@haverstack/record-adapter-sqlite 0.34.0 → 0.35.0

package/dist/index.js

@@ -1,6 +1,6 @@
 import { existsSync, writeFileSync, unlinkSync, readFileSync } from 'fs';
-import { StackConflictError, applyMergePatch, StackNotFoundError, assertOneSurface, StackVersionConflictError, StackBadRequestError, NATIVE_SORT_FIELDS } from '@haverstack/core';
-import { OwnerMismatchError, AUTHORITY_ASSOCIATION_KINDS, contentSortEntry, partitionAssociations, constantSortEntry, contentSortKey, parseContentFilterKey } from '@haverstack/core/adapter';
+import { StackConflictError, applyMergePatch, StackNotFoundError, StackVersionConflictError, StackBadRequestError, NATIVE_SORT_FIELDS } from '@haverstack/core';
+import { OwnerMismatchError, softDeletedRefusal, sameAssociationSet, ElementSetMovedError, contentSortEntry, constantSortEntry, contentSortKey, parseContentFilterKey } from '@haverstack/core/adapter';
 import { randomBytes, createHash } from 'crypto';
 
 // src/node-sqlite.ts
@@ -27,34 +27,43 @@ var RECORD_SCHEMA_SQL = `
     unlisted_at INTEGER
   ) STRICT;
 
-  -- Every edge a record carries, authority and data alike: a permission
-  -- has element identity and a delta shaped like a tag's, so it earns the
-  -- same table. The permissions and associations fields are projections
-  -- over it, partitioned by kind.
-  -- See docs/spec/access-control.md \xA7 Record-level permissions.
+  -- A record's data associations: tags, attachments and relationships.
+  -- Its permissions are in their own table below, so no predicate over this
+  -- one can match a grantee as a relationship target.
   CREATE TABLE IF NOT EXISTS associations (
     record_id     TEXT NOT NULL REFERENCES records(id),
-    kind          TEXT NOT NULL CHECK (kind IN ('tag', 'attachment', 'relationship', 'permission', 'anyone')),
+    kind          TEXT NOT NULL CHECK (kind IN ('tag', 'attachment', 'relationship')),
     label         TEXT NOT NULL,
     file_id       TEXT NOT NULL DEFAULT '',
     -- A relationship target is (related_scope, related_id) qualified by
-    -- related_ns (a foreign namespace) or related_stack (another stack); a
-    -- permission's grantee reuses scope and id. All are in the key, so
-    -- targets differing only by a qualifier are distinct associations.
-    related_scope TEXT NOT NULL DEFAULT '' CHECK (related_scope IN ('', 'record', 'entity', 'external', 'group')),
+    -- related_ns (a foreign namespace) or related_stack (another stack).
+    -- All are in the key, so targets differing only by a qualifier are
+    -- distinct associations.
+    related_scope TEXT NOT NULL DEFAULT '' CHECK (related_scope IN ('', 'record', 'entity', 'external')),
     related_id    TEXT NOT NULL DEFAULT '',
     related_ns    TEXT NOT NULL DEFAULT '',
     related_stack TEXT NOT NULL DEFAULT '',
-    -- Set only by a group grantee; in the key because member and admin name
-    -- two different sets of people.
-    related_role  TEXT NOT NULL DEFAULT '' CHECK (related_role IN ('', 'member', 'admin')),
     -- Out of the key: it annotates a reference rather than naming one, so
     -- re-pointing it updates the existing row. See docs/spec/attachments.md
     -- \xA7 Naming the upload a reference came from.
     attachment_record_id TEXT NOT NULL DEFAULT '',
     -- Leads with record_id, so its implicit index serves every by-record
     -- read and delete; the indexes below cover only the filter directions.
-    PRIMARY KEY (record_id, kind, label, file_id, related_scope, related_id, related_ns, related_stack, related_role)
+    PRIMARY KEY (record_id, kind, label, file_id, related_scope, related_id, related_ns, related_stack)
+  ) STRICT;
+
+  -- Who reaches a record, one row per element. An 'anyone' row names no
+  -- grantee; a group grantee's role is in the key, because member and
+  -- admin name two different sets of people.
+  -- See docs/spec/access-control.md \xA7 Record-level permissions.
+  CREATE TABLE IF NOT EXISTS permissions (
+    record_id    TEXT NOT NULL REFERENCES records(id),
+    kind         TEXT NOT NULL CHECK (kind IN ('permission', 'anyone')),
+    label        TEXT NOT NULL CHECK (label IN ('read', 'write')),
+    grantee_kind TEXT NOT NULL DEFAULT '' CHECK (grantee_kind IN ('', 'entity', 'group')),
+    grantee_id   TEXT NOT NULL DEFAULT '',
+    role         TEXT NOT NULL DEFAULT '' CHECK (role IN ('', 'member', 'admin')),
+    PRIMARY KEY (record_id, kind, label, grantee_kind, grantee_id, role)
   ) STRICT;
 
   -- Content and the type it is read under. No parent_id, unlisted_at or
@@ -156,6 +165,11 @@ var RECORD_SCHEMA_SQL = `
   CREATE INDEX IF NOT EXISTS idx_assoc_related      ON associations(kind, related_scope, related_ns, related_id, record_id);
   CREATE INDEX IF NOT EXISTS idx_types_base_id      ON types(base_id, version);
 
+  -- The permissions key with record_id moved last, so a scoped query reads
+  -- the records carrying an element straight out of the index.
+  CREATE INDEX IF NOT EXISTS idx_permissions_element
+    ON permissions(kind, label, grantee_kind, grantee_id, role, record_id);
+
   -- The whole content ordering, in index order, for one field at a time:
   -- a content-sorted page is an ordered walk of a slice of this index.
   CREATE INDEX IF NOT EXISTS idx_content_index_sort
@@ -346,24 +360,22 @@ var decodeCursor = (cursor) => {
   throw malformed();
 };
 var byTypeDescriptor = (byType) => JSON.stringify(Object.entries(byType).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0));
-var getSortField = (query) => query.sort?.field ?? "createdAt";
 var getSortColumn = (field) => field === "createdAt" ? "created_at" : field === "updatedAt" ? "updated_at" : "version";
-var makeCursor = (record, sort, kindOf) => {
-  const byType = sort?.contentFieldByType;
+var makeCursor = (record, sort, kindOf2) => {
+  const byType = sort.contentFieldByType;
   if (byType) {
-    const field = byTypeDescriptor(byType);
+    const field2 = byTypeDescriptor(byType);
     const key = Object.hasOwn(byType, record.typeId) ? byType[record.typeId] : void 0;
-    const kind2 = key?.field === void 0 ? void 0 : kindOf?.(record, key.field);
+    const kind2 = key?.field === void 0 ? void 0 : kindOf2?.(record, key.field);
     const entry2 = key?.field !== void 0 ? kind2 && contentSortEntry(kind2, record.content[key.field]) : key && constantSortEntry(key.value ?? null);
-    return encodeEntry(field, entry2 || null, record.id);
+    return encodeEntry(field2, entry2 || null, record.id);
   }
-  const contentField = sort?.contentField;
-  if (contentField === void 0) {
-    const field = getSortField({ sort });
+  const { contentField, field } = sort;
+  if (field !== void 0) {
     const value = field === "updatedAt" ? record.updatedAt.getTime() : field === "version" ? record.version : record.createdAt.getTime();
     return encodeCursor({ kind: "native", field, value, id: record.id });
   }
-  const kind = kindOf?.(record, contentField);
+  const kind = kindOf2?.(record, contentField);
   const entry = kind ? contentSortEntry(kind, record.content[contentField]) : null;
   return encodeEntry(contentField, entry, record.id);
 };
@@ -373,38 +385,182 @@ var encodeEntry = (field, entry, id) => {
   return entry.kind === "num" ? encodeCursor({ kind: "num", field, value: entry.num, id }) : encodeCursor({ kind: "text", field, value: entry.text, id });
 };
 
+// ../sqlite-shared/dist/mappers.js
+var toMs = (d) => d.getTime();
+var actorFromColumns = (subject, principal) => subject == null ? void 0 : {
+  subjectId: subject,
+  ...principal != null && { principalId: principal }
+};
+var fromMs = (ms) => new Date(ms);
+var rowToRecord = (row, associations, permissions) => {
+  const record = {
+    id: row.id,
+    typeId: row.type_id,
+    createdAt: fromMs(row.created_at),
+    updatedAt: fromMs(row.updated_at),
+    content: JSON.parse(row.content),
+    version: row.version
+  };
+  if (row.parent_id != null)
+    record.parentId = row.parent_id;
+  if (row.app_id != null)
+    record.appId = row.app_id;
+  const createdBy = actorFromColumns(row.entity_id, row.principal_id);
+  if (createdBy)
+    record.createdBy = createdBy;
+  const updatedBy = actorFromColumns(row.updated_by, row.updated_via);
+  if (updatedBy)
+    record.updatedBy = updatedBy;
+  if (row.deleted_at != null)
+    record.deletedAt = fromMs(row.deleted_at);
+  if (row.unlisted_at != null)
+    record.unlistedAt = fromMs(row.unlisted_at);
+  if (associations.length)
+    record.associations = associations;
+  if (permissions.length)
+    record.permissions = permissions;
+  return record;
+};
+var rowToAssociation = (row) => {
+  if (row.kind === "tag") {
+    return { kind: "tag", label: row.label };
+  }
+  if (row.kind === "attachment") {
+    const attachmentRecordId = row.attachment_record_id;
+    return {
+      kind: "attachment",
+      label: row.label,
+      fileId: row.file_id,
+      // Stored as '' when absent, like every other optional column here —
+      // the field is omitted rather than served empty, so a round trip
+      // produces the association the caller wrote.
+      ...attachmentRecordId && { attachmentRecordId }
+    };
+  }
+  return {
+    kind: "relationship",
+    label: row.label,
+    target: rowToTarget(row)
+  };
+};
+var associationKeyColumns = (a) => {
+  if (a.kind === "attachment")
+    return [a.fileId, "", "", "", ""];
+  if (a.kind !== "relationship")
+    return ["", "", "", "", ""];
+  const t = a.target;
+  if (t.kind === "entity")
+    return ["", "entity", t.entityId, "", ""];
+  if (t.kind === "external")
+    return ["", "external", t.id, t.ns, ""];
+  return ["", "record", t.recordId, "", t.stackUrl ?? ""];
+};
+var permissionKeyColumns = (p) => {
+  if (p.kind === "anyone")
+    return ["", "", ""];
+  const g = p.grantee;
+  return g.kind === "entity" ? ["entity", g.entityId, ""] : ["group", g.groupId, g.role];
+};
+var rowToPermission = (row) => {
+  if (row.kind === "anyone")
+    return { kind: "anyone", label: "read" };
+  const id = row.grantee_id;
+  return {
+    kind: "permission",
+    label: row.label,
+    grantee: row.grantee_kind === "group" ? { kind: "group", groupId: id, role: row.role } : { kind: "entity", entityId: id }
+  };
+};
+var rowToTarget = (row) => {
+  const id = row.related_id;
+  if (row.related_scope === "entity")
+    return { kind: "entity", entityId: id };
+  if (row.related_scope === "external") {
+    return { kind: "external", ns: row.related_ns, id };
+  }
+  const stackUrl = row.related_stack;
+  return { kind: "record", recordId: id, ...stackUrl && { stackUrl } };
+};
+var rowToType = (row) => {
+  const t = {
+    id: row.id,
+    baseId: row.base_id,
+    version: row.version,
+    name: row.name,
+    schema: JSON.parse(row.schema),
+    schemaHash: row.schema_hash,
+    createdAt: fromMs(row.created_at)
+  };
+  if (row.migrates_from)
+    t.migratesFrom = row.migrates_from;
+  return t;
+};
+var rowToVersion = (row) => {
+  const v = {
+    version: row.version,
+    typeId: row.type_id,
+    content: JSON.parse(row.content),
+    updatedAt: fromMs(row.updated_at)
+  };
+  const createdBy = actorFromColumns(row.entity_id, row.principal_id);
+  if (createdBy)
+    v.createdBy = createdBy;
+  const updatedBy = actorFromColumns(row.updated_by, row.updated_via);
+  if (updatedBy)
+    v.updatedBy = updatedBy;
+  return v;
+};
+var rowToJournalEntry = (row) => {
+  const e = {
+    seq: row.seq,
+    at: fromMs(row.at),
+    kind: row.kind,
+    ops: JSON.parse(row.ops),
+    version: row.version,
+    typeId: row.type_id
+  };
+  if (row.parent_id != null)
+    e.parentId = row.parent_id;
+  if (row.previous_parent_id != null) {
+    e.previousParentId = row.previous_parent_id === "" ? null : row.previous_parent_id;
+  }
+  if (row.actor != null)
+    e.actor = JSON.parse(row.actor);
+  if (row.associations != null)
+    e.associations = JSON.parse(row.associations);
+  return e;
+};
+
 // ../sqlite-shared/dist/query.js
-var atBudget = (page, rows) => ({
+var atBudget = (page, rows2) => ({
   sql: page.sql,
-  params: [...page.params, rows]
+  params: [...page.params, rows2]
 });
-var sqlDirection = (query) => {
-  const dir = query.sort ? query.sort.direction : "desc";
-  if (dir !== "asc" && dir !== "desc") {
-    throw new StackBadRequestError(`Invalid sort direction "${dir}": expected "asc" or "desc".`);
-  }
-  return dir === "asc" ? "ASC" : "DESC";
+var sqlDirection = (query) => query.sort.direction === "asc" ? "ASC" : "DESC";
+var spread = (alias) => `CASE ${alias}.type WHEN 'array' THEN ${alias}.value WHEN 'object' THEN json_array(json(${alias}.value)) WHEN 'true' THEN '[true]' WHEN 'false' THEN '[false]' ELSE json_array(${alias}.value) END`;
+var members = (alias) => `CASE WHEN ${alias}.t = 'object' THEN ${alias}.v ELSE '{}' END`;
+var emptyStatement = () => ({
+  tables: [],
+  tableParams: [],
+  conditions: ["r.id != '_config'"],
+  params: []
+});
+var rows = (s, columns, tuples) => {
+  const name = `t${s.tables.length}`;
+  s.tables.push(`${name} AS MATERIALIZED ${rowsTable(columns)}`);
+  s.tableParams.push(JSON.stringify(tuples));
+  return name;
+};
+var rowsTable = (columns) => {
+  const named = columns.map((column, i) => `json_extract(value, '$[${i}]') AS ${column}`);
+  return `(SELECT ${named.join(", ")} FROM json_each(?))`;
 };
-var spread = (alias) => `CASE WHEN ${alias}.type = 'array' THEN ${alias}.value WHEN ${alias}.type = 'object' THEN json_array(json(${alias}.value)) ELSE json_array(${alias}.value) END`;
-var members = (alias) => `CASE WHEN ${alias}.type = 'object' THEN ${alias}.value ELSE '{}' END`;
-var contentPathExists = (segments, leaf, params, nextAlias) => {
-  let key = nextAlias();
-  let value = nextAlias();
-  const from = [`json_each(r.content) AS ${key}`, `json_each(${spread(key)}) AS ${value}`];
-  const where = [`${key}.key = ?`];
-  params.push(segments[0]);
-  for (const segment of segments.slice(1)) {
-    key = nextAlias();
-    from.push(`json_each(${members(value)}) AS ${key}`);
-    value = nextAlias();
-    from.push(`json_each(${spread(key)}) AS ${value}`);
-    where.push(`${key}.key = ?`);
-    params.push(segment);
-  }
-  where.push(leaf(value));
-  return `EXISTS (SELECT 1 FROM ${from.join(", ")} WHERE ${where.join(" AND ")})`;
+var CONDITION_COLUMNS = ["scope", "path", "op", "val", "kind"];
+var kindOf = (type) => `CASE ${type} WHEN 'integer' THEN 'number' WHEN 'real' THEN 'number' ELSE ${type} END`;
+var holds = (c, r) => {
+  const depth = `json_array_length(${c}.path)`;
+  return `(WITH RECURSIVE w(d, v, t) AS (SELECT 0, ${r}.content, 'object' UNION ALL SELECT w.d + 1, e.value, e.type FROM w JOIN json_each(${members("w")}) m JOIN json_each(${spread("m")}) e WHERE w.d < ${depth} AND m.key = json_extract(${c}.path, '$[' || w.d || ']')) SELECT CASE ${c}.op WHEN 'equals' THEN IFNULL(MAX(${kindOf("w.t")} = ${c}.kind AND w.v = ${c}.val), 0) WHEN 'present' THEN IFNULL(MAX(w.t != 'null'), 0) WHEN 'isNull' THEN IFNULL(MAX(w.t = 'null'), 0) OR NOT IFNULL(MAX(w.t != 'null'), 0) END FROM w WHERE w.d = ${depth})`;
 };
-var equalsLeaf = (alias) => `${alias}.type NOT IN ('object', 'array') AND ${alias}.value = ?`;
 var SORT_ALIAS = "cs";
 var cursorMismatch = (cursor, field) => new StackBadRequestError(`Cursor sort field "${cursor.field}" does not match query sort field "${field}"`);
 var nativeCursor = (cursor, field) => {
@@ -417,37 +573,77 @@ var contentCursor = (cursor, field) => {
     throw cursorMismatch(cursor, field);
   return cursor;
 };
-var contentConditions = (predicate, params, nextAlias) => {
-  const conditions = [];
-  for (const [key, value] of Object.entries(predicate.content ?? {})) {
-    const segments = parseContentFilterKey(key);
-    if (value === null || value === void 0) {
-      const isNull = contentPathExists(segments, (a) => `${a}.value IS NULL`, params, nextAlias);
-      const anyValue = contentPathExists(segments, (a) => `${a}.value IS NOT NULL`, params, nextAlias);
-      conditions.push(`(${isNull} OR NOT ${anyValue})`);
-    } else {
-      const match = contentPathExists(segments, equalsLeaf, params, nextAlias);
-      params.push(value);
-      conditions.push(match);
-    }
+var valueKind = (value) => {
+  if (typeof value === "boolean")
+    return `${value}`;
+  if (typeof value === "number")
+    return "number";
+  return typeof value === "string" ? "text" : null;
+};
+var contentRows = (scope, predicate) => {
+  const row = (key, op, value = null) => {
+    const path = parseContentFilterKey(key);
+    return [scope, path, op, value, valueKind(value)];
+  };
+  return [
+    ...Object.entries(predicate.content ?? {}).map(([key, value]) => (
+      // undefined is the same absence null names — JSON drops it on the way
+      // over the wire, so treating it as a value would make an in-process
+      // query and its wire equivalent disagree.
+      value === null || value === void 0 ? row(key, "isNull") : row(key, "equals", value)
+    )),
+    ...(predicate.contentPresent ?? []).map((key) => row(key, "present"))
+  ];
+};
+var inList = (s, column, values) => {
+  if (values.length === 1) {
+    s.params.push(values[0]);
+    return `${column} = ?`;
   }
-  for (const key of predicate.contentPresent ?? []) {
-    conditions.push(contentPathExists(parseContentFilterKey(key), (a) => `${a}.value IS NOT NULL`, params, nextAlias));
+  const table = rows(s, ["value"], values.map((value) => [value]));
+  return `${column} IN (SELECT value FROM ${table})`;
+};
+var familyRange = (baseId) => [`${baseId}@`, `${baseId}A`];
+var withinFamily = (column, lo, hi) => `(${column} >= ${lo} AND ${column} < ${hi})`;
+var inFamily = (column, baseId) => ({
+  sql: withinFamily(column, "?", "?"),
+  params: familyRange(baseId)
+});
+var inFamilies = (s, record, baseIds) => {
+  if (baseIds.length === 1) {
+    const one = inFamily(`${record}.type_id`, baseIds[0]);
+    s.params.push(...one.params);
+    return one.sql;
+  }
+  const table = rows(s, ["lo", "hi"], baseIds.map(familyRange));
+  return `${record}.id IN (SELECT fr.id FROM ${table} f JOIN records fr ON ${withinFamily("fr.type_id", "f.lo", "f.hi")})`;
+};
+var carriesPermissions = (s, sets) => {
+  const elements = rows(s, ["set_index", "set_size", "kind", "label", "grantee_kind", "grantee_id", "role"], sets.flatMap((set, i) => set.map((p) => [i, set.length, p.kind, p.label, ...permissionKeyColumns(p)])));
+  return `r.id IN (SELECT p.record_id FROM ${elements} e JOIN permissions p ON p.kind = e.kind AND p.label = e.label AND p.grantee_kind = e.grantee_kind AND p.grantee_id = e.grantee_id AND p.role = e.role GROUP BY p.record_id, e.set_index HAVING COUNT(*) = MAX(e.set_size))`;
+};
+var reachConditions = (s, reach) => {
+  if (reach.fence)
+    s.conditions.push(inFamilies(s, "r", reach.fence));
+  const within = reach.within;
+  if (within) {
+    const arms = [inFamilies(s, "r", within.baseIds)];
+    if (within.authored) {
+      s.params.push(within.authored.subjectId);
+      arms.push(`(r.entity_id = ? AND ${inFamilies(s, "r", within.authored.baseIds)})`);
+    }
+    arms.push(carriesPermissions(s, within.permissions));
+    s.conditions.push(`(${arms.join(" OR ")})`);
   }
-  return conditions;
 };
-var recordConditions = (query) => {
-  const conditions = ["r.id != '_config'"];
-  const params = [];
+var recordConditions = (query, reach) => {
+  const s = emptyStatement();
+  const { conditions, params } = s;
   const f = query.filter ?? {};
-  let aliasSeq = 0;
-  const nextContentAlias = () => `cp${aliasSeq++}`;
   const inFilter = (column, value) => {
     if (value === void 0)
       return;
-    const values = Array.isArray(value) ? value : [value];
-    conditions.push(`r.${column} IN (${values.map(() => "?").join(",")})`);
-    params.push(...values);
+    conditions.push(inList(s, `r.${column}`, Array.isArray(value) ? value : [value]));
   };
   const rangeFilter = (column, range) => {
     if (range?.after) {
@@ -465,7 +661,12 @@ var recordConditions = (query) => {
   if (!f.includeUnlisted) {
     conditions.push("r.unlisted_at IS NULL");
   }
+  if (reach)
+    reachConditions(s, reach);
   inFilter("type_id", f.typeId);
+  if (f.baseId !== void 0) {
+    conditions.push(inFamilies(s, "r", Array.isArray(f.baseId) ? f.baseId : [f.baseId]));
+  }
   if (f.parentId !== void 0) {
     if (f.parentId === null) {
       conditions.push("r.parent_id IS NULL");
@@ -481,10 +682,10 @@ var recordConditions = (query) => {
   rangeFilter("updated_at", f.updatedAt);
   const hasAssociation = (kind, clauses) => `r.id IN (SELECT a.record_id FROM associations a WHERE a.kind = '${kind}'` + clauses.map((c) => ` AND ${c}`).join("") + `)`;
   if (f.tags?.length) {
-    for (const tag of f.tags) {
-      conditions.push(hasAssociation("tag", ["a.label = ?"]));
-      params.push(tag);
-    }
+    const tags = [...new Set(f.tags)];
+    const label = inList(s, "a.label", tags);
+    conditions.push(`r.id IN (SELECT a.record_id FROM associations a WHERE a.kind = 'tag' AND ${label} GROUP BY a.record_id HAVING COUNT(DISTINCT a.label) = ?)`);
+    params.push(tags.length);
   }
   if (f.attachment) {
     const clauses = [];
@@ -530,15 +731,17 @@ var recordConditions = (query) => {
     }
     conditions.push(hasAssociation("relationship", clauses));
   }
-  if (f.content || f.contentPresent?.length) {
-    conditions.push(...contentConditions(f, params, nextContentAlias));
-  }
+  const content = contentRows(null, f);
   if (f.contentByType) {
-    const arms = Object.entries(f.contentByType).map(([typeId, arm]) => {
-      params.push(typeId);
-      return ["r.type_id = ?", ...contentConditions(arm, params, nextContentAlias)].join(" AND ");
-    });
-    conditions.push(`(${arms.map((arm) => `(${arm})`).join(" OR ")})`);
+    const arms = Object.entries(f.contentByType);
+    const typeIds = arms.map(([typeId]) => typeId);
+    conditions.push(inList(s, "r.type_id", typeIds));
+    for (const [typeId, arm] of arms)
+      content.push(...contentRows(typeId, arm));
+  }
+  if (content.length > 0) {
+    const table = rows(s, CONDITION_COLUMNS, content);
+    conditions.push(`NOT EXISTS (SELECT 1 FROM ${table} c WHERE (c.scope IS NULL OR c.scope = r.type_id) AND NOT ${holds("c", "r")})`);
   }
   if (f.search) {
     const sanitized = sanitizeFts5Query(f.search);
@@ -549,7 +752,7 @@ var recordConditions = (query) => {
       conditions.push("0");
     }
   }
-  return { conditions, params };
+  return s;
 };
 var presentCursorCondition = (cursor, op, params) => {
   if (cursor.kind === "num") {
@@ -560,56 +763,54 @@ var presentCursorCondition = (cursor, op, params) => {
   params.push(key, key, cursor.value, cursor.value, cursor.id);
   return `(${SORT_ALIAS}.value_rank ${op} 1 OR (${SORT_ALIAS}.value_rank = 1 AND (${SORT_ALIAS}.text_key ${op} ? OR (${SORT_ALIAS}.text_key = ? AND (${SORT_ALIAS}.text_value ${op} ? OR (${SORT_ALIAS}.text_value = ? AND ${SORT_ALIAS}.record_id ${op} ?))))))`;
 };
-var statement = (select, from, conditions, params, tail = "") => ({
-  sql: `SELECT ${select} FROM ${from} WHERE ${conditions.join(" AND ")}${tail}`,
-  params
-});
-var buildQueryPlan = (query) => {
+var statement = (s, from, tail) => {
+  const select = `SELECT r.* FROM ${from} WHERE ${s.conditions.join(" AND ")}${tail}`;
+  const sql = s.tables.length === 0 ? select : `WITH ${s.tables.join(", ")} ${select}`;
+  return { sql, params: [...s.tableParams, ...s.params] };
+};
+var buildQueryPlan = (query, reach) => {
   const dir = sqlDirection(query);
   const op = dir === "ASC" ? ">" : "<";
   const decoded = query.cursor ? decodeCursor(query.cursor) : null;
-  if (query.sort?.contentFieldByType) {
-    return byTypePlan(query, query.sort.contentFieldByType, dir, op, decoded);
+  if (query.sort.contentFieldByType) {
+    return byTypePlan(query, reach, query.sort.contentFieldByType, dir, op, decoded);
   }
-  const contentField = query.sort?.contentField;
-  if (contentField === void 0) {
-    const { conditions, params } = recordConditions(query);
-    const field = getSortField(query);
+  const { contentField, field } = query.sort;
+  if (field !== void 0) {
+    const where = recordConditions(query, reach);
     const col = getSortColumn(field);
     if (decoded) {
       const cursor2 = nativeCursor(decoded, field);
-      conditions.push(`(r.${col} ${op} ? OR (r.${col} = ? AND r.id ${op} ?))`);
-      params.push(cursor2.value, cursor2.value, cursor2.id);
+      where.conditions.push(`(r.${col} ${op} ? OR (r.${col} = ? AND r.id ${op} ?))`);
+      where.params.push(cursor2.value, cursor2.value, cursor2.id);
     }
-    return [
-      statement("r.*", "records r", conditions, params, ` ORDER BY r.${col} ${dir}, r.id ${dir} LIMIT ?`)
-    ];
+    return [statement(where, "records r", ` ORDER BY r.${col} ${dir}, r.id ${dir} LIMIT ?`)];
   }
   const cursor = decoded ? contentCursor(decoded, contentField) : null;
   const pages = [];
   if (cursor?.kind !== "absent") {
-    const { conditions, params } = recordConditions(query);
+    const where = recordConditions(query, reach);
     const from = `content_index ${SORT_ALIAS} JOIN records r ON r.id = ${SORT_ALIAS}.record_id`;
-    conditions.push(`${SORT_ALIAS}.field = ?`);
-    params.push(contentField);
+    where.conditions.push(`${SORT_ALIAS}.field = ?`);
+    where.params.push(contentField);
     if (cursor)
-      conditions.push(presentCursorCondition(cursor, op, params));
+      where.conditions.push(presentCursorCondition(cursor, op, where.params));
     const order = `${SORT_ALIAS}.value_rank ${dir}, ${SORT_ALIAS}.num_value ${dir}, ${SORT_ALIAS}.text_key ${dir}, ${SORT_ALIAS}.text_value ${dir}, ${SORT_ALIAS}.record_id ${dir}`;
-    pages.push(statement("r.*", from, conditions, params, ` ORDER BY ${order} LIMIT ?`));
+    pages.push(statement(where, from, ` ORDER BY ${order} LIMIT ?`));
   }
   {
-    const { conditions, params } = recordConditions(query);
-    conditions.push(`NOT EXISTS (SELECT 1 FROM content_index ${SORT_ALIAS} WHERE ${SORT_ALIAS}.record_id = r.id AND ${SORT_ALIAS}.field = ?)`);
-    params.push(contentField);
+    const where = recordConditions(query, reach);
+    where.conditions.push(`NOT EXISTS (SELECT 1 FROM content_index ${SORT_ALIAS} WHERE ${SORT_ALIAS}.record_id = r.id AND ${SORT_ALIAS}.field = ?)`);
+    where.params.push(contentField);
     if (cursor?.kind === "absent") {
-      conditions.push(`r.id ${op} ?`);
-      params.push(cursor.id);
+      where.conditions.push(`r.id ${op} ?`);
+      where.params.push(cursor.id);
     }
-    pages.push(statement("r.*", "records r", conditions, params, ` ORDER BY r.id ${dir} LIMIT ?`));
+    pages.push(statement(where, "records r", ` ORDER BY r.id ${dir} LIMIT ?`));
   }
   return pages;
 };
-var byTypePlan = (query, byType, dir, op, decoded) => {
+var byTypePlan = (query, reach, byType, dir, op, decoded) => {
   const cursor = decoded ? contentCursor(decoded, byTypeDescriptor(byType)) : null;
   const fields = [];
   const constants = [];
@@ -623,42 +824,38 @@ var byTypePlan = (query, byType, dir, op, decoded) => {
       constants.push([typeId, entry]);
   }
   const pages = [];
-  const fieldOf = (alias, record) => fields.map(() => `(${record}.type_id = ? AND ${alias}.field = ?)`).join(" OR ");
   if (cursor?.kind !== "absent" && fields.length + constants.length > 0) {
+    const where = recordConditions(query, reach);
     const sources = [];
-    const sourceParams = [];
     if (fields.length > 0) {
-      sources.push(`SELECT c.record_id AS record_id, c.value_rank AS value_rank, c.num_value AS num_value, c.text_key AS text_key, c.text_value AS text_value FROM content_index c JOIN records t ON t.id = c.record_id WHERE ${fieldOf("c", "t")}`);
-      for (const [typeId, field] of fields)
-        sourceParams.push(typeId, field);
+      const byField = rows(where, ["type_id", "field"], fields);
+      sources.push(`SELECT ci.record_id AS record_id, ci.value_rank AS value_rank, ci.num_value AS num_value, ci.text_key AS text_key, ci.text_value AS text_value FROM ${byField} f JOIN content_index ci ON ci.field = f.field JOIN records t ON t.id = ci.record_id AND t.type_id = f.type_id`);
     }
-    for (const [typeId, entry] of constants) {
-      sources.push("SELECT t.id AS record_id, ? AS value_rank, ? AS num_value, ? AS text_key, ? AS text_value FROM records t WHERE t.type_id = ?");
-      sourceParams.push(...entry.kind === "num" ? [0, entry.num, null, null] : [1, null, entry.key, entry.text], typeId);
+    if (constants.length > 0) {
+      const byConstant = rows(where, ["type_id", "value_rank", "num_value", "text_key", "text_value"], constants.map(([typeId, entry]) => entry.kind === "num" ? [typeId, 0, entry.num, null, null] : [typeId, 1, null, entry.key, entry.text]));
+      sources.push(`SELECT t.id AS record_id, k.value_rank AS value_rank, k.num_value AS num_value, k.text_key AS text_key, k.text_value AS text_value FROM ${byConstant} k JOIN records t ON t.type_id = k.type_id`);
     }
-    const { conditions, params } = recordConditions(query);
     if (cursor)
-      conditions.push(presentCursorCondition(cursor, op, params));
+      where.conditions.push(presentCursorCondition(cursor, op, where.params));
     const from = `(${sources.join(" UNION ALL ")}) ${SORT_ALIAS} JOIN records r ON r.id = ${SORT_ALIAS}.record_id`;
     const order = `${SORT_ALIAS}.value_rank ${dir}, ${SORT_ALIAS}.num_value ${dir}, ${SORT_ALIAS}.text_key ${dir}, ${SORT_ALIAS}.text_value ${dir}, ${SORT_ALIAS}.record_id ${dir}`;
-    pages.push(statement("r.*", from, conditions, [...sourceParams, ...params], ` ORDER BY ${order} LIMIT ?`));
+    pages.push(statement(where, from, ` ORDER BY ${order} LIMIT ?`));
   }
   {
-    const { conditions, params } = recordConditions(query);
+    const where = recordConditions(query, reach);
     if (fields.length > 0) {
-      conditions.push(`NOT EXISTS (SELECT 1 FROM content_index ${SORT_ALIAS} WHERE ${SORT_ALIAS}.record_id = r.id AND (${fieldOf(SORT_ALIAS, "r")}))`);
-      for (const [typeId, field] of fields)
-        params.push(typeId, field);
+      const byField = rows(where, ["type_id", "field"], fields);
+      where.conditions.push(`NOT EXISTS (SELECT 1 FROM ${byField} f JOIN content_index ${SORT_ALIAS} ON ${SORT_ALIAS}.record_id = r.id AND ${SORT_ALIAS}.field = f.field WHERE f.type_id = r.type_id)`);
     }
     if (constants.length > 0) {
-      conditions.push(`r.type_id NOT IN (${constants.map(() => "?").join(",")})`);
-      params.push(...constants.map(([typeId]) => typeId));
+      const typeIds = constants.map(([typeId]) => typeId);
+      where.conditions.push(`NOT (${inList(where, "r.type_id", typeIds)})`);
     }
     if (cursor?.kind === "absent") {
-      conditions.push(`r.id ${op} ?`);
-      params.push(cursor.id);
+      where.conditions.push(`r.id ${op} ?`);
+      where.params.push(cursor.id);
     }
-    pages.push(statement("r.*", "records r", conditions, params, ` ORDER BY r.id ${dir} LIMIT ?`));
+    pages.push(statement(where, "records r", ` ORDER BY r.id ${dir} LIMIT ?`));
   }
   return pages;
 };
@@ -751,154 +948,6 @@ var ContentIndex = class {
     return fields;
   }
 };
-var toMs = (d) => d.getTime();
-var actorFromColumns = (subject, principal) => subject == null ? void 0 : {
-  subjectId: subject,
-  ...principal != null && { principalId: principal }
-};
-var fromMs = (ms) => new Date(ms);
-var rowToRecord = (row, associations) => {
-  const record = {
-    id: row.id,
-    typeId: row.type_id,
-    createdAt: fromMs(row.created_at),
-    updatedAt: fromMs(row.updated_at),
-    content: JSON.parse(row.content),
-    version: row.version
-  };
-  if (row.parent_id != null)
-    record.parentId = row.parent_id;
-  if (row.app_id != null)
-    record.appId = row.app_id;
-  const createdBy = actorFromColumns(row.entity_id, row.principal_id);
-  if (createdBy)
-    record.createdBy = createdBy;
-  const updatedBy = actorFromColumns(row.updated_by, row.updated_via);
-  if (updatedBy)
-    record.updatedBy = updatedBy;
-  if (row.deleted_at != null)
-    record.deletedAt = fromMs(row.deleted_at);
-  if (row.unlisted_at != null)
-    record.unlistedAt = fromMs(row.unlisted_at);
-  const partitioned = partitionAssociations(associations);
-  if (partitioned.associations.length)
-    record.associations = partitioned.associations;
-  if (partitioned.permissions.length)
-    record.permissions = partitioned.permissions;
-  return record;
-};
-var rowToAssociation = (row) => {
-  if (row.kind === "tag") {
-    return { kind: "tag", label: row.label };
-  }
-  if (row.kind === "anyone") {
-    return { kind: "anyone", label: "read" };
-  }
-  if (row.kind === "permission") {
-    return {
-      kind: "permission",
-      label: row.label,
-      grantee: rowToGrantee(row)
-    };
-  }
-  if (row.kind === "attachment") {
-    const attachmentRecordId = row.attachment_record_id;
-    return {
-      kind: "attachment",
-      label: row.label,
-      fileId: row.file_id,
-      // Stored as '' when absent, like every other optional column here —
-      // the field is omitted rather than served empty, so a round trip
-      // produces the association the caller wrote.
-      ...attachmentRecordId && { attachmentRecordId }
-    };
-  }
-  return {
-    kind: "relationship",
-    label: row.label,
-    target: rowToTarget(row)
-  };
-};
-var associationKeyColumns = (a) => {
-  if (a.kind === "attachment")
-    return [a.fileId, "", "", "", "", ""];
-  if (a.kind === "permission") {
-    const g = a.grantee;
-    return g.kind === "entity" ? ["", "entity", g.entityId, "", "", ""] : ["", "group", g.groupId, "", "", g.role];
-  }
-  if (a.kind !== "relationship")
-    return ["", "", "", "", "", ""];
-  const t = a.target;
-  if (t.kind === "entity")
-    return ["", "entity", t.entityId, "", "", ""];
-  if (t.kind === "external")
-    return ["", "external", t.id, t.ns, "", ""];
-  return ["", "record", t.recordId, "", t.stackUrl ?? "", ""];
-};
-var rowToGrantee = (row) => row.related_scope === "group" ? {
-  kind: "group",
-  groupId: row.related_id,
-  role: row.related_role
-} : { kind: "entity", entityId: row.related_id };
-var rowToTarget = (row) => {
-  const id = row.related_id;
-  if (row.related_scope === "entity")
-    return { kind: "entity", entityId: id };
-  if (row.related_scope === "external") {
-    return { kind: "external", ns: row.related_ns, id };
-  }
-  const stackUrl = row.related_stack;
-  return { kind: "record", recordId: id, ...stackUrl && { stackUrl } };
-};
-var rowToType = (row) => {
-  const t = {
-    id: row.id,
-    baseId: row.base_id,
-    version: row.version,
-    name: row.name,
-    schema: JSON.parse(row.schema),
-    schemaHash: row.schema_hash,
-    createdAt: fromMs(row.created_at)
-  };
-  if (row.migrates_from)
-    t.migratesFrom = row.migrates_from;
-  return t;
-};
-var rowToVersion = (row) => {
-  const v = {
-    version: row.version,
-    typeId: row.type_id,
-    content: JSON.parse(row.content),
-    updatedAt: fromMs(row.updated_at)
-  };
-  const createdBy = actorFromColumns(row.entity_id, row.principal_id);
-  if (createdBy)
-    v.createdBy = createdBy;
-  const updatedBy = actorFromColumns(row.updated_by, row.updated_via);
-  if (updatedBy)
-    v.updatedBy = updatedBy;
-  return v;
-};
-var rowToJournalEntry = (row) => {
-  const e = {
-    seq: row.seq,
-    at: fromMs(row.at),
-    kind: row.kind,
-    ops: JSON.parse(row.ops),
-    version: row.version,
-    typeId: row.type_id
-  };
-  if (row.parent_id != null)
-    e.parentId = row.parent_id;
-  if (row.previous_parent_id != null) {
-    e.previousParentId = row.previous_parent_id === "" ? null : row.previous_parent_id;
-  }
-  if (row.actor != null)
-    e.actor = JSON.parse(row.actor);
-  if (row.associations != null)
-    e.associations = JSON.parse(row.associations);
-  return e;
-};
 
 // ../sqlite-shared/dist/record-logic.js
 var asStackBadRequestError = (query, run) => {
@@ -957,6 +1006,18 @@ var SharedSqlRecordLogic = class {
       throw recordNotFound(id);
     throw versionConflict(id, expectedVersion, version);
   }
+  /**
+   * An aspect write's record, inside its transaction: missing is not found,
+   * a tombstone is refused, and anything else answers its version.
+   */
+  liveVersion(id) {
+    const row = this.exec.get("SELECT version, deleted_at FROM records WHERE id = ?", [id]);
+    if (!row)
+      throw recordNotFound(id);
+    if (row.deleted_at !== null)
+      throw softDeletedRefusal(id);
+    return row.version;
+  }
   currentVersion(id) {
     return this.exec.get("SELECT version FROM records WHERE id = ?", [id])?.version;
   }
@@ -1040,9 +1101,10 @@ var SharedSqlRecordLogic = class {
         }
         throw err;
       }
-      const edges = [...record.associations ?? [], ...record.permissions ?? []];
-      if (edges.length)
-        this.insertAssociations(record.id, edges);
+      if (record.associations?.length)
+        this.insertAssociations(record.id, record.associations);
+      if (record.permissions?.length)
+        this.insertPermissions(record.id, record.permissions);
       this.searchIndex.insert(record.id, JSON.stringify(record.content));
       this.contentIndex.sync(record.id, record.typeId, record.content);
       this.appendJournal(record.id, opts.journal);
@@ -1060,56 +1122,55 @@ var SharedSqlRecordLogic = class {
    */
   readRecord(id) {
     const row = this.exec.get("SELECT * FROM records WHERE id = ?", [id]);
-    return row ? this.hydrate(row) : null;
+    return row ? this.hydrate([row])[0] : null;
   }
-  /** A records row with its association set attached. */
-  hydrate(row) {
-    return rowToRecord(row, this.getAssociationsForRecord(row.id));
+  /**
+   * Records rows with their associations and permissions attached: one
+   * statement per element table for the whole list, so a page costs three
+   * reads however many records it holds.
+   */
+  hydrate(rows2) {
+    const ids = rows2.map((row) => row.id);
+    const associations = this.elementsByRecord("associations", ids, rowToAssociation);
+    const permissions = this.elementsByRecord("permissions", ids, rowToPermission);
+    return rows2.map((row) => rowToRecord(row, associations.get(row.id) ?? [], permissions.get(row.id) ?? []));
   }
   /**
-   * One transaction, so one call is one version whatever it moved, and the
-   * patch applies to the content as it stands when the write lands.
+   * The patch applies to the content as it stands when the write lands,
+   * read inside the same transaction.
    */
-  async mutateRecord(id, changes, opts = {}) {
-    const now = toMs(/* @__PURE__ */ new Date());
-    const sets = [];
-    const values = [];
-    if (changes.parentId !== void 0) {
-      sets.push("parent_id = ?");
-      values.push(changes.parentId);
-    }
-    if (changes.unlisted !== void 0) {
-      sets.push("unlisted_at = ?");
-      values.push(changes.unlisted ? now : null);
-    }
+  async patchContent(id, patch, opts = {}) {
     this.exec.transaction(() => {
       const current = this.readForWrite(id, opts.ifVersion);
-      if (opts.bumpsVersion === false) {
-        if (sets.length > 0) {
-          this.exec.run(`UPDATE records SET ${sets.join(", ")} WHERE id = ?`, [...values, id]);
-        }
-        this.replaceAssociationHalves(id, changes);
-        this.appendJournal(id, opts.journal);
-        return;
-      }
-      const merged = changes.contentPatch ? applyMergePatch(current.content, changes.contentPatch) : void 0;
-      if (merged !== void 0) {
-        sets.unshift("content = ?");
-        values.unshift(JSON.stringify(merged));
-      }
       if (opts.snapshot)
         this.snapshotBeforeMutation(id, opts.snapshot);
-      if (merged !== void 0)
-        this.searchIndex.remove(id);
-      this.versionedUpdate(id, sets, values, opts, now);
-      this.replaceAssociationHalves(id, changes);
-      if (merged !== void 0) {
-        this.searchIndex.insert(id, JSON.stringify(merged));
-        this.contentIndex.sync(id, current.typeId, merged);
+      this.rewriteContent(id, current.typeId, applyMergePatch(current.content, patch), opts);
+      this.appendJournal(id, opts.journal);
+    });
+    return this.reread(id, "patchContent");
+  }
+  async setParent(id, parentId, opts = {}) {
+    return this.aspectUpdate(id, "parent_id = ?", parentId, opts, "setParent");
+  }
+  /** Stamped fresh: `Stack` hands this only a transition. */
+  async setUnlisted(id, unlisted, opts = {}) {
+    return this.aspectUpdate(id, "unlisted_at = ?", unlisted ? toMs(/* @__PURE__ */ new Date()) : null, opts, "setUnlisted");
+  }
+  /**
+   * One records column that never bumps. The tombstone refusal and the
+   * `ifVersion` guard ride in the WHERE clause, as on a versioned update.
+   */
+  aspectUpdate(id, set, value, opts, verb) {
+    const guarded = opts.ifVersion !== void 0;
+    this.exec.transaction(() => {
+      const changed = this.exec.run(`UPDATE records SET ${set}
+         WHERE id = ? AND deleted_at IS NULL${guarded ? " AND version = ?" : ""}`, [value, id, ...guarded ? [opts.ifVersion] : []]);
+      if (changed === 0) {
+        throw versionConflict(id, opts.ifVersion, this.liveVersion(id));
       }
       this.appendJournal(id, opts.journal);
     });
-    return this.reread(id, "mutateRecord");
+    return this.reread(id, verb);
   }
   async deleteRecord(id, opts = {}) {
     if (opts.purge) {
@@ -1139,6 +1200,7 @@ var SharedSqlRecordLogic = class {
     this.checkExpectedVersion(id, purged.version, ifVersion);
     this.searchIndex.remove(id);
     this.exec.run("DELETE FROM associations WHERE record_id = ?", [id]);
+    this.exec.run("DELETE FROM permissions WHERE record_id = ?", [id]);
     this.exec.run("DELETE FROM versions WHERE record_id = ?", [id]);
     this.exec.run("DELETE FROM journal WHERE record_id = ?", [id]);
     this.contentIndex.remove(id);
@@ -1189,20 +1251,27 @@ var SharedSqlRecordLogic = class {
     this.searchIndex.insert(id, json);
     this.contentIndex.sync(id, typeId, content);
   }
-  async queryRecords(query) {
-    const limit = query.limit ?? 50;
+  queryRecords(query) {
+    return this.page(query);
+  }
+  queryReadable(query, reach) {
+    return this.page(query, reach);
+  }
+  /** `reach`, when given, is one more condition of every statement in the plan. */
+  async page(query, reach) {
+    const { limit } = query;
     const fetch = limit + 1;
-    const rows = [];
-    for (const page2 of buildQueryPlan(query)) {
-      const budget = fetch - rows.length;
+    const rows2 = [];
+    for (const page2 of buildQueryPlan(query, reach)) {
+      const budget = fetch - rows2.length;
       if (budget <= 0)
         break;
       const statement2 = atBudget(page2, budget);
-      rows.push(...asStackBadRequestError(query, () => this.exec.all(statement2.sql, statement2.params)));
+      rows2.push(...asStackBadRequestError(query, () => this.exec.all(statement2.sql, statement2.params)));
     }
-    const hasMore = rows.length > limit;
-    const page = hasMore ? rows.slice(0, limit) : rows;
-    const records = page.map((row) => this.hydrate(row));
+    const hasMore = rows2.length > limit;
+    const page = hasMore ? rows2.slice(0, limit) : rows2;
+    const records = this.hydrate(page);
     const lastRecord = records[records.length - 1];
     const cursor = hasMore && lastRecord ? makeCursor(lastRecord, query.sort, (record, field) => this.contentIndex.kindOf(record.typeId, field)) : null;
     return { records, cursor };
@@ -1211,7 +1280,7 @@ var SharedSqlRecordLogic = class {
    * The reference check and the purges share one synchronous transaction,
    * so nothing can add a reference between the two.
    */
-  async deleteUnreferencedAttachmentRecords(fileId, metadataTypeIds) {
+  async deleteUnreferencedAttachmentRecords(fileId, metadataBaseId) {
     return this.exec.transaction(() => {
       const referenced = this.exec.all(`SELECT 1 as found FROM associations WHERE kind = 'attachment' AND file_id = ?
          UNION ALL
@@ -1220,11 +1289,9 @@ var SharedSqlRecordLogic = class {
       if (referenced.length) {
         throw new StackConflictError("Attachment is still referenced by one or more records");
       }
-      if (metadataTypeIds.length === 0)
-        return [];
-      const placeholders = metadataTypeIds.map(() => "?").join(", ");
+      const family = inFamily("type_id", metadataBaseId);
       const metaRows = this.exec.all(`SELECT id FROM records
-         WHERE type_id IN (${placeholders}) AND json_extract(content, '$.fileId') = ?`, [...metadataTypeIds, fileId]);
+         WHERE ${family.sql} AND json_extract(content, '$.fileId') = ?`, [...family.params, fileId]);
       const deleted = [];
       for (const row of metaRows) {
         const purged = this.purgeRecord(row.id);
@@ -1244,8 +1311,8 @@ var SharedSqlRecordLogic = class {
       conditions.push("version < ?");
       values.push(query.beforeVersion);
     }
-    const rows = this.exec.all(`SELECT * FROM versions WHERE ${conditions.join(" AND ")} ORDER BY version DESC${query.limit !== void 0 ? " LIMIT ?" : ""}`, query.limit !== void 0 ? [...values, query.limit] : values);
-    return rows.map(rowToVersion);
+    const rows2 = this.exec.all(`SELECT * FROM versions WHERE ${conditions.join(" AND ")} ORDER BY version DESC${query.limit !== void 0 ? " LIMIT ?" : ""}`, query.limit !== void 0 ? [...values, query.limit] : values);
+    return rows2.map(rowToVersion);
   }
   async getVersion(id, version) {
     return this.readVersion(id, version);
@@ -1355,8 +1422,8 @@ var SharedSqlRecordLogic = class {
       conditions.push("seq > ?");
       values.push(query.afterSeq);
     }
-    const rows = this.exec.all(`SELECT * FROM journal WHERE ${conditions.join(" AND ")} ORDER BY seq ASC${query.limit !== void 0 ? " LIMIT ?" : ""}`, query.limit !== void 0 ? [...values, query.limit] : values);
-    return rows.map(rowToJournalEntry);
+    const rows2 = this.exec.all(`SELECT * FROM journal WHERE ${conditions.join(" AND ")} ORDER BY seq ASC${query.limit !== void 0 ? " LIMIT ?" : ""}`, query.limit !== void 0 ? [...values, query.limit] : values);
+    return rows2.map(rowToJournalEntry);
   }
   // -------------------------------------------------------
   // Types
@@ -1381,66 +1448,71 @@ var SharedSqlRecordLogic = class {
     return row ? rowToType(row) : null;
   }
   async listTypes() {
-    const rows = this.exec.all("SELECT * FROM types ORDER BY base_id, version");
-    return rows.map(rowToType);
+    const rows2 = this.exec.all("SELECT * FROM types ORDER BY base_id, version");
+    return rows2.map(rowToType);
   }
   // -------------------------------------------------------
   // Associations
   // -------------------------------------------------------
   /**
-   * Never bumps `version`/`updatedAt` and never snapshots — see
-   * StackRecordAdapter.amendAssociations(). Removes apply before adds, so
-   * removing and re-adding one identity in a call leaves it present.
+   * A write to one of a record's two element tables, inside a transaction
+   * that first checks the record exists, is not soft-deleted, is at
+   * `ifVersion`, and that the table holds `expectSet`. Never bumps and
+   * never snapshots.
    */
-  async amendAssociations(recordId, changes, opts = {}) {
-    assertOneSurface(changes);
+  elementWrite(id, table, opts, write, verb) {
     this.exec.transaction(() => {
-      if (this.currentVersion(recordId) === void 0)
-        throw recordNotFound(recordId);
-      for (const change of changes) {
-        if (change.op !== "remove")
-          continue;
-        const { association } = change;
-        this.exec.run(`DELETE FROM associations
-       WHERE record_id = ?
-         AND kind = ?
-         AND label = ?
-         AND file_id       = ?
-         AND related_scope = ?
-         AND related_id    = ?
-         AND related_ns    = ?
-         AND related_stack = ?
-         AND related_role  = ?`, [recordId, association.kind, association.label, ...associationKeyColumns(association)]);
+      this.checkExpectedVersion(id, this.liveVersion(id), opts.ifVersion);
+      if (opts.expectSet) {
+        const map = table === "associations" ? rowToAssociation : rowToPermission;
+        const stored = this.elementsByRecord(table, [id], map).get(id) ?? [];
+        if (!sameAssociationSet(stored, opts.expectSet))
+          throw new ElementSetMovedError(id);
       }
-      const adds = changes.flatMap((c) => c.op === "add" ? [c.association] : []);
-      if (adds.length)
-        this.insertAssociations(recordId, adds);
-      this.appendJournal(recordId, opts.journal);
+      write();
+      this.appendJournal(id, opts.journal);
     });
-    return this.reread(recordId, "amendAssociations");
+    return this.reread(id, verb);
   }
-  /**
-   * Each key replaces only within its own half of the partition, which is
-   * why a tag write cannot drop an ACL. Caller-transactional.
-   * See docs/spec/access-control.md § Record-level permissions.
-   */
-  replaceAssociationHalves(recordId, changes) {
-    if (changes.associations !== void 0) {
-      this.replaceAssociations(recordId, changes.associations, "data");
-    }
-    if (changes.permissions !== void 0) {
-      this.replaceAssociations(recordId, changes.permissions, "authority");
-    }
+  async editAssociations(id, edits, opts = {}) {
+    return this.elementWrite(id, "associations", opts, () => {
+      for (const edit of edits) {
+        if (edit.op !== "remove")
+          continue;
+        const association = edit.association;
+        this.exec.run(`DELETE FROM associations
+             WHERE record_id = ? AND kind = ? AND label = ?
+               AND file_id = ? AND related_scope = ? AND related_id = ?
+               AND related_ns = ? AND related_stack = ?`, [id, association.kind, association.label, ...associationKeyColumns(association)]);
+      }
+      this.insertAssociations(id, addsOf(edits));
+    }, "editAssociations");
+  }
+  async setAssociations(id, associations, opts = {}) {
+    return this.elementWrite(id, "associations", opts, () => {
+      this.exec.run("DELETE FROM associations WHERE record_id = ?", [id]);
+      this.insertAssociations(id, associations);
+    }, "setAssociations");
+  }
+  /** editAssociations() over the permissions table. */
+  async editAccess(id, edits, opts = {}) {
+    return this.elementWrite(id, "permissions", opts, () => {
+      for (const edit of edits) {
+        if (edit.op !== "remove")
+          continue;
+        const permission = edit.association;
+        this.exec.run(`DELETE FROM permissions
+             WHERE record_id = ? AND kind = ? AND label = ?
+               AND grantee_kind = ? AND grantee_id = ? AND role = ?`, [id, permission.kind, permission.label, ...permissionKeyColumns(permission)]);
+      }
+      this.insertPermissions(id, addsOf(edits));
+    }, "editAccess");
   }
-  /**
-   * Swap one half of a record's association set wholesale — the "replace,
-   * don't merge" semantics a change set's association list carries. The data
-   * half is "not an authority kind", so core's list is the only one.
-   */
-  replaceAssociations(recordId, associations, half) {
-    this.exec.run(`DELETE FROM associations WHERE record_id = ? AND kind ${half === "data" ? "NOT IN" : "IN"} (${AUTHORITY_ASSOCIATION_KINDS.map(() => "?").join(", ")})`, [recordId, ...AUTHORITY_ASSOCIATION_KINDS]);
-    if (associations.length)
-      this.insertAssociations(recordId, associations);
+  async setAccess(id, permissions, opts = {}) {
+    return this.elementWrite(id, "permissions", opts, () => {
+      this.exec.run("DELETE FROM permissions WHERE record_id = ?", [id]);
+      this.insertPermissions(id, permissions);
+    }, "setAccess");
   }
   /**
    * Upserts on association identity, so re-pointing `attachment_record_id`
@@ -1449,46 +1521,72 @@ var SharedSqlRecordLogic = class {
    */
   insertAssociations(recordId, associations) {
     for (const assoc of associations) {
-      try {
-        this.exec.run(`INSERT INTO associations
+      this.insertRow(recordId, () => this.exec.run(`INSERT INTO associations
             (record_id, kind, label, file_id, related_scope, related_id, related_ns,
-             related_stack, related_role, attachment_record_id)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+             related_stack, attachment_record_id)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
            ON CONFLICT DO UPDATE SET attachment_record_id = excluded.attachment_record_id`, [
-          recordId,
-          assoc.kind,
-          assoc.label,
-          ...associationKeyColumns(assoc),
-          assoc.kind === "attachment" ? assoc.attachmentRecordId ?? "" : ""
-        ]);
-      } catch (err) {
-        if (isForeignKeyViolation(err)) {
-          throw recordNotFound(recordId);
-        }
-        throw err;
-      }
+        recordId,
+        assoc.kind,
+        assoc.label,
+        ...associationKeyColumns(assoc),
+        assoc.kind === "attachment" ? assoc.attachmentRecordId ?? "" : ""
+      ]));
     }
   }
-  getAssociationsForRecord(recordId) {
-    const rows = this.exec.all("SELECT * FROM associations WHERE record_id = ?", [recordId]);
-    return rows.map(rowToAssociation);
+  /** Every column is in the key, so a repeated element is the same row. */
+  insertPermissions(recordId, permissions) {
+    for (const p of permissions) {
+      this.insertRow(recordId, () => this.exec.run(`INSERT INTO permissions (record_id, kind, label, grantee_kind, grantee_id, role)
+           VALUES (?, ?, ?, ?, ?, ?)
+           ON CONFLICT DO NOTHING`, [recordId, p.kind, p.label, ...permissionKeyColumns(p)]));
+    }
+  }
+  insertRow(recordId, insert) {
+    try {
+      insert();
+    } catch (err) {
+      if (isForeignKeyViolation(err))
+        throw recordNotFound(recordId);
+      throw err;
+    }
+  }
+  /**
+   * One element table's rows for every record in `ids`, in primary-key
+   * order — the order a single record's read has always had.
+   */
+  elementsByRecord(table, ids, map) {
+    const byRecord = /* @__PURE__ */ new Map();
+    const rows2 = this.exec.all(`WITH ids AS MATERIALIZED ${rowsTable(["id"])}
+       SELECT * FROM ${table} WHERE record_id IN (SELECT id FROM ids)
+       ORDER BY ${table === "associations" ? ASSOCIATION_KEY : PERMISSION_KEY}`, [JSON.stringify(ids.map((id) => [id]))]);
+    for (const row of rows2) {
+      const id = row.record_id;
+      const list = byRecord.get(id);
+      if (list)
+        list.push(map(row));
+      else
+        byRecord.set(id, [map(row)]);
+    }
+    return byRecord;
   }
 };
+var ASSOCIATION_KEY = "record_id, kind, label, file_id, related_scope, related_id, related_ns, related_stack";
+var PERMISSION_KEY = "record_id, kind, label, grantee_kind, grantee_id, role";
+var addsOf = (edits) => edits.flatMap((e) => e.op === "add" ? [e.association] : []);
 
 // ../sqlite-shared/dist/record-adapter.js
 var SQLITE_RECORD_CAPABILITIES = {
   filter: {
     content: "path",
     contentPresent: true,
-    // Inside SQLite's limits on expression depth and compound selects; see
-    // docs/spec/adapters.md § Adapter capabilities.
-    contentByType: 64,
+    contentByType: true,
     search: true
   },
   sort: {
     fields: ["createdAt", "updatedAt", "version"],
     contentField: true,
-    contentFieldByType: 64
+    contentFieldByType: true
   },
   limits: {
     attachmentBytes: null,
@@ -1514,8 +1612,14 @@ var SharedSqlRecordAdapter = class {
   getRecord(id) {
     return this.record.getRecord(id);
   }
-  mutateRecord(id, changes, opts) {
-    return this.record.mutateRecord(id, changes, opts);
+  patchContent(id, patch, opts) {
+    return this.record.patchContent(id, patch, opts);
+  }
+  setParent(id, parentId, opts) {
+    return this.record.setParent(id, parentId, opts);
+  }
+  setUnlisted(id, unlisted, opts) {
+    return this.record.setUnlisted(id, unlisted, opts);
   }
   deleteRecord(id, opts) {
     return this.record.deleteRecord(id, opts);
@@ -1532,8 +1636,11 @@ var SharedSqlRecordAdapter = class {
   queryRecords(query) {
     return this.record.queryRecords(query);
   }
-  deleteUnreferencedAttachmentRecords(fileId, metadataTypeIds) {
-    return this.record.deleteUnreferencedAttachmentRecords(fileId, metadataTypeIds);
+  queryReadable(query, reach) {
+    return this.record.queryReadable(query, reach);
+  }
+  deleteUnreferencedAttachmentRecords(fileId, metadataBaseId) {
+    return this.record.deleteUnreferencedAttachmentRecords(fileId, metadataBaseId);
   }
   // -------------------------------------------------------
   // Versions
@@ -1566,10 +1673,19 @@ var SharedSqlRecordAdapter = class {
     return this.record.listTypes();
   }
   // -------------------------------------------------------
-  // Associations
+  // Associations and permissions
   // -------------------------------------------------------
-  amendAssociations(recordId, changes, opts) {
-    return this.record.amendAssociations(recordId, changes, opts);
+  editAssociations(id, edits, opts) {
+    return this.record.editAssociations(id, edits, opts);
+  }
+  setAssociations(id, associations, opts) {
+    return this.record.setAssociations(id, associations, opts);
+  }
+  editAccess(id, edits, opts) {
+    return this.record.editAccess(id, edits, opts);
+  }
+  setAccess(id, permissions, opts) {
+    return this.record.setAccess(id, permissions, opts);
   }
 };
 var lockPathFor = (dbPath) => `${dbPath}.lock`;
@@ -1641,8 +1757,8 @@ var SharedTokenLogic = class {
     return { principalId: row.principal_id, subjectId: row.subject_id };
   }
   async listTokens() {
-    const rows = this.exec.all("SELECT id, principal_id, subject_id, label, created_at, expires_at FROM tokens ORDER BY created_at DESC");
-    return rows.map((row) => ({
+    const rows2 = this.exec.all("SELECT id, principal_id, subject_id, label, created_at, expires_at FROM tokens ORDER BY created_at DESC");
+    return rows2.map((row) => ({
       id: row.id,
       principalId: row.principal_id,
       subjectId: row.subject_id,