chainlesschain 0.132.0 → 0.145.0

package/src/lib/session-usage.js

@@ -164,3 +164,332 @@ export function allSessionsUsage({ limit = 1000 } = {}) {
     ),
   };
 }
+
+// ===== V2 Surface: Session Usage governance overlay (CLI v0.142.0) =====
+export const SUSE_BUDGET_MATURITY_V2 = Object.freeze({
+  PENDING: "pending",
+  ACTIVE: "active",
+  EXHAUSTED: "exhausted",
+  ARCHIVED: "archived",
+});
+export const SUSE_RECORD_LIFECYCLE_V2 = Object.freeze({
+  QUEUED: "queued",
+  RECORDING: "recording",
+  RECORDED: "recorded",
+  REJECTED: "rejected",
+  CANCELLED: "cancelled",
+});
+const _suseBTrans = new Map([
+  [
+    SUSE_BUDGET_MATURITY_V2.PENDING,
+    new Set([SUSE_BUDGET_MATURITY_V2.ACTIVE, SUSE_BUDGET_MATURITY_V2.ARCHIVED]),
+  ],
+  [
+    SUSE_BUDGET_MATURITY_V2.ACTIVE,
+    new Set([
+      SUSE_BUDGET_MATURITY_V2.EXHAUSTED,
+      SUSE_BUDGET_MATURITY_V2.ARCHIVED,
+    ]),
+  ],
+  [
+    SUSE_BUDGET_MATURITY_V2.EXHAUSTED,
+    new Set([SUSE_BUDGET_MATURITY_V2.ACTIVE, SUSE_BUDGET_MATURITY_V2.ARCHIVED]),
+  ],
+  [SUSE_BUDGET_MATURITY_V2.ARCHIVED, new Set()],
+]);
+const _suseBTerminal = new Set([SUSE_BUDGET_MATURITY_V2.ARCHIVED]);
+const _suseRTrans = new Map([
+  [
+    SUSE_RECORD_LIFECYCLE_V2.QUEUED,
+    new Set([
+      SUSE_RECORD_LIFECYCLE_V2.RECORDING,
+      SUSE_RECORD_LIFECYCLE_V2.CANCELLED,
+    ]),
+  ],
+  [
+    SUSE_RECORD_LIFECYCLE_V2.RECORDING,
+    new Set([
+      SUSE_RECORD_LIFECYCLE_V2.RECORDED,
+      SUSE_RECORD_LIFECYCLE_V2.REJECTED,
+      SUSE_RECORD_LIFECYCLE_V2.CANCELLED,
+    ]),
+  ],
+  [SUSE_RECORD_LIFECYCLE_V2.RECORDED, new Set()],
+  [SUSE_RECORD_LIFECYCLE_V2.REJECTED, new Set()],
+  [SUSE_RECORD_LIFECYCLE_V2.CANCELLED, new Set()],
+]);
+const _suseBsV2 = new Map();
+const _suseRsV2 = new Map();
+let _suseMaxActive = 5,
+  _suseMaxPending = 50,
+  _suseIdleMs = 30 * 24 * 60 * 60 * 1000,
+  _suseStuckMs = 30 * 1000;
+function _susePos(n, label) {
+  const v = Math.floor(Number(n));
+  if (!Number.isFinite(v) || v <= 0)
+    throw new Error(`${label} must be positive integer`);
+  return v;
+}
+function _suseCheckB(from, to) {
+  const a = _suseBTrans.get(from);
+  if (!a || !a.has(to))
+    throw new Error(`invalid suse budget transition ${from} → ${to}`);
+}
+function _suseCheckR(from, to) {
+  const a = _suseRTrans.get(from);
+  if (!a || !a.has(to))
+    throw new Error(`invalid suse record transition ${from} → ${to}`);
+}
+export function setMaxActiveSuseBudgetsPerOwnerV2(n) {
+  _suseMaxActive = _susePos(n, "maxActiveSuseBudgetsPerOwner");
+}
+export function getMaxActiveSuseBudgetsPerOwnerV2() {
+  return _suseMaxActive;
+}
+export function setMaxPendingSuseRecordsPerBudgetV2(n) {
+  _suseMaxPending = _susePos(n, "maxPendingSuseRecordsPerBudget");
+}
+export function getMaxPendingSuseRecordsPerBudgetV2() {
+  return _suseMaxPending;
+}
+export function setSuseBudgetIdleMsV2(n) {
+  _suseIdleMs = _susePos(n, "suseBudgetIdleMs");
+}
+export function getSuseBudgetIdleMsV2() {
+  return _suseIdleMs;
+}
+export function setSuseRecordStuckMsV2(n) {
+  _suseStuckMs = _susePos(n, "suseRecordStuckMs");
+}
+export function getSuseRecordStuckMsV2() {
+  return _suseStuckMs;
+}
+export function _resetStateSessionUsageV2() {
+  _suseBsV2.clear();
+  _suseRsV2.clear();
+  _suseMaxActive = 5;
+  _suseMaxPending = 50;
+  _suseIdleMs = 30 * 24 * 60 * 60 * 1000;
+  _suseStuckMs = 30 * 1000;
+}
+export function registerSuseBudgetV2({ id, owner, limit, metadata } = {}) {
+  if (!id) throw new Error("suse budget id required");
+  if (!owner) throw new Error("suse budget owner required");
+  if (_suseBsV2.has(id))
+    throw new Error(`suse budget ${id} already registered`);
+  const now = Date.now();
+  const lim =
+    limit == null ? 1000 : Math.max(1, Math.floor(Number(limit)) || 1);
+  const b = {
+    id,
+    owner,
+    limit: lim,
+    status: SUSE_BUDGET_MATURITY_V2.PENDING,
+    createdAt: now,
+    updatedAt: now,
+    activatedAt: null,
+    archivedAt: null,
+    lastTouchedAt: now,
+    metadata: { ...(metadata || {}) },
+  };
+  _suseBsV2.set(id, b);
+  return { ...b, metadata: { ...b.metadata } };
+}
+function _suseCountActive(owner) {
+  let n = 0;
+  for (const b of _suseBsV2.values())
+    if (b.owner === owner && b.status === SUSE_BUDGET_MATURITY_V2.ACTIVE) n++;
+  return n;
+}
+export function activateSuseBudgetV2(id) {
+  const b = _suseBsV2.get(id);
+  if (!b) throw new Error(`suse budget ${id} not found`);
+  _suseCheckB(b.status, SUSE_BUDGET_MATURITY_V2.ACTIVE);
+  const recovery = b.status === SUSE_BUDGET_MATURITY_V2.EXHAUSTED;
+  if (!recovery && _suseCountActive(b.owner) >= _suseMaxActive)
+    throw new Error(`max active suse budgets for owner ${b.owner} reached`);
+  const now = Date.now();
+  b.status = SUSE_BUDGET_MATURITY_V2.ACTIVE;
+  b.updatedAt = now;
+  b.lastTouchedAt = now;
+  if (!b.activatedAt) b.activatedAt = now;
+  return { ...b, metadata: { ...b.metadata } };
+}
+export function exhaustSuseBudgetV2(id) {
+  const b = _suseBsV2.get(id);
+  if (!b) throw new Error(`suse budget ${id} not found`);
+  _suseCheckB(b.status, SUSE_BUDGET_MATURITY_V2.EXHAUSTED);
+  b.status = SUSE_BUDGET_MATURITY_V2.EXHAUSTED;
+  b.updatedAt = Date.now();
+  return { ...b, metadata: { ...b.metadata } };
+}
+export function archiveSuseBudgetV2(id) {
+  const b = _suseBsV2.get(id);
+  if (!b) throw new Error(`suse budget ${id} not found`);
+  _suseCheckB(b.status, SUSE_BUDGET_MATURITY_V2.ARCHIVED);
+  const now = Date.now();
+  b.status = SUSE_BUDGET_MATURITY_V2.ARCHIVED;
+  b.updatedAt = now;
+  if (!b.archivedAt) b.archivedAt = now;
+  return { ...b, metadata: { ...b.metadata } };
+}
+export function touchSuseBudgetV2(id) {
+  const b = _suseBsV2.get(id);
+  if (!b) throw new Error(`suse budget ${id} not found`);
+  if (_suseBTerminal.has(b.status))
+    throw new Error(`cannot touch terminal suse budget ${id}`);
+  const now = Date.now();
+  b.lastTouchedAt = now;
+  b.updatedAt = now;
+  return { ...b, metadata: { ...b.metadata } };
+}
+export function getSuseBudgetV2(id) {
+  const b = _suseBsV2.get(id);
+  if (!b) return null;
+  return { ...b, metadata: { ...b.metadata } };
+}
+export function listSuseBudgetsV2() {
+  return [..._suseBsV2.values()].map((b) => ({
+    ...b,
+    metadata: { ...b.metadata },
+  }));
+}
+function _suseCountPending(budgetId) {
+  let n = 0;
+  for (const r of _suseRsV2.values())
+    if (
+      r.budgetId === budgetId &&
+      (r.status === SUSE_RECORD_LIFECYCLE_V2.QUEUED ||
+        r.status === SUSE_RECORD_LIFECYCLE_V2.RECORDING)
+    )
+      n++;
+  return n;
+}
+export function createSuseRecordV2({ id, budgetId, amount, metadata } = {}) {
+  if (!id) throw new Error("suse record id required");
+  if (!budgetId) throw new Error("suse record budgetId required");
+  if (_suseRsV2.has(id)) throw new Error(`suse record ${id} already exists`);
+  if (!_suseBsV2.has(budgetId))
+    throw new Error(`suse budget ${budgetId} not found`);
+  if (_suseCountPending(budgetId) >= _suseMaxPending)
+    throw new Error(`max pending suse records for budget ${budgetId} reached`);
+  const now = Date.now();
+  const amt = amount == null ? 0 : Math.max(0, Number(amount) || 0);
+  const r = {
+    id,
+    budgetId,
+    amount: amt,
+    status: SUSE_RECORD_LIFECYCLE_V2.QUEUED,
+    createdAt: now,
+    updatedAt: now,
+    startedAt: null,
+    settledAt: null,
+    metadata: { ...(metadata || {}) },
+  };
+  _suseRsV2.set(id, r);
+  return { ...r, metadata: { ...r.metadata } };
+}
+export function recordingSuseRecordV2(id) {
+  const r = _suseRsV2.get(id);
+  if (!r) throw new Error(`suse record ${id} not found`);
+  _suseCheckR(r.status, SUSE_RECORD_LIFECYCLE_V2.RECORDING);
+  const now = Date.now();
+  r.status = SUSE_RECORD_LIFECYCLE_V2.RECORDING;
+  r.updatedAt = now;
+  if (!r.startedAt) r.startedAt = now;
+  return { ...r, metadata: { ...r.metadata } };
+}
+export function recordSuseRecordV2(id) {
+  const r = _suseRsV2.get(id);
+  if (!r) throw new Error(`suse record ${id} not found`);
+  _suseCheckR(r.status, SUSE_RECORD_LIFECYCLE_V2.RECORDED);
+  const now = Date.now();
+  r.status = SUSE_RECORD_LIFECYCLE_V2.RECORDED;
+  r.updatedAt = now;
+  if (!r.settledAt) r.settledAt = now;
+  return { ...r, metadata: { ...r.metadata } };
+}
+export function rejectSuseRecordV2(id, reason) {
+  const r = _suseRsV2.get(id);
+  if (!r) throw new Error(`suse record ${id} not found`);
+  _suseCheckR(r.status, SUSE_RECORD_LIFECYCLE_V2.REJECTED);
+  const now = Date.now();
+  r.status = SUSE_RECORD_LIFECYCLE_V2.REJECTED;
+  r.updatedAt = now;
+  if (!r.settledAt) r.settledAt = now;
+  if (reason) r.metadata.rejectReason = String(reason);
+  return { ...r, metadata: { ...r.metadata } };
+}
+export function cancelSuseRecordV2(id, reason) {
+  const r = _suseRsV2.get(id);
+  if (!r) throw new Error(`suse record ${id} not found`);
+  _suseCheckR(r.status, SUSE_RECORD_LIFECYCLE_V2.CANCELLED);
+  const now = Date.now();
+  r.status = SUSE_RECORD_LIFECYCLE_V2.CANCELLED;
+  r.updatedAt = now;
+  if (!r.settledAt) r.settledAt = now;
+  if (reason) r.metadata.cancelReason = String(reason);
+  return { ...r, metadata: { ...r.metadata } };
+}
+export function getSuseRecordV2(id) {
+  const r = _suseRsV2.get(id);
+  if (!r) return null;
+  return { ...r, metadata: { ...r.metadata } };
+}
+export function listSuseRecordsV2() {
+  return [..._suseRsV2.values()].map((r) => ({
+    ...r,
+    metadata: { ...r.metadata },
+  }));
+}
+export function autoExhaustIdleSuseBudgetsV2({ now } = {}) {
+  const t = now ?? Date.now();
+  const flipped = [];
+  for (const b of _suseBsV2.values())
+    if (
+      b.status === SUSE_BUDGET_MATURITY_V2.ACTIVE &&
+      t - b.lastTouchedAt >= _suseIdleMs
+    ) {
+      b.status = SUSE_BUDGET_MATURITY_V2.EXHAUSTED;
+      b.updatedAt = t;
+      flipped.push(b.id);
+    }
+  return { flipped, count: flipped.length };
+}
+export function autoRejectStuckSuseRecordsV2({ now } = {}) {
+  const t = now ?? Date.now();
+  const flipped = [];
+  for (const r of _suseRsV2.values())
+    if (
+      r.status === SUSE_RECORD_LIFECYCLE_V2.RECORDING &&
+      r.startedAt != null &&
+      t - r.startedAt >= _suseStuckMs
+    ) {
+      r.status = SUSE_RECORD_LIFECYCLE_V2.REJECTED;
+      r.updatedAt = t;
+      if (!r.settledAt) r.settledAt = t;
+      r.metadata.rejectReason = "auto-reject-stuck";
+      flipped.push(r.id);
+    }
+  return { flipped, count: flipped.length };
+}
+export function getSessionUsageGovStatsV2() {
+  const budgetsByStatus = {};
+  for (const v of Object.values(SUSE_BUDGET_MATURITY_V2))
+    budgetsByStatus[v] = 0;
+  for (const b of _suseBsV2.values()) budgetsByStatus[b.status]++;
+  const recordsByStatus = {};
+  for (const v of Object.values(SUSE_RECORD_LIFECYCLE_V2))
+    recordsByStatus[v] = 0;
+  for (const r of _suseRsV2.values()) recordsByStatus[r.status]++;
+  return {
+    totalSuseBudgetsV2: _suseBsV2.size,
+    totalSuseRecordsV2: _suseRsV2.size,
+    maxActiveSuseBudgetsPerOwner: _suseMaxActive,
+    maxPendingSuseRecordsPerBudget: _suseMaxPending,
+    suseBudgetIdleMs: _suseIdleMs,
+    suseRecordStuckMs: _suseStuckMs,
+    budgetsByStatus,
+    recordsByStatus,
+  };
+}

package/src/lib/siem-exporter.js

@@ -468,3 +468,355 @@ export function listTargetsByStatus(status) {
 }
 
 export { _severityCEF, _allowedTargetTransitions };
+
+// ===== V2 Surface: SIEM Exporter governance overlay (CLI v0.138.0) =====
+export const SIEM_TARGET_MATURITY_V2 = Object.freeze({
+  PENDING: "pending",
+  ACTIVE: "active",
+  DEGRADED: "degraded",
+  RETIRED: "retired",
+});
+export const SIEM_EXPORT_LIFECYCLE_V2 = Object.freeze({
+  QUEUED: "queued",
+  SENDING: "sending",
+  DELIVERED: "delivered",
+  FAILED: "failed",
+  CANCELLED: "cancelled",
+});
+
+const _siemTargetTrans = new Map([
+  [
+    SIEM_TARGET_MATURITY_V2.PENDING,
+    new Set([SIEM_TARGET_MATURITY_V2.ACTIVE, SIEM_TARGET_MATURITY_V2.RETIRED]),
+  ],
+  [
+    SIEM_TARGET_MATURITY_V2.ACTIVE,
+    new Set([
+      SIEM_TARGET_MATURITY_V2.DEGRADED,
+      SIEM_TARGET_MATURITY_V2.RETIRED,
+    ]),
+  ],
+  [
+    SIEM_TARGET_MATURITY_V2.DEGRADED,
+    new Set([SIEM_TARGET_MATURITY_V2.ACTIVE, SIEM_TARGET_MATURITY_V2.RETIRED]),
+  ],
+  [SIEM_TARGET_MATURITY_V2.RETIRED, new Set()],
+]);
+const _siemTargetTerminal = new Set([SIEM_TARGET_MATURITY_V2.RETIRED]);
+const _siemExportTrans = new Map([
+  [
+    SIEM_EXPORT_LIFECYCLE_V2.QUEUED,
+    new Set([
+      SIEM_EXPORT_LIFECYCLE_V2.SENDING,
+      SIEM_EXPORT_LIFECYCLE_V2.CANCELLED,
+    ]),
+  ],
+  [
+    SIEM_EXPORT_LIFECYCLE_V2.SENDING,
+    new Set([
+      SIEM_EXPORT_LIFECYCLE_V2.DELIVERED,
+      SIEM_EXPORT_LIFECYCLE_V2.FAILED,
+      SIEM_EXPORT_LIFECYCLE_V2.CANCELLED,
+    ]),
+  ],
+  [SIEM_EXPORT_LIFECYCLE_V2.DELIVERED, new Set()],
+  [SIEM_EXPORT_LIFECYCLE_V2.FAILED, new Set()],
+  [SIEM_EXPORT_LIFECYCLE_V2.CANCELLED, new Set()],
+]);
+
+const _siemTargets = new Map();
+const _siemExportJobs = new Map();
+let _siemMaxActivePerOperator = 8;
+let _siemMaxPendingExportsPerTarget = 50;
+let _siemTargetIdleMs = 24 * 60 * 60 * 1000;
+let _siemExportStuckMs = 5 * 60 * 1000;
+
+function _siemPos(n, lbl) {
+  const v = Math.floor(Number(n));
+  if (!Number.isFinite(v) || v <= 0)
+    throw new Error(`${lbl} must be positive integer`);
+  return v;
+}
+
+export function setMaxActiveSiemTargetsPerOperatorV2(n) {
+  _siemMaxActivePerOperator = _siemPos(n, "maxActiveSiemTargetsPerOperator");
+}
+export function getMaxActiveSiemTargetsPerOperatorV2() {
+  return _siemMaxActivePerOperator;
+}
+export function setMaxPendingSiemExportsPerTargetV2(n) {
+  _siemMaxPendingExportsPerTarget = _siemPos(
+    n,
+    "maxPendingSiemExportsPerTarget",
+  );
+}
+export function getMaxPendingSiemExportsPerTargetV2() {
+  return _siemMaxPendingExportsPerTarget;
+}
+export function setSiemTargetIdleMsV2(n) {
+  _siemTargetIdleMs = _siemPos(n, "siemTargetIdleMs");
+}
+export function getSiemTargetIdleMsV2() {
+  return _siemTargetIdleMs;
+}
+export function setSiemExportStuckMsV2(n) {
+  _siemExportStuckMs = _siemPos(n, "siemExportStuckMs");
+}
+export function getSiemExportStuckMsV2() {
+  return _siemExportStuckMs;
+}
+
+export function _resetStateSiemExporterV2() {
+  _siemTargets.clear();
+  _siemExportJobs.clear();
+  _siemMaxActivePerOperator = 8;
+  _siemMaxPendingExportsPerTarget = 50;
+  _siemTargetIdleMs = 24 * 60 * 60 * 1000;
+  _siemExportStuckMs = 5 * 60 * 1000;
+}
+
+export function registerSiemTargetV2({ id, operator, kind, metadata } = {}) {
+  if (!id || typeof id !== "string") throw new Error("id is required");
+  if (!operator || typeof operator !== "string")
+    throw new Error("operator is required");
+  if (_siemTargets.has(id))
+    throw new Error(`siem target ${id} already registered`);
+  const now = Date.now();
+  const t = {
+    id,
+    operator,
+    kind: kind || "splunk_hec",
+    status: SIEM_TARGET_MATURITY_V2.PENDING,
+    createdAt: now,
+    updatedAt: now,
+    activatedAt: null,
+    retiredAt: null,
+    lastTouchedAt: now,
+    metadata: { ...(metadata || {}) },
+  };
+  _siemTargets.set(id, t);
+  return { ...t, metadata: { ...t.metadata } };
+}
+function _siemCheckT(from, to) {
+  const a = _siemTargetTrans.get(from);
+  if (!a || !a.has(to))
+    throw new Error(`invalid siem target transition ${from} → ${to}`);
+}
+function _siemCountActive(operator) {
+  let n = 0;
+  for (const t of _siemTargets.values())
+    if (t.operator === operator && t.status === SIEM_TARGET_MATURITY_V2.ACTIVE)
+      n++;
+  return n;
+}
+
+export function activateSiemTargetV2(id) {
+  const t = _siemTargets.get(id);
+  if (!t) throw new Error(`siem target ${id} not found`);
+  _siemCheckT(t.status, SIEM_TARGET_MATURITY_V2.ACTIVE);
+  const recovery = t.status === SIEM_TARGET_MATURITY_V2.DEGRADED;
+  if (!recovery) {
+    const c = _siemCountActive(t.operator);
+    if (c >= _siemMaxActivePerOperator)
+      throw new Error(
+        `max active siem targets per operator (${_siemMaxActivePerOperator}) reached for ${t.operator}`,
+      );
+  }
+  const now = Date.now();
+  t.status = SIEM_TARGET_MATURITY_V2.ACTIVE;
+  t.updatedAt = now;
+  t.lastTouchedAt = now;
+  if (!t.activatedAt) t.activatedAt = now;
+  return { ...t, metadata: { ...t.metadata } };
+}
+export function degradeSiemTargetV2(id) {
+  const t = _siemTargets.get(id);
+  if (!t) throw new Error(`siem target ${id} not found`);
+  _siemCheckT(t.status, SIEM_TARGET_MATURITY_V2.DEGRADED);
+  t.status = SIEM_TARGET_MATURITY_V2.DEGRADED;
+  t.updatedAt = Date.now();
+  return { ...t, metadata: { ...t.metadata } };
+}
+export function retireSiemTargetV2(id) {
+  const t = _siemTargets.get(id);
+  if (!t) throw new Error(`siem target ${id} not found`);
+  _siemCheckT(t.status, SIEM_TARGET_MATURITY_V2.RETIRED);
+  const now = Date.now();
+  t.status = SIEM_TARGET_MATURITY_V2.RETIRED;
+  t.updatedAt = now;
+  if (!t.retiredAt) t.retiredAt = now;
+  return { ...t, metadata: { ...t.metadata } };
+}
+export function touchSiemTargetV2(id) {
+  const t = _siemTargets.get(id);
+  if (!t) throw new Error(`siem target ${id} not found`);
+  if (_siemTargetTerminal.has(t.status))
+    throw new Error(`cannot touch terminal siem target ${id}`);
+  const now = Date.now();
+  t.lastTouchedAt = now;
+  t.updatedAt = now;
+  return { ...t, metadata: { ...t.metadata } };
+}
+export function getSiemTargetV2(id) {
+  const t = _siemTargets.get(id);
+  if (!t) return null;
+  return { ...t, metadata: { ...t.metadata } };
+}
+export function listSiemTargetsV2() {
+  return [..._siemTargets.values()].map((t) => ({
+    ...t,
+    metadata: { ...t.metadata },
+  }));
+}
+
+function _siemCountPendingExports(tid) {
+  let n = 0;
+  for (const e of _siemExportJobs.values())
+    if (
+      e.targetId === tid &&
+      (e.status === SIEM_EXPORT_LIFECYCLE_V2.QUEUED ||
+        e.status === SIEM_EXPORT_LIFECYCLE_V2.SENDING)
+    )
+      n++;
+  return n;
+}
+
+export function createSiemExportV2({ id, targetId, format, metadata } = {}) {
+  if (!id || typeof id !== "string") throw new Error("id is required");
+  if (!targetId || typeof targetId !== "string")
+    throw new Error("targetId is required");
+  if (_siemExportJobs.has(id))
+    throw new Error(`siem export ${id} already exists`);
+  if (!_siemTargets.has(targetId))
+    throw new Error(`siem target ${targetId} not found`);
+  const pending = _siemCountPendingExports(targetId);
+  if (pending >= _siemMaxPendingExportsPerTarget)
+    throw new Error(
+      `max pending siem exports per target (${_siemMaxPendingExportsPerTarget}) reached for ${targetId}`,
+    );
+  const now = Date.now();
+  const e = {
+    id,
+    targetId,
+    format: format || "json",
+    status: SIEM_EXPORT_LIFECYCLE_V2.QUEUED,
+    createdAt: now,
+    updatedAt: now,
+    startedAt: null,
+    settledAt: null,
+    metadata: { ...(metadata || {}) },
+  };
+  _siemExportJobs.set(id, e);
+  return { ...e, metadata: { ...e.metadata } };
+}
+function _siemCheckE(from, to) {
+  const a = _siemExportTrans.get(from);
+  if (!a || !a.has(to))
+    throw new Error(`invalid siem export transition ${from} → ${to}`);
+}
+export function startSiemExportV2(id) {
+  const e = _siemExportJobs.get(id);
+  if (!e) throw new Error(`siem export ${id} not found`);
+  _siemCheckE(e.status, SIEM_EXPORT_LIFECYCLE_V2.SENDING);
+  const now = Date.now();
+  e.status = SIEM_EXPORT_LIFECYCLE_V2.SENDING;
+  e.updatedAt = now;
+  if (!e.startedAt) e.startedAt = now;
+  return { ...e, metadata: { ...e.metadata } };
+}
+export function deliverSiemExportV2(id) {
+  const e = _siemExportJobs.get(id);
+  if (!e) throw new Error(`siem export ${id} not found`);
+  _siemCheckE(e.status, SIEM_EXPORT_LIFECYCLE_V2.DELIVERED);
+  const now = Date.now();
+  e.status = SIEM_EXPORT_LIFECYCLE_V2.DELIVERED;
+  e.updatedAt = now;
+  if (!e.settledAt) e.settledAt = now;
+  return { ...e, metadata: { ...e.metadata } };
+}
+export function failSiemExportV2(id, reason) {
+  const e = _siemExportJobs.get(id);
+  if (!e) throw new Error(`siem export ${id} not found`);
+  _siemCheckE(e.status, SIEM_EXPORT_LIFECYCLE_V2.FAILED);
+  const now = Date.now();
+  e.status = SIEM_EXPORT_LIFECYCLE_V2.FAILED;
+  e.updatedAt = now;
+  if (!e.settledAt) e.settledAt = now;
+  if (reason) e.metadata.failReason = String(reason);
+  return { ...e, metadata: { ...e.metadata } };
+}
+export function cancelSiemExportV2(id, reason) {
+  const e = _siemExportJobs.get(id);
+  if (!e) throw new Error(`siem export ${id} not found`);
+  _siemCheckE(e.status, SIEM_EXPORT_LIFECYCLE_V2.CANCELLED);
+  const now = Date.now();
+  e.status = SIEM_EXPORT_LIFECYCLE_V2.CANCELLED;
+  e.updatedAt = now;
+  if (!e.settledAt) e.settledAt = now;
+  if (reason) e.metadata.cancelReason = String(reason);
+  return { ...e, metadata: { ...e.metadata } };
+}
+export function getSiemExportV2(id) {
+  const e = _siemExportJobs.get(id);
+  if (!e) return null;
+  return { ...e, metadata: { ...e.metadata } };
+}
+export function listSiemExportsV2() {
+  return [..._siemExportJobs.values()].map((e) => ({
+    ...e,
+    metadata: { ...e.metadata },
+  }));
+}
+
+export function autoDegradeIdleSiemTargetsV2({ now } = {}) {
+  const t = now ?? Date.now();
+  const flipped = [];
+  for (const tgt of _siemTargets.values())
+    if (
+      tgt.status === SIEM_TARGET_MATURITY_V2.ACTIVE &&
+      t - tgt.lastTouchedAt >= _siemTargetIdleMs
+    ) {
+      tgt.status = SIEM_TARGET_MATURITY_V2.DEGRADED;
+      tgt.updatedAt = t;
+      flipped.push(tgt.id);
+    }
+  return { flipped, count: flipped.length };
+}
+export function autoFailStuckSiemExportsV2({ now } = {}) {
+  const t = now ?? Date.now();
+  const flipped = [];
+  for (const e of _siemExportJobs.values())
+    if (
+      e.status === SIEM_EXPORT_LIFECYCLE_V2.SENDING &&
+      e.startedAt != null &&
+      t - e.startedAt >= _siemExportStuckMs
+    ) {
+      e.status = SIEM_EXPORT_LIFECYCLE_V2.FAILED;
+      e.updatedAt = t;
+      if (!e.settledAt) e.settledAt = t;
+      e.metadata.failReason = "auto-fail-stuck";
+      flipped.push(e.id);
+    }
+  return { flipped, count: flipped.length };
+}
+
+export function getSiemExporterGovStatsV2() {
+  const targetsByStatus = {};
+  for (const s of Object.values(SIEM_TARGET_MATURITY_V2))
+    targetsByStatus[s] = 0;
+  for (const t of _siemTargets.values()) targetsByStatus[t.status]++;
+  const exportsByStatus = {};
+  for (const s of Object.values(SIEM_EXPORT_LIFECYCLE_V2))
+    exportsByStatus[s] = 0;
+  for (const e of _siemExportJobs.values()) exportsByStatus[e.status]++;
+  return {
+    totalSiemTargetsV2: _siemTargets.size,
+    totalSiemExportsV2: _siemExportJobs.size,
+    maxActiveSiemTargetsPerOperator: _siemMaxActivePerOperator,
+    maxPendingSiemExportsPerTarget: _siemMaxPendingExportsPerTarget,
+    siemTargetIdleMs: _siemTargetIdleMs,
+    siemExportStuckMs: _siemExportStuckMs,
+    targetsByStatus,
+    exportsByStatus,
+  };
+}