@dopamint-fun/open-sdk 0.2.0-dev.0 → 0.2.0-dev.10

package/dist/session.js

@@ -3,10 +3,11 @@ import { blake2b256 } from "./crypto.js";
 import { equalBytes, fromHex, textBytes, toHex0x } from "./bytes.js";
 import { AGENT_HTTP_CAPABILITY_HEADER, mintAgentHttpCapability, } from "./agentHttp.js";
 import { signRaw } from "./keypair.js";
-import { MAX_TRANSPORT_FRAME_BYTES, decodeAuthorityMessage, decodeEnvelope, encodeAckFrame, encodeEnvelope, encodeSeatAuthSuccessFrame, sessionErrorHint, sessionErrorName, } from "./sessionCodec.js";
+import { MAX_TRANSPORT_FRAME_BYTES, PredictionGateConflictError, SessionBoundaryError, admitAuthorityEvent, decodeAuthorityMessage, freshSessionBoundary, decodeEnvelope, encodeAckFrame, encodeEnvelope, encodeSeatAuthSuccessFrame, sessionErrorHint, sessionErrorName, } from "./sessionCodec.js";
 import { actionSigningBytes, encodeActionFrame, encodeJoinFrame, encodeResumeFrame, joinSigningBytes, requireSessionVersion, resumeSigningBytes, SESSION_VERSION, UnsupportedSessionVersionError, } from "./sessionWire.js";
 import { decodeLegalActions, decodeParticipantView, encodeAction, pickAction, } from "./texas.js";
 import { authorizeSeatChallenge } from "./seatAuth.js";
+import { ownershipFenced } from "./refusal.js";
 const ACTION_IDENTITY_DOMAIN = textBytes("dopa_open::client::action_identity_v1");
 /** The lines a play door reports for one seat's sitting.
  *
@@ -245,7 +246,7 @@ export class SessionClient {
             typeof ceiling !== "number" ||
             !Number.isFinite(ceiling) ||
             ceiling < MAX_TRANSPORT_FRAME_BYTES)
-            throw new Error("authority discovery does not support participant session V2");
+            throw new Error("authority discovery does not support participant session V3");
     }
     async answeredDiscovery() {
         const { boundMs, pauseMs, sleep } = this.discoveryRetry;
@@ -528,13 +529,50 @@ export async function fetchWhileRestarting(fetchImpl, url, retry = {
         await sleep(retry.pauseMs);
     }
 }
+/** Poll product until the committed owner is ready, then return its origin. */
+export async function waitForReadyOwner(args) {
+    const fetchImpl = args.fetchImpl ?? fetch;
+    const sleep = args.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const product = args.productUrl.replace(/\/$/, "");
+    const until = Date.now() + (args.timeoutMs ?? 30_000);
+    const pause = args.pauseMs ?? 200;
+    const id = args.executionId.replace(/^0x/i, "");
+    for (;;) {
+        const response = await fetchImpl(`${product}/v1/authority/executions/${id}/route`);
+        if (response.ok) {
+            const body = (await response.json());
+            if (body.ready && body.sessionOrigin)
+                return { sessionOrigin: body.sessionOrigin, version: body.version ?? 0 };
+        }
+        else {
+            await response.body?.cancel();
+        }
+        if (Date.now() + pause > until)
+            throw new Error("committed owner did not become ready");
+        await sleep(pause);
+    }
+}
+function httpFailure(error) {
+    if (!(error instanceof Error))
+        return null;
+    const match = /^[a-z-]+ failed \((\d+)\): (.*)$/is.exec(error.message);
+    if (!match)
+        return null;
+    const status = Number(match[1]);
+    try {
+        return { status, body: JSON.parse(match[2] ?? "") };
+    }
+    catch {
+        return { status, body: match[2] ?? "" };
+    }
+}
 export async function openSeatSession(args) {
     const fetchImpl = args.fetchImpl ?? fetch;
     const product = args.productUrl.replace(/\/$/, "");
     /* Read again while the product is coming back: a seat reopens its session
        after every dropped stream, and the product answering 502 for the seconds
        it restarts ended the seat as surely as a refusal would have. */
-    const offer = await fetchWhileRestarting(fetchImpl, `${product}/open/v1/playground/matches/${args.offerId}`, args.restartRetry);
+    const offer = await fetchWhileRestarting(fetchImpl, `${product}/v1/playground/matches/${args.offerId}`, args.restartRetry);
     if (!offer.ok)
         throw new Error(`offer read failed (${offer.status}): ${await offer.text()}`);
     const record = (await offer.json());
@@ -581,7 +619,7 @@ export async function openSeatSession(args) {
 }
 export async function playSeat(args) {
     const fetchImpl = args.fetchImpl ?? fetch;
-    const { client, product, executionHex, coordinatorKey, timeAuthorityKey, executionId, } = await openSeatSession(args);
+    let { client, product, executionHex, coordinatorKey, timeAuthorityKey, executionId, } = await openSeatSession(args);
     const record = {
         admission: {
             execution_id: executionId,
@@ -611,6 +649,11 @@ export async function playSeat(args) {
     let pending = null;
     let lastContext = null;
     let lastCursor = { sequence: 0n, witnessedReceipt: null };
+    /* What this seat has accepted: the event sequence, the receipt floor, the
+       view it was last shown, and the named gate phase it holds. Every event
+       goes through it before anything is acknowledged, so the two doors -- this
+       loop and `openTurn` -- refuse the same streams for the same reasons. */
+    let accepted = freshSessionBoundary();
     const inbox = [];
     let joined = await client.join();
     if (joined.context)
@@ -634,7 +677,17 @@ export async function playSeat(args) {
         if (message.type === "actionPending" ||
             message.type === "actionAcknowledged")
             return null;
-        if (message.type === "predictionGateReleased") {
+        if (message.type === "predictionGatePrepared" ||
+            message.type === "predictionGateOpened" ||
+            message.type === "predictionGateReleased") {
+            /* A named notice moves no receipt and carries no view: it is accepted,
+               acknowledged, and waited on. Only the real view that follows a
+               release is a turn to decide. */
+            const admitted = admitAuthorityEvent(accepted, message);
+            if (admitted.disposition !== "applied")
+                return null;
+            accepted = admitted.boundary;
+            lastContext = message.context;
             await client.acknowledge(message.context, message.cursor, originToken);
             lastCursor = message.cursor;
             return null;
@@ -642,8 +695,16 @@ export async function playSeat(args) {
         if ("context" in message)
             lastContext = message.context;
         if (message.type === "sessionTerminal") {
-            await client.acknowledge(message.context, message.cursor, originToken);
-            lastCursor = message.cursor;
+            const admitted = admitAuthorityEvent(accepted, message);
+            /* A re-delivered terminal is this boundary's own last event - a resume
+               at the terminal cursor repeats it. There is nothing to apply and its
+               acknowledgement is spent, but the sitting is over either way and the
+               caller still needs what `consent` takes. */
+            if (admitted.disposition === "applied") {
+                accepted = admitted.boundary;
+                await client.acknowledge(message.context, message.cursor, originToken);
+                lastCursor = message.cursor;
+            }
             return {
                 outcome: "terminal",
                 committedActions,
@@ -660,52 +721,61 @@ export async function playSeat(args) {
         }
         let view = null;
         let cursor = null;
-        if (message.type === "sessionJoined") {
-            view = message.view;
-            cursor = message.cursor;
-        }
-        else if (message.type === "participantView") {
+        if (message.type === "sessionJoined" ||
+            message.type === "participantView" ||
+            message.type === "actionCommitted" ||
+            message.type === "actionRejected" ||
+            message.type === "sessionResumed") {
             view = message.view;
             cursor = message.cursor;
         }
-        else if (message.type === "actionCommitted") {
-            pending = null;
-            committedActions += 1;
-            view = message.view;
-            cursor = message.cursor;
-        }
-        else if (message.type === "actionRejected") {
-            pending = null;
-            view = message.view;
-            cursor = message.cursor;
-        }
-        else if (message.type === "sessionResumed") {
-            view = message.view;
-            cursor = message.cursor;
-        }
-        if (view &&
-            view.legalActions.length === 0 &&
-            !elimination.eliminated &&
-            Date.now() - lastIdleTableReadMs >= IDLE_TABLE_READ_MS) {
-            /* Nothing to decide: somebody else's turn, a hand this seat folded, or
-               a sitting this seat is out of. Read now and then, so the hand lines go
-               on and a seat that has lost its last chip says so once. */
-            lastIdleTableReadMs = Date.now();
-            const idle = await readPublicTable(fetchImpl, product, executionHex, names, tableCapability);
-            if (idle && idle.handNumber !== lastHandSeen) {
-                lastHandSeen = idle.handNumber;
-                args.onHand?.({
-                    number: idle.handNumber,
-                    stack: idle.seats.find((entry) => entry.seat === args.seat)?.stack ?? null,
-                });
+        if (cursor !== null && lastContext) {
+            /* Accepted before anything else happens: a refusal here leaves the
+               retained boundary untouched and nothing acknowledged. */
+            const admitted = admitAuthorityEvent(accepted, message);
+            /* A re-delivery is the suffix a resume repeats. It was applied and
+               acknowledged once, so nothing here moves for it: no view, no pending
+               resolution, no commit count, no table read, no decision, no
+               acknowledgement. */
+            if (admitted.disposition !== "applied")
+                return null;
+            accepted = admitted.boundary;
+            /* Resolved only for the applied event, so a replayed commit cannot
+               count twice or drop a proposal that is still in flight. */
+            if (message.type === "actionCommitted") {
+                pending = null;
+                committedActions += 1;
             }
-            if (elimination.observe(idle))
-                args.onEliminated?.();
-        }
-        if (view && cursor !== null && lastContext) {
-            const nonceKey = view.state.nonce.toString();
+            else if (message.type === "actionRejected")
+                pending = null;
+            if (view &&
+                view.legalActions.length === 0 &&
+                !elimination.eliminated &&
+                Date.now() - lastIdleTableReadMs >= IDLE_TABLE_READ_MS) {
+                /* Nothing to decide: somebody else's turn, a hand this seat folded, or
+                   a sitting this seat is out of. Read now and then, so the hand lines go
+                   on and a seat that has lost its last chip says so once. */
+                lastIdleTableReadMs = Date.now();
+                const idle = await readPublicTable(fetchImpl, product, executionHex, names, tableCapability);
+                if (idle && idle.handNumber !== lastHandSeen) {
+                    lastHandSeen = idle.handNumber;
+                    args.onHand?.({
+                        number: idle.handNumber,
+                        stack: idle.seats.find((entry) => entry.seat === args.seat)?.stack ??
+                            null,
+                    });
+                }
+                if (elimination.observe(idle))
+                    args.onEliminated?.();
+            }
+            const nonceKey = view?.state.nonce.toString() ?? "";
             const now = BigInt(Date.now());
-            if (view.legalActions.length > 0 &&
+            if (
+            /* A viewless admission is acknowledged and waited on: a held seat has
+               nothing to answer, and nothing to infer on, until its gate releases
+               and the real view arrives. */
+            view !== null &&
+                view.legalActions.length > 0 &&
                 !acted.has(nonceKey) &&
                 view.participantDeadlineMs > now) {
                 const legal = decodeLegalActions(view.legalActions);
@@ -876,6 +946,12 @@ export async function playSeat(args) {
                look successful while the seat cannot read the gated stream. */
             if (error instanceof UnsupportedSessionVersionError)
                 throw error;
+            /* Nor is a refused projection: the event the authority sent is one this
+               contract forbids, and resuming would fetch the same bytes again while
+               the loop reported it as flaky transport. */
+            if (error instanceof SessionBoundaryError ||
+                error instanceof PredictionGateConflictError)
+                throw error;
             if (!lastContext || reconnects >= 5)
                 throw error;
             /* Three refusals, three answers. A gone session (`UnknownSession`, or a
@@ -885,6 +961,22 @@ export async function playSeat(args) {
                client joined this seat with this key; fighting it back would evict
                a reconnect that may be the operator's own, so this one steps aside
                and says so. Everything else is transient, and resume is right. */
+            const failed = httpFailure(error);
+            if (failed?.status === 409 && ownershipFenced(failed.body)) {
+                const ready = await waitForReadyOwner({
+                    productUrl: product,
+                    executionId: executionHex,
+                    fetchImpl,
+                    timeoutMs: 30_000,
+                    pauseMs: 200,
+                });
+                client = new SessionClient(ready.sessionOrigin, args.agent, args.seat, args.agentId, client.executionId, client.executionManifestDigest, client.clientNonce, fetchImpl);
+                client.token = originToken;
+                await client.resume(lastContext, lastCursor);
+                originToken = client.token ?? originToken;
+                reconnects += 1;
+                continue;
+            }
             const answer = afterRefusal(error);
             if (answer === "step-aside")
                 return {
@@ -907,6 +999,12 @@ export async function playSeat(args) {
                 if (joined.context)
                     lastContext = joined.context;
                 lastCursor = { sequence: 0n, witnessedReceipt: null };
+                /* A rejoin is a new session: nothing the old one retained - its phase,
+                   its floor, its sequence - describes this one, and only a boundary
+                   this loop opened itself may be reset. The stale inbox belongs to
+                   the session that is gone. */
+                accepted = freshSessionBoundary();
+                inbox.length = 0;
                 inbox.push(...joined.messages);
                 rejoins += 1;
                 reconnects += 1;
@@ -960,7 +1058,7 @@ export function normaliseCardCode(code) {
 export async function readDisclosedEntitlement(fetchImpl, product, executionId, seat, capability, options = {}) {
     const attempts = options.attempts ?? 15;
     const pauseMs = options.pauseMs ?? 1_000;
-    const target = `/open/v1/spectator/executions/${executionId}`;
+    const target = `/v1/spectator/executions/${executionId}`;
     for (let attempt = 0; attempt < attempts; attempt += 1) {
         try {
             const header = capability ? await capability("GET", target) : null;
@@ -988,7 +1086,7 @@ export async function readDisclosedEntitlement(fetchImpl, product, executionId,
  *  gone -- which is precisely the moment this question is being asked. */
 export async function readSittingStatus(fetchImpl, product, executionHex) {
     try {
-        const response = await fetchImpl(`${product}/open/v1/history/matches/${executionHex}`);
+        const response = await fetchImpl(`${product}/v1/history/matches/${executionHex}`);
         if (!response.ok)
             return { state: "unknown" };
         const wire = (await response.json());
@@ -1029,7 +1127,7 @@ export function agentReadCapability(agent, agentId) {
 export async function readPublicTable(fetchImpl, product, executionHex, names = new Map(), capability) {
     /* Bound to the target the server reconstructs from the request, which is the
        origin-form path and not the absolute URL the fetch is given. */
-    const target = `/open/v1/spectator/executions/${executionHex}`;
+    const target = `/v1/spectator/executions/${executionHex}`;
     try {
         const header = capability ? await capability("GET", target) : null;
         const response = await fetchImpl(`${product}${target}`, header === null
@@ -1090,14 +1188,14 @@ export async function readPublicTable(fetchImpl, product, executionHex, names =
         return null;
     }
 }
-/** What an agent is called, from `GET /open/v1/agents/{id}/custody`, read
+/** What an agent is called, from `GET /v1/agents/{id}/custody`, read
  *  once and remembered in `names`. Null where the read did not answer. */
 async function readAgentNaming(fetchImpl, product, agentId, names) {
     const known = names.get(agentId);
     if (known !== undefined)
         return known;
     try {
-        const response = await fetchImpl(`${product}/open/v1/agents/${agentId}/custody`);
+        const response = await fetchImpl(`${product}/v1/agents/${agentId}/custody`);
         if (!response.ok) {
             names.set(agentId, null);
             return null;
@@ -1120,7 +1218,7 @@ async function readAgentNaming(fetchImpl, product, agentId, names) {
  *  table: an empty list where the read did not answer. */
 export async function readTableTalk(fetchImpl, product, executionHex, handIndex) {
     try {
-        const response = await fetchImpl(`${product}/open/v1/executions/${executionHex}/talk`);
+        const response = await fetchImpl(`${product}/v1/executions/${executionHex}/talk`);
         if (!response.ok)
             return [];
         const wire = (await response.json());
@@ -1156,7 +1254,7 @@ function potChips(pot) {
 /** File one line at the table, signed as this seat's agent. True when the
  *  product accepted it. */
 async function sayAtTable(fetchImpl, product, executionHex, args, say) {
-    const target = `/open/v1/executions/${executionHex}/talk`;
+    const target = `/v1/executions/${executionHex}/talk`;
     const body = textBytes(JSON.stringify({ say }));
     try {
         const { header } = await mintAgentHttpCapability(args.agent, args.agentId, {

package/dist/sessionCodec.d.ts

@@ -11,6 +11,9 @@ export declare const SESSION_ERROR_TAG = 13;
 export declare const SEAT_AUTHORIZATION_CHALLENGE_TAG = 15;
 export declare const SEAT_AUTHORIZATION_RESPONSE_TAG = 16;
 export declare const PREDICTION_GATE_RELEASED_TAG = 17;
+export declare const PREDICTION_GATE_PREPARED_TAG = 18;
+export declare const PREDICTION_GATE_OPENED_TAG = 19;
+export declare const PREDICTION_GATE_RELEASED_V4_TAG = 20;
 export declare const MAX_TRANSPORT_FRAME_BYTES: number;
 export interface WireEnvelope {
     message: string;
@@ -57,12 +60,83 @@ export interface SeatAuthChallenge {
     coordinatorProof: Uint8Array;
     coordinatorPublicKey: Uint8Array;
 }
+/** ADR-0096's ceiling on added pacing for one next-action prediction window,
+ *  as `arena_session::prediction_gate::MAX_PREDICTION_PACING_MS`. */
+export declare const MAX_PREDICTION_PACING_MS = 25000n;
+/** The in-play window a gate names. The session reuses this identity; it
+ *  never mints a second one. */
+export interface PredictionWindowRef {
+    windowId: bigint;
+    marketId: bigint;
+    /** The only contract kind a gate can hold a seat behind (wire tag 1). */
+    contract: "pokerActionV1";
+}
+/** A durably committed preparation: the frozen window identity, the target
+ *  the acting seat is held on, its original committed deadline, and the
+ *  persisted instant publication started. */
+export interface PredictionGatePreparation {
+    window: PredictionWindowRef;
+    actingSeat: number;
+    state: StateRef;
+    receipt: ReceiptRef | null;
+    originalDeadlineMs: bigint;
+    preparedAtMs: bigint;
+}
+/** Acknowledged publication. `closesAtMs` is the service-committed close
+ *  instant, never the action deadline. */
+export interface PredictionGateOpening {
+    preparation: PredictionGatePreparation;
+    openedAtMs: bigint;
+    closesAtMs: bigint;
+}
+/** The terminal overlay: how the gate closed, and the bounded same-receipt
+ *  deadline it admits. `lockCappedMs` and `participantDeadlineMs` are derived
+ *  the way the shared crate derives them, so a recipient never has to repeat
+ *  the arithmetic to know which later deadline is legal. */
+export interface PredictionGateRelease {
+    window: PredictionWindowRef;
+    actingSeat: number;
+    state: StateRef;
+    receipt: ReceiptRef | null;
+    terminal: "locked" | "cancelled";
+    originalDeadlineMs: bigint;
+    arrivalMs: bigint;
+    lockedAtMs: bigint;
+    lockCappedMs: bigint;
+    budgetMs: bigint;
+    participantDeadlineMs: bigint;
+    /** Digest of the protected LLM terminal decision, when bound. A release
+     *  with none is the version-three notice; a bound one is version four. */
+    terminalDigest: Uint8Array | null;
+}
+/** The gate facts a participant retains for one revision. */
+export type PredictionGateStatus = {
+    phase: "prepared";
+    preparation: PredictionGatePreparation;
+} | {
+    phase: "open";
+    opening: PredictionGateOpening;
+} | {
+    phase: "released";
+    release: PredictionGateRelease;
+};
+/** One named lifecycle step, as a value: what the fold below applies. */
+export type PredictionGateMessage = {
+    kind: "prepared";
+    preparation: PredictionGatePreparation;
+} | {
+    kind: "opened";
+    opening: PredictionGateOpening;
+} | {
+    kind: "released";
+    release: PredictionGateRelease;
+};
 export type AuthorityMessage = {
     type: "sessionJoined";
     context: SessionContext;
     sequence: bigint;
     policy: SessionPolicy;
-    view: ViewSnapshot;
+    view: ViewSnapshot | null;
     cursor: ResumeCursor;
 } | {
     type: "participantView";
@@ -98,7 +172,10 @@ export type AuthorityMessage = {
     type: "sessionResumed";
     context: SessionContext;
     sequence: bigint;
-    view: ViewSnapshot;
+    /** The boundary the authority replayed from. It must precede the event
+        itself, or the resume names a suffix it cannot have replayed. */
+    replayFrom: bigint;
+    view: ViewSnapshot | null;
     cursor: ResumeCursor;
 } | {
     type: "sessionTerminal";
@@ -108,10 +185,23 @@ export type AuthorityMessage = {
     finalState: StateRef;
     cursor: ResumeCursor;
     finalReceipt: ReceiptRef | null;
+} | {
+    type: "predictionGatePrepared";
+    context: SessionContext;
+    sequence: bigint;
+    preparation: PredictionGatePreparation;
+    cursor: ResumeCursor;
+} | {
+    type: "predictionGateOpened";
+    context: SessionContext;
+    sequence: bigint;
+    opening: PredictionGateOpening;
+    cursor: ResumeCursor;
 } | {
     type: "predictionGateReleased";
     context: SessionContext;
     sequence: bigint;
+    release: PredictionGateRelease;
     cursor: ResumeCursor;
 } | {
     type: "error";
@@ -131,6 +221,19 @@ export declare function sessionErrorName(tag: number): string;
  *  join supersedes the older binding, and the older client's next message
  *  finds its session gone. Both used to read as transport flakiness. */
 export declare function sessionErrorHint(tag: number): string | null;
+export declare function equalStateRef(left: StateRef, right: StateRef): boolean;
+export declare function equalReceiptRef(left: ReceiptRef | null, right: ReceiptRef | null): boolean;
+export declare function equalPredictionGatePreparation(left: PredictionGatePreparation, right: PredictionGatePreparation): boolean;
+export declare function equalPredictionGateRelease(left: PredictionGateRelease, right: PredictionGateRelease): boolean;
+/** The structural refusals of `PredictionGatePreparation::new`, made wherever
+ *  a preparation enters this process - the wire, or a retained seat state. */
+export declare function bindPredictionGatePreparation(fields: PredictionGatePreparation): PredictionGatePreparation;
+/** The structural refusals of `PredictionGateOpening::new`. */
+export declare function bindPredictionGateOpening(fields: PredictionGateOpening): PredictionGateOpening;
+/** The structural refusals of `PredictionGateRelease::new`, with the bounded
+ *  overlay derived here rather than trusted from a sender or a stored file:
+ *  the lock instant capped at the pacing ceiling, plus the budget. */
+export declare function bindPredictionGateRelease(fields: Omit<PredictionGateRelease, "lockCappedMs" | "participantDeadlineMs">): PredictionGateRelease;
 export declare function decodeAuthorityMessage(bytes: Uint8Array): AuthorityMessage;
 export declare function encodeSeatAuthSuccessFrame(context: SessionContext, actionId: Uint8Array, signature: Uint8Array): Uint8Array;
 export declare function extractProtocolInput(payload: Uint8Array): Uint8Array;
@@ -143,3 +246,60 @@ export declare function takePrincipalProof(bytes: Uint8Array): {
     signature: Uint8Array;
     rest: Uint8Array;
 };
+/** A refused phase transition, named as the shared crate names it. */
+export declare class PredictionGateConflictError extends Error {
+    readonly conflict: "PredictionGatePhaseConflict" | "PredictionGateReleaseConflict";
+    constructor(conflict: "PredictionGatePhaseConflict" | "PredictionGateReleaseConflict", detail: string);
+}
+/** The lifecycle step an authority message carries, or null where it carries
+ *  none. The fold takes the value, not the envelope. */
+export declare function predictionGateMessage(message: AuthorityMessage): PredictionGateMessage | null;
+/** The committed preparation behind any phase, or null once released - a
+ *  release carries the identity but not the persisted preparation instant. */
+export declare function predictionGatePreparationOf(status: PredictionGateStatus): PredictionGatePreparation | null;
+/** The receipt the gate targets. A recipient behind it still receives every
+ *  notice, because each notice cursor names that recipient's own floor. */
+export declare function predictionGateTargetReceipt(status: PredictionGateStatus): ReceiptRef | null;
+/** Whether a newly named preparation supersedes the retained facts.
+ *
+ *  Only a released gate can be superseded: a held gate's turn has not closed,
+ *  so a second preparation contradicts it. Once released, the next selected
+ *  turn always targets a later committed state and therefore its own receipt.
+ *  A seat that is itself withheld for that next turn never witnesses the view
+ *  that would otherwise retire the closed gate - which is exactly the second
+ *  window of a hand, held on the seat that was a bystander for the first. A
+ *  preparation naming the same revision is the same-target conflict, not a
+ *  supersession. */
+export declare function predictionGateSupersededByPreparation(status: PredictionGateStatus, nextTurn: PredictionGatePreparation): boolean;
+export declare function applyPredictionGateStatus(current: PredictionGateStatus | null, message: PredictionGateMessage): PredictionGateStatus;
+export interface AcceptedSessionBoundary {
+    context: SessionContext | null;
+    /** The last accepted authority event sequence; zero before the first. */
+    sequence: bigint;
+    receiptFloor: ReceiptRef | null;
+    /** The view last disclosed to this seat, or null while it is withheld. */
+    view: ViewSnapshot | null;
+    predictionGate: PredictionGateStatus | null;
+    /** Whether a viewless admission still owes its named prepared prefix. */
+    awaitingGatePrefix: boolean;
+}
+/** A refused event, named as `SessionSemanticError` names it. */
+export declare class SessionBoundaryError extends Error {
+    readonly reason: string;
+    constructor(reason: string, detail: string);
+}
+/** The boundary a seat that has accepted nothing holds. */
+export declare function freshSessionBoundary(): AcceptedSessionBoundary;
+/** What the seam did with an event.
+ *
+ *  `applied` is the only disposition that moved the boundary, and so the only
+ *  one a consumer may act on: a re-delivery was applied and acknowledged once
+ *  already, and acting on it a second time would decide a turn that is over,
+ *  count a commit twice, or walk the acknowledged cursor backwards. */
+export type AuthorityEventDisposition = "applied" | "replay" | "boundaryless";
+export interface AdmittedAuthorityEvent {
+    disposition: AuthorityEventDisposition;
+    /** The boundary to retain. Unchanged unless the event was applied. */
+    boundary: AcceptedSessionBoundary;
+}
+export declare function admitAuthorityEvent(accepted: AcceptedSessionBoundary, message: AuthorityMessage): AdmittedAuthorityEvent;