@swal/edge-mesh 0.0.0-stage → 0.1.0

package/dist/web/oplog/log.js

@@ -0,0 +1,693 @@
+// OpLog: per-device append-only, signed, hash-chained operation logs with capability-gated application.
+//
+// Ingest pipeline (serialized):
+//   shape/size/instance -> duplicate? -> author key known? (else pending) -> signature -> fork check (same seq,
+//   different id = equivocation) -> chain (gap = pending, prev mismatch = equivocation, HLC must increase) ->
+//   future HLC? (pending) -> append to the author's chain -> verdict.
+// Verdict (pure, recomputed whenever trust changes): equivocation cut -> app `validate` -> TrustStore.can(author,
+//   module, level(action), { seq, time: hlc wall }). Ops in the chain with a negative verdict are "held" in
+//   quarantine and re-evaluated; the accepted set (and so every projection) is a function of (ops, trust docs).
+import { canonicalBytes, contentId } from "../trust/canonical.js";
+import { SIG_ALG, signCanonical, verifyCanonical, } from "../trust/keys.js";
+import { compareHlc, createHlc, hlcWall, isHlc } from "./hlc.js";
+import { MemoryOpStore, MemoryQuarantineStore, } from "./store.js";
+export class OpLogError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+const isObj = (x) => !!x && typeof x === "object" && !Array.isArray(x);
+const isStr = (x, max = 256) => typeof x === "string" && x.length > 0 && x.length <= max;
+const isOptStr = (x, max = 256) => x === undefined || isStr(x, max);
+const vkey = (author, seq) => `${author}:${seq}`;
+function opShape(x) {
+    if (!isObj(x) || x.t !== "op")
+        return "not an op";
+    if (x.v !== 1 || x.alg !== SIG_ALG)
+        return "unsupported version/alg";
+    if (!isStr(x.inst) || !isStr(x.author) || !isStr(x.sig, 4500))
+        return "missing fields";
+    if (typeof x.seq !== "number" || !Number.isSafeInteger(x.seq) || x.seq < 1)
+        return "bad seq";
+    if (x.seq === 1 ? x.prev !== null : !isStr(x.prev))
+        return "bad prev";
+    if (!isHlc(x.hlc))
+        return "bad hlc";
+    if (!isStr(x.module, 64) ||
+        !isStr(x.action, 128) ||
+        !isStr(x.entity, 128) ||
+        !isStr(x.entityId, 256)) {
+        return "bad module/action/entity";
+    }
+    if (!isOptStr(x.base) || !isOptStr(x.actor))
+        return "bad base/actor";
+    return null;
+}
+const bodyOfOp = (op) => {
+    const { sig: _sig, ...body } = op;
+    return body;
+};
+/** Total order used by projections: (hlc, author, seq). */
+export const compareOps = (a, b) => compareHlc(a.hlc, b.hlc) ||
+    (a.author < b.author ? -1 : a.author > b.author ? 1 : 0) ||
+    a.seq - b.seq;
+export async function openOpLog(opts) {
+    const log = new OpLog(opts);
+    await log.load();
+    return log;
+}
+export class OpLog {
+    trust;
+    inst;
+    store;
+    quarantine;
+    signer;
+    validateFn;
+    now;
+    maxSkewMs;
+    maxPending;
+    maxPendingBytes;
+    maxPendingPerAuthor;
+    maxPendingUnknown;
+    maxPendingUnknownBytes;
+    pendingBytes = 0;
+    unknownCount = 0;
+    unknownBytes = 0;
+    pendingPerAuthor = new Map();
+    /** BL2: op id -> pending key of ops parked for an anchor (backward resolution walks `prev` ids) */
+    anchorIds = new Map();
+    /** finding 6: pending keys of ops parked for an anchor, per `author:seq` (at most 2 per seq) */
+    anchorBySeq = new Map();
+    maxOpBytes;
+    clock;
+    verdicts = new Map();
+    modulesOf = new Map();
+    equiv = new Map();
+    pendingOps = new Map(); // key author:seq:sig
+    /** S3: author -> highest anchored seq whose STORED op is not the anchored one (its history <= that seq is void) */
+    offAnchor = new Map();
+    listeners = new Map();
+    queue = Promise.resolve();
+    changed = new Set();
+    unsubscribeTrust;
+    constructor(opts) {
+        this.trust = opts.trust;
+        this.inst = opts.trust.inst;
+        this.store = opts.store ?? new MemoryOpStore();
+        this.quarantine = opts.quarantine ?? new MemoryQuarantineStore();
+        this.signer = opts.signer;
+        this.validateFn = opts.validate;
+        this.now = opts.now ?? Date.now;
+        this.maxSkewMs = opts.maxSkewMs ?? 10 * 60_000;
+        this.maxPending = opts.maxPending ?? 10_000;
+        this.maxPendingBytes = opts.maxPendingBytes ?? 16 * 1024 * 1024;
+        this.maxPendingPerAuthor = opts.maxPendingPerAuthor ?? 1024;
+        this.maxPendingUnknown =
+            opts.maxPendingUnknown ?? Math.max(1, Math.floor(this.maxPending / 10));
+        this.maxPendingUnknownBytes = opts.maxPendingUnknownBytes ?? 1024 * 1024;
+        this.maxOpBytes = opts.maxOpBytes ?? 32 * 1024;
+        this.clock = createHlc(this.now);
+        this.unsubscribeTrust = this.trust.onChange(() => void this.reevaluate());
+    }
+    /** Rebuild in-memory indexes from the stores (no events). */
+    async load() {
+        await this.serial(async () => {
+            await this.refreshAnchors();
+            for (const q of await this.quarantine.list()) {
+                if (q.kind === "evidence" && q.author && q.forkSeq !== undefined) {
+                    const cur = this.equiv.get(q.author);
+                    if (!cur || q.forkSeq < cur.forkSeq)
+                        this.equiv.set(q.author, { forkSeq: q.forkSeq });
+                }
+            }
+            for (const s of await this.store.all()) {
+                this.modulesOf.set(vkey(s.op.author, s.op.seq), s.op.module);
+                this.verdicts.set(vkey(s.op.author, s.op.seq), this.verdict(s));
+                this.clock.observe(s.op.hlc);
+            }
+        });
+    }
+    close() {
+        this.unsubscribeTrust();
+        this.listeners.clear();
+    }
+    on(event, cb) {
+        let s = this.listeners.get(event);
+        if (!s) {
+            s = new Set();
+            this.listeners.set(event, s);
+        }
+        s.add(cb);
+        return () => s?.delete(cb);
+    }
+    emit(event, e) {
+        for (const cb of [...(this.listeners.get(event) ?? [])]) {
+            try {
+                cb(e);
+            }
+            catch {
+                // listener errors never break the log
+            }
+        }
+    }
+    serial(fn) {
+        const run = this.queue.then(fn);
+        this.queue = run.catch(() => undefined);
+        return run;
+    }
+    flushChange() {
+        if (!this.changed.size)
+            return;
+        const modules = [...this.changed].sort();
+        this.changed = new Set();
+        this.emit("change", { modules });
+    }
+    // ─── verdict ─────────────────────────────────────────────────────────────
+    levelFor(module, action) {
+        return this.trust.schema.actionLevel?.(module, action) ?? "editar";
+    }
+    /** Pure function of (op, trust docs, equivocation evidence, validate). */
+    verdict(s) {
+        const { op } = s;
+        const eq = this.equiv.get(op.author);
+        if (eq && op.seq >= eq.forkSeq)
+            return {
+                ok: false,
+                reason: "equivocation",
+                detail: `fork at seq ${eq.forkSeq}`,
+            };
+        const off = this.offAnchor.get(op.author);
+        if (off !== undefined && op.seq <= off)
+            return {
+                ok: false,
+                reason: "unauthorized",
+                detail: "not on the revocation anchor chain",
+            };
+        const v = this.validateFn?.(op) ?? true;
+        if (v !== true)
+            return { ok: false, reason: "invalid", detail: v };
+        const d = this.trust.explain(op.author, op.module, this.levelFor(op.module, op.action), {
+            seq: op.seq,
+            time: hlcWall(op.hlc),
+        });
+        return d.ok
+            ? { ok: true }
+            : { ok: false, reason: "unauthorized", detail: d.reason };
+    }
+    async setVerdict(s, v, fresh) {
+        const k = vkey(s.op.author, s.op.seq);
+        const prev = this.verdicts.get(k);
+        this.verdicts.set(k, v);
+        this.modulesOf.set(k, s.op.module);
+        const qkey = `held:${k}`;
+        if (v.ok) {
+            if (prev && !prev.ok)
+                await this.quarantine.delete(qkey);
+            if (fresh || !prev?.ok) {
+                this.changed.add(s.op.module);
+                this.clock.observe(s.op.hlc);
+                this.emit("applied", s);
+            }
+            return;
+        }
+        if (prev?.ok) {
+            this.changed.add(s.op.module);
+            this.emit("retracted", { entry: s, reason: v.reason, detail: v.detail });
+        }
+        if (fresh ||
+            prev?.ok ||
+            (prev &&
+                !prev.ok &&
+                (prev.reason !== v.reason || prev.detail !== v.detail))) {
+            const entry = {
+                key: qkey,
+                kind: "held",
+                reason: v.reason,
+                detail: v.detail,
+                author: s.op.author,
+                seq: s.op.seq,
+                id: s.id,
+                op: s.op,
+                at: this.now(),
+            };
+            await this.quarantine.put(entry);
+            this.emit("quarantined", entry);
+        }
+    }
+    async rejectOp(reason, op, detail, id) {
+        const o = isObj(op) ? op : {};
+        const author = typeof o.author === "string" ? o.author.slice(0, 64) : undefined;
+        const seq = typeof o.seq === "number" ? o.seq : undefined;
+        const entry = {
+            key: `rej:${author ?? "?"}:${seq ?? "?"}:${id ?? (typeof o.sig === "string" ? o.sig.slice(0, 16) : "?")}`,
+            kind: "rejected",
+            reason,
+            detail,
+            author,
+            seq,
+            id,
+            // keep the evidence only for well-formed, size-checked ops
+            op: reason === "too-large" || reason === "malformed" ? undefined : op,
+            at: this.now(),
+        };
+        await this.quarantine.put(entry);
+        this.emit("quarantined", entry);
+        return { status: "quarantined", reason, detail, id };
+    }
+    // ─── append (local) ──────────────────────────────────────────────────────
+    /** Sign and append a local op. Throws OpLogError if the local device is not allowed (nothing is signed). */
+    append(input) {
+        return this.serial(async () => {
+            const signer = this.signer;
+            if (!signer)
+                throw new OpLogError("no-signer", "append needs a signer");
+            const head = await this.store.head(signer.fp);
+            const seq = (head?.op.seq ?? 0) + 1;
+            if (head)
+                this.clock.observe(head.op.hlc);
+            const hlc = this.clock.now();
+            const body = JSON.parse(JSON.stringify({
+                ...input,
+                t: "op",
+                v: 1,
+                alg: SIG_ALG,
+                inst: this.inst,
+                author: signer.fp,
+                seq,
+                prev: head?.id ?? null,
+                hlc,
+            }));
+            const shape = opShape({ ...body, sig: "x" });
+            if (shape)
+                throw new OpLogError("invalid", shape);
+            if (canonicalBytes(body).length > this.maxOpBytes)
+                throw new OpLogError("too-large", "op too large");
+            const pre = this.verdict({ id: "", op: { ...body, sig: "" } });
+            if (!pre.ok) {
+                throw new OpLogError(pre.reason === "invalid" ? "invalid" : "unauthorized", `${pre.reason}: ${pre.detail}`);
+            }
+            const op = { ...body, sig: await signCanonical(signer, body) };
+            const entry = { id: await contentId(body), op };
+            await this.store.append(entry);
+            this.emit("appended", entry);
+            await this.setVerdict(entry, this.verdict(entry), true);
+            this.flushChange();
+            return entry;
+        });
+    }
+    // ─── ingest (remote) ─────────────────────────────────────────────────────
+    ingest(op) {
+        return this.ingestMany([op]).then((r) => r[0]);
+    }
+    ingestMany(ops) {
+        return this.serial(async () => {
+            const out = [];
+            for (const op of ops)
+                out.push(await this.ingestOne(op));
+            this.flushChange();
+            return out;
+        });
+    }
+    takePending(k) {
+        const p = this.pendingOps.get(k);
+        if (!p)
+            return undefined;
+        this.pendingOps.delete(k);
+        this.pendingBytes -= p.size;
+        const n = (this.pendingPerAuthor.get(p.op.author) ?? 1) - 1;
+        if (n > 0)
+            this.pendingPerAuthor.set(p.op.author, n);
+        else
+            this.pendingPerAuthor.delete(p.op.author);
+        if (p.reason === "unknown-author") {
+            this.unknownCount--;
+            this.unknownBytes -= p.size;
+        }
+        if (p.reason === "anchor" && p.id && this.anchorIds.get(p.id) === k)
+            this.anchorIds.delete(p.id);
+        if (p.reason === "anchor") {
+            const sk = `${p.op.author}:${p.op.seq}`;
+            const set = this.anchorBySeq.get(sk);
+            set?.delete(k);
+            if (set && set.size === 0)
+                this.anchorBySeq.delete(sk);
+        }
+        return p;
+    }
+    /** Drop the oldest unknown-author pending op (insertion order). False if there is none. */
+    evictUnknown() {
+        for (const [k, p] of this.pendingOps) {
+            if (p.reason !== "unknown-author")
+                continue;
+            this.takePending(k);
+            return true;
+        }
+        return false;
+    }
+    /**
+     * S4: bounded pending set. Known authors (gap/future/anchor) only take free room (or room held by unknown authors);
+     * unknown authors live in a small FIFO budget of their own and never displace a known author's op.
+     */
+    park(op, reason, size, id, authorCap = this.maxPendingPerAuthor) {
+        const k = `${op.author}:${op.seq}:${op.sig}`;
+        if (this.pendingOps.has(k))
+            return { status: "pending", reason };
+        const overflow = {
+            status: "quarantined",
+            reason: "pending-overflow",
+        };
+        if ((this.pendingPerAuthor.get(op.author) ?? 0) >= authorCap)
+            return overflow;
+        const unknown = reason === "unknown-author";
+        if (unknown && size > this.maxPendingUnknownBytes)
+            return overflow;
+        while (this.pendingOps.size >= this.maxPending ||
+            this.pendingBytes + size > this.maxPendingBytes ||
+            (unknown &&
+                (this.unknownCount >= this.maxPendingUnknown ||
+                    this.unknownBytes + size > this.maxPendingUnknownBytes))) {
+            if (!this.evictUnknown())
+                return overflow;
+        }
+        this.pendingOps.set(k, { op, reason, id, size });
+        if (reason === "anchor" && id)
+            this.anchorIds.set(id, k);
+        if (reason === "anchor") {
+            const sk = `${op.author}:${op.seq}`;
+            const set = this.anchorBySeq.get(sk) ?? new Set();
+            set.add(k);
+            this.anchorBySeq.set(sk, set);
+        }
+        this.pendingBytes += size;
+        this.pendingPerAuthor.set(op.author, (this.pendingPerAuthor.get(op.author) ?? 0) + 1);
+        if (unknown) {
+            this.unknownCount++;
+            this.unknownBytes += size;
+        }
+        this.emit("pending", { op, reason });
+        return { status: "pending", reason };
+    }
+    /** Highest anchor of `author` covering `seq` (S3), if any. */
+    anchorFor(author, seq) {
+        return this.trust.anchorsOf(author).find((a) => a.seq >= seq);
+    }
+    /**
+     * S3: ops of a revoked author at or below an anchor wait as pending until a chain from our stored head up to the
+     * anchored op is complete (walked backwards from the anchor id through `prev`); then exactly that chain is
+     * ingested and every other pending op of the author at or below the anchor is rejected as a forgery.
+     */
+    async resolveAnchor(author, anchor) {
+        const head = await this.store.head(author);
+        const headSeq = head?.op.seq ?? 0;
+        if (headSeq >= anchor.seq)
+            return;
+        // BL2: walk backwards from the anchor through `prev` ids (index lookups, no scan per step)
+        const chain = [];
+        let want = anchor.id;
+        for (let s = anchor.seq; s > headSeq; s--) {
+            const k = want === null ? undefined : this.anchorIds.get(want);
+            const p = k ? this.pendingOps.get(k) : undefined;
+            if (!k || !p || p.op.author !== author || p.op.seq !== s)
+                return; // incomplete: keep waiting
+            chain.push([k, p.op]);
+            want = p.op.prev;
+        }
+        if ((head?.id ?? null) !== want)
+            return; // does not continue what we store
+        chain.reverse();
+        for (const [k, o] of chain) {
+            this.takePending(k);
+            await this.ingestOne(o, false, true);
+        }
+        const mine = [...this.pendingOps.entries()].filter(([, p]) => p.op.author === author && p.op.seq <= anchor.seq);
+        for (const [k, p] of mine) {
+            if (!this.pendingOps.has(k))
+                continue;
+            this.takePending(k);
+            await this.rejectOp("broken-chain", p.op, "not on the revocation anchor chain", p.id);
+        }
+    }
+    /** finding 6: pending keys on the (partial) chain walked back from the anchor id through `prev`. */
+    anchoredChainKeys(author, anchor) {
+        const out = new Set();
+        let want = anchor.id;
+        while (want !== null) {
+            const k = this.anchorIds.get(want);
+            const p = k ? this.pendingOps.get(k) : undefined;
+            if (!k || !p || p.op.author !== author)
+                break;
+            out.add(k);
+            want = p.op.prev;
+        }
+        return out;
+    }
+    /** Is our stored op of `author` at `seq` on an anchored chain (an anchor >= seq whose op we store)? */
+    async storedAnchored(author, seq) {
+        for (const a of this.trust.anchorsOf(author))
+            if (a.seq >= seq && (await this.store.get(author, a.seq))?.id === a.id)
+                return true;
+        return false;
+    }
+    /** Recompute which authors' STORED history contradicts an anchor (sync verdicts read the result). */
+    async refreshAnchors() {
+        const next = new Map();
+        for (const author of Object.keys(await this.store.heads())) {
+            for (const a of this.trust.anchorsOf(author)) {
+                const stored = await this.store.get(author, a.seq);
+                if (stored && stored.id !== a.id)
+                    next.set(author, Math.max(next.get(author) ?? 0, a.seq));
+            }
+        }
+        this.offAnchor = next;
+    }
+    async ingestOne(x, drain = true, anchored = false) {
+        const bad = opShape(x);
+        if (bad)
+            return this.rejectOp("malformed", x, bad);
+        const op = x;
+        const body = bodyOfOp(op);
+        const size = canonicalBytes(body).length;
+        if (size > this.maxOpBytes)
+            return this.rejectOp("too-large", op);
+        if (op.inst !== this.inst)
+            return this.rejectOp("wrong-instance", op);
+        const id = await contentId(body);
+        const existing = await this.store.get(op.author, op.seq);
+        if (existing && existing.id === id)
+            return { status: "duplicate", id };
+        const pub = this.trust.keyOf(op.author);
+        if (!pub)
+            return this.park(op, "unknown-author", size);
+        if (!(await verifyCanonical(pub, body, op.sig)))
+            return this.rejectOp("bad-signature", op, undefined, id);
+        const anchor = anchored ? undefined : this.anchorFor(op.author, op.seq);
+        if (existing) {
+            // S3: our stored chain IS the anchored one: a different op at that seq is a forgery by the revoked key, not
+            // evidence against the legit history (no equivocation cut)
+            if (await this.storedAnchored(op.author, op.seq))
+                return this.rejectOp("broken-chain", op, "not on the revocation anchor chain", id);
+            return this.equivocate(op.author, op.seq, existing.op, op);
+        }
+        const head = await this.store.head(op.author);
+        const headSeq = head?.op.seq ?? 0;
+        if (op.seq <= headSeq)
+            return { status: "stale", id }; // below a pruned base
+        if (anchor) {
+            if (op.seq === anchor.seq && id !== anchor.id)
+                return this.rejectOp("broken-chain", op, "not the op the revocation anchored", id);
+            // finding 6: at most 2 waiting ops per (author, seq); when full, the ones not on the chain walked back from
+            // the anchor so far are evicted (a fork sent first must not keep the real history out)
+            const sk = `${op.author}:${op.seq}`;
+            if ((this.anchorBySeq.get(sk)?.size ?? 0) >= 2) {
+                const onChain = this.anchoredChainKeys(op.author, anchor);
+                for (const k of [...(this.anchorBySeq.get(sk) ?? [])])
+                    if (!onChain.has(k))
+                        this.takePending(k);
+                if ((this.anchorBySeq.get(sk)?.size ?? 0) >= 2)
+                    return { status: "quarantined", reason: "pending-overflow" };
+            }
+            // BL2: the whole anchored span may wait (bounded by the global pending caps, not the per-author one), twice
+            // over (a fork and the real history), finding 6
+            const r = this.park(op, "anchor", size, id, Math.max(this.maxPendingPerAuthor, 2 * (anchor.seq - headSeq)));
+            if (r.status !== "pending")
+                return r; // overflow is reported as such, never as a broken chain
+            await this.resolveAnchor(op.author, anchor);
+            if ((await this.store.get(op.author, op.seq))?.id === id) {
+                if (drain)
+                    await this.drain(op.author);
+                const v = this.verdictOf(op.author, op.seq);
+                return !v || v.ok
+                    ? { status: "applied", id, stored: true }
+                    : {
+                        status: "quarantined",
+                        id,
+                        stored: true,
+                        reason: v.reason,
+                        detail: v.detail,
+                    };
+            }
+            return this.pendingOps.has(`${op.author}:${op.seq}:${op.sig}`)
+                ? r
+                : {
+                    status: "quarantined",
+                    id,
+                    reason: "broken-chain",
+                    detail: "not on the revocation anchor chain",
+                };
+        }
+        if (op.seq > headSeq + 1)
+            return this.park(op, "gap", size);
+        if (head && op.prev !== head.id) {
+            if (await this.storedAnchored(op.author, headSeq))
+                return this.rejectOp("broken-chain", op, "not on the revocation anchor chain", id);
+            return this.equivocate(op.author, headSeq, head.op, op);
+        }
+        if (head && compareHlc(op.hlc, head.op.hlc) <= 0)
+            return this.rejectOp("hlc-regression", op, undefined, id);
+        if (hlcWall(op.hlc) > this.now() + this.maxSkewMs)
+            return this.park(op, "future", size);
+        const entry = { id, op };
+        await this.store.append(entry);
+        this.emit("stored", entry);
+        const v = this.verdict(entry);
+        await this.setVerdict(entry, v, true);
+        if (drain)
+            await this.drain(op.author);
+        return v.ok
+            ? { status: "applied", id, stored: true }
+            : {
+                status: "quarantined",
+                id,
+                reason: v.reason,
+                detail: v.detail,
+                stored: true,
+            };
+    }
+    /** Retry pending ops (of one author, or all) in seq order. */
+    async drain(author) {
+        for (;;) {
+            const batch = [...this.pendingOps.entries()]
+                .filter(([, p]) => author === undefined || p.op.author === author)
+                .sort(([, a], [, b]) => a.op.author < b.op.author
+                ? -1
+                : a.op.author > b.op.author
+                    ? 1
+                    : a.op.seq - b.op.seq);
+            let progressed = false;
+            for (const [k, p] of batch) {
+                this.takePending(k);
+                const r = await this.ingestOne(p.op, false);
+                if (r.status !== "pending")
+                    progressed = true;
+                else if (r.reason !== p.reason)
+                    progressed = true;
+            }
+            if (!progressed)
+                return;
+        }
+    }
+    async equivocate(author, forkSeq, a, b) {
+        const cur = this.equiv.get(author);
+        if (!cur || forkSeq < cur.forkSeq) {
+            this.equiv.set(author, { forkSeq });
+            const entry = {
+                key: `eq:${author}`,
+                kind: "evidence",
+                reason: "equivocation",
+                detail: `two signed ops for ${author} at/after seq ${forkSeq}`,
+                author,
+                seq: forkSeq,
+                forkSeq,
+                evidence: [a, b],
+                at: this.now(),
+            };
+            await this.quarantine.put(entry);
+            this.emit("quarantined", entry);
+            this.emit("equivocation", { author, forkSeq });
+            await this.reevaluateAuthor(author);
+        }
+        return {
+            status: "equivocation",
+            reason: "equivocation",
+            detail: `fork at seq ${forkSeq}`,
+        };
+    }
+    async reevaluateAuthor(author) {
+        const head = await this.store.head(author);
+        if (!head)
+            return;
+        for (const s of await this.store.range(author, 1, head.op.seq))
+            await this.setVerdict(s, this.verdict(s), false);
+    }
+    /** Recompute every verdict (trust changed) and retry pending ops. Called automatically on trust changes. */
+    reevaluate() {
+        return this.serial(async () => {
+            await this.refreshAnchors();
+            for (const s of await this.store.all())
+                await this.setVerdict(s, this.verdict(s), false);
+            await this.drain();
+            this.flushChange();
+        });
+    }
+    /** Retry pending ops (e.g. on a timer so future-dated ops are picked up once the clock reaches them). */
+    retryPending() {
+        return this.serial(async () => {
+            await this.drain();
+            this.flushChange();
+        });
+    }
+    // ─── queries ─────────────────────────────────────────────────────────────
+    isAccepted(author, seq) {
+        return this.verdicts.get(vkey(author, seq))?.ok === true;
+    }
+    verdictOf(author, seq) {
+        return this.verdicts.get(vkey(author, seq));
+    }
+    /** Accepted ops (optionally of one module), in projection order (hlc, author, seq). */
+    async accepted(module) {
+        const all = await this.store.all();
+        return all
+            .filter((s) => (module === undefined || s.op.module === module) &&
+            this.isAccepted(s.op.author, s.op.seq))
+            .sort((a, b) => compareOps(a.op, b.op));
+    }
+    heads() {
+        return this.store.heads();
+    }
+    /** Head seq AND op id per author: pass it to `TrustStore.prepareRevocation` to anchor a revocation (S3). */
+    async headIds() {
+        const out = {};
+        for (const author of Object.keys(await this.store.heads())) {
+            const h = await this.store.head(author);
+            if (h)
+                out[author] = { seq: h.op.seq, id: h.id };
+        }
+        return out;
+    }
+    pending() {
+        return [...this.pendingOps.values()].map((p) => ({
+            author: p.op.author,
+            seq: p.op.seq,
+            reason: p.reason,
+        }));
+    }
+    equivocations() {
+        return [...this.equiv.entries()].map(([author, e]) => ({
+            author,
+            forkSeq: e.forkSeq,
+        }));
+    }
+    quarantined() {
+        return this.quarantine.list();
+    }
+    /** Local clock helper (e.g. to stamp UI checks). */
+    hlcNow() {
+        return this.clock.last();
+    }
+    get deviceFp() {
+        return this.signer?.fp;
+    }
+}
+//# sourceMappingURL=log.js.map