op} ? OR (r.${col} = ? AND r.id ${op} ?))`);
-      params.push(cursor2.value, cursor2.value, cursor2.id);
+      where.conditions.push(`(r.${col} ${op} ? OR (r.${col} = ? AND r.id ${op} ?))`);
+      where.params.push(cursor2.value, cursor2.value, cursor2.id);
     }
-    return [
-      statement("r.*", "records r", conditions, params, ` ORDER BY r.${col} ${dir}, r.id ${dir} LIMIT ?`)
-    ];
+    return [statement(where, "records r", ` ORDER BY r.${col} ${dir}, r.id ${dir} LIMIT ?`)];
   }
   const cursor = decoded ? contentCursor(decoded, contentField) : null;
   const pages = [];
   if (cursor?.kind !== "absent") {
-    const { conditions, params } = recordConditions(query);
+    const where = recordConditions(query, reach);
     const from = `content_index ${SORT_ALIAS} JOIN records r ON r.id = ${SORT_ALIAS}.record_id`;
-    conditions.push(`${SORT_ALIAS}.field = ?`);
-    params.push(contentField);
+    where.conditions.push(`${SORT_ALIAS}.field = ?`);
+    where.params.push(contentField);
     if (cursor)
-      conditions.push(presentCursorCondition(cursor, op, params));
+      where.conditions.push(presentCursorCondition(cursor, op, where.params));
     const order = `${SORT_ALIAS}.value_rank ${dir}, ${SORT_ALIAS}.num_value ${dir}, ${SORT_ALIAS}.text_key ${dir}, ${SORT_ALIAS}.text_value ${dir}, ${SORT_ALIAS}.record_id ${dir}`;
-    pages.push(statement("r.*", from, conditions, params, ` ORDER BY ${order} LIMIT ?`));
+    pages.push(statement(where, from, ` ORDER BY ${order} LIMIT ?`));
   }
   {
-    const { conditions, params } = recordConditions(query);
-    conditions.push(`NOT EXISTS (SELECT 1 FROM content_index ${SORT_ALIAS} WHERE ${SORT_ALIAS}.record_id = r.id AND ${SORT_ALIAS}.field = ?)`);
-    params.push(contentField);
+    const where = recordConditions(query, reach);
+    where.conditions.push(`NOT EXISTS (SELECT 1 FROM content_index ${SORT_ALIAS} WHERE ${SORT_ALIAS}.record_id = r.id AND ${SORT_ALIAS}.field = ?)`);
+    where.params.push(contentField);
     if (cursor?.kind === "absent") {
-      conditions.push(`r.id ${op} ?`);
-      params.push(cursor.id);
+      where.conditions.push(`r.id ${op} ?`);
+      where.params.push(cursor.id);
     }
-    pages.push(statement("r.*", "records r", conditions, params, ` ORDER BY r.id ${dir} LIMIT ?`));
+    pages.push(statement(where, "records r", ` ORDER BY r.id ${dir} LIMIT ?`));
   }
   return pages;
 };
-var byTypePlan = (query, byType, dir, op, decoded) => {
+var byTypePlan = (query, reach, byType, dir, op, decoded) => {
   const cursor = decoded ? contentCursor(decoded, byTypeDescriptor(byType)) : null;
   const fields = [];
   const constants = [];
@@ -597,42 +791,38 @@ var byTypePlan = (query, byType, dir, op, decoded) => {
       constants.push([typeId, entry]);
   }
   const pages = [];
-  const fieldOf = (alias, record) => fields.map(() => `(${record}.type_id = ? AND ${alias}.field = ?)`).join(" OR ");
   if (cursor?.kind !== "absent" && fields.length + constants.length > 0) {
+    const where = recordConditions(query, reach);
     const sources = [];
-    const sourceParams = [];
     if (fields.length > 0) {
-      sources.push(`SELECT c.record_id AS record_id, c.value_rank AS value_rank, c.num_value AS num_value, c.text_key AS text_key, c.text_value AS text_value FROM content_index c JOIN records t ON t.id = c.record_id WHERE ${fieldOf("c", "t")}`);
-      for (const [typeId, field] of fields)
-        sourceParams.push(typeId, field);
+      const byField = rows(where, ["type_id", "field"], fields);
+      sources.push(`SELECT ci.record_id AS record_id, ci.value_rank AS value_rank, ci.num_value AS num_value, ci.text_key AS text_key, ci.text_value AS text_value FROM ${byField} f JOIN content_index ci ON ci.field = f.field JOIN records t ON t.id = ci.record_id AND t.type_id = f.type_id`);
     }
-    for (const [typeId, entry] of constants) {
-      sources.push("SELECT t.id AS record_id, ? AS value_rank, ? AS num_value, ? AS text_key, ? AS text_value FROM records t WHERE t.type_id = ?");
-      sourceParams.push(...entry.kind === "num" ? [0, entry.num, null, null] : [1, null, entry.key, entry.text], typeId);
+    if (constants.length > 0) {
+      const byConstant = rows(where, ["type_id", "value_rank", "num_value", "text_key", "text_value"], constants.map(([typeId, entry]) => entry.kind === "num" ? [typeId, 0, entry.num, null, null] : [typeId, 1, null, entry.key, entry.text]));
+      sources.push(`SELECT t.id AS record_id, k.value_rank AS value_rank, k.num_value AS num_value, k.text_key AS text_key, k.text_value AS text_value FROM ${byConstant} k JOIN records t ON t.type_id = k.type_id`);
     }
-    const { conditions, params } = recordConditions(query);
     if (cursor)
-      conditions.push(presentCursorCondition(cursor, op, params));
+      where.conditions.push(presentCursorCondition(cursor, op, where.params));
     const from = `(${sources.join(" UNION ALL ")}) ${SORT_ALIAS} JOIN records r ON r.id = ${SORT_ALIAS}.record_id`;
     const order = `${SORT_ALIAS}.value_rank ${dir}, ${SORT_ALIAS}.num_value ${dir}, ${SORT_ALIAS}.text_key ${dir}, ${SORT_ALIAS}.text_value ${dir}, ${SORT_ALIAS}.record_id ${dir}`;
-    pages.push(statement("r.*", from, conditions, [...sourceParams, ...params], ` ORDER BY ${order} LIMIT ?`));
+    pages.push(statement(where, from, ` ORDER BY ${order} LIMIT ?`));
   }
   {
-    const { conditions, params } = recordConditions(query);
+    const where = recordConditions(query, reach);
     if (fields.length > 0) {
-      conditions.push(`NOT EXISTS (SELECT 1 FROM content_index ${SORT_ALIAS} WHERE ${SORT_ALIAS}.record_id = r.id AND (${fieldOf(SORT_ALIAS, "r")}))`);
-      for (const [typeId, field] of fields)
-        params.push(typeId, field);
+      const byField = rows(where, ["type_id", "field"], fields);
+      where.conditions.push(`NOT EXISTS (SELECT 1 FROM ${byField} f JOIN content_index ${SORT_ALIAS} ON ${SORT_ALIAS}.record_id = r.id AND ${SORT_ALIAS}.field = f.field WHERE f.type_id = r.type_id)`);
     }
     if (constants.length > 0) {
-      conditions.push(`r.type_id NOT IN (${constants.map(() => "?").join(",")})`);
-      params.push(...constants.map(([typeId]) => typeId));
+      const typeIds = constants.map(([typeId]) => typeId);
+      where.conditions.push(`NOT (${inList(where, "r.type_id", typeIds)})`);
     }
     if (cursor?.kind === "absent") {
-      conditions.push(`r.id ${op} ?`);
-      params.push(cursor.id);
+      where.conditions.push(`r.id ${op} ?`);
+      where.params.push(cursor.id);
     }
-    pages.push(statement("r.*", "records r", conditions, params, ` ORDER BY r.id ${dir} LIMIT ?`));
+    pages.push(statement(where, "records r", ` ORDER BY r.id ${dir} LIMIT ?`));
   }
   return pages;
 };
@@ -725,154 +915,6 @@ var ContentIndex = class {
     return fields;
   }
 };
-var toMs = (d) => d.getTime();
-var actorFromColumns = (subject, principal) => subject == null ? void 0 : {
-  subjectId: subject,
-  ...principal != null && { principalId: principal }
-};
-var fromMs = (ms) => new Date(ms);
-var rowToRecord = (row, associations) => {
-  const record = {
-    id: row.id,
-    typeId: row.type_id,
-    createdAt: fromMs(row.created_at),
-    updatedAt: fromMs(row.updated_at),
-    content: JSON.parse(row.content),
-    version: row.version
-  };
-  if (row.parent_id != null)
-    record.parentId = row.parent_id;
-  if (row.app_id != null)
-    record.appId = row.app_id;
-  const createdBy = actorFromColumns(row.entity_id, row.principal_id);
-  if (createdBy)
-    record.createdBy = createdBy;
-  const updatedBy = actorFromColumns(row.updated_by, row.updated_via);
-  if (updatedBy)
-    record.updatedBy = updatedBy;
-  if (row.deleted_at != null)
-    record.deletedAt = fromMs(row.deleted_at);
-  if (row.unlisted_at != null)
-    record.unlistedAt = fromMs(row.unlisted_at);
-  const partitioned = partitionAssociations(associations);
-  if (partitioned.associations.length)
-    record.associations = partitioned.associations;
-  if (partitioned.permissions.length)
-    record.permissions = partitioned.permissions;
-  return record;
-};
-var rowToAssociation = (row) => {
-  if (row.kind === "tag") {
-    return { kind: "tag", label: row.label };
-  }
-  if (row.kind === "anyone") {
-    return { kind: "anyone", label: "read" };
-  }
-  if (row.kind === "permission") {
-    return {
-      kind: "permission",
-      label: row.label,
-      grantee: rowToGrantee(row)
-    };
-  }
-  if (row.kind === "attachment") {
-    const attachmentRecordId = row.attachment_record_id;
-    return {
-      kind: "attachment",
-      label: row.label,
-      fileId: row.file_id,
-      // Stored as '' when absent, like every other optional column here —
-      // the field is omitted rather than served empty, so a round trip
-      // produces the association the caller wrote.
-      ...attachmentRecordId && { attachmentRecordId }
-    };
-  }
-  return {
-    kind: "relationship",
-    label: row.label,
-    target: rowToTarget(row)
-  };
-};
-var associationKeyColumns = (a) => {
-  if (a.kind === "attachment")
-    return [a.fileId, "", "", "", "", ""];
-  if (a.kind === "permission") {
-    const g = a.grantee;
-    return g.kind === "entity" ? ["", "entity", g.entityId, "", "", ""] : ["", "group", g.groupId, "", "", g.role];
-  }
-  if (a.kind !== "relationship")
-    return ["", "", "", "", "", ""];
-  const t = a.target;
-  if (t.kind === "entity")
-    return ["", "entity", t.entityId, "", "", ""];
-  if (t.kind === "external")
-    return ["", "external", t.id, t.ns, "", ""];
-  return ["", "record", t.recordId, "", t.stackUrl ?? "", ""];
-};
-var rowToGrantee = (row) => row.related_scope === "group" ? {
-  kind: "group",
-  groupId: row.related_id,
-  role: row.related_role
-} : { kind: "entity", entityId: row.related_id };
-var rowToTarget = (row) => {
-  const id = row.related_id;
-  if (row.related_scope === "entity")
-    return { kind: "entity", entityId: id };
-  if (row.related_scope === "external") {
-    return { kind: "external", ns: row.related_ns, id };
-  }
-  const stackUrl = row.related_stack;
-  return { kind: "record", recordId: id, ...stackUrl && { stackUrl } };
-};
-var rowToType = (row) => {
-  const t = {
-    id: row.id,
-    baseId: row.base_id,
-    version: row.version,
-    name: row.name,
-    schema: JSON.parse(row.schema),
-    schemaHash: row.schema_hash,
-    createdAt: fromMs(row.created_at)
-  };
-  if (row.migrates_from)
-    t.migratesFrom = row.migrates_from;
-  return t;
-};
-var rowToVersion = (row) => {
-  const v = {
-    version: row.version,
-    typeId: row.type_id,
-    content: JSON.parse(row.content),
-    updatedAt: fromMs(row.updated_at)
-  };
-  const createdBy = actorFromColumns(row.entity_id, row.principal_id);
-  if (createdBy)
-    v.createdBy = createdBy;
-  const updatedBy = actorFromColumns(row.updated_by, row.updated_via);
-  if (updatedBy)
-    v.updatedBy = updatedBy;
-  return v;
-};
-var rowToJournalEntry = (row) => {
-  const e = {
-    seq: row.seq,
-    at: fromMs(row.at),
-    kind: row.kind,
-    ops: JSON.parse(row.ops),
-    version: row.version,
-    typeId: row.type_id
-  };
-  if (row.parent_id != null)
-    e.parentId = row.parent_id;
-  if (row.previous_parent_id != null) {
-    e.previousParentId = row.previous_parent_id === "" ? null : row.previous_parent_id;
-  }
-  if (row.actor != null)
-    e.actor = JSON.parse(row.actor);
-  if (row.associations != null)
-    e.associations = JSON.parse(row.associations);
-  return e;
-};
 
 // ../sqlite-shared/dist/record-logic.js
 var asStackBadRequestError = (query, run) => {
@@ -904,6 +946,35 @@ var versionRowValues = (version) => [
   version.updatedBy?.subjectId ?? null,
   version.updatedBy?.principalId ?? null
 ];
+var JOURNAL_COLUMNS = [
+  "record_id",
+  "seq",
+  "at",
+  "kind",
+  "ops",
+  "previous_parent_id",
+  "actor",
+  "associations",
+  "version",
+  "type_id",
+  "parent_id"
+];
+var INSERT_JOURNAL_SQL = `INSERT INTO journal (${JOURNAL_COLUMNS.join(", ")})
+   VALUES (${JOURNAL_COLUMNS.map(() => "?").join(", ")})`;
+var journalValues = (recordId, seq, at, entry, row) => [
+  recordId,
+  seq,
+  toMs(at),
+  entry.kind,
+  JSON.stringify(entry.ops),
+  // '' is the root; NULL is an entry that names no origin at all.
+  entry.previousParentId === void 0 ? null : entry.previousParentId ?? "",
+  entry.actor ? JSON.stringify(entry.actor) : null,
+  entry.associations?.length ? JSON.stringify(entry.associations) : null,
+  row.version,
+  row.typeId,
+  row.parentId
+];
 var SharedSqlRecordLogic = class {
   exec;
   searchIndex;
@@ -931,6 +1002,18 @@ var SharedSqlRecordLogic = class {
       throw recordNotFound(id);
     throw versionConflict(id, expectedVersion, version);
   }
+  /**
+   * An aspect write's record, inside its transaction: missing is not found,
+   * a tombstone is refused, and anything else answers its version.
+   */
+  liveVersion(id) {
+    const row = this.exec.get("SELECT version, deleted_at FROM records WHERE id = ?", [id]);
+    if (!row)
+      throw recordNotFound(id);
+    if (row.deleted_at !== null)
+      throw softDeletedRefusal(id);
+    return row.version;
+  }
   currentVersion(id) {
     return this.exec.get("SELECT version FROM records WHERE id = ?", [id])?.version;
   }
@@ -987,41 +1070,71 @@ var SharedSqlRecordLogic = class {
    */
   async createRecord(record, opts = {}) {
     this.exec.transaction(() => {
-      try {
-        this.exec.run(`INSERT INTO records
+      this.insertRecord(record);
+      this.appendJournal(record.id, opts.journal);
+    });
+    return record;
+  }
+  /**
+   * createRecord() carrying the record's history as recorded: its version
+   * rows and journal entries, `seq` and `at` included, in the same
+   * transaction. Appends no entry of its own. See
+   * docs/spec/portability.md § Writing history.
+   */
+  async importRecord(record, history) {
+    this.exec.transaction(() => this.writeImported(record, history));
+    return record;
+  }
+  /**
+   * importRecord()'s write, for a caller already inside a transaction:
+   * writeNewStore() writes a store's `_config` seed through it, so the one
+   * Record a store starts with lands as every other Record does.
+   */
+  writeImported(record, history) {
+    this.insertRecord(record);
+    for (const version of history.versions)
+      this.insertVersionRow(record.id, version);
+    for (const entry of history.journal)
+      this.insertJournalRow(record.id, entry);
+  }
+  /**
+   * The record row and every table describing it, for a caller already
+   * inside a transaction. A duplicate id maps to StackConflictError.
+   */
+  insertRecord(record) {
+    try {
+      this.exec.run(`INSERT INTO records
           (id, type_id, created_at, updated_at, content, version,
            parent_id, entity_id, app_id, principal_id, updated_by, updated_via,
            deleted_at, unlisted_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
-          record.id,
-          record.typeId,
-          toMs(record.createdAt),
-          toMs(record.updatedAt),
-          JSON.stringify(record.content),
-          record.version,
-          record.parentId ?? null,
-          record.createdBy?.subjectId ?? null,
-          record.appId ?? null,
-          record.createdBy?.principalId ?? null,
-          record.updatedBy?.subjectId ?? null,
-          record.updatedBy?.principalId ?? null,
-          record.deletedAt ? toMs(record.deletedAt) : null,
-          record.unlistedAt ? toMs(record.unlistedAt) : null
-        ]);
-      } catch (err) {
-        if (isUniqueConstraintViolation(err)) {
-          throw new StackConflictError(`Record already exists: "${record.id}"`);
-        }
-        throw err;
+        record.id,
+        record.typeId,
+        toMs(record.createdAt),
+        toMs(record.updatedAt),
+        JSON.stringify(record.content),
+        record.version,
+        record.parentId ?? null,
+        record.createdBy?.subjectId ?? null,
+        record.appId ?? null,
+        record.createdBy?.principalId ?? null,
+        record.updatedBy?.subjectId ?? null,
+        record.updatedBy?.principalId ?? null,
+        record.deletedAt ? toMs(record.deletedAt) : null,
+        record.unlistedAt ? toMs(record.unlistedAt) : null
+      ]);
+    } catch (err) {
+      if (isUniqueConstraintViolation(err)) {
+        throw new StackConflictError(`Record already exists: "${record.id}"`);
       }
-      const edges = [...record.associations ?? [], ...record.permissions ?? []];
-      if (edges.length)
-        this.insertAssociations(record.id, edges);
-      this.searchIndex.insert(record.id, JSON.stringify(record.content));
-      this.contentIndex.sync(record.id, record.typeId, record.content);
-      this.appendJournal(record.id, opts.journal);
-    });
-    return record;
+      throw err;
+    }
+    if (record.associations?.length)
+      this.insertAssociations(record.id, record.associations);
+    if (record.permissions?.length)
+      this.insertPermissions(record.id, record.permissions);
+    this.searchIndex.insert(record.id, JSON.stringify(record.content));
+    this.contentIndex.sync(record.id, record.typeId, record.content);
   }
   async getRecord(id) {
     return this.readRecord(id);
@@ -1034,56 +1147,55 @@ var SharedSqlRecordLogic = class {
    */
   readRecord(id) {
     const row = this.exec.get("SELECT * FROM records WHERE id = ?", [id]);
-    return row ? this.hydrate(row) : null;
+    return row ? this.hydrate([row])[0] : null;
   }
-  /** A records row with its association set attached. */
-  hydrate(row) {
-    return rowToRecord(row, this.getAssociationsForRecord(row.id));
+  /**
+   * Records rows with their associations and permissions attached: one
+   * statement per element table for the whole list, so a page costs three
+   * reads however many records it holds.
+   */
+  hydrate(rows2) {
+    const ids = rows2.map((row) => row.id);
+    const associations = this.elementsByRecord("associations", ids, rowToAssociation);
+    const permissions = this.elementsByRecord("permissions", ids, rowToPermission);
+    return rows2.map((row) => rowToRecord(row, associations.get(row.id) ?? [], permissions.get(row.id) ?? []));
   }
   /**
-   * One transaction, so one call is one version whatever it moved, and the
-   * patch applies to the content as it stands when the write lands.
+   * The patch applies to the content as it stands when the write lands,
+   * read inside the same transaction.
    */
-  async mutateRecord(id, changes, opts = {}) {
-    const now = toMs(/* @__PURE__ */ new Date());
-    const sets = [];
-    const values = [];
-    if (changes.parentId !== void 0) {
-      sets.push("parent_id = ?");
-      values.push(changes.parentId);
-    }
-    if (changes.unlisted !== void 0) {
-      sets.push("unlisted_at = ?");
-      values.push(changes.unlisted ? now : null);
-    }
+  async patchContent(id, patch, opts = {}) {
     this.exec.transaction(() => {
       const current = this.readForWrite(id, opts.ifVersion);
-      if (opts.bumpsVersion === false) {
-        if (sets.length > 0) {
-          this.exec.run(`UPDATE records SET ${sets.join(", ")} WHERE id = ?`, [...values, id]);
-        }
-        this.replaceAssociationHalves(id, changes);
-        this.appendJournal(id, opts.journal);
-        return;
-      }
-      const merged = changes.contentPatch ? applyMergePatch(current.content, changes.contentPatch) : void 0;
-      if (merged !== void 0) {
-        sets.unshift("content = ?");
-        values.unshift(JSON.stringify(merged));
-      }
       if (opts.snapshot)
         this.snapshotBeforeMutation(id, opts.snapshot);
-      if (merged !== void 0)
-        this.searchIndex.remove(id);
-      this.versionedUpdate(id, sets, values, opts, now);
-      this.replaceAssociationHalves(id, changes);
-      if (merged !== void 0) {
-        this.searchIndex.insert(id, JSON.stringify(merged));
-        this.contentIndex.sync(id, current.typeId, merged);
+      this.rewriteContent(id, current.typeId, applyMergePatch(current.content, patch), opts);
+      this.appendJournal(id, opts.journal);
+    });
+    return this.reread(id, "patchContent");
+  }
+  async setParent(id, parentId, opts = {}) {
+    return this.aspectUpdate(id, "parent_id = ?", parentId, opts, "setParent");
+  }
+  /** Stamped fresh: `Stack` hands this only a transition. */
+  async setUnlisted(id, unlisted, opts = {}) {
+    return this.aspectUpdate(id, "unlisted_at = ?", unlisted ? toMs(/* @__PURE__ */ new Date()) : null, opts, "setUnlisted");
+  }
+  /**
+   * One records column that never bumps. The tombstone refusal and the
+   * `ifVersion` guard ride in the WHERE clause, as on a versioned update.
+   */
+  aspectUpdate(id, set, value, opts, verb) {
+    const guarded = opts.ifVersion !== void 0;
+    this.exec.transaction(() => {
+      const changed = this.exec.run(`UPDATE records SET ${set}
+         WHERE id = ? AND deleted_at IS NULL${guarded ? " AND version = ?" : ""}`, [value, id, ...guarded ? [opts.ifVersion] : []]);
+      if (changed === 0) {
+        throw versionConflict(id, opts.ifVersion, this.liveVersion(id));
       }
       this.appendJournal(id, opts.journal);
     });
-    return this.reread(id, "mutateRecord");
+    return this.reread(id, verb);
   }
   async deleteRecord(id, opts = {}) {
     if (opts.purge) {
@@ -1113,6 +1225,7 @@ var SharedSqlRecordLogic = class {
     this.checkExpectedVersion(id, purged.version, ifVersion);
     this.searchIndex.remove(id);
     this.exec.run("DELETE FROM associations WHERE record_id = ?", [id]);
+    this.exec.run("DELETE FROM permissions WHERE record_id = ?", [id]);
     this.exec.run("DELETE FROM versions WHERE record_id = ?", [id]);
     this.exec.run("DELETE FROM journal WHERE record_id = ?", [id]);
     this.contentIndex.remove(id);
@@ -1163,20 +1276,27 @@ var SharedSqlRecordLogic = class {
     this.searchIndex.insert(id, json);
     this.contentIndex.sync(id, typeId, content);
   }
-  async queryRecords(query) {
-    const limit = query.limit ?? 50;
+  queryRecords(query) {
+    return this.page(query);
+  }
+  queryReadable(query, reach) {
+    return this.page(query, reach);
+  }
+  /** `reach`, when given, is one more condition of every statement in the plan. */
+  async page(query, reach) {
+    const { limit } = query;
     const fetch = limit + 1;
-    const rows = [];
-    for (const page2 of buildQueryPlan(query)) {
-      const budget = fetch - rows.length;
+    const rows2 = [];
+    for (const page2 of buildQueryPlan(query, reach)) {
+      const budget = fetch - rows2.length;
       if (budget <= 0)
         break;
       const statement2 = atBudget(page2, budget);
-      rows.push(...asStackBadRequestError(query, () => this.exec.all(statement2.sql, statement2.params)));
+      rows2.push(...asStackBadRequestError(query, () => this.exec.all(statement2.sql, statement2.params)));
     }
-    const hasMore = rows.length > limit;
-    const page = hasMore ? rows.slice(0, limit) : rows;
-    const records = page.map((row) => this.hydrate(row));
+    const hasMore = rows2.length > limit;
+    const page = hasMore ? rows2.slice(0, limit) : rows2;
+    const records = this.hydrate(page);
     const lastRecord = records[records.length - 1];
     const cursor = hasMore && lastRecord ? makeCursor(lastRecord, query.sort, (record, field) => this.contentIndex.kindOf(record.typeId, field)) : null;
     return { records, cursor };
@@ -1185,7 +1305,7 @@ var SharedSqlRecordLogic = class {
    * The reference check and the purges share one synchronous transaction,
    * so nothing can add a reference between the two.
    */
-  async deleteUnreferencedAttachmentRecords(fileId, metadataTypeIds) {
+  async deleteUnreferencedAttachmentRecords(fileId, metadataBaseId) {
     return this.exec.transaction(() => {
       const referenced = this.exec.all(`SELECT 1 as found FROM associations WHERE kind = 'attachment' AND file_id = ?
          UNION ALL
@@ -1194,11 +1314,9 @@ var SharedSqlRecordLogic = class {
       if (referenced.length) {
         throw new StackConflictError("Attachment is still referenced by one or more records");
       }
-      if (metadataTypeIds.length === 0)
-        return [];
-      const placeholders = metadataTypeIds.map(() => "?").join(", ");
+      const family = inFamily("type_id", metadataBaseId);
       const metaRows = this.exec.all(`SELECT id FROM records
-         WHERE type_id IN (${placeholders}) AND json_extract(content, '$.fileId') = ?`, [...metadataTypeIds, fileId]);
+         WHERE ${family.sql} AND json_extract(content, '$.fileId') = ?`, [...family.params, fileId]);
       const deleted = [];
       for (const row of metaRows) {
         const purged = this.purgeRecord(row.id);
@@ -1218,8 +1336,8 @@ var SharedSqlRecordLogic = class {
       conditions.push("version < ?");
       values.push(query.beforeVersion);
     }
-    const rows = this.exec.all(`SELECT * FROM versions WHERE ${conditions.join(" AND ")} ORDER BY version DESC${query.limit !== void 0 ? " LIMIT ?" : ""}`, query.limit !== void 0 ? [...values, query.limit] : values);
-    return rows.map(rowToVersion);
+    const rows2 = this.exec.all(`SELECT * FROM versions WHERE ${conditions.join(" AND ")} ORDER BY version DESC${query.limit !== void 0 ? " LIMIT ?" : ""}`, query.limit !== void 0 ? [...values, query.limit] : values);
+    return rows2.map(rowToVersion);
   }
   async getVersion(id, version) {
     return this.readVersion(id, version);
@@ -1241,7 +1359,7 @@ var SharedSqlRecordLogic = class {
          VALUES (?, ?, ${VERSION_COLUMNS.map(() => "?").join(", ")})`, [id, version.version, ...versionRowValues(version)]);
     } catch (err) {
       if (isUniqueConstraintViolation(err)) {
-        throw new StackConflictError(`Version ${version.version} already exists for record "${id}" \u2014 a concurrent writer raced past this version. Use ifVersion to detect this before it happens.`);
+        throw new StackConflictError(`Version ${version.version} already exists for record "${id}"`);
       }
       throw err;
     }
@@ -1257,14 +1375,6 @@ var SharedSqlRecordLogic = class {
          SET ${VERSION_COLUMNS.map((c) => `${c} = ?`).join(", ")}
        WHERE record_id = ? AND version = ?`, [...versionRowValues(version), id, version.version]);
   }
-  /**
-   * Standalone snapshot write for tooling and tests — loud on any
-   * collision, since nothing here is about to bump the version. Mutating
-   * methods take a `snapshot` option instead; see snapshotBeforeMutation.
-   */
-  async saveVersion(id, version) {
-    this.insertVersionRow(id, version);
-  }
   /**
    * The snapshot half of a mutating method's atomic snapshot-then-mutate
    * transaction. A collision is a racing-writer conflict, except an orphan
@@ -1278,8 +1388,9 @@ var SharedSqlRecordLogic = class {
     } catch (err) {
       if (!(err instanceof StackConflictError))
         throw err;
-      if (this.currentVersion(id) !== version.version)
-        throw err;
+      if (this.currentVersion(id) !== version.version) {
+        throw new StackConflictError(`Version ${version.version} already exists for record "${id}" \u2014 a concurrent writer raced past this version. Use ifVersion to detect this before it happens.`);
+      }
       this.overwriteVersionRow(id, version);
     }
   }
@@ -1288,9 +1399,9 @@ var SharedSqlRecordLogic = class {
   // -------------------------------------------------------
   /**
    * Append one entry, stamped from the row as it now stands, so callers run
-   * this inside their write's transaction, after the write. `seq` is
-   * allocated in the INSERT itself, so no caller ever holds one it expects
-   * to be free. See docs/spec/journal.md § Ordering.
+   * this inside their write's transaction, after the write. `seq` is read
+   * from the log's maximum in that same transaction, so no caller ever holds
+   * one it expects to be free. See docs/spec/journal.md § Ordering.
    */
   appendJournal(recordId, entry) {
     if (!entry)
@@ -1298,26 +1409,20 @@ var SharedSqlRecordLogic = class {
     const row = this.exec.get("SELECT version, type_id, parent_id FROM records WHERE id = ?", [recordId]);
     if (!row)
       throw recordNotFound(recordId);
-    this.exec.run(`INSERT INTO journal
-        (record_id, seq, at, kind, ops, version, type_id, parent_id,
-         previous_parent_id, actor, associations)
-       VALUES (
-         ?,
-         (SELECT COALESCE(MAX(seq), 0) + 1 FROM journal WHERE record_id = ?),
-         ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
-      recordId,
-      recordId,
-      toMs(/* @__PURE__ */ new Date()),
-      entry.kind,
-      JSON.stringify(entry.ops),
-      row.version,
-      row.type_id,
-      row.parent_id,
-      // '' is the root; NULL is an entry that names no origin at all.
-      entry.previousParentId === void 0 ? null : entry.previousParentId ?? "",
-      entry.actor ? JSON.stringify(entry.actor) : null,
-      entry.associations?.length ? JSON.stringify(entry.associations) : null
-    ]);
+    const { seq } = this.exec.get("SELECT COALESCE(MAX(seq), 0) + 1 AS seq FROM journal WHERE record_id = ?", [recordId]);
+    this.exec.run(INSERT_JOURNAL_SQL, journalValues(recordId, seq, /* @__PURE__ */ new Date(), entry, {
+      version: row.version,
+      typeId: row.type_id,
+      parentId: row.parent_id
+    }));
+  }
+  /** A whole entry as recorded, `seq` and `at` included — importRecord()'s half of the journal. */
+  insertJournalRow(recordId, entry) {
+    this.exec.run(INSERT_JOURNAL_SQL, journalValues(recordId, entry.seq, entry.at, entry, {
+      version: entry.version,
+      typeId: entry.typeId,
+      parentId: entry.parentId ?? null
+    }));
   }
   async getJournal(id, query = {}) {
     if (!this.exec.get("SELECT 1 FROM records WHERE id = ?", [id])) {
@@ -1329,8 +1434,8 @@ var SharedSqlRecordLogic = class {
       conditions.push("seq > ?");
       values.push(query.afterSeq);
     }
-    const rows = this.exec.all(`SELECT * FROM journal WHERE ${conditions.join(" AND ")} ORDER BY seq ASC${query.limit !== void 0 ? " LIMIT ?" : ""}`, query.limit !== void 0 ? [...values, query.limit] : values);
-    return rows.map(rowToJournalEntry);
+    const rows2 = this.exec.all(`SELECT * FROM journal WHERE ${conditions.join(" AND ")} ORDER BY seq ASC${query.limit !== void 0 ? " LIMIT ?" : ""}`, query.limit !== void 0 ? [...values, query.limit] : values);
+    return rows2.map(rowToJournalEntry);
   }
   // -------------------------------------------------------
   // Types
@@ -1355,66 +1460,71 @@ var SharedSqlRecordLogic = class {
     return row ? rowToType(row) : null;
   }
   async listTypes() {
-    const rows = this.exec.all("SELECT * FROM types ORDER BY base_id, version");
-    return rows.map(rowToType);
+    const rows2 = this.exec.all("SELECT * FROM types ORDER BY base_id, version");
+    return rows2.map(rowToType);
   }
   // -------------------------------------------------------
   // Associations
   // -------------------------------------------------------
   /**
-   * Never bumps `version`/`updatedAt` and never snapshots — see
-   * StackRecordAdapter.amendAssociations(). Removes apply before adds, so
-   * removing and re-adding one identity in a call leaves it present.
+   * A write to one of a record's two element tables, inside a transaction
+   * that first checks the record exists, is not soft-deleted, is at
+   * `ifVersion`, and that the table holds `expectSet`. Never bumps and
+   * never snapshots.
    */
-  async amendAssociations(recordId, changes, opts = {}) {
-    assertOneSurface(changes);
+  elementWrite(id, table, opts, write, verb) {
     this.exec.transaction(() => {
-      if (this.currentVersion(recordId) === void 0)
-        throw recordNotFound(recordId);
-      for (const change of changes) {
-        if (change.op !== "remove")
-          continue;
-        const { association } = change;
-        this.exec.run(`DELETE FROM associations
-       WHERE record_id = ?
-         AND kind = ?
-         AND label = ?
-         AND file_id       = ?
-         AND related_scope = ?
-         AND related_id    = ?
-         AND related_ns    = ?
-         AND related_stack = ?
-         AND related_role  = ?`, [recordId, association.kind, association.label, ...associationKeyColumns(association)]);
+      this.checkExpectedVersion(id, this.liveVersion(id), opts.ifVersion);
+      if (opts.expectSet) {
+        const map = table === "associations" ? rowToAssociation : rowToPermission;
+        const stored = this.elementsByRecord(table, [id], map).get(id) ?? [];
+        if (!sameAssociationSet(stored, opts.expectSet))
+          throw new ElementSetMovedError(id);
       }
-      const adds = changes.flatMap((c) => c.op === "add" ? [c.association] : []);
-      if (adds.length)
-        this.insertAssociations(recordId, adds);
-      this.appendJournal(recordId, opts.journal);
+      write();
+      this.appendJournal(id, opts.journal);
     });
-    return this.reread(recordId, "amendAssociations");
+    return this.reread(id, verb);
   }
-  /**
-   * Each key replaces only within its own half of the partition, which is
-   * why a tag write cannot drop an ACL. Caller-transactional.
-   * See docs/spec/access-control.md § Record-level permissions.
-   */
-  replaceAssociationHalves(recordId, changes) {
-    if (changes.associations !== void 0) {
-      this.replaceAssociations(recordId, changes.associations, "data");
-    }
-    if (changes.permissions !== void 0) {
-      this.replaceAssociations(recordId, changes.permissions, "authority");
-    }
+  async editAssociations(id, edits, opts = {}) {
+    return this.elementWrite(id, "associations", opts, () => {
+      for (const edit of edits) {
+        if (edit.op !== "remove")
+          continue;
+        const association = edit.association;
+        this.exec.run(`DELETE FROM associations
+             WHERE record_id = ? AND kind = ? AND label = ?
+               AND file_id = ? AND related_scope = ? AND related_id = ?
+               AND related_ns = ? AND related_stack = ?`, [id, association.kind, association.label, ...associationKeyColumns(association)]);
+      }
+      this.insertAssociations(id, addsOf(edits));
+    }, "editAssociations");
+  }
+  async setAssociations(id, associations, opts = {}) {
+    return this.elementWrite(id, "associations", opts, () => {
+      this.exec.run("DELETE FROM associations WHERE record_id = ?", [id]);
+      this.insertAssociations(id, associations);
+    }, "setAssociations");
+  }
+  /** editAssociations() over the permissions table. */
+  async editAccess(id, edits, opts = {}) {
+    return this.elementWrite(id, "permissions", opts, () => {
+      for (const edit of edits) {
+        if (edit.op !== "remove")
+          continue;
+        const permission = edit.association;
+        this.exec.run(`DELETE FROM permissions
+             WHERE record_id = ? AND kind = ? AND label = ?
+               AND grantee_kind = ? AND grantee_id = ? AND role = ?`, [id, permission.kind, permission.label, ...permissionKeyColumns(permission)]);
+      }
+      this.insertPermissions(id, addsOf(edits));
+    }, "editAccess");
   }
-  /**
-   * Swap one half of a record's association set wholesale — the "replace,
-   * don't merge" semantics a change set's association list carries. The data
-   * half is "not an authority kind", so core's list is the only one.
-   */
-  replaceAssociations(recordId, associations, half) {
-    this.exec.run(`DELETE FROM associations WHERE record_id = ? AND kind ${half === "data" ? "NOT IN" : "IN"} (${AUTHORITY_ASSOCIATION_KINDS.map(() => "?").join(", ")})`, [recordId, ...AUTHORITY_ASSOCIATION_KINDS]);
-    if (associations.length)
-      this.insertAssociations(recordId, associations);
+  async setAccess(id, permissions, opts = {}) {
+    return this.elementWrite(id, "permissions", opts, () => {
+      this.exec.run("DELETE FROM permissions WHERE record_id = ?", [id]);
+      this.insertPermissions(id, permissions);
+    }, "setAccess");
   }
   /**
    * Upserts on association identity, so re-pointing `attachment_record_id`
@@ -1423,46 +1533,118 @@ var SharedSqlRecordLogic = class {
    */
   insertAssociations(recordId, associations) {
     for (const assoc of associations) {
-      try {
-        this.exec.run(`INSERT INTO associations
+      this.insertRow(recordId, () => this.exec.run(`INSERT INTO associations
             (record_id, kind, label, file_id, related_scope, related_id, related_ns,
-             related_stack, related_role, attachment_record_id)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+             related_stack, attachment_record_id)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
            ON CONFLICT DO UPDATE SET attachment_record_id = excluded.attachment_record_id`, [
-          recordId,
-          assoc.kind,
-          assoc.label,
-          ...associationKeyColumns(assoc),
-          assoc.kind === "attachment" ? assoc.attachmentRecordId ?? "" : ""
-        ]);
-      } catch (err) {
-        if (isForeignKeyViolation(err)) {
-          throw recordNotFound(recordId);
-        }
-        throw err;
-      }
+        recordId,
+        assoc.kind,
+        assoc.label,
+        ...associationKeyColumns(assoc),
+        assoc.kind === "attachment" ? assoc.attachmentRecordId ?? "" : ""
+      ]));
+    }
+  }
+  /** Every column is in the key, so a repeated element is the same row. */
+  insertPermissions(recordId, permissions) {
+    for (const p of permissions) {
+      this.insertRow(recordId, () => this.exec.run(`INSERT INTO permissions (record_id, kind, label, grantee_kind, grantee_id, role)
+           VALUES (?, ?, ?, ?, ?, ?)
+           ON CONFLICT DO NOTHING`, [recordId, p.kind, p.label, ...permissionKeyColumns(p)]));
+    }
+  }
+  insertRow(recordId, insert) {
+    try {
+      insert();
+    } catch (err) {
+      if (isForeignKeyViolation(err))
+        throw recordNotFound(recordId);
+      throw err;
     }
   }
-  getAssociationsForRecord(recordId) {
-    const rows = this.exec.all("SELECT * FROM associations WHERE record_id = ?", [recordId]);
-    return rows.map(rowToAssociation);
+  /**
+   * One element table's rows for every record in `ids`, in primary-key
+   * order — the order a single record's read has always had.
+   */
+  elementsByRecord(table, ids, map) {
+    const byRecord = /* @__PURE__ */ new Map();
+    const rows2 = this.exec.all(`WITH ids AS MATERIALIZED ${rowsTable(["id"])}
+       SELECT * FROM ${table} WHERE record_id IN (SELECT id FROM ids)
+       ORDER BY ${table === "associations" ? ASSOCIATION_KEY : PERMISSION_KEY}`, [JSON.stringify(ids.map((id) => [id]))]);
+    for (const row of rows2) {
+      const id = row.record_id;
+      const list = byRecord.get(id);
+      if (list)
+        list.push(map(row));
+      else
+        byRecord.set(id, [map(row)]);
+    }
+    return byRecord;
   }
 };
+var ASSOCIATION_KEY = "record_id, kind, label, file_id, related_scope, related_id, related_ns, related_stack";
+var PERMISSION_KEY = "record_id, kind, label, grantee_kind, grantee_id, role";
+var addsOf = (edits) => edits.flatMap((e) => e.op === "add" ? [e.association] : []);
+
+// ../sqlite-shared/dist/config.js
+var CONFIG_ROW_SQL = `SELECT content FROM records WHERE id = '_config'`;
+var missingStoreError = (where) => new Error(`Cannot open: no database found at ${where}. Pass create: 'ifMissing' or 'exclusive' to create one.`);
+var writeNewStore = (exec, seed) => {
+  exec.transaction(() => {
+    exec.exec(RECORD_SCHEMA_SQL);
+    exec.exec(FTS5_SCHEMA_SQL);
+    exec.run("INSERT INTO format (id, version) VALUES (1, ?)", [FORMAT_VERSION]);
+    new SharedSqlRecordLogic({ exec }).writeImported(seed.config, seed.history);
+  });
+  return seed.config.content;
+};
+var readStoredConfig = (exec, where) => {
+  const hasFormat = exec.get(`SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'format'`) !== void 0;
+  if (!hasFormat)
+    return null;
+  const version = exec.get("SELECT version FROM format WHERE id = 1")?.version;
+  if (version !== FORMAT_VERSION)
+    throw new FormatMismatchError(FORMAT_VERSION, version, where);
+  const { content } = exec.get(CONFIG_ROW_SQL);
+  return JSON.parse(content);
+};
+var openStore = async (exec, opts) => {
+  const stored = readStoredConfig(exec, opts.where);
+  if (!stored && opts.mode === "never")
+    throw missingStoreError(opts.where);
+  if (stored && (opts.mode === "exclusive" || opts.seed)) {
+    throw new Error(`Cannot create: database already exists at ${opts.where}. Pass create: 'never' or 'ifMissing' without a seed to open it.`);
+  }
+  applyConnectionPragmas(exec, { wal: opts.wal });
+  if (stored) {
+    const expected = typeof opts.ownerEntityId === "string" ? opts.ownerEntityId : void 0;
+    if (expected !== void 0 && expected !== stored.ownerEntityId) {
+      throw new OwnerMismatchError(expected, stored.ownerEntityId, opts.where);
+    }
+    return stored;
+  }
+  if (opts.seed)
+    return writeNewStore(exec, opts.seed);
+  const owner = typeof opts.ownerEntityId === "function" ? await opts.ownerEntityId() : opts.ownerEntityId;
+  if (!owner) {
+    throw new Error(`Cannot create: no ownerEntityId given for the new database at ${opts.where}.`);
+  }
+  return writeNewStore(exec, newStoreSeed({ ownerEntityId: owner }));
+};
 
 // ../sqlite-shared/dist/record-adapter.js
 var SQLITE_RECORD_CAPABILITIES = {
   filter: {
     content: "path",
     contentPresent: true,
-    // Inside SQLite's limits on expression depth and compound selects; see
-    // docs/spec/adapters.md § Adapter capabilities.
-    contentByType: 64,
+    contentByType: true,
     search: true
   },
   sort: {
     fields: ["createdAt", "updatedAt", "version"],
     contentField: true,
-    contentFieldByType: 64
+    contentFieldByType: true
   },
   limits: {
     attachmentBytes: null,
@@ -1472,12 +1654,10 @@ var SQLITE_RECORD_CAPABILITIES = {
 var SharedSqlRecordAdapter = class {
   capabilities = SQLITE_RECORD_CAPABILITIES;
   ownerEntityId;
-  timezone;
   record;
   constructor(exec, config) {
     this.record = new SharedSqlRecordLogic({ exec });
-    this.ownerEntityId = config.entityId;
-    this.timezone = config.timezone;
+    this.ownerEntityId = config.ownerEntityId;
   }
   // -------------------------------------------------------
   // Records
@@ -1485,11 +1665,20 @@ var SharedSqlRecordAdapter = class {
   createRecord(record, opts) {
     return this.record.createRecord(record, opts);
   }
+  importRecord(record, history) {
+    return this.record.importRecord(record, history);
+  }
   getRecord(id) {
     return this.record.getRecord(id);
   }
-  mutateRecord(id, changes, opts) {
-    return this.record.mutateRecord(id, changes, opts);
+  patchContent(id, patch, opts) {
+    return this.record.patchContent(id, patch, opts);
+  }
+  setParent(id, parentId, opts) {
+    return this.record.setParent(id, parentId, opts);
+  }
+  setUnlisted(id, unlisted, opts) {
+    return this.record.setUnlisted(id, unlisted, opts);
   }
   deleteRecord(id, opts) {
     return this.record.deleteRecord(id, opts);
@@ -1506,8 +1695,11 @@ var SharedSqlRecordAdapter = class {
   queryRecords(query) {
     return this.record.queryRecords(query);
   }
-  deleteUnreferencedAttachmentRecords(fileId, metadataTypeIds) {
-    return this.record.deleteUnreferencedAttachmentRecords(fileId, metadataTypeIds);
+  queryReadable(query, reach) {
+    return this.record.queryReadable(query, reach);
+  }
+  deleteUnreferencedAttachmentRecords(fileId, metadataBaseId) {
+    return this.record.deleteUnreferencedAttachmentRecords(fileId, metadataBaseId);
   }
   // -------------------------------------------------------
   // Versions
@@ -1518,9 +1710,6 @@ var SharedSqlRecordAdapter = class {
   getVersion(id, version) {
     return this.record.getVersion(id, version);
   }
-  saveVersion(id, version) {
-    return this.record.saveVersion(id, version);
-  }
   // -------------------------------------------------------
   // Change journal
   // -------------------------------------------------------
@@ -1540,10 +1729,19 @@ var SharedSqlRecordAdapter = class {
     return this.record.listTypes();
   }
   // -------------------------------------------------------
-  // Associations
+  // Associations and permissions
   // -------------------------------------------------------
-  amendAssociations(recordId, changes, opts) {
-    return this.record.amendAssociations(recordId, changes, opts);
+  editAssociations(id, edits, opts) {
+    return this.record.editAssociations(id, edits, opts);
+  }
+  setAssociations(id, associations, opts) {
+    return this.record.setAssociations(id, associations, opts);
+  }
+  editAccess(id, edits, opts) {
+    return this.record.editAccess(id, edits, opts);
+  }
+  setAccess(id, permissions, opts) {
+    return this.record.setAccess(id, permissions, opts);
   }
 };
 
@@ -1564,8 +1762,8 @@ var DurableObjectSqliteExecutor = class {
     return cursor.rowsWritten;
   }
   get(sql, params = []) {
-    const rows = this.sql.exec(sql, ...params).toArray();
-    return rows[0];
+    const rows2 = this.sql.exec(sql, ...params).toArray();
+    return rows2[0];
   }
   all(sql, params = []) {
     return this.sql.exec(sql, ...params).toArray();
@@ -1583,9 +1781,9 @@ var DoSQLiteRecordAdapter = class _DoSQLiteRecordAdapter extends SharedSqlRecord
   /**
    * Open the adapter for a DO instance, creating its storage on first use.
    * A DO id either already has a config record (reattach) or it doesn't
-   * (first call — opts.ownerEntityId/timezone become the config), so there
-   * is no `create` option. Schema DDL is `CREATE TABLE IF NOT EXISTS`, so
-   * running it every call is idempotent and cheap.
+   * (first call — opts.ownerEntityId becomes the config), so there
+   * is no `create` option. A new store's tables are written in the same
+   * transaction as its config record, so storage holds a whole store or none.
    *
    * DO SQLite manages its own durability and rejects PRAGMA journal_mode
    * outright ("not authorized") — verified against the real runtime, not
@@ -1593,20 +1791,12 @@ var DoSQLiteRecordAdapter = class _DoSQLiteRecordAdapter extends SharedSqlRecord
    */
   static async open(storage, opts) {
     const exec = new DurableObjectSqliteExecutor(storage);
-    applyRecordSchema(exec);
-    let config = tryReadStackConfig(exec);
-    if (config) {
-      if (typeof opts.ownerEntityId === "string" && opts.ownerEntityId !== config.entityId) {
-        throw new OwnerMismatchError(
-          opts.ownerEntityId,
-          config.entityId,
-          "the Durable Object storage"
-        );
-      }
-    } else {
-      const ownerEntityId = typeof opts.ownerEntityId === "function" ? await opts.ownerEntityId() : opts.ownerEntityId;
-      config = insertConfigRecord(exec, ownerEntityId, opts.timezone);
-    }
+    const config = await openStore(exec, {
+      ...opts,
+      mode: "ifMissing",
+      where: "the Durable Object storage",
+      wal: false
+    });
     return new _DoSQLiteRecordAdapter(exec, config);
   }
   // -------------------------------------------------------