chainlesschain 0.81.0 → 0.132.0

package/src/commands/pqc.js

@@ -13,6 +13,35 @@ import {
   getMigrationStatus,
   migrate,
   listAlgorithms,
+  KEY_MATURITY_V2,
+  MIGRATION_LIFECYCLE_V2,
+  getMaxActiveKeysPerOwnerV2,
+  setMaxActiveKeysPerOwnerV2,
+  getMaxPendingMigrationsPerKeyV2,
+  setMaxPendingMigrationsPerKeyV2,
+  getKeyIdleMsV2,
+  setKeyIdleMsV2,
+  getMigrationStuckMsV2,
+  setMigrationStuckMsV2,
+  registerKeyV2,
+  getKeyV2,
+  listKeysV2,
+  activateKeyV2,
+  deprecateKeyV2,
+  archiveKeyV2,
+  touchKeyV2,
+  createMigrationV2,
+  getMigrationV2,
+  listMigrationsV2,
+  startMigrationV2,
+  completeMigrationV2,
+  failMigrationV2,
+  cancelMigrationV2,
+  getActiveKeyCountV2,
+  getPendingMigrationCountV2,
+  autoDeprecateIdleKeysV2,
+  autoFailStuckMigrationsV2,
+  getPqcManagerStatsV2,
 } from "../lib/pqc-manager.js";
 
 export function registerPqcCommand(program) {
@@ -193,4 +222,368 @@ export function registerPqcCommand(program) {
         process.exit(1);
       }
     });
+
+  // ===== V2 in-memory governance surface (no DB, no bootstrap) =====
+
+  pqc
+    .command("key-maturities-v2")
+    .description("[V2] List key maturity states")
+    .option("--json", "Output as JSON")
+    .action((opts) => {
+      const states = Object.values(KEY_MATURITY_V2);
+      if (opts.json) console.log(JSON.stringify(states, null, 2));
+      else for (const s of states) logger.log(s);
+    });
+
+  pqc
+    .command("migration-lifecycles-v2")
+    .description("[V2] List migration lifecycle states")
+    .option("--json", "Output as JSON")
+    .action((opts) => {
+      const states = Object.values(MIGRATION_LIFECYCLE_V2);
+      if (opts.json) console.log(JSON.stringify(states, null, 2));
+      else for (const s of states) logger.log(s);
+    });
+
+  pqc
+    .command("config-v2")
+    .description("[V2] Show governance config")
+    .option("--json", "Output as JSON")
+    .action((opts) => {
+      const cfg = {
+        maxActiveKeysPerOwner: getMaxActiveKeysPerOwnerV2(),
+        maxPendingMigrationsPerKey: getMaxPendingMigrationsPerKeyV2(),
+        keyIdleMs: getKeyIdleMsV2(),
+        migrationStuckMs: getMigrationStuckMsV2(),
+      };
+      if (opts.json) console.log(JSON.stringify(cfg, null, 2));
+      else for (const [k, v] of Object.entries(cfg)) logger.log(`${k}: ${v}`);
+    });
+
+  pqc
+    .command("set-max-active-keys-per-owner-v2 <n>")
+    .description("[V2] Set per-owner active key cap")
+    .action((n) => {
+      try {
+        setMaxActiveKeysPerOwnerV2(Number(n));
+        logger.success(
+          `max active keys/owner = ${getMaxActiveKeysPerOwnerV2()}`,
+        );
+      } catch (err) {
+        logger.error(err.message);
+        process.exit(1);
+      }
+    });
+
+  pqc
+    .command("set-max-pending-migrations-per-key-v2 <n>")
+    .description("[V2] Set per-key pending migration cap")
+    .action((n) => {
+      try {
+        setMaxPendingMigrationsPerKeyV2(Number(n));
+        logger.success(
+          `max pending migrations/key = ${getMaxPendingMigrationsPerKeyV2()}`,
+        );
+      } catch (err) {
+        logger.error(err.message);
+        process.exit(1);
+      }
+    });
+
+  pqc
+    .command("set-key-idle-ms-v2 <ms>")
+    .description("[V2] Set key idle threshold (ms)")
+    .action((ms) => {
+      try {
+        setKeyIdleMsV2(Number(ms));
+        logger.success(`key idle ms = ${getKeyIdleMsV2()}`);
+      } catch (err) {
+        logger.error(err.message);
+        process.exit(1);
+      }
+    });
+
+  pqc
+    .command("set-migration-stuck-ms-v2 <ms>")
+    .description("[V2] Set migration stuck threshold (ms)")
+    .action((ms) => {
+      try {
+        setMigrationStuckMsV2(Number(ms));
+        logger.success(`migration stuck ms = ${getMigrationStuckMsV2()}`);
+      } catch (err) {
+        logger.error(err.message);
+        process.exit(1);
+      }
+    });
+
+  pqc
+    .command("register-key-v2 <id>")
+    .description("[V2] Register a key profile (PENDING)")
+    .requiredOption("-o, --owner <id>", "Owner ID")
+    .requiredOption("-a, --algorithm <algo>", "Algorithm")
+    .option("-p, --purpose <purpose>", "Purpose", "general")
+    .action((id, opts) => {
+      try {
+        const k = registerKeyV2(id, {
+          ownerId: opts.owner,
+          algorithm: opts.algorithm,
+          purpose: opts.purpose,
+        });
+        logger.success(`key ${k.id} registered (status=${k.status})`);
+      } catch (err) {
+        logger.error(err.message);
+        process.exit(1);
+      }
+    });
+
+  pqc
+    .command("activate-key-v2 <id>")
+    .description("[V2] Activate a key (pending|deprecated -> active)")
+    .action((id) => {
+      try {
+        const k = activateKeyV2(id);
+        logger.success(`key ${k.id} active`);
+      } catch (err) {
+        logger.error(err.message);
+        process.exit(1);
+      }
+    });
+
+  pqc
+    .command("deprecate-key-v2 <id>")
+    .description("[V2] Deprecate a key (active -> deprecated)")
+    .action((id) => {
+      try {
+        const k = deprecateKeyV2(id);
+        logger.success(`key ${k.id} deprecated`);
+      } catch (err) {
+        logger.error(err.message);
+        process.exit(1);
+      }
+    });
+
+  pqc
+    .command("archive-key-v2 <id>")
+    .description("[V2] Archive a key (terminal)")
+    .action((id) => {
+      try {
+        const k = archiveKeyV2(id);
+        logger.success(`key ${k.id} archived`);
+      } catch (err) {
+        logger.error(err.message);
+        process.exit(1);
+      }
+    });
+
+  pqc
+    .command("touch-key-v2 <id>")
+    .description("[V2] Bump key lastSeenAt")
+    .action((id) => {
+      try {
+        const k = touchKeyV2(id);
+        logger.success(`key ${k.id} touched`);
+      } catch (err) {
+        logger.error(err.message);
+        process.exit(1);
+      }
+    });
+
+  pqc
+    .command("get-key-v2 <id>")
+    .description("[V2] Show a key profile")
+    .option("--json", "Output as JSON")
+    .action((id, opts) => {
+      try {
+        const k = getKeyV2(id);
+        if (!k) {
+          logger.info("key not found");
+          return;
+        }
+        if (opts.json) console.log(JSON.stringify(k, null, 2));
+        else logger.log(JSON.stringify(k, null, 2));
+      } catch (err) {
+        logger.error(err.message);
+        process.exit(1);
+      }
+    });
+
+  pqc
+    .command("list-keys-v2")
+    .description("[V2] List key profiles")
+    .option("-o, --owner <id>", "Filter by owner")
+    .option("-s, --status <s>", "Filter by status")
+    .option("-a, --algorithm <algo>", "Filter by algorithm")
+    .option("--json", "Output as JSON")
+    .action((opts) => {
+      const list = listKeysV2({
+        ownerId: opts.owner,
+        status: opts.status,
+        algorithm: opts.algorithm,
+      });
+      if (opts.json) console.log(JSON.stringify(list, null, 2));
+      else
+        for (const k of list)
+          logger.log(`${k.id}\t${k.ownerId}\t${k.status}\t${k.algorithm}`);
+    });
+
+  pqc
+    .command("create-migration-v2 <id>")
+    .description("[V2] Create a queued V2 migration")
+    .requiredOption("-k, --key <keyId>", "Key ID")
+    .requiredOption("-t, --target <algo>", "Target algorithm")
+    .action((id, opts) => {
+      try {
+        const m = createMigrationV2(id, {
+          keyId: opts.key,
+          targetAlgorithm: opts.target,
+        });
+        logger.success(
+          `migration ${m.id} queued (key=${m.keyId} ${m.sourceAlgorithm}->${m.targetAlgorithm})`,
+        );
+      } catch (err) {
+        logger.error(err.message);
+        process.exit(1);
+      }
+    });
+
+  pqc
+    .command("start-migration-v2 <id>")
+    .description("[V2] Start a migration (queued -> running)")
+    .action((id) => {
+      try {
+        const m = startMigrationV2(id);
+        logger.success(`migration ${m.id} running`);
+      } catch (err) {
+        logger.error(err.message);
+        process.exit(1);
+      }
+    });
+
+  pqc
+    .command("complete-migration-v2 <id>")
+    .description("[V2] Complete a migration (running -> completed)")
+    .action((id) => {
+      try {
+        const m = completeMigrationV2(id);
+        logger.success(`migration ${m.id} completed`);
+      } catch (err) {
+        logger.error(err.message);
+        process.exit(1);
+      }
+    });
+
+  pqc
+    .command("fail-migration-v2 <id>")
+    .description("[V2] Fail a migration (running -> failed)")
+    .action((id) => {
+      try {
+        const m = failMigrationV2(id);
+        logger.success(`migration ${m.id} failed`);
+      } catch (err) {
+        logger.error(err.message);
+        process.exit(1);
+      }
+    });
+
+  pqc
+    .command("cancel-migration-v2 <id>")
+    .description("[V2] Cancel a migration (queued|running -> cancelled)")
+    .action((id) => {
+      try {
+        const m = cancelMigrationV2(id);
+        logger.success(`migration ${m.id} cancelled`);
+      } catch (err) {
+        logger.error(err.message);
+        process.exit(1);
+      }
+    });
+
+  pqc
+    .command("get-migration-v2 <id>")
+    .description("[V2] Show migration job")
+    .option("--json", "Output as JSON")
+    .action((id, opts) => {
+      try {
+        const m = getMigrationV2(id);
+        if (!m) {
+          logger.info("migration not found");
+          return;
+        }
+        if (opts.json) console.log(JSON.stringify(m, null, 2));
+        else logger.log(JSON.stringify(m, null, 2));
+      } catch (err) {
+        logger.error(err.message);
+        process.exit(1);
+      }
+    });
+
+  pqc
+    .command("list-migrations-v2")
+    .description("[V2] List V2 migrations")
+    .option("-k, --key <keyId>", "Filter by key")
+    .option("-s, --status <s>", "Filter by status")
+    .option("--json", "Output as JSON")
+    .action((opts) => {
+      const list = listMigrationsV2({ keyId: opts.key, status: opts.status });
+      if (opts.json) console.log(JSON.stringify(list, null, 2));
+      else
+        for (const m of list)
+          logger.log(
+            `${m.id}\t${m.keyId}\t${m.status}\t${m.sourceAlgorithm}->${m.targetAlgorithm}`,
+          );
+    });
+
+  pqc
+    .command("active-key-count-v2")
+    .description("[V2] Count active keys (optional --owner filter)")
+    .option("-o, --owner <id>", "Filter by owner")
+    .action((opts) => {
+      logger.log(String(getActiveKeyCountV2(opts.owner)));
+    });
+
+  pqc
+    .command("pending-migration-count-v2")
+    .description(
+      "[V2] Count pending migrations (queued+running) (optional --key filter)",
+    )
+    .option("-k, --key <keyId>", "Filter by key")
+    .action((opts) => {
+      logger.log(String(getPendingMigrationCountV2(opts.key)));
+    });
+
+  pqc
+    .command("auto-deprecate-idle-keys-v2")
+    .description("[V2] Deprecate idle active keys")
+    .option("--now <ms>", "Override current time (ms)")
+    .option("--json", "Output as JSON")
+    .action((opts) => {
+      const list = autoDeprecateIdleKeysV2(
+        opts.now ? { now: Number(opts.now) } : undefined,
+      );
+      if (opts.json) console.log(JSON.stringify(list, null, 2));
+      else logger.success(`deprecated ${list.length} key(s)`);
+    });
+
+  pqc
+    .command("auto-fail-stuck-migrations-v2")
+    .description("[V2] Fail stuck running migrations")
+    .option("--now <ms>", "Override current time (ms)")
+    .option("--json", "Output as JSON")
+    .action((opts) => {
+      const list = autoFailStuckMigrationsV2(
+        opts.now ? { now: Number(opts.now) } : undefined,
+      );
+      if (opts.json) console.log(JSON.stringify(list, null, 2));
+      else logger.success(`failed ${list.length} migration(s)`);
+    });
+
+  pqc
+    .command("stats-v2")
+    .description("[V2] Show governance stats")
+    .option("--json", "Output as JSON")
+    .action((opts) => {
+      const s = getPqcManagerStatsV2();
+      if (opts.json) console.log(JSON.stringify(s, null, 2));
+      else logger.log(JSON.stringify(s, null, 2));
+    });
 }