chainlesschain 0.132.0 → 0.145.0

package/src/lib/web-fetch.js

@@ -222,3 +222,325 @@ export async function webFetch(url, options = {}) {
 }
 
 export const _deps = { http, https };
+
+// ===== V2 Surface: Web Fetch governance overlay (CLI v0.142.0) =====
+export const WFET_TARGET_MATURITY_V2 = Object.freeze({
+  PENDING: "pending",
+  ACTIVE: "active",
+  DEGRADED: "degraded",
+  RETIRED: "retired",
+});
+export const WFET_JOB_LIFECYCLE_V2 = Object.freeze({
+  QUEUED: "queued",
+  FETCHING: "fetching",
+  SUCCEEDED: "succeeded",
+  FAILED: "failed",
+  CANCELLED: "cancelled",
+});
+const _wfetTTrans = new Map([
+  [
+    WFET_TARGET_MATURITY_V2.PENDING,
+    new Set([WFET_TARGET_MATURITY_V2.ACTIVE, WFET_TARGET_MATURITY_V2.RETIRED]),
+  ],
+  [
+    WFET_TARGET_MATURITY_V2.ACTIVE,
+    new Set([
+      WFET_TARGET_MATURITY_V2.DEGRADED,
+      WFET_TARGET_MATURITY_V2.RETIRED,
+    ]),
+  ],
+  [
+    WFET_TARGET_MATURITY_V2.DEGRADED,
+    new Set([WFET_TARGET_MATURITY_V2.ACTIVE, WFET_TARGET_MATURITY_V2.RETIRED]),
+  ],
+  [WFET_TARGET_MATURITY_V2.RETIRED, new Set()],
+]);
+const _wfetTTerminal = new Set([WFET_TARGET_MATURITY_V2.RETIRED]);
+const _wfetJTrans = new Map([
+  [
+    WFET_JOB_LIFECYCLE_V2.QUEUED,
+    new Set([WFET_JOB_LIFECYCLE_V2.FETCHING, WFET_JOB_LIFECYCLE_V2.CANCELLED]),
+  ],
+  [
+    WFET_JOB_LIFECYCLE_V2.FETCHING,
+    new Set([
+      WFET_JOB_LIFECYCLE_V2.SUCCEEDED,
+      WFET_JOB_LIFECYCLE_V2.FAILED,
+      WFET_JOB_LIFECYCLE_V2.CANCELLED,
+    ]),
+  ],
+  [WFET_JOB_LIFECYCLE_V2.SUCCEEDED, new Set()],
+  [WFET_JOB_LIFECYCLE_V2.FAILED, new Set()],
+  [WFET_JOB_LIFECYCLE_V2.CANCELLED, new Set()],
+]);
+const _wfetTsV2 = new Map();
+const _wfetJsV2 = new Map();
+let _wfetMaxActive = 12,
+  _wfetMaxPending = 30,
+  _wfetIdleMs = 7 * 24 * 60 * 60 * 1000,
+  _wfetStuckMs = 60 * 1000;
+function _wfetPos(n, label) {
+  const v = Math.floor(Number(n));
+  if (!Number.isFinite(v) || v <= 0)
+    throw new Error(`${label} must be positive integer`);
+  return v;
+}
+function _wfetCheckT(from, to) {
+  const a = _wfetTTrans.get(from);
+  if (!a || !a.has(to))
+    throw new Error(`invalid wfet target transition ${from} → ${to}`);
+}
+function _wfetCheckJ(from, to) {
+  const a = _wfetJTrans.get(from);
+  if (!a || !a.has(to))
+    throw new Error(`invalid wfet job transition ${from} → ${to}`);
+}
+export function setMaxActiveWfetTargetsPerOwnerV2(n) {
+  _wfetMaxActive = _wfetPos(n, "maxActiveWfetTargetsPerOwner");
+}
+export function getMaxActiveWfetTargetsPerOwnerV2() {
+  return _wfetMaxActive;
+}
+export function setMaxPendingWfetJobsPerTargetV2(n) {
+  _wfetMaxPending = _wfetPos(n, "maxPendingWfetJobsPerTarget");
+}
+export function getMaxPendingWfetJobsPerTargetV2() {
+  return _wfetMaxPending;
+}
+export function setWfetTargetIdleMsV2(n) {
+  _wfetIdleMs = _wfetPos(n, "wfetTargetIdleMs");
+}
+export function getWfetTargetIdleMsV2() {
+  return _wfetIdleMs;
+}
+export function setWfetJobStuckMsV2(n) {
+  _wfetStuckMs = _wfetPos(n, "wfetJobStuckMs");
+}
+export function getWfetJobStuckMsV2() {
+  return _wfetStuckMs;
+}
+export function _resetStateWebFetchV2() {
+  _wfetTsV2.clear();
+  _wfetJsV2.clear();
+  _wfetMaxActive = 12;
+  _wfetMaxPending = 30;
+  _wfetIdleMs = 7 * 24 * 60 * 60 * 1000;
+  _wfetStuckMs = 60 * 1000;
+}
+export function registerWfetTargetV2({ id, owner, baseUrl, metadata } = {}) {
+  if (!id) throw new Error("wfet target id required");
+  if (!owner) throw new Error("wfet target owner required");
+  if (_wfetTsV2.has(id))
+    throw new Error(`wfet target ${id} already registered`);
+  const now = Date.now();
+  const t = {
+    id,
+    owner,
+    baseUrl: baseUrl || "",
+    status: WFET_TARGET_MATURITY_V2.PENDING,
+    createdAt: now,
+    updatedAt: now,
+    activatedAt: null,
+    retiredAt: null,
+    lastTouchedAt: now,
+    metadata: { ...(metadata || {}) },
+  };
+  _wfetTsV2.set(id, t);
+  return { ...t, metadata: { ...t.metadata } };
+}
+function _wfetCountActive(owner) {
+  let n = 0;
+  for (const t of _wfetTsV2.values())
+    if (t.owner === owner && t.status === WFET_TARGET_MATURITY_V2.ACTIVE) n++;
+  return n;
+}
+export function activateWfetTargetV2(id) {
+  const t = _wfetTsV2.get(id);
+  if (!t) throw new Error(`wfet target ${id} not found`);
+  _wfetCheckT(t.status, WFET_TARGET_MATURITY_V2.ACTIVE);
+  const recovery = t.status === WFET_TARGET_MATURITY_V2.DEGRADED;
+  if (!recovery && _wfetCountActive(t.owner) >= _wfetMaxActive)
+    throw new Error(`max active wfet targets for owner ${t.owner} reached`);
+  const now = Date.now();
+  t.status = WFET_TARGET_MATURITY_V2.ACTIVE;
+  t.updatedAt = now;
+  t.lastTouchedAt = now;
+  if (!t.activatedAt) t.activatedAt = now;
+  return { ...t, metadata: { ...t.metadata } };
+}
+export function degradeWfetTargetV2(id) {
+  const t = _wfetTsV2.get(id);
+  if (!t) throw new Error(`wfet target ${id} not found`);
+  _wfetCheckT(t.status, WFET_TARGET_MATURITY_V2.DEGRADED);
+  t.status = WFET_TARGET_MATURITY_V2.DEGRADED;
+  t.updatedAt = Date.now();
+  return { ...t, metadata: { ...t.metadata } };
+}
+export function retireWfetTargetV2(id) {
+  const t = _wfetTsV2.get(id);
+  if (!t) throw new Error(`wfet target ${id} not found`);
+  _wfetCheckT(t.status, WFET_TARGET_MATURITY_V2.RETIRED);
+  const now = Date.now();
+  t.status = WFET_TARGET_MATURITY_V2.RETIRED;
+  t.updatedAt = now;
+  if (!t.retiredAt) t.retiredAt = now;
+  return { ...t, metadata: { ...t.metadata } };
+}
+export function touchWfetTargetV2(id) {
+  const t = _wfetTsV2.get(id);
+  if (!t) throw new Error(`wfet target ${id} not found`);
+  if (_wfetTTerminal.has(t.status))
+    throw new Error(`cannot touch terminal wfet target ${id}`);
+  const now = Date.now();
+  t.lastTouchedAt = now;
+  t.updatedAt = now;
+  return { ...t, metadata: { ...t.metadata } };
+}
+export function getWfetTargetV2(id) {
+  const t = _wfetTsV2.get(id);
+  if (!t) return null;
+  return { ...t, metadata: { ...t.metadata } };
+}
+export function listWfetTargetsV2() {
+  return [..._wfetTsV2.values()].map((t) => ({
+    ...t,
+    metadata: { ...t.metadata },
+  }));
+}
+function _wfetCountPending(targetId) {
+  let n = 0;
+  for (const j of _wfetJsV2.values())
+    if (
+      j.targetId === targetId &&
+      (j.status === WFET_JOB_LIFECYCLE_V2.QUEUED ||
+        j.status === WFET_JOB_LIFECYCLE_V2.FETCHING)
+    )
+      n++;
+  return n;
+}
+export function createWfetJobV2({ id, targetId, kind, metadata } = {}) {
+  if (!id) throw new Error("wfet job id required");
+  if (!targetId) throw new Error("wfet job targetId required");
+  if (_wfetJsV2.has(id)) throw new Error(`wfet job ${id} already exists`);
+  if (!_wfetTsV2.has(targetId))
+    throw new Error(`wfet target ${targetId} not found`);
+  if (_wfetCountPending(targetId) >= _wfetMaxPending)
+    throw new Error(`max pending wfet jobs for target ${targetId} reached`);
+  const now = Date.now();
+  const j = {
+    id,
+    targetId,
+    kind: kind || "GET",
+    status: WFET_JOB_LIFECYCLE_V2.QUEUED,
+    createdAt: now,
+    updatedAt: now,
+    startedAt: null,
+    settledAt: null,
+    metadata: { ...(metadata || {}) },
+  };
+  _wfetJsV2.set(id, j);
+  return { ...j, metadata: { ...j.metadata } };
+}
+export function fetchingWfetJobV2(id) {
+  const j = _wfetJsV2.get(id);
+  if (!j) throw new Error(`wfet job ${id} not found`);
+  _wfetCheckJ(j.status, WFET_JOB_LIFECYCLE_V2.FETCHING);
+  const now = Date.now();
+  j.status = WFET_JOB_LIFECYCLE_V2.FETCHING;
+  j.updatedAt = now;
+  if (!j.startedAt) j.startedAt = now;
+  return { ...j, metadata: { ...j.metadata } };
+}
+export function succeedWfetJobV2(id) {
+  const j = _wfetJsV2.get(id);
+  if (!j) throw new Error(`wfet job ${id} not found`);
+  _wfetCheckJ(j.status, WFET_JOB_LIFECYCLE_V2.SUCCEEDED);
+  const now = Date.now();
+  j.status = WFET_JOB_LIFECYCLE_V2.SUCCEEDED;
+  j.updatedAt = now;
+  if (!j.settledAt) j.settledAt = now;
+  return { ...j, metadata: { ...j.metadata } };
+}
+export function failWfetJobV2(id, reason) {
+  const j = _wfetJsV2.get(id);
+  if (!j) throw new Error(`wfet job ${id} not found`);
+  _wfetCheckJ(j.status, WFET_JOB_LIFECYCLE_V2.FAILED);
+  const now = Date.now();
+  j.status = WFET_JOB_LIFECYCLE_V2.FAILED;
+  j.updatedAt = now;
+  if (!j.settledAt) j.settledAt = now;
+  if (reason) j.metadata.failReason = String(reason);
+  return { ...j, metadata: { ...j.metadata } };
+}
+export function cancelWfetJobV2(id, reason) {
+  const j = _wfetJsV2.get(id);
+  if (!j) throw new Error(`wfet job ${id} not found`);
+  _wfetCheckJ(j.status, WFET_JOB_LIFECYCLE_V2.CANCELLED);
+  const now = Date.now();
+  j.status = WFET_JOB_LIFECYCLE_V2.CANCELLED;
+  j.updatedAt = now;
+  if (!j.settledAt) j.settledAt = now;
+  if (reason) j.metadata.cancelReason = String(reason);
+  return { ...j, metadata: { ...j.metadata } };
+}
+export function getWfetJobV2(id) {
+  const j = _wfetJsV2.get(id);
+  if (!j) return null;
+  return { ...j, metadata: { ...j.metadata } };
+}
+export function listWfetJobsV2() {
+  return [..._wfetJsV2.values()].map((j) => ({
+    ...j,
+    metadata: { ...j.metadata },
+  }));
+}
+export function autoDegradeIdleWfetTargetsV2({ now } = {}) {
+  const t = now ?? Date.now();
+  const flipped = [];
+  for (const x of _wfetTsV2.values())
+    if (
+      x.status === WFET_TARGET_MATURITY_V2.ACTIVE &&
+      t - x.lastTouchedAt >= _wfetIdleMs
+    ) {
+      x.status = WFET_TARGET_MATURITY_V2.DEGRADED;
+      x.updatedAt = t;
+      flipped.push(x.id);
+    }
+  return { flipped, count: flipped.length };
+}
+export function autoFailStuckWfetJobsV2({ now } = {}) {
+  const t = now ?? Date.now();
+  const flipped = [];
+  for (const j of _wfetJsV2.values())
+    if (
+      j.status === WFET_JOB_LIFECYCLE_V2.FETCHING &&
+      j.startedAt != null &&
+      t - j.startedAt >= _wfetStuckMs
+    ) {
+      j.status = WFET_JOB_LIFECYCLE_V2.FAILED;
+      j.updatedAt = t;
+      if (!j.settledAt) j.settledAt = t;
+      j.metadata.failReason = "auto-fail-stuck";
+      flipped.push(j.id);
+    }
+  return { flipped, count: flipped.length };
+}
+export function getWebFetchGovStatsV2() {
+  const targetsByStatus = {};
+  for (const v of Object.values(WFET_TARGET_MATURITY_V2))
+    targetsByStatus[v] = 0;
+  for (const t of _wfetTsV2.values()) targetsByStatus[t.status]++;
+  const jobsByStatus = {};
+  for (const v of Object.values(WFET_JOB_LIFECYCLE_V2)) jobsByStatus[v] = 0;
+  for (const j of _wfetJsV2.values()) jobsByStatus[j.status]++;
+  return {
+    totalWfetTargetsV2: _wfetTsV2.size,
+    totalWfetJobsV2: _wfetJsV2.size,
+    maxActiveWfetTargetsPerOwner: _wfetMaxActive,
+    maxPendingWfetJobsPerTarget: _wfetMaxPending,
+    wfetTargetIdleMs: _wfetIdleMs,
+    wfetJobStuckMs: _wfetStuckMs,
+    targetsByStatus,
+    jobsByStatus,
+  };
+}

package/src/lib/zkp-engine.js

@@ -742,3 +742,345 @@ export function getZKPStatsV2() {
     credentialsByDid,
   };
 }
+
+// ===== V2 Surface: ZKP Engine governance overlay (CLI v0.136.0) =====
+export const ZKP_CIRCUIT_MATURITY_V2 = Object.freeze({
+  PENDING: "pending",
+  ACTIVE: "active",
+  DEPRECATED: "deprecated",
+  ARCHIVED: "archived",
+});
+export const ZKP_PROOF_LIFECYCLE_V2 = Object.freeze({
+  QUEUED: "queued",
+  PROVING: "proving",
+  VERIFIED: "verified",
+  FAILED: "failed",
+  CANCELLED: "cancelled",
+});
+
+const _zkpCircTrans = new Map([
+  [
+    ZKP_CIRCUIT_MATURITY_V2.PENDING,
+    new Set([ZKP_CIRCUIT_MATURITY_V2.ACTIVE, ZKP_CIRCUIT_MATURITY_V2.ARCHIVED]),
+  ],
+  [
+    ZKP_CIRCUIT_MATURITY_V2.ACTIVE,
+    new Set([
+      ZKP_CIRCUIT_MATURITY_V2.DEPRECATED,
+      ZKP_CIRCUIT_MATURITY_V2.ARCHIVED,
+    ]),
+  ],
+  [
+    ZKP_CIRCUIT_MATURITY_V2.DEPRECATED,
+    new Set([ZKP_CIRCUIT_MATURITY_V2.ACTIVE, ZKP_CIRCUIT_MATURITY_V2.ARCHIVED]),
+  ],
+  [ZKP_CIRCUIT_MATURITY_V2.ARCHIVED, new Set()],
+]);
+const _zkpCircTerminal = new Set([ZKP_CIRCUIT_MATURITY_V2.ARCHIVED]);
+const _zkpProofTrans = new Map([
+  [
+    ZKP_PROOF_LIFECYCLE_V2.QUEUED,
+    new Set([ZKP_PROOF_LIFECYCLE_V2.PROVING, ZKP_PROOF_LIFECYCLE_V2.CANCELLED]),
+  ],
+  [
+    ZKP_PROOF_LIFECYCLE_V2.PROVING,
+    new Set([
+      ZKP_PROOF_LIFECYCLE_V2.VERIFIED,
+      ZKP_PROOF_LIFECYCLE_V2.FAILED,
+      ZKP_PROOF_LIFECYCLE_V2.CANCELLED,
+    ]),
+  ],
+  [ZKP_PROOF_LIFECYCLE_V2.VERIFIED, new Set()],
+  [ZKP_PROOF_LIFECYCLE_V2.FAILED, new Set()],
+  [ZKP_PROOF_LIFECYCLE_V2.CANCELLED, new Set()],
+]);
+
+const _zkpCircs = new Map();
+const _zkpProofs = new Map();
+let _zkpMaxActivePerOwner = 10;
+let _zkpMaxPendingPerCircuit = 15;
+let _zkpCircuitIdleMs = 30 * 24 * 60 * 60 * 1000;
+let _zkpProofStuckMs = 10 * 60 * 1000;
+
+function _zkpPos(n, lbl) {
+  const v = Math.floor(Number(n));
+  if (!Number.isFinite(v) || v <= 0)
+    throw new Error(`${lbl} must be positive integer`);
+  return v;
+}
+
+export function setMaxActiveZkpCircuitsPerOwnerV2(n) {
+  _zkpMaxActivePerOwner = _zkpPos(n, "maxActiveZkpCircuitsPerOwner");
+}
+export function getMaxActiveZkpCircuitsPerOwnerV2() {
+  return _zkpMaxActivePerOwner;
+}
+export function setMaxPendingZkpProofsPerCircuitV2(n) {
+  _zkpMaxPendingPerCircuit = _zkpPos(n, "maxPendingZkpProofsPerCircuit");
+}
+export function getMaxPendingZkpProofsPerCircuitV2() {
+  return _zkpMaxPendingPerCircuit;
+}
+export function setZkpCircuitIdleMsV2(n) {
+  _zkpCircuitIdleMs = _zkpPos(n, "zkpCircuitIdleMs");
+}
+export function getZkpCircuitIdleMsV2() {
+  return _zkpCircuitIdleMs;
+}
+export function setZkpProofStuckMsV2(n) {
+  _zkpProofStuckMs = _zkpPos(n, "zkpProofStuckMs");
+}
+export function getZkpProofStuckMsV2() {
+  return _zkpProofStuckMs;
+}
+
+export function _resetStateZkpEngineV2() {
+  _zkpCircs.clear();
+  _zkpProofs.clear();
+  _zkpMaxActivePerOwner = 10;
+  _zkpMaxPendingPerCircuit = 15;
+  _zkpCircuitIdleMs = 30 * 24 * 60 * 60 * 1000;
+  _zkpProofStuckMs = 10 * 60 * 1000;
+}
+
+export function registerZkpCircuitV2({ id, owner, scheme, metadata } = {}) {
+  if (!id || typeof id !== "string") throw new Error("id is required");
+  if (!owner || typeof owner !== "string") throw new Error("owner is required");
+  if (_zkpCircs.has(id))
+    throw new Error(`zkp circuit ${id} already registered`);
+  const now = Date.now();
+  const c = {
+    id,
+    owner,
+    scheme: scheme || "groth16",
+    status: ZKP_CIRCUIT_MATURITY_V2.PENDING,
+    createdAt: now,
+    updatedAt: now,
+    activatedAt: null,
+    archivedAt: null,
+    lastTouchedAt: now,
+    metadata: { ...(metadata || {}) },
+  };
+  _zkpCircs.set(id, c);
+  return { ...c, metadata: { ...c.metadata } };
+}
+function _zkpCheckC(from, to) {
+  const a = _zkpCircTrans.get(from);
+  if (!a || !a.has(to))
+    throw new Error(`invalid zkp circuit transition ${from} → ${to}`);
+}
+function _zkpCountActive(owner) {
+  let n = 0;
+  for (const c of _zkpCircs.values())
+    if (c.owner === owner && c.status === ZKP_CIRCUIT_MATURITY_V2.ACTIVE) n++;
+  return n;
+}
+
+export function activateZkpCircuitV2(id) {
+  const c = _zkpCircs.get(id);
+  if (!c) throw new Error(`zkp circuit ${id} not found`);
+  _zkpCheckC(c.status, ZKP_CIRCUIT_MATURITY_V2.ACTIVE);
+  const recovery = c.status === ZKP_CIRCUIT_MATURITY_V2.DEPRECATED;
+  if (!recovery) {
+    const a = _zkpCountActive(c.owner);
+    if (a >= _zkpMaxActivePerOwner)
+      throw new Error(
+        `max active zkp circuits per owner (${_zkpMaxActivePerOwner}) reached for ${c.owner}`,
+      );
+  }
+  const now = Date.now();
+  c.status = ZKP_CIRCUIT_MATURITY_V2.ACTIVE;
+  c.updatedAt = now;
+  c.lastTouchedAt = now;
+  if (!c.activatedAt) c.activatedAt = now;
+  return { ...c, metadata: { ...c.metadata } };
+}
+export function deprecateZkpCircuitV2(id) {
+  const c = _zkpCircs.get(id);
+  if (!c) throw new Error(`zkp circuit ${id} not found`);
+  _zkpCheckC(c.status, ZKP_CIRCUIT_MATURITY_V2.DEPRECATED);
+  c.status = ZKP_CIRCUIT_MATURITY_V2.DEPRECATED;
+  c.updatedAt = Date.now();
+  return { ...c, metadata: { ...c.metadata } };
+}
+export function archiveZkpCircuitV2(id) {
+  const c = _zkpCircs.get(id);
+  if (!c) throw new Error(`zkp circuit ${id} not found`);
+  _zkpCheckC(c.status, ZKP_CIRCUIT_MATURITY_V2.ARCHIVED);
+  const now = Date.now();
+  c.status = ZKP_CIRCUIT_MATURITY_V2.ARCHIVED;
+  c.updatedAt = now;
+  if (!c.archivedAt) c.archivedAt = now;
+  return { ...c, metadata: { ...c.metadata } };
+}
+export function touchZkpCircuitV2(id) {
+  const c = _zkpCircs.get(id);
+  if (!c) throw new Error(`zkp circuit ${id} not found`);
+  if (_zkpCircTerminal.has(c.status))
+    throw new Error(`cannot touch terminal zkp circuit ${id}`);
+  const now = Date.now();
+  c.lastTouchedAt = now;
+  c.updatedAt = now;
+  return { ...c, metadata: { ...c.metadata } };
+}
+export function getZkpCircuitV2(id) {
+  const c = _zkpCircs.get(id);
+  if (!c) return null;
+  return { ...c, metadata: { ...c.metadata } };
+}
+export function listZkpCircuitsV2() {
+  return [..._zkpCircs.values()].map((c) => ({
+    ...c,
+    metadata: { ...c.metadata },
+  }));
+}
+
+function _zkpCountPending(cid) {
+  let n = 0;
+  for (const p of _zkpProofs.values())
+    if (
+      p.circuitId === cid &&
+      (p.status === ZKP_PROOF_LIFECYCLE_V2.QUEUED ||
+        p.status === ZKP_PROOF_LIFECYCLE_V2.PROVING)
+    )
+      n++;
+  return n;
+}
+
+export function createZkpProofV2({ id, circuitId, inputs, metadata } = {}) {
+  if (!id || typeof id !== "string") throw new Error("id is required");
+  if (!circuitId || typeof circuitId !== "string")
+    throw new Error("circuitId is required");
+  if (_zkpProofs.has(id)) throw new Error(`zkp proof ${id} already exists`);
+  if (!_zkpCircs.has(circuitId))
+    throw new Error(`zkp circuit ${circuitId} not found`);
+  const pending = _zkpCountPending(circuitId);
+  if (pending >= _zkpMaxPendingPerCircuit)
+    throw new Error(
+      `max pending zkp proofs per circuit (${_zkpMaxPendingPerCircuit}) reached for ${circuitId}`,
+    );
+  const now = Date.now();
+  const p = {
+    id,
+    circuitId,
+    inputs: inputs || "",
+    status: ZKP_PROOF_LIFECYCLE_V2.QUEUED,
+    createdAt: now,
+    updatedAt: now,
+    startedAt: null,
+    settledAt: null,
+    metadata: { ...(metadata || {}) },
+  };
+  _zkpProofs.set(id, p);
+  return { ...p, metadata: { ...p.metadata } };
+}
+function _zkpCheckP(from, to) {
+  const a = _zkpProofTrans.get(from);
+  if (!a || !a.has(to))
+    throw new Error(`invalid zkp proof transition ${from} → ${to}`);
+}
+export function startZkpProofV2(id) {
+  const p = _zkpProofs.get(id);
+  if (!p) throw new Error(`zkp proof ${id} not found`);
+  _zkpCheckP(p.status, ZKP_PROOF_LIFECYCLE_V2.PROVING);
+  const now = Date.now();
+  p.status = ZKP_PROOF_LIFECYCLE_V2.PROVING;
+  p.updatedAt = now;
+  if (!p.startedAt) p.startedAt = now;
+  return { ...p, metadata: { ...p.metadata } };
+}
+export function verifyZkpProofV2(id) {
+  const p = _zkpProofs.get(id);
+  if (!p) throw new Error(`zkp proof ${id} not found`);
+  _zkpCheckP(p.status, ZKP_PROOF_LIFECYCLE_V2.VERIFIED);
+  const now = Date.now();
+  p.status = ZKP_PROOF_LIFECYCLE_V2.VERIFIED;
+  p.updatedAt = now;
+  if (!p.settledAt) p.settledAt = now;
+  return { ...p, metadata: { ...p.metadata } };
+}
+export function failZkpProofV2(id, reason) {
+  const p = _zkpProofs.get(id);
+  if (!p) throw new Error(`zkp proof ${id} not found`);
+  _zkpCheckP(p.status, ZKP_PROOF_LIFECYCLE_V2.FAILED);
+  const now = Date.now();
+  p.status = ZKP_PROOF_LIFECYCLE_V2.FAILED;
+  p.updatedAt = now;
+  if (!p.settledAt) p.settledAt = now;
+  if (reason) p.metadata.failReason = String(reason);
+  return { ...p, metadata: { ...p.metadata } };
+}
+export function cancelZkpProofV2(id, reason) {
+  const p = _zkpProofs.get(id);
+  if (!p) throw new Error(`zkp proof ${id} not found`);
+  _zkpCheckP(p.status, ZKP_PROOF_LIFECYCLE_V2.CANCELLED);
+  const now = Date.now();
+  p.status = ZKP_PROOF_LIFECYCLE_V2.CANCELLED;
+  p.updatedAt = now;
+  if (!p.settledAt) p.settledAt = now;
+  if (reason) p.metadata.cancelReason = String(reason);
+  return { ...p, metadata: { ...p.metadata } };
+}
+export function getZkpProofV2(id) {
+  const p = _zkpProofs.get(id);
+  if (!p) return null;
+  return { ...p, metadata: { ...p.metadata } };
+}
+export function listZkpProofsV2() {
+  return [..._zkpProofs.values()].map((p) => ({
+    ...p,
+    metadata: { ...p.metadata },
+  }));
+}
+
+export function autoDeprecateIdleZkpCircuitsV2({ now } = {}) {
+  const t = now ?? Date.now();
+  const flipped = [];
+  for (const c of _zkpCircs.values())
+    if (
+      c.status === ZKP_CIRCUIT_MATURITY_V2.ACTIVE &&
+      t - c.lastTouchedAt >= _zkpCircuitIdleMs
+    ) {
+      c.status = ZKP_CIRCUIT_MATURITY_V2.DEPRECATED;
+      c.updatedAt = t;
+      flipped.push(c.id);
+    }
+  return { flipped, count: flipped.length };
+}
+export function autoFailStuckZkpProofsV2({ now } = {}) {
+  const t = now ?? Date.now();
+  const flipped = [];
+  for (const p of _zkpProofs.values())
+    if (
+      p.status === ZKP_PROOF_LIFECYCLE_V2.PROVING &&
+      p.startedAt != null &&
+      t - p.startedAt >= _zkpProofStuckMs
+    ) {
+      p.status = ZKP_PROOF_LIFECYCLE_V2.FAILED;
+      p.updatedAt = t;
+      if (!p.settledAt) p.settledAt = t;
+      p.metadata.failReason = "auto-fail-stuck";
+      flipped.push(p.id);
+    }
+  return { flipped, count: flipped.length };
+}
+
+export function getZkpEngineGovStatsV2() {
+  const circuitsByStatus = {};
+  for (const s of Object.values(ZKP_CIRCUIT_MATURITY_V2))
+    circuitsByStatus[s] = 0;
+  for (const c of _zkpCircs.values()) circuitsByStatus[c.status]++;
+  const proofsByStatus = {};
+  for (const s of Object.values(ZKP_PROOF_LIFECYCLE_V2)) proofsByStatus[s] = 0;
+  for (const p of _zkpProofs.values()) proofsByStatus[p.status]++;
+  return {
+    totalCircuitsV2: _zkpCircs.size,
+    totalProofsV2: _zkpProofs.size,
+    maxActiveZkpCircuitsPerOwner: _zkpMaxActivePerOwner,
+    maxPendingZkpProofsPerCircuit: _zkpMaxPendingPerCircuit,
+    zkpCircuitIdleMs: _zkpCircuitIdleMs,
+    zkpProofStuckMs: _zkpProofStuckMs,
+    circuitsByStatus,
+    proofsByStatus,
+  };
+}