hikoutei 0.2.0

package/apps-script/gateway/Code.gs

@@ -0,0 +1,412 @@
+/**
+ * Thin Sheet I/O dispatcher for the typed-sheets sync runtime.
+ *
+ * This is the v2 data plane. It deliberately contains no business logic, no
+ * compare-and-set, no receipts, and no outbox awareness. The Node worker is
+ * the sole decision maker; this gateway only executes signed, range-constrained
+ * Sheet operations that the worker already planned.
+ *
+ * This is the only supported Apps Script gateway source. The former full
+ * gateway implementation is no longer shipped with the package.
+ */
+
+var GATEWAY_SHEET_ID_PROPERTY_ = "TYPED_SHEETS_GATEWAY_SHEET_ID";
+var GATEWAY_SHARED_SECRET_PROPERTY_ = "TYPED_SHEETS_GATEWAY_SHARED_SECRET";
+var LEGACY_GATEWAY_SHEET_ID_PROPERTY_ = "TYPED_SHEETS_MVP_SHEET_ID";
+var LEGACY_GATEWAY_SHARED_SECRET_PROPERTY_ = "TYPED_SHEETS_MVP_SHARED_SECRET";
+var GATEWAY_MAX_CLOCK_SKEW_MS_ = 60 * 1000;
+var GATEWAY_MAX_REQUEST_LIFETIME_MS_ = 10 * 60 * 1000;
+var GATEWAY_LOCK_TIMEOUT_MS_ = 20 * 1000;
+
+var SYNC_PROTOCOL_VERSION_ = "typed-sheets-sync-v1";
+
+// Operations accepted by the v2 data plane. Each operation carries its own
+// serialised function body plus the args that function needs. Adding a new
+// operation requires only that the Node worker send a recognised opKind and a
+// self-contained function string; this list is the allowlist of opKind values.
+var SYNC_OPERATIONS_ = {
+  applyOperations: true,
+};
+
+/** Web-app entry point. Every useful operation must be a signed POST. */
+function doPost(event) {
+  try {
+    return jsonOutput_(handlePost_(event));
+  } catch (error) {
+    return jsonOutput_(failure_("internal_error", safeErrorMessage_(error)));
+  }
+}
+
+/** Rejects unauthenticated GET calls instead of exposing spreadsheet metadata. */
+function doGet() {
+  return jsonOutput_(failure_("method_not_allowed", "Use a signed POST request."));
+}
+
+// Paste the deployed /exec URL here, then run setupSyncGateway() from the
+// Apps Script editor. It is never reachable through doPost().
+var TYPED_SHEETS_GATEWAY_URL = "";
+
+/**
+ * Configures this bound spreadsheet for the sync gateway.
+ *
+ * Run this manually from the Apps Script editor after deploying the web app.
+ * It reads the deployed `/exec` URL from TYPED_SHEETS_GATEWAY_URL above,
+ * generates a shared secret only when one is absent, and logs a copyable local
+ * `.env` block. It is never reachable through doPost(), so the secret is not
+ * exposed by the public gateway.
+ *
+ * @returns {object} Local runner config.
+ */
+function setupSyncGateway() {
+  var config = configureSyncGateway_(TYPED_SHEETS_GATEWAY_URL);
+  Logger.log(config.localEnv);
+  return config;
+}
+
+/**
+ * Saves the allowlisted sheet ID and shared secret under a script lock so two
+ * manual setup executions cannot accidentally rotate the generated secret.
+ */
+function configureSyncGateway_(gatewayUrl) {
+  var normalizedGatewayUrl = requireSyncGatewayUrl_(gatewayUrl);
+  var spreadsheet = SpreadsheetApp.getActiveSpreadsheet();
+  if (spreadsheet === null) {
+    throw new Error("setupSyncGateway() must run from the bound spreadsheet's Apps Script project.");
+  }
+
+  var sheetId = spreadsheet.getId();
+  if (!isNonEmptyString_(sheetId)) {
+    throw new Error("Could not resolve the bound disposable spreadsheet ID.");
+  }
+
+  var lock = LockService.getScriptLock();
+  if (!lock.tryLock(GATEWAY_LOCK_TIMEOUT_MS_)) {
+    throw new Error("Could not acquire the sync gateway setup lock.");
+  }
+
+  try {
+    var properties = PropertiesService.getScriptProperties();
+    var existingSecret = properties.getProperty(GATEWAY_SHARED_SECRET_PROPERTY_) ||
+      properties.getProperty(LEGACY_GATEWAY_SHARED_SECRET_PROPERTY_);
+    var sharedSecret = isNonEmptyString_(existingSecret) ? existingSecret : createSyncGatewaySharedSecret_();
+
+    properties.setProperty(GATEWAY_SHEET_ID_PROPERTY_, sheetId);
+    properties.setProperty(GATEWAY_SHARED_SECRET_PROPERTY_, sharedSecret);
+
+    return {
+      gatewayUrl: normalizedGatewayUrl,
+      sheetId: sheetId,
+      sharedSecret: sharedSecret,
+      localEnv: formatSyncGatewayLocalEnv_(normalizedGatewayUrl, sharedSecret, sheetId),
+    };
+  } finally {
+    lock.releaseLock();
+  }
+}
+
+/** Validates a deployed Apps Script Web App URL before it is copied locally. */
+function requireSyncGatewayUrl_(value) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new Error("Paste a deployed Apps Script Web App URL ending in /exec before running setupSyncGateway().");
+  }
+
+  var gatewayUrl = value.trim();
+  if (!/^https:\/\/script\.google\.com\/macros\/s\/[^/?#]+\/exec$/.test(gatewayUrl)) {
+    throw new Error("Sync gateway URL must be a deployed Apps Script Web App URL ending in /exec.");
+  }
+  return gatewayUrl;
+}
+
+/** Generates a long URL-safe secret only for the trusted editor setup path. */
+function createSyncGatewaySharedSecret_() {
+  return Utilities.getUuid().replace(/-/g, "") + Utilities.getUuid().replace(/-/g, "");
+}
+
+/** Formats the exact local environment values consumed by the Node sync runners. */
+function formatSyncGatewayLocalEnv_(gatewayUrl, sharedSecret, sheetId) {
+  return [
+    "# Keep this untracked. The shared secret grants gateway access.",
+    "TYPED_SHEETS_GATEWAY_URL=" + JSON.stringify(gatewayUrl),
+    "TYPED_SHEETS_GATEWAY_SHARED_SECRET=" + JSON.stringify(sharedSecret),
+    "TYPED_SHEETS_GATEWAY_SHEET_ID=" + JSON.stringify(sheetId),
+  ].join("\n");
+}
+
+
+function handlePost_(event) {
+  if (!event || !event.postData || typeof event.postData.contents !== "string") {
+    return failure_("invalid_request", "Expected a JSON POST body.");
+  }
+
+  var envelope;
+  try {
+    envelope = JSON.parse(event.postData.contents);
+  } catch (error) {
+    return failure_("invalid_json", "Request body is not valid JSON.");
+  }
+
+  if (!isPlainObject_(envelope) || envelope.protocolVersion !== SYNC_PROTOCOL_VERSION_) {
+    return failure_("unsupported_protocol", "Unsupported sync protocol version.");
+  }
+
+  var validation = validateSyncEnvelope_(envelope);
+  if (validation.failure !== null) return validation.failure;
+
+  if (envelope.operation === "applyOperations") {
+    return applyOperations_(envelope);
+  }
+  return failure_("unsupported_operation", "Sync operation is not implemented.");
+}
+
+/**
+ * Executes one signed batch of Sheet operations.
+ *
+ * Each operation carries:
+ *   - opKind: an allowlisted label (currently unused for dispatch, reserved for
+ *             future per-op validation), and
+ *   - fn:     the function body as a string, of the form
+ *             (spreadsheet, args) => result, and
+ *   - args:   a JSON-serialisable payload passed as the second argument.
+ *
+ * The function is evaluated in this request's global context, so it may call
+ * SpreadsheetApp/Utilities just like any other Apps Script code. It must not
+ * rely on any external closure, because only the body text crosses the wire.
+ *
+ * A single SpreadsheetApp.flush() is issued after all operations have run, so
+ * a multi-operation request applies atomically from the Sheet's perspective.
+ */
+function applyOperations_(envelope) {
+  var payload = envelope.payload;
+  if (!isPlainObject_(payload) || !Array.isArray(payload.operations)) {
+    return failure_("invalid_payload", "applyOperations payload must contain an operations array.");
+  }
+
+  var spreadsheet;
+  try {
+    spreadsheet = SpreadsheetApp.openById(envelope.sheetId);
+  } catch (error) {
+    return failure_("sheet_open_failed", "Configured sync spreadsheet could not be opened.");
+  }
+
+  var results = [];
+  for (var index = 0; index < payload.operations.length; index += 1) {
+    var operation = payload.operations[index];
+    try {
+      var operationStartedAt = Date.now();
+      var operationResult = runOneOperation_(spreadsheet, operation);
+      appendGatewayTimingPhase_(operationResult, "dispatcher_eval", Date.now() - operationStartedAt);
+      results.push(operationResult);
+    } catch (error) {
+      // Stop at the first failing operation so the worker can retry the whole
+      // signed batch idempotently. Partial results are returned for diagnosis.
+      return failure_("operation_failed", "Operation " + index + " failed: " + safeErrorMessage_(error));
+    }
+  }
+
+  var flushStartedAt = Date.now();
+  SpreadsheetApp.flush();
+  var flushDurationMs = Date.now() - flushStartedAt;
+  results.forEach(function (result) {
+    appendGatewayTimingPhase_(result, "dispatcher_flush", flushDurationMs);
+  });
+  return success_({ results: results });
+}
+
+/** Adds dispatcher timing without requiring older dynamic operations to know the contract. */
+function appendGatewayTimingPhase_(result, phase, durationMs) {
+  if (!isPlainObject_(result)) return;
+  if (!isPlainObject_(result.timing)) {
+    result.timing = {
+      operationKinds: [],
+      operationCounts: { append: 0, update: 0, delete: 0 },
+      durationMs: 0,
+      phases: [],
+    };
+  }
+  if (!Array.isArray(result.timing.phases)) result.timing.phases = [];
+  result.timing.phases.push({ phase: phase, durationMs: durationMs });
+  result.timing.durationMs = Number(result.timing.durationMs) + durationMs;
+}
+
+/** Restores one operation function from its serialised body and runs it. */
+function runOneOperation_(spreadsheet, operation) {
+  if (!isPlainObject_(operation) || typeof operation.fn !== "string" || operation.fn.length === 0) {
+    throw new Error("operation must be an object with a non-empty fn string");
+  }
+  // The function body is restored in this request scope. Eval is safe here
+  // because the enclosing envelope was HMAC-signed; an attacker who cannot
+  // sign requests cannot inject code.
+  var fn;
+  try {
+    fn = eval("(" + operation.fn + ")");
+  } catch (error) {
+    throw new Error("operation fn could not be restored: " + safeErrorMessage_(error));
+  }
+  if (typeof fn !== "function") {
+    throw new Error("operation fn did not evaluate to a function");
+  }
+  return fn(spreadsheet, operation.args);
+}
+
+// ---------------------------------------------------------------------------
+// Envelope validation (preserved from v1 so the trust boundary is unchanged)
+// ---------------------------------------------------------------------------
+
+/** Validates the sync envelope and resolves the configured spreadsheet id. */
+function validateSyncEnvelope_(envelope) {
+  if (!isPlainObject_(envelope)) {
+    return { failure: failure_("invalid_envelope", "Envelope must be a JSON object.") };
+  }
+  if (envelope.protocolVersion !== SYNC_PROTOCOL_VERSION_) {
+    return { failure: failure_("unsupported_protocol", "Unsupported sync protocol version.") };
+  }
+  if (!isNonEmptyString_(envelope.requestId) || !/^[A-Za-z0-9._:-]{8,128}$/.test(envelope.requestId)) {
+    return { failure: failure_("invalid_request_id", "Request ID must be 8-128 URL-safe characters.") };
+  }
+  if (!isNonEmptyString_(envelope.operation) || !SYNC_OPERATIONS_[envelope.operation]) {
+    return { failure: failure_("unsupported_operation", "Operation is not allowlisted.") };
+  }
+  if (!isNonEmptyString_(envelope.keyId) || !isNonEmptyString_(envelope.sheetId) ||
+      !isNonEmptyString_(envelope.actorId) || !isNonEmptyString_(envelope.bodyHash) ||
+      !isNonEmptyString_(envelope.signature)) {
+    return { failure: failure_("invalid_envelope", "Sync envelope is missing an authenticated field.") };
+  }
+  if (!isPositiveSafeInteger_(envelope.issuedAt) || !isPositiveSafeInteger_(envelope.expiresAt)) {
+    return { failure: failure_("invalid_time", "issuedAt and expiresAt must be positive epoch milliseconds.") };
+  }
+  var now = Date.now();
+  if (envelope.issuedAt > now + GATEWAY_MAX_CLOCK_SKEW_MS_ || envelope.expiresAt < now ||
+      envelope.expiresAt <= envelope.issuedAt ||
+      envelope.expiresAt - envelope.issuedAt > GATEWAY_MAX_REQUEST_LIFETIME_MS_) {
+    return { failure: failure_("invalid_expiry", "Sync envelope is expired or outside the allowed lifetime.") };
+  }
+  var gateway = readGatewayConfiguration_();
+  if (gateway === null) {
+    return { failure: failure_("gateway_not_configured", "Required Script Properties are not configured.") };
+  }
+  if (gateway.sheetId !== envelope.sheetId) {
+    return { failure: failure_("sheet_not_allowlisted", "Envelope sheetId is not the configured spreadsheet.") };
+  }
+  if (envelope.keyId !== "typed-sheets-shared-secret-v1") {
+    return { failure: failure_("unknown_key", "Sync keyId is not configured.") };
+  }
+  var actualBodyHash;
+  try {
+    actualBodyHash = sha256Hex_(canonicalJson_(envelope.payload));
+  } catch (error) {
+    return { failure: failure_("invalid_payload", safeErrorMessage_(error)) };
+  }
+  if (!constantTimeEquals_(actualBodyHash, envelope.bodyHash)) {
+    return { failure: failure_("body_hash_mismatch", "Payload does not match the signed body hash.") };
+  }
+  if (!constantTimeEquals_(
+    hmacSha256Base64Url_(syncSigningInput_(envelope), gateway.sharedSecret),
+    envelope.signature,
+  )) {
+    return { failure: failure_("invalid_signature", "Sync envelope signature could not be verified.") };
+  }
+  return { failure: null };
+}
+
+/** HMAC material for typed-sheets-sync-v1; actor/sheet/key are authenticated too. */
+function syncSigningInput_(envelope) {
+  return [
+    envelope.protocolVersion,
+    envelope.requestId,
+    envelope.operation,
+    envelope.keyId,
+    String(envelope.issuedAt),
+    String(envelope.expiresAt),
+    envelope.sheetId,
+    envelope.actorId,
+    envelope.bodyHash,
+  ].join("\n");
+}
+
+/** Reads the configured gateway identity, accepting one prior property namespace during migration. */
+function readGatewayConfiguration_() {
+  var properties = PropertiesService.getScriptProperties();
+  var sheetId = properties.getProperty(GATEWAY_SHEET_ID_PROPERTY_) ||
+    properties.getProperty(LEGACY_GATEWAY_SHEET_ID_PROPERTY_);
+  var sharedSecret = properties.getProperty(GATEWAY_SHARED_SECRET_PROPERTY_) ||
+    properties.getProperty(LEGACY_GATEWAY_SHARED_SECRET_PROPERTY_);
+  if (!isNonEmptyString_(sheetId) || !isNonEmptyString_(sharedSecret)) return null;
+  return { sheetId: sheetId, sharedSecret: sharedSecret };
+}
+
+// ---------------------------------------------------------------------------
+// Shared encoding / hashing helpers (preserved from v1)
+// ---------------------------------------------------------------------------
+
+function canonicalJson_(value) {
+  if (value === null) return "null";
+  if (value === true) return "true";
+  if (value === false) return "false";
+  if (typeof value === "string") return JSON.stringify(value);
+  if (typeof value === "number") {
+    if (!isFinite(value)) throw new Error("Sync payload numbers must be finite");
+    return (value === 0 ? "0" : String(value)).replace(/e\+/, "e").replace(/e(-?)0+(\d+)/, "e$1$2");
+  }
+  if (Array.isArray(value)) {
+    return "[" + value.map(canonicalJson_).join(",") + "]";
+  }
+  if (isPlainObject_(value)) {
+    return "{" + Object.keys(value).sort().map(function (key) {
+      return JSON.stringify(key) + ":" + canonicalJson_(value[key]);
+    }).join(",") + "}";
+  }
+  throw new Error("Sync payload has unsupported value type");
+}
+
+function sha256Hex_(value) {
+  return Utilities.computeDigest(Utilities.DigestAlgorithm.SHA_256, value, Utilities.Charset.UTF_8)
+    .map(function (byte) {
+      var unsigned = byte < 0 ? byte + 256 : byte;
+      return ("0" + unsigned.toString(16)).slice(-2);
+    })
+    .join("");
+}
+
+function hmacSha256Base64Url_(value, secret) {
+  return Utilities.base64EncodeWebSafe(Utilities.computeHmacSha256Signature(value, secret)).replace(/=+$/, "");
+}
+
+function constantTimeEquals_(left, right) {
+  if (typeof left !== "string" || typeof right !== "string") return false;
+  var maxLength = Math.max(left.length, right.length);
+  var difference = left.length ^ right.length;
+  for (var index = 0; index < maxLength; index += 1) {
+    difference |= (left.charCodeAt(index) || 0) ^ (right.charCodeAt(index) || 0);
+  }
+  return difference === 0;
+}
+
+function isPlainObject_(value) {
+  return value !== null && !Array.isArray(value) && Object.prototype.toString.call(value) === "[object Object]";
+}
+
+function isNonEmptyString_(value) {
+  return typeof value === "string" && value.length > 0;
+}
+
+function isPositiveSafeInteger_(value) {
+  return typeof value === "number" && isFinite(value) && Math.floor(value) === value &&
+    value > 0 && value <= Number.MAX_SAFE_INTEGER;
+}
+
+function success_(result) {
+  return { ok: true, result: result };
+}
+
+function failure_(code, message) {
+  return { ok: false, error: { code: code, message: message } };
+}
+
+function jsonOutput_(value) {
+  return ContentService.createTextOutput(JSON.stringify(value)).setMimeType(ContentService.MimeType.JSON);
+}
+
+function safeErrorMessage_(error) {
+  var message = error && error.message ? String(error.message) : "Unexpected gateway failure.";
+  return message.replace(/[\r\n]+/g, " ").slice(0, 500);
+}

package/dist/adapter/persistence/contracts/index.d.ts

@@ -0,0 +1,3 @@
+/** Adapter-neutral persistence contracts grouped by storage capability. */
+export type { SqlExecutor, SqlGeneratedId, SqlMutationResult, SqlParameter, SqlStorageAdapter, SqlStorageContext, } from "./sql.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/adapter/persistence/contracts/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapter/persistence/contracts/index.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAE3E,YAAY,EACV,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,UAAU,CAAC"}

package/dist/adapter/persistence/contracts/index.js

@@ -0,0 +1,3 @@
+/** Adapter-neutral persistence contracts grouped by storage capability. */
+export {};
+//# sourceMappingURL=index.js.map

package/dist/adapter/persistence/contracts/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/adapter/persistence/contracts/index.ts"],"names":[],"mappings":"AAAA,2EAA2E"}

package/dist/adapter/persistence/contracts/sql.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Adapter-neutral asynchronous SQL primitives used by the sync storage layer.
+ *
+ * The core and storage packages depend on these contracts instead of a
+ * particular ORM. An adapter may implement them with MikroORM today and a
+ * different persistence library later without changing sync semantics.
+ */
+/** Values accepted as bound parameters by the SQLite-backed adapters. */
+export type SqlParameter = string | number | bigint | boolean | Uint8Array | null;
+/** A generated identifier returned by a database mutation when one exists. */
+export type SqlGeneratedId = string | number | bigint;
+/** Observable outcome of one SQL data-definition or data-mutation statement. */
+export interface SqlMutationResult {
+    /** Number of rows changed by the statement. */
+    readonly changes: number;
+    /** Present only when the database reports a generated primary-key value. */
+    readonly lastInsertId?: SqlGeneratedId;
+}
+/**
+ * Executes SQL through the active persistence context.
+ *
+ * Callers must pass parameters separately from SQL text. The implementation
+ * keeps this executor bound to the current transaction when one exists.
+ */
+export interface SqlExecutor {
+    /** Returns every row produced by a query. */
+    all<Row extends object>(sql: string, parameters?: readonly SqlParameter[]): Promise<readonly Row[]>;
+    /** Returns the first query row, or undefined when no row matches. */
+    get<Row extends object>(sql: string, parameters?: readonly SqlParameter[]): Promise<Row | undefined>;
+    /** Runs a statement that changes schema or persisted state. */
+    run(sql: string, parameters?: readonly SqlParameter[]): Promise<SqlMutationResult>;
+}
+/** The adapter-neutral context available to one storage operation. */
+export interface SqlStorageContext {
+    readonly sql: SqlExecutor;
+}
+/**
+ * Owns SQL execution contexts for one SQLite-backed typed-sheets runtime.
+ *
+ * `transaction()` is the only outer write boundary. Every user-entity write,
+ * canonical-state mutation, and outbox append that belongs together must use
+ * the `sql` executor supplied to the callback.
+ */
+export interface SqlStorageAdapter {
+    /** Runs a read using a fresh persistence context with no reused identity map. */
+    read<T>(operation: (context: SqlStorageContext) => Promise<T>): Promise<T>;
+    /** Runs one atomic write transaction and rolls all callback work back on failure. */
+    transaction<T>(operation: (context: SqlStorageContext) => Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=sql.d.ts.map

package/dist/adapter/persistence/contracts/sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.d.ts","sourceRoot":"","sources":["../../../../src/adapter/persistence/contracts/sql.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,yEAAyE;AACzE,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,IAAI,CAAC;AAElF,8EAA8E;AAC9E,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEtD,gFAAgF;AAChF,MAAM,WAAW,iBAAiB;IAChC,+CAA+C;IAC/C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,6CAA6C;IAC7C,GAAG,CAAC,GAAG,SAAS,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,OAAO,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;IAEpG,qEAAqE;IACrE,GAAG,CAAC,GAAG,SAAS,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC;IAErG,+DAA+D;IAC/D,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACpF;AAED,sEAAsE;AACtE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,iFAAiF;IACjF,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAE3E,qFAAqF;IACrF,WAAW,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACnF"}

package/dist/adapter/persistence/contracts/sql.js

@@ -0,0 +1,9 @@
+/**
+ * Adapter-neutral asynchronous SQL primitives used by the sync storage layer.
+ *
+ * The core and storage packages depend on these contracts instead of a
+ * particular ORM. An adapter may implement them with MikroORM today and a
+ * different persistence library later without changing sync semantics.
+ */
+export {};
+//# sourceMappingURL=sql.js.map

package/dist/adapter/persistence/contracts/sql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.js","sourceRoot":"","sources":["../../../../src/adapter/persistence/contracts/sql.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/adapter/persistence/index.d.ts

@@ -0,0 +1,2 @@
+export type { SqlExecutor, SqlGeneratedId, SqlMutationResult, SqlParameter, SqlStorageAdapter, SqlStorageContext, } from "./contracts/index.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/adapter/persistence/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapter/persistence/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC"}

package/dist/adapter/persistence/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.js.map

package/dist/adapter/persistence/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapter/persistence/index.ts"],"names":[],"mappings":""}

package/dist/adapter/persistence/providers/mikro-orm/api/MikroOrmTypedSheetsEntityManager.d.ts

@@ -0,0 +1,53 @@
+/**
+ * MikroORM EntityManager bridge for the adapter-neutral typed-sheets engine.
+ *
+ * Stateful delegation stays in this class. Changeset normalization is kept in
+ * `MikroOrmFlushChanges.ts` so the lifecycle contract can be tested separately
+ * from transaction and identity-map behavior.
+ */
+import type { TypedSheetsEntityData, TypedSheetsEntityEngineManager, TypedSheetsEntityFilter, TypedSheetsEntityFlushListener, TypedSheetsEntityReference, TypedSheetsFindOptions, TypedSheetsForkOptions } from "../../../../../application/orm/api/contracts.js";
+import type { MikroOrmSqliteAdapter, MikroOrmSqliteEntityManager } from "../storage/MikroOrmSqliteAdapter.js";
+/**
+ * Adapts one forked MikroORM manager to the typed-sheets engine contract.
+ *
+ * The subscriber is scoped to this manager instance and ignores events from
+ * other forks, preventing a request-local flush plan from leaking across
+ * identity maps or transactions.
+ */
+export declare class MikroOrmSqliteTypedSheetsEntityManager implements TypedSheetsEntityEngineManager {
+    private readonly storage;
+    private readonly entityManager;
+    private flushListener;
+    constructor(storage: MikroOrmSqliteAdapter, entityManager: MikroOrmSqliteEntityManager);
+    /** Creates a manager with an independent MikroORM identity map. */
+    fork(options?: TypedSheetsForkOptions): TypedSheetsEntityEngineManager;
+    /** Delegates entity construction while keeping MikroORM types inside the adapter. */
+    create<Entity extends object>(entityName: TypedSheetsEntityReference<Entity>, data: TypedSheetsEntityData<Entity>): Entity;
+    /** Reads a filtered entity collection through the local SQLite manager. */
+    find<Entity extends object>(entityName: TypedSheetsEntityReference<Entity>, where: TypedSheetsEntityFilter<Entity>, options?: TypedSheetsFindOptions): Promise<readonly Entity[]>;
+    /** Reads one filtered entity through the local SQLite manager. */
+    findOne<Entity extends object>(entityName: TypedSheetsEntityReference<Entity>, where: TypedSheetsEntityFilter<Entity>, options?: TypedSheetsFindOptions): Promise<Entity | null>;
+    /** Marks one or more entities for MikroORM insertion or update. */
+    persist<Entity extends object>(entity: Entity | Iterable<Entity>): void;
+    /** Marks one or more entities for MikroORM removal. */
+    remove<Entity extends object>(entity: Entity | Iterable<Entity>): void;
+    /** Flushes the current MikroORM unit of work. */
+    flush(): Promise<void>;
+    /** Runs work through MikroORM's transaction boundary. */
+    transactional<Result>(operation: (entityManager: TypedSheetsEntityEngineManager) => Promise<Result>): Promise<Result>;
+    /** Clears MikroORM's request-local identity map. */
+    clear(): void;
+    /** Reports whether this manager already owns a SQLite transaction. */
+    isInTransaction(): boolean;
+    /** Opens the explicit SQLite transaction used by the public facade. */
+    begin(): Promise<void>;
+    /** Commits the explicit SQLite transaction used by the public facade. */
+    commit(): Promise<void>;
+    /** Rolls back the explicit SQLite transaction used by the public facade. */
+    rollback(): Promise<void>;
+    /** Stores the planner that must share this manager's flush transaction. */
+    onFlush(listener: TypedSheetsEntityFlushListener): void;
+    /** Converts a MikroORM flush event into one typed-sheets planning callback. */
+    private coordinateFlush;
+}
+//# sourceMappingURL=MikroOrmTypedSheetsEntityManager.d.ts.map

package/dist/adapter/persistence/providers/mikro-orm/api/MikroOrmTypedSheetsEntityManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MikroOrmTypedSheetsEntityManager.d.ts","sourceRoot":"","sources":["../../../../../../src/adapter/persistence/providers/mikro-orm/api/MikroOrmTypedSheetsEntityManager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EACV,qBAAqB,EACrB,8BAA8B,EAC9B,uBAAuB,EACvB,8BAA8B,EAC9B,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,iDAAiD,CAAC;AAEzD,OAAO,KAAK,EACV,qBAAqB,EACrB,2BAA2B,EAC5B,MAAM,qCAAqC,CAAC;AAE7C;;;;;;GAMG;AACH,qBAAa,sCACX,YAAW,8BAA8B;IAIvC,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAJhC,OAAO,CAAC,aAAa,CAA6C;gBAG/C,OAAO,EAAE,qBAAqB,EAC9B,aAAa,EAAE,2BAA2B;IAO7D,mEAAmE;IACnE,IAAI,CAAC,OAAO,CAAC,EAAE,sBAAsB,GAAG,8BAA8B;IAKtE,qFAAqF;IACrF,MAAM,CAAC,MAAM,SAAS,MAAM,EAC1B,UAAU,EAAE,0BAA0B,CAAC,MAAM,CAAC,EAC9C,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC,GAClC,MAAM;IAKT,2EAA2E;IACrE,IAAI,CAAC,MAAM,SAAS,MAAM,EAC9B,UAAU,EAAE,0BAA0B,CAAC,MAAM,CAAC,EAC9C,KAAK,EAAE,uBAAuB,CAAC,MAAM,CAAC,EACtC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAK7B,kEAAkE;IAC5D,OAAO,CAAC,MAAM,SAAS,MAAM,EACjC,UAAU,EAAE,0BAA0B,CAAC,MAAM,CAAC,EAC9C,KAAK,EAAE,uBAAuB,CAAC,MAAM,CAAC,EACtC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAKzB,mEAAmE;IACnE,OAAO,CAAC,MAAM,SAAS,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI;IAIvE,uDAAuD;IACvD,MAAM,CAAC,MAAM,SAAS,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI;IAItE,iDAAiD;IAC3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B,yDAAyD;IACnD,aAAa,CAAC,MAAM,EACxB,SAAS,EAAE,CAAC,aAAa,EAAE,8BAA8B,KAAK,OAAO,CAAC,MAAM,CAAC,GAC5E,OAAO,CAAC,MAAM,CAAC;IAQlB,oDAAoD;IACpD,KAAK,IAAI,IAAI;IAIb,sEAAsE;IACtE,eAAe,IAAI,OAAO;IAI1B,uEAAuE;IACjE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B,yEAAyE;IACnE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7B,4EAA4E;IACtE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAI/B,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,EAAE,8BAA8B,GAAG,IAAI;IAIvD,+EAA+E;YACjE,eAAe;CAW9B"}