@haverstack/record-adapter-sqlite 0.29.0 → 0.31.0

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-import { StackRecord, JournalOptions, RecordChanges, RecordVersion, ActorOptions, TypeId, StackQuery, QueryResult, FileId, JournalQuery, RecordJournalEntry, StackType, Association, TokenSession } from '@haverstack/core';
-import { StackRecordAdapter, AdapterCapabilities } from '@haverstack/core/adapter';
-import { StackTokenStore, TokenInfo } from '@haverstack/core/wire';
+import { StackCapabilities, StackRecord, RecordChangeSet, RecordVersion, ActorOptions, TypeId, StackQuery, QueryResult, FileId, JournalQuery, RecordJournalEntry, StackType, Association, Actor } from '@haverstack/core';
+import { StackRecordAdapter, JournalOptions } from '@haverstack/core/adapter';
+import { StackTokenStore, TokenSession, TokenInfo } from '@haverstack/core/wire';
 
 /**
  * Normalizes a SQLite binding's call convention (array-bind-then-step,
@@ -60,33 +60,33 @@ type StackConfig = {
  */
 
 declare abstract class SharedSqlRecordAdapter implements StackRecordAdapter {
-    readonly capabilities: AdapterCapabilities;
+    readonly capabilities: StackCapabilities;
     readonly ownerEntityId: string;
     readonly timezone: string | undefined;
     private readonly record;
     protected constructor(exec: SqlExecutor, config: StackConfig);
     createRecord(record: StackRecord, opts?: JournalOptions): Promise<StackRecord>;
     getRecord(id: string): Promise<StackRecord | null>;
-    mutateRecord(id: string, changes: RecordChanges, opts?: {
-        expectedVersion?: number;
+    mutateRecord(id: string, changes: RecordChangeSet, opts?: {
+        ifVersion?: number;
         snapshot?: RecordVersion;
         bumpsVersion?: boolean;
     } & ActorOptions & JournalOptions): Promise<StackRecord>;
     deleteRecord(id: string, opts?: {
-        hard?: boolean;
-        expectedVersion?: number;
+        purge?: boolean;
+        ifVersion?: number;
         snapshot?: RecordVersion;
     } & ActorOptions & JournalOptions): Promise<StackRecord | null>;
     undeleteRecord(id: string, opts?: {
-        expectedVersion?: number;
+        ifVersion?: number;
         snapshot?: RecordVersion;
     } & ActorOptions & JournalOptions): Promise<StackRecord>;
     restoreVersion(id: string, version: number, opts?: {
-        expectedVersion?: number;
+        ifVersion?: number;
         snapshot?: RecordVersion;
     } & ActorOptions & JournalOptions): Promise<StackRecord>;
     commitMigration(id: string, toTypeId: TypeId, content: Record<string, unknown>, opts?: {
-        expectedVersion?: number;
+        ifVersion?: number;
         snapshot?: RecordVersion;
     } & ActorOptions & JournalOptions): Promise<StackRecord>;
     queryRecords(query: StackQuery): Promise<QueryResult>;
@@ -120,7 +120,7 @@ declare abstract class SharedSqlRecordAdapter implements StackRecordAdapter {
 
 /** Conventional sibling path for a token store beside a stack's main .db file. */
 declare const defaultTokenStorePath: (dbPath: string) => string;
-type NativeTokenStoreOptions = {
+type NativeTokenStoreOpenOptions = {
     /** Absolute path to the token store file. Created if it doesn't exist. */
     path: string;
     /** Bypass the storage-ownership lock check. See docs/spec/adapters.md § Concurrency & storage ownership. */
@@ -132,9 +132,8 @@ declare class NativeTokenStore implements StackTokenStore {
     private tokens;
     private constructor();
     /** Opens the token store, creating the file and schema if needed. */
-    static open(opts: NativeTokenStoreOptions): Promise<NativeTokenStore>;
-    createToken(principalId: string, opts?: {
-        onBehalfOf?: string;
+    static open(opts: NativeTokenStoreOpenOptions): Promise<NativeTokenStore>;
+    createToken(actor: Actor, opts?: {
         label?: string;
         expiresAt?: Date;
     }): Promise<{
@@ -174,17 +173,17 @@ declare class NativeTokenStore implements StackTokenStore {
  * spread-args run/get/all calls to it).
  */
 
-type NativeRecordInitializeOptions = {
+type NativeSQLiteRecordAdapterInitializeOptions = {
     /** Absolute path to the .db file. Must not already exist. */
     path: string;
     /** IANA timezone string e.g. "America/New_York". Optional passthrough app metadata — no default. */
     timezone?: string;
     /** Entity ID of the stack owner. */
-    entityId: string;
-    /** Bypass the storage-ownership lock check. See NativeRecordOpenOptions.force. */
+    ownerEntityId: string;
+    /** Bypass the storage-ownership lock check. See NativeSQLiteRecordAdapterOpenOptions.force. */
     force?: boolean;
 };
-type NativeRecordOpenOptions = {
+type NativeSQLiteRecordAdapterOpenOptions = {
     /** Absolute path to an existing .db file. */
     path: string;
     /**
@@ -210,15 +209,15 @@ declare class NativeSQLiteRecordAdapter extends SharedSqlRecordAdapter {
      * Initialize a new stack database. Fails if the file already exists —
      * use open() for existing databases.
      */
-    static initialize(opts: NativeRecordInitializeOptions): Promise<NativeSQLiteRecordAdapter>;
+    static initialize(opts: NativeSQLiteRecordAdapterInitializeOptions): Promise<NativeSQLiteRecordAdapter>;
     /**
      * Open an existing stack database. Fails if the file does not exist —
      * use initialize() for new databases.
      */
-    static open(opts: NativeRecordOpenOptions): Promise<NativeSQLiteRecordAdapter>;
+    static open(opts: NativeSQLiteRecordAdapterOpenOptions): Promise<NativeSQLiteRecordAdapter>;
     /** Folds the WAL back into the main file — useful before copying/backing up the database. */
     flush(): Promise<void>;
     close(): Promise<void>;
 }
 
-export { type NativeRecordInitializeOptions, type NativeRecordOpenOptions, NativeSQLiteRecordAdapter, NativeTokenStore, type NativeTokenStoreOptions, defaultTokenStorePath };
+export { NativeSQLiteRecordAdapter, type NativeSQLiteRecordAdapterInitializeOptions, type NativeSQLiteRecordAdapterOpenOptions, NativeTokenStore, type NativeTokenStoreOpenOptions, defaultTokenStorePath };

package/dist/index.js

@@ -1,5 +1,5 @@
 import { existsSync, writeFileSync, unlinkSync, readFileSync } from 'fs';
-import { StackNotFoundError, StackConflictError, applyMergePatch, StackVersionConflictError, StackQueryError, NATIVE_SORT_FIELDS } from '@haverstack/core';
+import { StackNotFoundError, StackConflictError, applyMergePatch, StackVersionConflictError, StackBadRequestError, NATIVE_SORT_FIELDS } from '@haverstack/core';
 import { contentSortEntry, parseContentFilterKey, contentSortKey } from '@haverstack/core/adapter';
 import { randomBytes, createHash } from 'crypto';
 
@@ -75,6 +75,7 @@ var RECORD_SCHEMA_SQL = `
     content     TEXT NOT NULL CHECK (json_valid(content)),
     updated_at  INTEGER NOT NULL,
     entity_id   TEXT,
+    principal_id TEXT,
     updated_by  TEXT,
     updated_via TEXT,
     PRIMARY KEY (record_id, version)
@@ -91,7 +92,7 @@ var RECORD_SCHEMA_SQL = `
     at          INTEGER NOT NULL,
     -- No 'purged': a purge destroys the log rather than appending to it,
     -- so the constraint names exactly the kinds an entry can carry.
-    -- See docs/spec/journal.md \xA7 A hard delete destroys the journal.
+    -- See docs/spec/journal.md \xA7 A purge destroys the journal.
     kind        TEXT NOT NULL CHECK (kind IN ('created', 'changed', 'deleted')),
     ops         TEXT NOT NULL CHECK (json_valid(ops)),
     version     INTEGER NOT NULL,
@@ -217,7 +218,7 @@ var fromBase64 = (cursor) => {
 };
 var encodeCursor = (decoded) => toBase64(JSON.stringify(decoded.kind === "absent" ? { k: decoded.kind, f: decoded.field, i: decoded.id } : { k: decoded.kind, f: decoded.field, i: decoded.id, v: decoded.value }));
 var decodeCursor = (cursor) => {
-  const malformed = () => new StackQueryError(`Invalid cursor: malformed "${cursor}"`);
+  const malformed = () => new StackBadRequestError(`Invalid cursor: malformed "${cursor}"`);
   let parsed;
   try {
     parsed = JSON.parse(fromBase64(cursor));
@@ -238,11 +239,11 @@ var decodeCursor = (cursor) => {
   }
   if (k === "num" || k === "native") {
     if (typeof v !== "number" || !isFinite(v)) {
-      throw new StackQueryError(`Invalid cursor: non-numeric sort value`);
+      throw new StackBadRequestError(`Invalid cursor: non-numeric sort value`);
     }
     if (k === "native") {
       if (!SORT_FIELDS.includes(f)) {
-        throw new StackQueryError(`Invalid cursor: unknown sort field "${f}"`);
+        throw new StackBadRequestError(`Invalid cursor: unknown sort field "${f}"`);
       }
       return { kind: "native", field: f, value: v, id: i };
     }
@@ -376,7 +377,7 @@ var atBudget = (page, rows) => ({
 var sqlDirection = (query) => {
   const dir = query.sort?.direction ?? "desc";
   if (dir !== "asc" && dir !== "desc") {
-    throw new StackQueryError(`Invalid sort direction "${dir}": expected "asc" or "desc".`);
+    throw new StackBadRequestError(`Invalid sort direction "${dir}": expected "asc" or "desc".`);
   }
   return dir === "asc" ? "ASC" : "DESC";
 };
@@ -401,7 +402,7 @@ var contentPathExists = (segments, leaf, params, nextAlias) => {
 };
 var equalsLeaf = (alias) => `${alias}.type NOT IN ('object', 'array') AND ${alias}.value = ?`;
 var SORT_ALIAS = "cs";
-var cursorMismatch = (cursor, field) => new StackQueryError(`Cursor sort field "${cursor.field}" does not match query sort field "${field}"`);
+var cursorMismatch = (cursor, field) => new StackBadRequestError(`Cursor sort field "${cursor.field}" does not match query sort field "${field}"`);
 var nativeCursor = (cursor, field) => {
   if (cursor.kind !== "native" || cursor.field !== field)
     throw cursorMismatch(cursor, field);
@@ -449,8 +450,8 @@ var recordConditions = (query) => {
     }
   }
   inFilter("app_id", f.appId);
-  inFilter("entity_id", f.entityId);
-  inFilter("principal_id", f.principalId);
+  inFilter("entity_id", f.createdBy?.subjectId);
+  inFilter("principal_id", f.createdBy?.principalId);
   rangeFilter("created_at", f.createdAt);
   rangeFilter("updated_at", f.updatedAt);
   const hasAssociation = (kind, clauses) => `r.id IN (SELECT a.record_id FROM associations a WHERE a.kind = '${kind}'` + clauses.map((c) => ` AND ${c}`).join("") + `)`;
@@ -460,14 +461,22 @@ var recordConditions = (query) => {
       params.push(tag);
     }
   }
-  if (f.hasAttachment) {
-    conditions.push(hasAssociation("attachment", ["a.label = ?"]));
-    params.push(f.hasAttachment);
+  if (f.attachment) {
+    const clauses = [];
+    if (f.attachment.label !== void 0) {
+      clauses.push("a.label = ?");
+      params.push(f.attachment.label);
+    }
+    if (f.attachment.fileId !== void 0) {
+      clauses.push("a.file_id = ?");
+      params.push(f.attachment.fileId);
+    }
+    conditions.push(hasAssociation("attachment", clauses));
   }
-  if (f.attachmentFileId) {
+  if (f.referencesFileId) {
     conditions.push(`(${hasAssociation("attachment", ["a.file_id = ?"])}
         OR r.id IN (SELECT ci.record_id FROM content_index ci WHERE ci.file_id = ?))`);
-    params.push(f.attachmentFileId, f.attachmentFileId);
+    params.push(f.referencesFileId, f.referencesFileId);
   }
   if (f.relatedTo) {
     const clauses = [];
@@ -478,11 +487,11 @@ var recordConditions = (query) => {
     }
     if (target) {
       clauses.push("a.related_scope = ?");
-      params.push(target.scope);
-      if (target.scope === "record") {
+      params.push(target.kind);
+      if (target.kind === "record") {
         clauses.push("a.related_ns = ?", "a.related_id = ?", "a.related_stack = ?");
         params.push("", target.recordId, target.stackUrl ?? "");
-      } else if (target.scope === "entity") {
+      } else if (target.kind === "entity") {
         clauses.push("a.related_ns = ?", "a.related_id = ?");
         params.push("", target.entityId);
       } else {
@@ -587,6 +596,10 @@ var buildQueryPlan = (query) => {
 
 // ../sqlite-shared/dist/mappers.js
 var toMs = (d) => d.getTime();
+var actorFromColumns = (subject, principal) => subject == null ? void 0 : {
+  subjectId: subject,
+  ...principal != null && { principalId: principal }
+};
 var fromMs = (ms) => new Date(ms);
 var partitionAssociations = (associations) => ({
   associations: associations.filter((a) => a.kind !== "permission" && a.kind !== "anyone"),
@@ -603,16 +616,14 @@ var rowToRecord = (row, associations) => {
   };
   if (row.parent_id != null)
     record.parentId = row.parent_id;
-  if (row.entity_id != null)
-    record.entityId = row.entity_id;
   if (row.app_id != null)
     record.appId = row.app_id;
-  if (row.principal_id != null)
-    record.principalId = row.principal_id;
-  if (row.updated_by != null)
-    record.updatedBy = row.updated_by;
-  if (row.updated_via != null)
-    record.updatedVia = row.updated_via;
+  const createdBy = actorFromColumns(row.entity_id, row.principal_id);
+  if (createdBy)
+    record.createdBy = createdBy;
+  const updatedBy = actorFromColumns(row.updated_by, row.updated_via);
+  if (updatedBy)
+    record.updatedBy = updatedBy;
   if (row.deleted_at != null)
     record.deletedAt = fromMs(row.deleted_at);
   if (row.unlisted_at != null)
@@ -661,31 +672,31 @@ var associationKeyColumns = (a) => {
     return [a.fileId, "", "", "", "", ""];
   if (a.kind === "permission") {
     const g = a.grantee;
-    return g.scope === "entity" ? ["", "entity", g.entityId, "", "", ""] : ["", "group", g.groupId, "", "", g.role];
+    return g.kind === "entity" ? ["", "entity", g.entityId, "", "", ""] : ["", "group", g.groupId, "", "", g.role];
   }
   if (a.kind !== "relationship")
     return ["", "", "", "", "", ""];
   const t = a.target;
-  if (t.scope === "entity")
+  if (t.kind === "entity")
     return ["", "entity", t.entityId, "", "", ""];
-  if (t.scope === "external")
+  if (t.kind === "external")
     return ["", "external", t.id, t.ns, "", ""];
   return ["", "record", t.recordId, "", t.stackUrl ?? "", ""];
 };
 var rowToGrantee = (row) => row.related_scope === "group" ? {
-  scope: "group",
+  kind: "group",
   groupId: row.related_id,
   role: row.related_role
-} : { scope: "entity", entityId: row.related_id };
+} : { kind: "entity", entityId: row.related_id };
 var rowToTarget = (row) => {
   const id = row.related_id;
   if (row.related_scope === "entity")
-    return { scope: "entity", entityId: id };
+    return { kind: "entity", entityId: id };
   if (row.related_scope === "external") {
-    return { scope: "external", ns: row.related_ns, id };
+    return { kind: "external", ns: row.related_ns, id };
   }
   const stackUrl = row.related_stack;
-  return { scope: "record", recordId: id, ...stackUrl && { stackUrl } };
+  return { kind: "record", recordId: id, ...stackUrl && { stackUrl } };
 };
 var rowToType = (row) => {
   const t = {
@@ -708,12 +719,12 @@ var rowToVersion = (row) => {
     content: JSON.parse(row.content),
     updatedAt: fromMs(row.updated_at)
   };
-  if (row.entity_id != null)
-    v.entityId = row.entity_id;
-  if (row.updated_by != null)
-    v.updatedBy = row.updated_by;
-  if (row.updated_via != null)
-    v.updatedVia = row.updated_via;
+  const createdBy = actorFromColumns(row.entity_id, row.principal_id);
+  if (createdBy)
+    v.createdBy = createdBy;
+  const updatedBy = actorFromColumns(row.updated_by, row.updated_via);
+  if (updatedBy)
+    v.updatedBy = updatedBy;
   return v;
 };
 var rowToJournalEntry = (row) => {
@@ -762,13 +773,13 @@ var readStackConfig = (exec) => {
     throw new Error("Stack database is missing its config record.");
   return config;
 };
-var asStackQueryError = (query, run) => {
+var asStackBadRequestError = (query, run) => {
   try {
     return run();
   } catch (err) {
     if (!query.filter?.search)
       throw err;
-    throw new StackQueryError(`Search text could not be parsed: ${err instanceof Error ? err.message : String(err)}`);
+    throw new StackBadRequestError(`Search text could not be parsed: ${err instanceof Error ? err.message : String(err)}`);
   }
 };
 var versionConflict = (id, expected, actual) => new StackVersionConflictError(`Record "${id}" is at version ${actual}, expected ${expected}`, id, expected, actual);
@@ -777,6 +788,7 @@ var VERSION_COLUMNS = [
   "content",
   "updated_at",
   "entity_id",
+  "principal_id",
   "updated_by",
   "updated_via"
 ];
@@ -784,9 +796,10 @@ var versionRowValues = (version) => [
   version.typeId,
   JSON.stringify(version.content),
   toMs(version.updatedAt),
-  version.entityId ?? null,
-  version.updatedBy ?? null,
-  version.updatedVia ?? null
+  version.createdBy?.subjectId ?? null,
+  version.createdBy?.principalId ?? null,
+  version.updatedBy?.subjectId ?? null,
+  version.updatedBy?.principalId ?? null
 ];
 var indexedFieldKinds = (schema) => {
   const kinds = /* @__PURE__ */ new Map();
@@ -815,7 +828,7 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
   /**
    * Precondition check for a mutation that has already read the record —
    * either because it can't fold the check into its own statement
-   * (hardDeleteRecord: children reference the row, so the DELETE can't
+   * (purgeRecord: children reference the row, so the DELETE can't
    * carry it), or because it has to settle the precondition *before*
    * fts5Strategy.remove() runs, which needs the records row still holding
    * the old content. In the latter case versionedUpdate() re-checks it
@@ -844,7 +857,7 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
   /**
    * The one shape every mutating UPDATE in this class has: whatever columns
    * the caller is changing, then the version bump and the actor/timestamp
-   * stamp that every mutation owes, gated on the opt-in `expectedVersion`
+   * stamp that every mutation owes, gated on the opt-in `ifVersion`
    * precondition and failing loudly when nothing matched.
    *
    * The guard rides in the WHERE clause even where the caller has already
@@ -853,17 +866,17 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
    * rather than silently overwritten.
    */
   versionedUpdate(id, sets, values, opts, now = toMs(/* @__PURE__ */ new Date())) {
-    const guarded = opts.expectedVersion !== void 0;
+    const guarded = opts.ifVersion !== void 0;
     const changed = this.exec.run(`UPDATE records SET ${[...sets, "version = version + 1", "updated_at = ?", "updated_by = ?", "updated_via = ?"].join(", ")} WHERE id = ?${guarded ? " AND version = ?" : ""}`, [
       ...values,
       now,
-      opts.updatedBy ?? null,
-      opts.updatedVia ?? null,
+      opts.actor?.subjectId ?? null,
+      opts.actor?.principalId ?? null,
       id,
-      ...guarded ? [opts.expectedVersion] : []
+      ...guarded ? [opts.ifVersion] : []
     ]);
     if (changed === 0)
-      this.throwVersionConflict(id, opts.expectedVersion);
+      this.throwVersionConflict(id, opts.ifVersion);
   }
   /**
    * Read a record back after its own mutation committed, for the caller to
@@ -912,11 +925,11 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
           JSON.stringify(record.content),
           record.version,
           record.parentId ?? null,
-          record.entityId ?? null,
+          record.createdBy?.subjectId ?? null,
           record.appId ?? null,
-          record.principalId ?? null,
-          record.updatedBy ?? null,
-          record.updatedVia ?? null,
+          record.createdBy?.principalId ?? null,
+          record.updatedBy?.subjectId ?? null,
+          record.updatedBy?.principalId ?? null,
           record.deletedAt ? toMs(record.deletedAt) : null,
           record.unlistedAt ? toMs(record.unlistedAt) : null
         ]);
@@ -969,13 +982,13 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
    * `associations`, `parentId` and/or `unlisted` — Stack computes this from
    * which ops the set actually moves. Such a write still lands its columns,
    * but leaves `version`, `updatedAt` and the actor stamps exactly as they
-   * stood and takes no snapshot. `expectedVersion`, if given, is re-checked
+   * stood and takes no snapshot. `ifVersion`, if given, is re-checked
    * synchronously inside the transaction — the CAS guard the bumping path
    * gets from its UPDATE's WHERE clause, restated as a read because the
    * UPDATE here carries no version predicate. See
    * docs/spec/versioning.md § Version history.
    *
-   * The expectedVersion check for a bumping write is standalone rather than
+   * The ifVersion check for a bumping write is standalone rather than
    * folded into the UPDATE alone, because a content change needs
    * fts.remove() to run *before* the records-table content changes. The
    * guard is still in the UPDATE's WHERE, so a writer that slipped in
@@ -985,7 +998,7 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
     const existing = await this.getRecord(id);
     if (!existing)
       throw new StackNotFoundError(`Record not found: "${id}"`);
-    this.checkExpectedVersion(existing, opts.expectedVersion);
+    this.checkExpectedVersion(existing, opts.ifVersion);
     const now = toMs(/* @__PURE__ */ new Date());
     const sets = [];
     const values = [];
@@ -1002,7 +1015,7 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
         const current = this.readRecord(id);
         if (!current)
           throw new StackNotFoundError(`Record not found: "${id}"`);
-        this.checkExpectedVersion(current, opts.expectedVersion);
+        this.checkExpectedVersion(current, opts.ifVersion);
         if (sets.length > 0) {
           this.exec.run(`UPDATE records SET ${sets.join(", ")} WHERE id = ?`, [...values, id]);
         }
@@ -1032,8 +1045,8 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
     return this.reread(id, "mutateRecord");
   }
   async deleteRecord(id, opts = {}) {
-    if (opts.hard) {
-      return this.exec.transaction(() => this.hardDeleteRecord(id, opts.expectedVersion));
+    if (opts.purge) {
+      return this.exec.transaction(() => this.purgeRecord(id, opts.ifVersion));
     }
     const now = toMs(/* @__PURE__ */ new Date());
     this.exec.transaction(() => {
@@ -1049,18 +1062,18 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
    * index rows, and row, returning the record as it stood — the last copy that will ever
    * exist, read here so that nothing can overtake it between the read and
    * the deletes. Null when there was no such record. No write() call —
-   * callers batch it. expectedVersion is checked first so a lost CAS race
+   * callers batch it. ifVersion is checked first so a lost CAS race
    * leaves nothing touched (children reference the row, so the check can't
    * fold into the final DELETE).
    */
-  hardDeleteRecord(id, expectedVersion) {
+  purgeRecord(id, ifVersion) {
     const purged = this.readRecord(id);
     if (!purged) {
-      if (expectedVersion !== void 0)
+      if (ifVersion !== void 0)
         throw new StackNotFoundError(`Record not found: "${id}"`);
       return null;
     }
-    this.checkExpectedVersion(purged, expectedVersion);
+    this.checkExpectedVersion(purged, ifVersion);
     fts5Strategy.remove(this.exec, id);
     this.exec.run("DELETE FROM associations WHERE record_id = ?", [id]);
     this.exec.run("DELETE FROM versions WHERE record_id = ?", [id]);
@@ -1082,7 +1095,7 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
     const existing = await this.getRecord(id);
     if (!existing)
       throw new StackNotFoundError(`Record not found: "${id}"`);
-    this.checkExpectedVersion(existing, opts.expectedVersion);
+    this.checkExpectedVersion(existing, opts.ifVersion);
     const target = await this.getVersion(id, version);
     if (!target)
       throw new StackNotFoundError(`Version not found: "${id}"@${version}`);
@@ -1098,7 +1111,7 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
     const existing = await this.getRecord(id);
     if (!existing)
       throw new StackNotFoundError(`Record not found: "${id}"`);
-    this.checkExpectedVersion(existing, opts.expectedVersion);
+    this.checkExpectedVersion(existing, opts.ifVersion);
     this.exec.transaction(() => {
       if (opts.snapshot)
         this.snapshotBeforeMutation(id, opts.snapshot);
@@ -1133,7 +1146,7 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
       if (budget <= 0)
         break;
       const statement2 = atBudget(page2, budget);
-      rows.push(...asStackQueryError(query, () => this.exec.all(statement2.sql, statement2.params)));
+      rows.push(...asStackBadRequestError(query, () => this.exec.all(statement2.sql, statement2.params)));
     }
     const hasMore = rows.length > limit;
     const page = hasMore ? rows.slice(0, limit) : rows;
@@ -1146,7 +1159,7 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
     return { records, cursor };
   }
   /**
-   * Atomically verify fileId is unreferenced, then hard-delete its
+   * Atomically verify fileId is unreferenced, then purge its
    * metadata records across every typeId in `metadataTypeIds` (see
    * deleteUnreferencedAttachmentRecords on the adapter contract). A real
    * SQL transaction of synchronous calls — no `await` between the check
@@ -1168,7 +1181,7 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
          WHERE type_id IN (${placeholders}) AND json_extract(content, '$.fileId') = ?`, [...metadataTypeIds, fileId]);
       const deleted = [];
       for (const row of metaRows) {
-        const purged = this.hardDeleteRecord(row.id);
+        const purged = this.purgeRecord(row.id);
         if (purged)
           deleted.push(purged);
       }
@@ -1290,9 +1303,9 @@ var SharedSqlRecordLogic = class _SharedSqlRecordLogic {
     }
     const conditions = ["record_id = ?"];
     const values = [id];
-    if (query.sinceSeq !== void 0) {
+    if (query.afterSeq !== void 0) {
       conditions.push("seq > ?");
-      values.push(query.sinceSeq);
+      values.push(query.afterSeq);
     }
     const rows = this.exec.all(`SELECT * FROM journal WHERE ${conditions.join(" AND ")} ORDER BY seq ASC${query.limit !== void 0 ? " LIMIT ?" : ""}`, query.limit !== void 0 ? [...values, query.limit] : values);
     return rows.map(rowToJournalEntry);
@@ -1612,17 +1625,17 @@ var SharedTokenLogic = class {
   get exec() {
     return this.deps.exec;
   }
-  async createToken(principalId, opts = {}) {
+  async createToken(actor, opts = {}) {
     const id = randomBytes(8).toString("hex");
     const token = randomBytes(32).toString("hex");
     const tokenHash = hashToken(token);
     this.exec.run("INSERT INTO tokens (id, token_hash, principal_id, subject_id, label, created_at, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?)", [
       id,
       tokenHash,
-      principalId,
       // Stored rather than left null for an undelegated token, so a
       // reader never has to know which column stands in for the other.
-      opts.onBehalfOf ?? principalId,
+      actor.principalId ?? actor.subjectId,
+      actor.subjectId,
       opts.label ?? null,
       toMs(/* @__PURE__ */ new Date()),
       opts.expiresAt ? toMs(opts.expiresAt) : null
@@ -1705,8 +1718,8 @@ var NativeTokenStore = class _NativeTokenStore {
     store.tokens = new SharedTokenLogic({ exec: new NativeSqliteExecutor(store.db) });
     return store;
   }
-  createToken(principalId, opts) {
-    return this.tokens.createToken(principalId, opts);
+  createToken(actor, opts) {
+    return this.tokens.createToken(actor, opts);
   }
   lookupToken(token) {
     return this.tokens.lookupToken(token);
@@ -1756,7 +1769,7 @@ var NativeSQLiteRecordAdapter = class _NativeSQLiteRecordAdapter extends SharedS
       );
     }
     const [db, exec] = _NativeSQLiteRecordAdapter.attach(opts.path, opts.force);
-    const config = insertConfigRecord(exec, opts.entityId, opts.timezone);
+    const config = insertConfigRecord(exec, opts.ownerEntityId, opts.timezone);
     return new _NativeSQLiteRecordAdapter(opts.path, db, exec, config);
   }
   /**