chore: update to core v0.5.0 and remove now-redundant workarounds

package.json

@@ -17,8 +17,8 @@
     "format:check": "prettier --check ."
   },
   "dependencies": {
-    "@haverstack/adapter-sqlite": "^0.4.0",
-    "@haverstack/core": "^0.4.0",
+    "@haverstack/adapter-sqlite": "^0.5.0",
+    "@haverstack/core": "^0.5.0",
     "@hono/node-server": "^1.13.7",
     "hono": "^4.6.0",
     "pino": "^9.5.0",

src/middleware/auth.ts

@@ -17,9 +17,6 @@ export function authMiddleware(ownerToken: string, ctx: StackContext): Middlewar
     if (header?.startsWith('Bearer ')) {
       const token = header.slice(7);
       if (safeCompare(token, ownerToken)) {
-        if (!ownerEntityId) {
-          return c.json({ error: 'Server misconfiguration: owner entity not set' }, 500);
-        }
         c.set('auth', { entityId: ownerEntityId });
       } else {
         const result = await ctx.adapter.lookupToken(token);
@@ -39,12 +36,11 @@ export function requireAuth(): MiddlewareHandler<AppEnv> {
   };
 }
 
-export function requireOwner(ownerEntityId: string | null): MiddlewareHandler<AppEnv> {
+export function requireOwner(ownerEntityId: string): MiddlewareHandler<AppEnv> {
   return async (c, next) => {
     const auth = c.get('auth');
     if (!auth) return c.json({ error: 'Unauthorized' }, 401);
-    if (!ownerEntityId || auth.entityId !== ownerEntityId)
-      return c.json({ error: 'Forbidden' }, 403);
+    if (auth.entityId !== ownerEntityId) return c.json({ error: 'Forbidden' }, 403);
     await next();
   };
 }

src/routes/records.ts

@@ -1,7 +1,7 @@
 import { Hono } from 'hono';
 import type { AppEnv } from '../types.js';
 import type { StackContext } from '../stack.js';
-import { requireAuth, requireOwner } from '../middleware/auth.js';
+import { requireAuth } from '../middleware/auth.js';
 import { parseDate, serializeRecord, serializeVersion } from '../lib/serialize.js';
 import { SYSTEM_TYPES } from '@haverstack/core';
 import type { StackQuery, RecordFilter, Association, Permission, TypeId } from '@haverstack/core';
@@ -153,7 +153,6 @@ function parseQueryParams(url: URL): StackQuery {
 export function recordRoutes(ctx: StackContext): Hono<AppEnv> {
   const app = new Hono<AppEnv>();
   const { stack } = ctx;
-  const { ownerEntityId } = stack;
 
   // POST /records/query — full query with content-field filters
   // Registered before /:id patterns to avoid param capture on the literal "query" segment.
@@ -278,7 +277,7 @@ export function recordRoutes(ctx: StackContext): Hono<AppEnv> {
     return c.json({ permissions: record.permissions ?? [] });
   });
 
-  app.put('/:id/permissions', requireOwner(ownerEntityId), async (c) => {
+  app.put('/:id/permissions', requireAuth(), async (c) => {
     const id = c.req.param('id');
     const auth = c.get('auth')!;
     const body = await c.req.json<{ permissions: Permission[] }>();