@mengine/medeo-client 1.0.1-alpha.2 → 1.1.0

package/dist/index.d.ts

@@ -1,5 +1,4 @@
-import { t as index_d_exports } from "./index-6e5cbdM3.js";
-import { $ as VideoClipPart, A as TrackItemDraft, B as derivePositionFromAbs, C as isImplementedSemanticOpKind, D as PartIdFactory, E as ValidationError, F as assertValidVideoDocument, G as PartKind, H as toVideoDocument, I as validateVideoDocument, J as Timeline, K as PartUnion, L as DerivedItemPosition, M as VideoDocumentMirrorSchema, N as videoDocumentMirrorSchema, O as generatePartId, P as VideoDocumentValidationError, Q as VIDEO_DOCUMENT_SCHEMA_VERSION, R as SpeechHostMap, S as SemanticOpKind, T as SnapshotReadable, U as BgmPart, V as fromVideoDocument, W as CaptionPart, X as TrackItem, Y as Track, Z as TrackItemTimePosition, _ as SemanticOpName, a as PlainMemoryAdapter, at as effectiveVideoClipDurationMs, b as ImplementedSemanticOpKind, c as MirrorVideoDocumentAdapter, ct as CaptionPart$1, d as createMirrorVideoDocumentAdapter, dt as SpeedShift, et as VideoDocument, f as writeVideoDocumentToDraft, ft as Timeline$1, g as SemanticOpInput, h as SemanticEditor, i as JournalEntry, it as VideoDraft, j as VideoDocumentDraft, k as TrackDraft, l as MirrorVideoDocumentOptions, lt as CaptionStyle, m as SemanticDocumentAdapter, mt as TrackItem$1, n as videoDocumentSchema, nt as VideoDocumentValidationIssue, o as PlainMemoryAdapterOptions, ot as speedOf, p as CommitOptions, pt as Track$1, q as SpeechPart, r as readVideoDocumentFromDraft, rt as VideoDocumentValidationIssueCode, s as createPlainMemoryAdapter, st as Attachment, t as partUnionSchema, tt as VideoDocumentSchemaVersion, u as createMirrorVideoDocument, ut as PartAggregation, v as TransactAudit, w as SchemaValidator, x as PlannedSemanticOpKind, y as IMPLEMENTED_SEMANTIC_OP_KINDS, z as buildSpeechHostMap } from "./index-DRUGsbm2.js";
+import { $ as VideoDocumentValidationIssue, A as assertValidVideoDocument, B as BgmPart, C as index_d_exports, D as VideoDocumentMirrorSchema, E as VideoDocumentDraft, F as SpeechHostMap, G as Timeline, H as PartKind, I as buildSpeechHostMap, J as TrackItemTimePosition, K as Track, L as derivePositionFromAbs, M as InitialDocumentFacts, N as buildInitialVideoDocument, O as videoDocumentMirrorSchema, P as DerivedItemPosition, Q as VideoDocumentSchemaVersion, R as fromVideoDocument, S as ValidationError, T as TrackItemDraft, U as PartUnion, V as CaptionPart, W as SpeechPart, X as VideoClipPart, Y as VIDEO_DOCUMENT_SCHEMA_VERSION, Z as VideoDocument, _ as PlannedSemanticOpKind, a as MirrorVideoDocumentOptions, at as CaptionStyle, b as SchemaValidator, c as CommitOptions, ct as Timeline$1, d as SemanticEditor, et as VideoDocumentValidationIssueCode, f as SemanticOpInput, g as ImplementedSemanticOpKind, h as IMPLEMENTED_SEMANTIC_OP_KINDS, i as MirrorVideoDocumentAdapter, it as CaptionPart$1, j as validateVideoDocument, k as VideoDocumentValidationError, l as OpActor, lt as Track$1, m as TransactAudit, n as videoDocumentSchema, nt as VideoDraftPartUnion, o as createMirrorVideoDocument, ot as PartAggregation, p as SemanticOpName, q as TrackItem, r as readVideoDocumentFromDraft, rt as Attachment, s as createMirrorVideoDocumentAdapter, st as SpeedShift, t as partUnionSchema, tt as VideoDraft, u as SemanticDocumentAdapter, ut as TrackItem$1, v as SemanticOpKind, w as TrackDraft, x as SnapshotReadable, y as isImplementedSemanticOpKind, z as toVideoDocument } from "./index-BUKA3L7o.js";
 import { PeerID } from "loro-crdt";
 import { DocState } from "@mengine/sync";
 import { BaseDocStorage, Connection, DocDiff, DocSnapshotRecord, DocStorage, DocStorageOptions, DocUpdate, DocUpdateRecord } from "@mengine/storage";
@@ -25,6 +24,16 @@ interface MengineUpdateMeta {
   semantic_op: string | null;
   payload: unknown;
   intent: string | null;
+  /**
+   * Who authored the op, as recorded in the Loro commit message (see `OpActor`).
+   * Null for writes with no acting user — bootstrap, repair — and for Changes
+   * written before attribution existed. Self-reported by the authoring client;
+   * the server does not verify it against the request identity.
+   */
+  actor: {
+    user_id: string;
+    role: string;
+  } | null;
   message: string | null;
   parse_error: boolean;
   peer: string;
@@ -99,6 +108,26 @@ declare class MengineHttpRequestError extends Error {
   readonly payload: unknown;
   constructor(status: number, payload: unknown);
 }
+/**
+ * A push the server refused on its merits (`kind: 'rejected'`), as opposed to a
+ * transport failure. Carries the server's machine `code` so callers can branch on
+ * *why* rather than on an HTTP status:
+ *
+ * - `missing_dependency` (server answers 409) — retryable: the update depends on
+ *   ops the server log lacks, so catching up and re-exporting resolves it.
+ * - `corrupt_update` (server answers 422) — never valid, retrying cannot help.
+ *
+ * Distinct from {@link MengineHttpRequestError} (transport/status-level failure)
+ * and from a raw `fetch` rejection (network down): the three are separate classes
+ * so a caller can tell "the server said no" from "the server never answered".
+ */
+declare class MenginePushRejectedError extends Error {
+  readonly code: string;
+  readonly serverMessage: string;
+  readonly serverVersion: MengineDocumentVersion | undefined;
+  readonly status: number | undefined;
+  constructor(code: string, serverMessage: string, serverVersion: MengineDocumentVersion | undefined, status: number | undefined);
+}
 declare class MengineHttpClient {
   private readonly options;
   private readonly fetchImpl;
@@ -113,7 +142,24 @@ declare class MengineHttpClient {
   sync(fromVV?: Uint8Array): Promise<MengineSyncResponse>;
   /** Audit trail: extracted metadata per accepted update, in log order. */
   audit(): Promise<MengineAuditResponse>;
-  pushUpdate(update: Uint8Array, baseVersion?: unknown): Promise<MenginePushUpdateResponse>;
+  /**
+   * Append one Loro update to the server log.
+   *
+   * Resolves for both accepted outcomes and hands the verdict back verbatim —
+   * `ack` (appended, `update_seq` allocated) and `duplicate` (already known, no
+   * row appended). A `duplicate` is NOT an error, but it is also not an ack: it
+   * means the bytes contributed nothing, so a caller waiting for its own write to
+   * land must be able to tell them apart. Hence the verdict is returned rather
+   * than collapsed into `void`.
+   *
+   * Rejections raise {@link MenginePushRejectedError} carrying the server's
+   * machine `code`. The server answers them with 409/422, so the failure arrives
+   * as a non-ok response; this method re-reads the parsed body to recover `code` /
+   * `server_version` instead of leaving the caller a bare status. Transport-level
+   * failures stay {@link MengineHttpRequestError}, and a dead network keeps
+   * surfacing as the underlying `fetch` rejection.
+   */
+  pushUpdate(update: Uint8Array): Promise<MenginePushUpdateResponse>;
   eventsUrl(): string;
   headers(): Headers;
   fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
@@ -131,23 +177,33 @@ interface MengineEventStreamOptions {
 }
 declare function readMengineEventStream(options: MengineEventStreamOptions): Promise<void>;
 //#endregion
-//#region src/editor/journal.d.ts
+//#region src/editor/id-gen.d.ts
 /**
- * Wire a plain-memory adapter + editor that share a recording id factory, so
- * every mutating transact lands in `journal` with ordered `generated_ids`.
+ * Part-id generation, aligned with the online ecosystem.
+ *
+ * The authoritative online producers — agent-harness (`@harness/shared`
+ * `genObjId`) and director.v2 (`common/obj_id.py` `gen_obj_id`) — both mint part
+ * ids as `` `${prefix}_${ulid()}` ``, and real captured drafts use exactly that
+ * shape (`clip_…` / `spe_…` / `cap_…` / `bgm_…`, each a 26-char ULID). The engine
+ * previously emitted `vc_<base36 timestamp><6 random>`, a different prefix AND a
+ * different encoding — the sole cross-repo id divergence. This module removes it
+ * by emitting the same `<prefix>_<ULID>` bytes.
+ *
+ * The ULID is generated inline (Crockford Base32, 48-bit time + 80-bit random)
+ * rather than pulling the `ulid` npm package: the randomness class matches the
+ * old generator (both `Math.random`-based) and it keeps `@mengine/medeo-client`
+ * dependency-free for a purely mechanical id string. Part ids only need to be
+ * unique and lexicographically time-sortable, which this satisfies.
  */
-declare function createEditSandbox(document: VideoDocument, options?: PlainMemoryAdapterOptions): {
-  adapter: PlainMemoryAdapter;
-  editor: SemanticEditor;
-  journal: readonly JournalEntry[];
-};
 /**
- * Re-drive `doc` from a recorded journal, forcing each entry's `generated_ids`
- * through a queue-backed id factory. Never mints fresh ids: an empty queue on
- * demand throws `unrecorded id`; leftover ids after an entry throws
- * `unconsumed ids`. Legacy entries without `generated_ids` are treated as `[]`.
+ * Online part-id semantic prefixes. `clip` (video clip) is the only value the
+ * engine currently mints (see `addVideoClips`); the rest are declared so the
+ * type documents the shared vocabulary and guards against reintroducing the old
+ * `vc`/`sp`/`cp`/`bg` names. Speech/caption/bgm ids arrive pre-minted in op
+ * payloads, so the engine never generates them itself.
  */
-declare function replayJournal(doc: SemanticDocumentAdapter, journal: readonly JournalEntry[]): Promise<void>;
+type PartIdPrefix = 'clip' | 'spe' | 'cap' | 'bgm' | 'ti';
+declare function generatePartId(prefix: PartIdPrefix): string;
 //#endregion
 //#region src/editor/snapshot-utils.d.ts
 /** Main-track item identity read from a raw snapshot (only `part_id` is needed). */
@@ -171,6 +227,355 @@ declare function readPart(snapshot: unknown, partId: string): (Record<string, un
   part_kind?: PartKind;
 }) | null;
 //#endregion
+//#region src/manual-sync/types.d.ts
+/**
+ * Opaque marker for "the document state I last looked at".
+ *
+ * Deliberately not a number. Under mengine there is no monotonic document
+ * version to compare: `meta.version` is stamped once at legacy ingest and then
+ * frozen, and the server's `update_seq` counts every writer's pushes, so neither
+ * can answer "has this document changed since I last read it". The answer comes
+ * from comparing version vectors.
+ *
+ * Opaque means: no arithmetic, no ordering, no comparison other than handing it
+ * back to {@link ManualSyncDoc.hasChangedSince}. Two version vectors are only
+ * partially ordered — concurrent ones are neither greater nor equal, and Loro's
+ * own `compare` returns `undefined` for them — so `mark1 > mark2` or sorting a
+ * list of marks has no meaning to get wrong.
+ *
+ * Persisting one IS supported, via {@link encodeDocVersionMark} /
+ * {@link decodeDocVersionMark}. Storing an opaque blob and reading it back does
+ * not order or compute anything, and callers that compare across turns (rather
+ * than within one process) need it: the legacy integer version this replaces was
+ * itself persisted between agent turns.
+ */
+interface DocVersionMark {
+  readonly __brand: 'mengine-doc-version-mark';
+  /** Encoded oplog `VersionVector` at the moment the mark was taken. */
+  readonly encoded: Uint8Array;
+}
+/** Why a `pull()` did not complete. Mirrors the push failure taxonomy. */
+type PullFailureReason = 'failed';
+/**
+ * Result of a `pull()`.
+ *
+ * `ok: false` is a first-class outcome, not an exception: per the M2/A ruling a
+ * failed pull must not hard-fail the tool call, matching legacy's tolerance for
+ * read failures (`getDraftVersion` swallows to null, `DraftVersionDetector`
+ * catches and skips). The caller decides whether to proceed on a possibly-stale
+ * document, so the degradation has to be visible in the return value.
+ */
+type PullResult = {
+  ok: true; /** True when the pull actually advanced the local document. */
+  changed: boolean;
+} | {
+  ok: false;
+  reason: PullFailureReason;
+  error: Error;
+};
+/**
+ * What the server did with a `push()`.
+ *
+ * The first four mirror the server's verdict taxonomy (see `PushOutcomeKind`);
+ * `nothing_to_push` is a local short-circuit — no request was made because the
+ * document holds no ops the server lacks.
+ */
+type PushResultKind = 'ack' | 'duplicate' | 'rejected' | 'failed' | 'nothing_to_push';
+/**
+ * Result of a `push()`.
+ *
+ * `collaborated` is the load-bearing field. The legacy Drizzle path fails loudly
+ * on concurrent writes (`Optimistic lock failed`); mengine merges silently by
+ * design (M0/S2 accepted CRDT merge semantics). Migrating without surfacing this
+ * would replace a path that reports conflicts with one that hides them, so every
+ * successful push says whether the server held ops the local document did not.
+ *
+ * Its meaning is "the server has ops you don't", NOT "there was a conflict" — the
+ * same user's other browser tab counts. It is therefore suitable for driving a
+ * re-pull and for informing the caller, but not for raising an alarm on its own.
+ */
+interface PushResult {
+  kind: PushResultKind;
+  /** Server-allocated sequence number; only present for `ack`. */
+  updateSeq?: number | undefined;
+  /** Whether the server held ops the local document lacked. See above. */
+  collaborated: boolean;
+  /** Server machine code for `rejected` (`missing_dependency` / `corrupt_update`). */
+  code?: string | undefined;
+  /** Underlying error for `rejected` / `failed`. */
+  error?: Error | undefined;
+}
+//#endregion
+//#region src/manual-sync/doc-version-mark.d.ts
+/**
+ * Encode a {@link DocVersionMark} for storage or transport.
+ *
+ * The mark stays opaque across the round trip — the string is not a version
+ * number and must not be compared, ordered, or parsed. Its only use is
+ * {@link decodeDocVersionMark} followed by `hasChangedSince`.
+ *
+ * Callers that persist this should know the encoded length grows with the number
+ * of peers that have ever written to the document (one counter each), and the FE
+ * mints a fresh peer per page load. Still small in practice (a few hundred bytes
+ * for dozens of peers), but it grows with document age rather than size; version
+ * vector compaction is deferred to a later phase.
+ */
+declare function encodeDocVersionMark(mark: DocVersionMark): string;
+/**
+ * Rebuild a mark from {@link encodeDocVersionMark}'s output.
+ *
+ * Returns `undefined` for input this did not produce (a legacy integer version,
+ * a truncated value, an empty string). That is the honest answer — "I cannot
+ * establish what you last saw" — and callers should treat it as "no baseline"
+ * rather than as "unchanged". Decoding does not validate the bytes as a version
+ * vector; `hasChangedSince` reports "changed" for an undecodable mark, which is
+ * the conservative direction.
+ */
+declare function decodeDocVersionMark(encoded: string): DocVersionMark | undefined;
+//#endregion
+//#region src/manual-sync/manual-sync-doc.d.ts
+interface ManualSyncDocOptions {
+  client: MengineHttpClient;
+  /**
+   * Peer id for this writer. Every writer needs a distinct one: two writers
+   * sharing a peer and branching from the same base emit identical
+   * `(peer, counter)` pairs, the server classifies the second as `duplicate` and
+   * drops it, and the write is silently lost. Callers mint a random one (see the
+   * harness's `mintHarnessPeerId`).
+   */
+  peerId?: PeerID;
+}
+/**
+ * Agent-facing document with explicit `pull()` / `push()` over one Loro
+ * document, with no background sync (ADR 0015 D1–D4).
+ *
+ * It deliberately does NOT reuse `MengineDocSession`'s stack. That stack —
+ * SSE + local `DocStorage` + `ClientServerSynchronizer` + `DocManager` — is
+ * correct for a browser editor and actively wrong here:
+ *
+ * - Its retry backoff lands *outside* the tool-call lifetime, so a write can
+ *   settle seconds after the tool already told the LLM what happened.
+ * - It has no durable local queue in the harness, so pending pushes die with the
+ *   process — that is lost data, reported as success.
+ * - Agent semantics require the document to change only at points the agent can
+ *   name. If it converged on its own between tool calls, "what state was this
+ *   decision based on" would be unanswerable, and a remote change could land
+ *   mid-edit.
+ *
+ * What replaces the whole background job queue is one variable: the **watermark**,
+ * the version the server has confirmed. `push()` exports `{mode:'update', from:
+ * watermark}` and only advances it on a confirmed verdict, so a failed push is
+ * retried implicitly — the next push carries both the failed ops and any new
+ * ones, in one blob. No queue, no timer, no retry bookkeeping.
+ *
+ * Two non-obvious properties of that watermark, both verified against a real
+ * server in the ADR 0015 spike:
+ *
+ * - It can legitimately *lead* the local document (it carries other peers'
+ *   counters). Exporting `from` a leading watermark does not error; the blob
+ *   correctly contains only the local peer's new ops. So a collaborative merge
+ *   does not force a pull before pushing.
+ * - Therefore every emptiness/coverage test must be one-directional containment,
+ *   never equality. See {@link covers}.
+ *
+ * Lifecycle: one `LoroDoc` per document, shared across agent loops with a
+ * refcount held by the caller's session registry. Rebuilding the doc per tool
+ * call would mint a new peer each time and permanently inflate the document's
+ * version vector for every future reader.
+ *
+ * Not thread-safe by design and it does not need to be: harness tool calls run
+ * serially (`execToolCalls` is a `for` + `await`).
+ */
+declare class ManualSyncDoc {
+  private readonly client;
+  private readonly doc;
+  private readonly adapter;
+  readonly editor: SemanticEditor;
+  /**
+   * The version the server is known to hold. Starts empty (nothing confirmed)
+   * and only ever moves forward on a verdict that proves the server took our ops.
+   */
+  private watermark;
+  private constructor();
+  /**
+   * Open an existing server document.
+   *
+   * Fetches the snapshot up front rather than starting empty and converging: the
+   * agent's first act is to read the document, so there is no useful state before
+   * the snapshot lands. This also fails fast and loudly on a document that does
+   * not exist, instead of `MengineDocSession.waitForContent()`'s behavior of
+   * waiting forever for content that will never arrive.
+   */
+  static open(options: ManualSyncDocOptions): Promise<ManualSyncDoc>;
+  /** Current document read model (authoritative shape). */
+  snapshot(): VideoDocument;
+  /**
+   * The Loro peer this document writes as.
+   *
+   * Exposed because the peer is an externally-meaningful fact, not an internal
+   * detail: it is the identity every op this document emits is attributed to, and
+   * callers mint it under rules of their own (the harness reserves a range so a
+   * peer id alone says "Agent wrote this"). Being able to read it back means those
+   * rules can be verified against the live document rather than against whatever
+   * was passed to the constructor.
+   */
+  editorPeerId(): PeerID;
+  /** Current document projected to the legacy `VideoDraft` read shape. */
+  draft(): VideoDraft;
+  /**
+   * Mark the document state the caller has just observed, for a later
+   * {@link hasChangedSince}.
+   *
+   * This pair replaces the legacy integer-version comparison that
+   * `DraftVersionDetector` used to tell the LLM "the draft was modified
+   * externally, reload before editing". Under mengine `meta.version` never
+   * changes, so that detector would go permanently silent; comparing version
+   * vectors restores the same capability.
+   *
+   * Same capability, not a stronger one: like the legacy detector, this only
+   * reports what changed between two moments the caller chose to sample.
+   */
+  versionMark(): DocVersionMark;
+  /**
+   * Has the document moved since `mark` was taken?
+   *
+   * Reports any advance, whoever caused it — including this document's own edits.
+   * The caller decides what is interesting: a detector sampling once per turn is
+   * asking "did anything happen", and its own edits legitimately count.
+   */
+  hasChangedSince(mark: DocVersionMark): boolean;
+  /**
+   * Fetch and merge everything the server has that this document lacks.
+   *
+   * Must run *before* the editor on each tool call. `SemanticEditor` validates
+   * against the local document, so editing a stale one validates against a world
+   * that no longer exists: the ADR 0015 spike confirmed that without pull-first
+   * an edit to a clip another writer had already deleted passes validation and is
+   * accepted by the server. Pulling afterwards cannot undo that.
+   *
+   * A failure is returned, not thrown — a transient network blip must not make
+   * the tool unusable (M2/A ruling; legacy tolerates read failures the same way).
+   * The caller proceeds on a possibly-stale document knowingly.
+   */
+  pull(): Promise<PullResult>;
+  /**
+   * Push every local op the server has not confirmed, and report the verdict.
+   *
+   * The return value is the durability answer a tool needs before claiming
+   * success: only `ack` / `duplicate` mean the server holds the ops. This is why
+   * this class exists rather than an ack-waiter — with a direct call, "did it
+   * land" is simply the result.
+   *
+   * `duplicate` counts as durable: the bytes added nothing *because* the server
+   * already had them.
+   */
+  push(): Promise<PushResult>;
+  /** Decode a wire `server_vv`, tolerating absence/corruption (never throws). */
+  private serverVVFrom;
+}
+//#endregion
+//#region src/storage/medeo-http-doc-storage.d.ts
+interface MedeoHttpDocStorageOptions {
+  docId: string;
+  client: MengineHttpClient;
+  sseReconnectDelayMs?: number;
+  readonlyMode?: boolean;
+}
+/**
+ * What the server did with one pushed update, as observed by this storage.
+ *
+ * `ack` / `duplicate` mirror the server verdict. `rejected` is a refusal on the
+ * merits (carrying the machine `code`: `missing_dependency` is retryable after
+ * catch-up, `corrupt_update` never is). `failed` is everything else — transport
+ * error, non-2xx status, dead network — i.e. the server's answer is unknown.
+ *
+ * The four are kept distinct because the recovery differs per case, and because
+ * the whole point of M1 is that a caller can tell "written" from "not written".
+ */
+type PushOutcomeKind = 'ack' | 'duplicate' | 'rejected' | 'failed';
+interface PushOutcome {
+  kind: PushOutcomeKind;
+  /** Server-allocated sequence number; only present for `ack`. */
+  updateSeq?: number | undefined;
+  /**
+   * The server oplog version vector *after* handling this push (`ack` and
+   * `duplicate` both carry it; encoded `VersionVector`).
+   *
+   * This is what an "is my write durable" waiter keys on, and it is deliberately
+   * the ONLY correlation handle here. An earlier revision also carried the pushed
+   * bytes so a waiter could match its own update; that was removed because byte
+   * identity is not a reliable match — the same ops can reach the server either
+   * as the individual blob the push job carried or as a merged
+   * `export({from: serverVV})` blob produced by the synchronizer's sync path.
+   * Version coverage is reliable, and it makes `duplicate` satisfy a waiter
+   * correctly: the bytes appended nothing precisely because the server already
+   * held them. Offering both invited the wrong one.
+   */
+  serverVV?: Uint8Array | undefined;
+  /** Server machine code for `rejected` (e.g. `missing_dependency`). */
+  code?: string | undefined;
+  /** The underlying error for `rejected` / `failed`. */
+  error?: Error | undefined;
+}
+/**
+ * Adapts the mengine-server HTTP/SSE protocol to the engine `DocStorage`
+ * contract so `ClientServerSynchronizer` can treat it as a remote peer.
+ *
+ * Deliberately thin (mirrors the socket `DocStorage` in the playground): it
+ * forwards live SSE updates and exposes a version-vector diff, and keeps NO
+ * sync state of its own.
+ *
+ * - `getDocDiff(docId, knownVersion)` pulls the server-computed VV-diff via
+ *   `GET /sync?from=<vv>` — the synchronizer passes the real `doc.version()`, so
+ *   the response carries exactly the ops the doc is missing. `getDoc` (full
+ *   `/snapshot`) stays for cold start, when the caller holds no version yet.
+ * - `pushDocUpdate` forwards a Loro update; the server appends it.
+ * - `subscribeDocUpdate` registers a callback for live SSE updates. It does no
+ *   catch-up and keeps no cursor: after an SSE drop the connection reports a
+ *   status change, and the synchronizer re-runs its cycle to catch up via
+ *   `getDocDiff(doc.version())`. `LoroDoc.import` is idempotent (OpId/VV), so
+ *   re-forwarded or echoed updates are harmless.
+ *
+ * It is bound to a single `docId` because `MengineHttpClient` is per-document.
+ */
+declare class MedeoHttpDocStorage implements DocStorage {
+  private readonly options;
+  readonly connection: Connection;
+  private readonly client;
+  private readonly docId;
+  private readonly events;
+  constructor(options: MedeoHttpDocStorageOptions);
+  get isReadonly(): boolean;
+  getDoc(docId: string): Promise<DocSnapshotRecord | null>;
+  getDocDiff(docId: string, knownVersion?: Uint8Array): Promise<DocDiff | null>;
+  /**
+   * Forward one update to the server.
+   *
+   * The `DocStorage` contract returns `void`, so the server's verdict cannot be
+   * the return value — it is published on {@link subscribePushOutcome} instead,
+   * for BOTH outcomes and failures. That channel is what makes the push
+   * observable; previously the verdict was read and dropped, so a `duplicate`
+   * (bytes contributed nothing) was indistinguishable from a successful write.
+   *
+   * The error is still rethrown after being published: the synchronizer treats a
+   * throw as "retry this cycle", and swallowing it here would strand the update.
+   * Publishing is therefore additive observability, not error handling.
+   */
+  pushDocUpdate(update: DocUpdate, _origin: unknown): Promise<void>;
+  /**
+   * Observe the server's verdict for every pushed update, including failures.
+   *
+   * This is the loud channel the `void`-returning `DocStorage.pushDocUpdate`
+   * cannot express. Consumers that need "did my write land" (the agent's
+   * tool-level ack wait) subscribe here.
+   */
+  subscribePushOutcome(callback: (outcome: PushOutcome) => void): () => void;
+  deleteDoc(_docId: string): Promise<void>;
+  subscribeDocUpdate(callback: (update: DocUpdate, origin: unknown) => void): () => void;
+  private assertDocId;
+  private emitUpdate;
+}
+//#endregion
 //#region src/session/types.d.ts
 /**
  * Local storage contract the runtime depends on. Aliased to the engine
@@ -185,6 +590,34 @@ interface MengineDocSessionUpdateEvent {
   source: 'remote' | 'local';
   snapshot: VideoDocument;
 }
+/**
+ * Raised by {@link MengineDocSession.waitForServerAck} when the local edits it
+ * was asked to confirm were not acknowledged as durable.
+ *
+ * Named `...AckFailed`, not `...AckTimeout`: two of the three `reason` values are
+ * not timeouts, and the earlier name made callers reach for a retry-after-delay
+ * that is wrong for `rejected`.
+ *
+ * The distinction the caller needs is "was it written": if this throws, treat the
+ * write as NOT durable. `reason` says which failure it was, and `code` carries the
+ * server's machine code when the push was rejected on its merits:
+ *
+ * - `timeout` — no verdict within the deadline. Ambiguous by nature: the push may
+ *   still land later. The caller should surface it as unconfirmed, not as "failed".
+ * - `rejected` — the server refused. `missing_dependency` is retryable after
+ *   catch-up; `corrupt_update` never is.
+ * - `failed` — transport/network failure; the server's answer is unknown.
+ */
+declare class MengineAckFailedError extends Error {
+  readonly reason: 'timeout' | 'rejected' | 'failed';
+  readonly code: string | undefined;
+  readonly cause: Error | undefined;
+  constructor(reason: 'timeout' | 'rejected' | 'failed', code: string | undefined, cause: Error | undefined, message: string);
+}
+interface WaitForServerAckOptions {
+  /** Deadline in ms. Rejects with reason `timeout` when it elapses. */
+  timeoutMs?: number;
+}
 interface MengineDocSessionOptions {
   docId: string;
   client: MengineHttpClient;
@@ -230,7 +663,44 @@ declare class MengineDocSession {
   private adapterValue;
   private editorValue;
   private started;
+  /**
+   * Latest server oplog version seen on a push outcome. Lets `waitForServerAck`
+   * return without waiting when the server is already known to cover the local
+   * doc (e.g. nothing was edited since the last confirmed push).
+   */
+  private serverVVValue;
   constructor(options: MengineDocSessionOptions);
+  /**
+   * Observe every push verdict, including `duplicate` and failures.
+   *
+   * Exposed so a host can log/meter the four outcomes (rfc/05 §3 asks for
+   * explicit ack/rejected semantics). Most callers want the higher-level
+   * {@link waitForServerAck} instead.
+   */
+  subscribePushOutcome(callback: (outcome: PushOutcome) => void): () => void;
+  /**
+   * Resolve once the server has durably accepted the local document state as of
+   * *now* — the capability an Agent tool needs to answer "did my edit land?"
+   * before reporting success.
+   *
+   * Call it right after the editor ops whose durability matters. It snapshots the
+   * local doc's current version and resolves on the first push outcome whose
+   * `serverVV` covers that version, i.e. the server log is at least as advanced as
+   * the local doc was when this was called.
+   *
+   * Version coverage, not byte identity, is the acceptance test — for two reasons:
+   * the ops may reach the server inside a merged blob rather than as the exact
+   * bytes a push job carried, and a `duplicate` verdict then correctly satisfies
+   * the wait (the bytes appended nothing *because* the server already had them).
+   * A `rejected` / `failed` outcome rejects immediately with that reason rather
+   * than burning the whole timeout, since neither will resolve by waiting.
+   *
+   * Returns early when the server is already known to be current, so a caller
+   * with nothing outstanding does not block.
+   *
+   * @throws {MengineAckFailedError} on timeout, rejection, or transport failure.
+   */
+  waitForServerAck(options?: WaitForServerAckOptions): Promise<void>;
   /**
    * The editor for local edits. Each op method validates, writes, and commits
    * itself as one SemanticOp (single commit carrying its audit message), so
@@ -238,18 +708,6 @@ declare class MengineDocSession {
    * step. The committed change drives DocManager's local-update push.
    */
   get editor(): SemanticEditor;
-  /**
-   * Opaque version token of the local oplog (base64 `VersionVector.encode`).
-   * Equality-comparable only: equal means no observed change (local or
-   * remote-arrived) since the token was taken. Throws when not started.
-   */
-  version(): string;
-  /**
-   * The live document adapter, exposed for journal replay (commit channel).
-   * Replaying through it still goes SemanticEditor → Loro → mengine-server —
-   * no write bypass. Typed by the narrow interface on purpose.
-   */
-  get documentAdapter(): SemanticDocumentAdapter;
   /** Current document snapshot (read model). */
   snapshot(): VideoDocument;
   /**
@@ -277,51 +735,6 @@ declare class MengineDocSession {
   private hasContent;
 }
 //#endregion
-//#region src/storage/medeo-http-doc-storage.d.ts
-interface MedeoHttpDocStorageOptions {
-  docId: string;
-  client: MengineHttpClient;
-  sseReconnectDelayMs?: number;
-  readonlyMode?: boolean;
-}
-/**
- * Adapts the mengine-server HTTP/SSE protocol to the engine `DocStorage`
- * contract so `ClientServerSynchronizer` can treat it as a remote peer.
- *
- * Deliberately thin (mirrors the socket `DocStorage` in the playground): it
- * forwards live SSE updates and exposes a version-vector diff, and keeps NO
- * sync state of its own.
- *
- * - `getDocDiff(docId, knownVersion)` pulls the server-computed VV-diff via
- *   `GET /sync?from=<vv>` — the synchronizer passes the real `doc.version()`, so
- *   the response carries exactly the ops the doc is missing. `getDoc` (full
- *   `/snapshot`) stays for cold start, when the caller holds no version yet.
- * - `pushDocUpdate` forwards a Loro update; the server appends it.
- * - `subscribeDocUpdate` registers a callback for live SSE updates. It does no
- *   catch-up and keeps no cursor: after an SSE drop the connection reports a
- *   status change, and the synchronizer re-runs its cycle to catch up via
- *   `getDocDiff(doc.version())`. `LoroDoc.import` is idempotent (OpId/VV), so
- *   re-forwarded or echoed updates are harmless.
- *
- * It is bound to a single `docId` because `MengineHttpClient` is per-document.
- */
-declare class MedeoHttpDocStorage implements DocStorage {
-  private readonly options;
-  readonly connection: Connection;
-  private readonly client;
-  private readonly docId;
-  private readonly events;
-  constructor(options: MedeoHttpDocStorageOptions);
-  get isReadonly(): boolean;
-  getDoc(docId: string): Promise<DocSnapshotRecord | null>;
-  getDocDiff(docId: string, knownVersion?: Uint8Array): Promise<DocDiff | null>;
-  pushDocUpdate(update: DocUpdate, _origin: unknown): Promise<void>;
-  deleteDoc(_docId: string): Promise<void>;
-  subscribeDocUpdate(callback: (update: DocUpdate, origin: unknown) => void): () => void;
-  private assertDocId;
-  private emitUpdate;
-}
-//#endregion
 //#region src/storage/memory-doc-storage.d.ts
 /**
  * Runtime-neutral local `DocStorage` backed by in-process memory.
@@ -530,6 +943,25 @@ interface SolvedVideoDocument {
   aggregations: PartAggregation[];
   durationMs: number;
   partLibrary: Record<string, PartUnion>;
+  /**
+   * Part ids of the gap fillers this solve minted.
+   *
+   * They exist only inside the solve: gap filling needs them so the clips after a
+   * gap land at the right absolute time, but they are not authoritative state and
+   * the read view does not carry them (see `fromVideoDocument`).
+   *
+   * Reported as ids rather than left for the caller to detect, because the caller
+   * *cannot* detect them. The obvious predicate — `origin_media_id === ''` — also
+   * matches an empty clip a writer placed on purpose (`batch_replace_video_clip_sequence`
+   * documents "Omit to create an empty clip placeholder"), and those are
+   * authoritative parts that must survive the projection. The mint callback is the
+   * only place that knows the difference.
+   *
+   * Note this deliberately excludes the fillers that gap filling *extended* rather
+   * than minted (`fillMainTrackTimeGaps` cases 1 and 2): those are authoritative
+   * empty clips already in `part_library`, and only their length is derived.
+   */
+  derivedFillerPartIds: Set<string>;
 }
 /**
  * Solve a `VideoDocument` (authoritative, position-only) into its derived
@@ -539,13 +971,48 @@ interface SolvedVideoDocument {
 declare function solveVideoDocument(document: VideoDocument): SolvedVideoDocument;
 /** The named container a secondary lane lives in. */
 type SecondaryLane = 'speech' | 'caption' | 'bgm';
+/** A lane's track kind: the `video_clip` main lane plus the three secondary lanes. */
+type LaneKind = SecondaryLane | 'video_clip';
+/**
+ * The four lanes in top-to-bottom stack order — the order a `tracks` list holds
+ * them in (see {@link laneRank}).
+ *
+ * Exported so a document can be seeded with all four lanes up front. That seed is
+ * not cosmetic: {@link ensureLaneTrack} is find-then-mint over a `LoroMovableList`,
+ * so two concurrent writers that each mint the same absent lane both keep their
+ * row, and the merged document holds two tracks for one lane. For the main lane
+ * that is fatal — `videoDocumentSchema` allows at most one `video_clip` track, so
+ * the merged document stops being projectable at all, symmetrically on both
+ * replicas. Pre-seeding every lane makes `ensureLaneTrack` always take its find
+ * branch, which removes the race by construction rather than by detection.
+ *
+ * What closes the race is that a track with the lane's `parts_kind` EXISTS — the
+ * lookup is by kind, not by id. So a seed is only safe if it covers every lane:
+ * a partial seed leaves the uncovered lanes exactly as exposed as before.
+ */
+declare const LANE_KINDS_IN_STACK_ORDER: readonly LaneKind[];
+/**
+ * The conventional track id for a lane (`main_track`, `<kind>_track`). Shared by
+ * the up-front seed and {@link ensureLaneTrack}'s lazy mint so a document's lane
+ * ids do not depend on which of the two created the track.
+ *
+ * Ids are cosmetic to the merge itself — lane lookup goes by `parts_kind`, so
+ * drifting them apart would not reopen the concurrent-mint race. They matter to
+ * readers that address a lane by id (the FE editor's panes, fixtures), which is
+ * why there is one convention rather than two.
+ */
+declare function laneTrackId(kind: LaneKind): string;
 /**
  * Locate a lane's track row in the single `tracks` list by kind, minting an empty
  * row in lane-stacking order if absent (reference/17 §4: lane = `parts_kind`).
  * Ops use this to write authoritative items onto the right lane. The track id
- * mirrors the seed convention (`<kind>_track`).
+ * comes from {@link laneTrackId}, shared with the up-front seed.
+ *
+ * The mint branch is a concurrency hazard, not a convenience: see
+ * {@link LANE_KINDS_IN_STACK_ORDER}. A document seeded with all four lanes never
+ * reaches it.
  */
-declare function ensureLaneTrack(draft: VideoDocumentDraft, kind: SecondaryLane | 'video_clip'): TrackDraft;
+declare function ensureLaneTrack(draft: VideoDocumentDraft, kind: LaneKind): TrackDraft;
 /** Find a secondary lane's track row without minting it. */
 declare function findLaneTrack(draft: VideoDocumentDraft, kind: SecondaryLane): TrackDraft | undefined;
 //#endregion
@@ -592,4 +1059,4 @@ declare function hostForAbsMs(ranges: MainClipRange[], absMs: number): MainClipR
  */
 declare function relativePositionForAbs(ranges: MainClipRange[], absMs: number): TrackItemTimePosition;
 //#endregion
-export { type Aggregation, type Attachment, type BgmPart, type CaptionPart, type CaptionStyle, type CommitOptions, type DerivedItemPosition, type DocStorageLike, IMPLEMENTED_SEMANTIC_OP_KINDS, type ImplementedSemanticOpKind, type JournalEntry, type MainClipRange, type MakeEmptyPart, MedeoHttpDocStorage, type MedeoHttpDocStorageOptions, MemoryDocStorage, type MengineAuditEntry, type MengineAuditResponse, MengineDocSession, type MengineDocSessionOptions, type MengineDocSessionUpdateEvent, type MengineDocumentVersion, type MengineEventStreamOptions, MengineHttpClient, type MengineHttpClientOptions, MengineHttpRequestError, type MenginePushResponse, type MenginePushUpdateResponse, type MengineRejectedResponse, type MengineSnapshotResponse, type MengineSseUpdateEvent, type MengineSyncResponse, type MengineUpdateMeta, MirrorVideoDocumentAdapter, type MirrorVideoDocumentOptions, type PartAggregation, type PartIdFactory, type PartKind, type PartUnion, PlainMemoryAdapter, type PlainMemoryAdapterOptions, type PlannedSemanticOpKind, SchemaValidator, type SemanticDocumentAdapter, SemanticEditor, type SemanticOpInput, type SemanticOpKind, type SemanticOpName, type SnapshotReadable, type SolvedVideoDocument, type SpeechHostMap, type SpeechPart, type SpeedShift, TIMELINE_SKELETON_DURATION_MS, type Timeline, type TimelineDoc, type TimelineItem, type Track, type TrackDraft, type TrackItem, type TrackItemDraft, type TrackItemTimePosition, type TransactAudit, VIDEO_DOCUMENT_SCHEMA_VERSION, ValidationError, type VideoClipPart, type VideoDocument, type VideoDocumentDraft, type VideoDocumentMirrorSchema, type VideoDocumentSchemaVersion, VideoDocumentValidationError, type VideoDocumentValidationIssue, type VideoDocumentValidationIssueCode, type VideoDraft, type CaptionPart$1 as VideoDraftCaptionPart, type Timeline$1 as VideoDraftTimeline, type Track$1 as VideoDraftTrack, type TrackItem$1 as VideoDraftTrackItem, arrangeMainTrackSeamlessly, assertValidVideoDocument, base64ToBytes, buildSpeechHostMap, bytesToBase64, cascadeAfterVideoClipChanges, createEditSandbox, createMirrorVideoDocument, createMirrorVideoDocumentAdapter, createPlainMemoryAdapter, derivePositionFromAbs, effectiveVideoClipDurationMs, ensureLaneTrack, fillMainTrackTimeGaps, findLaneTrack, fromVideoDocument, generatePartId, getAt, hostForAbsMs, isEmptyVideoClip, isImplementedSemanticOpKind, isMap, mainTrackRanges, partDurationMs, partUnionSchema, readMainTrackItems, readMengineEventStream, readPart, readPartDurationMs, readVideoDocumentFromDraft, reassignSpeechesToVideoClipsByTime, recalculateTimelineDuration, relativePositionForAbs, replayJournal, resolveAllSpeechOverlaps, resolveSpeechOverlapByShiftingVideos, safeDurationMs, index_d_exports as schemas, snapshotToPlain, solveVideoDocument, speedOf, syncAggregatedClipsTimePosition, toVideoDocument, validateVideoDocument, videoDocumentMirrorSchema, videoDocumentSchema, writeVideoDocumentToDraft };
+export { type Aggregation, type Attachment, type BgmPart, type CaptionPart, type CaptionStyle, type CommitOptions, type DerivedItemPosition, type DocStorageLike, type DocVersionMark, IMPLEMENTED_SEMANTIC_OP_KINDS, type ImplementedSemanticOpKind, type InitialDocumentFacts, LANE_KINDS_IN_STACK_ORDER, type LaneKind, type MainClipRange, type MakeEmptyPart, ManualSyncDoc, type ManualSyncDocOptions, MedeoHttpDocStorage, type MedeoHttpDocStorageOptions, MemoryDocStorage, MengineAckFailedError, type MengineAuditEntry, type MengineAuditResponse, MengineDocSession, type MengineDocSessionOptions, type MengineDocSessionUpdateEvent, type MengineDocumentVersion, type MengineEventStreamOptions, MengineHttpClient, type MengineHttpClientOptions, MengineHttpRequestError, MenginePushRejectedError, type MenginePushResponse, type MenginePushUpdateResponse, type MengineRejectedResponse, type MengineSnapshotResponse, type MengineSseUpdateEvent, type MengineSyncResponse, type MengineUpdateMeta, MirrorVideoDocumentAdapter, type MirrorVideoDocumentOptions, type OpActor, type PartAggregation, type PartKind, type PartUnion, type PlannedSemanticOpKind, type PullFailureReason, type PullResult, type PushOutcome, type PushOutcomeKind, type PushResult, type PushResultKind, SchemaValidator, type SemanticDocumentAdapter, SemanticEditor, type SemanticOpInput, type SemanticOpKind, type SemanticOpName, type SnapshotReadable, type SolvedVideoDocument, type SpeechHostMap, type SpeechPart, type SpeedShift, TIMELINE_SKELETON_DURATION_MS, type Timeline, type TimelineDoc, type TimelineItem, type Track, type TrackDraft, type TrackItem, type TrackItemDraft, type TrackItemTimePosition, type TransactAudit, VIDEO_DOCUMENT_SCHEMA_VERSION, ValidationError, type VideoClipPart, type VideoDocument, type VideoDocumentDraft, type VideoDocumentMirrorSchema, type VideoDocumentSchemaVersion, VideoDocumentValidationError, type VideoDocumentValidationIssue, type VideoDocumentValidationIssueCode, type VideoDraft, type CaptionPart$1 as VideoDraftCaptionPart, type VideoDraftPartUnion, type Timeline$1 as VideoDraftTimeline, type Track$1 as VideoDraftTrack, type TrackItem$1 as VideoDraftTrackItem, type WaitForServerAckOptions, arrangeMainTrackSeamlessly, assertValidVideoDocument, base64ToBytes, buildInitialVideoDocument, buildSpeechHostMap, bytesToBase64, cascadeAfterVideoClipChanges, createMirrorVideoDocument, createMirrorVideoDocumentAdapter, decodeDocVersionMark, derivePositionFromAbs, encodeDocVersionMark, ensureLaneTrack, fillMainTrackTimeGaps, findLaneTrack, fromVideoDocument, generatePartId, getAt, hostForAbsMs, isEmptyVideoClip, isImplementedSemanticOpKind, isMap, laneTrackId, mainTrackRanges, partDurationMs, partUnionSchema, readMainTrackItems, readMengineEventStream, readPart, readPartDurationMs, readVideoDocumentFromDraft, reassignSpeechesToVideoClipsByTime, recalculateTimelineDuration, relativePositionForAbs, resolveAllSpeechOverlaps, resolveSpeechOverlapByShiftingVideos, safeDurationMs, index_d_exports as schemas, snapshotToPlain, solveVideoDocument, syncAggregatedClipsTimePosition, toVideoDocument, validateVideoDocument, videoDocumentMirrorSchema, videoDocumentSchema };