chainlesschain 0.81.0 → 0.143.0

package/src/lib/scim-manager.js

@@ -210,3 +210,332 @@ export function _resetState() {
   _connectors.clear();
   _syncLog.length = 0;
 }
+
+/* ═══════════════════════════════════════════════════════════════
+ * V2 Surface — SCIM provisioning lifecycle layer.
+ * Tracks identities and sync-job lifecycle independent of legacy
+ * createUser/syncProvision flows above.
+ * ═══════════════════════════════════════════════════════════════ */
+
+export const IDENTITY_LIFECYCLE_V2 = Object.freeze({
+  PENDING: "pending",
+  PROVISIONED: "provisioned",
+  SUSPENDED: "suspended",
+  DEPROVISIONED: "deprovisioned",
+});
+
+export const SYNC_JOB_V2 = Object.freeze({
+  QUEUED: "queued",
+  RUNNING: "running",
+  SUCCEEDED: "succeeded",
+  FAILED: "failed",
+  CANCELLED: "cancelled",
+});
+
+const IDENTITY_TRANSITIONS_V2 = new Map([
+  ["pending", new Set(["provisioned", "deprovisioned"])],
+  ["provisioned", new Set(["suspended", "deprovisioned"])],
+  ["suspended", new Set(["provisioned", "deprovisioned"])],
+  ["deprovisioned", new Set()],
+]);
+const IDENTITY_TERMINALS_V2 = new Set(["deprovisioned"]);
+
+const SYNC_TRANSITIONS_V2 = new Map([
+  ["queued", new Set(["running", "cancelled"])],
+  ["running", new Set(["succeeded", "failed", "cancelled"])],
+  ["succeeded", new Set()],
+  ["failed", new Set()],
+  ["cancelled", new Set()],
+]);
+const SYNC_TERMINALS_V2 = new Set(["succeeded", "failed", "cancelled"]);
+
+export const SCIM_DEFAULT_MAX_PROVISIONED_PER_CONNECTOR = 1000;
+export const SCIM_DEFAULT_MAX_RUNNING_SYNC_PER_CONNECTOR = 2;
+export const SCIM_DEFAULT_IDENTITY_IDLE_MS = 1000 * 60 * 60 * 24 * 90; // 90 days
+export const SCIM_DEFAULT_SYNC_STUCK_MS = 1000 * 60 * 30; // 30 min
+
+const _identitiesV2 = new Map();
+const _syncJobsV2 = new Map();
+let _maxProvisionedPerConnectorV2 = SCIM_DEFAULT_MAX_PROVISIONED_PER_CONNECTOR;
+let _maxRunningSyncPerConnectorV2 = SCIM_DEFAULT_MAX_RUNNING_SYNC_PER_CONNECTOR;
+let _identityIdleMsV2 = SCIM_DEFAULT_IDENTITY_IDLE_MS;
+let _syncStuckMsV2 = SCIM_DEFAULT_SYNC_STUCK_MS;
+
+function _posIntScimV2(n, label) {
+  const v = Math.floor(Number(n));
+  if (!Number.isFinite(v) || v <= 0)
+    throw new Error(`${label} must be a positive integer`);
+  return v;
+}
+
+export function getMaxProvisionedPerConnectorV2() {
+  return _maxProvisionedPerConnectorV2;
+}
+export function setMaxProvisionedPerConnectorV2(n) {
+  _maxProvisionedPerConnectorV2 = _posIntScimV2(
+    n,
+    "maxProvisionedPerConnector",
+  );
+}
+export function getMaxRunningSyncPerConnectorV2() {
+  return _maxRunningSyncPerConnectorV2;
+}
+export function setMaxRunningSyncPerConnectorV2(n) {
+  _maxRunningSyncPerConnectorV2 = _posIntScimV2(
+    n,
+    "maxRunningSyncPerConnector",
+  );
+}
+export function getIdentityIdleMsV2() {
+  return _identityIdleMsV2;
+}
+export function setIdentityIdleMsV2(n) {
+  _identityIdleMsV2 = _posIntScimV2(n, "identityIdleMs");
+}
+export function getSyncStuckMsV2() {
+  return _syncStuckMsV2;
+}
+export function setSyncStuckMsV2(n) {
+  _syncStuckMsV2 = _posIntScimV2(n, "syncStuckMs");
+}
+
+export function getProvisionedCountV2(connectorId) {
+  let n = 0;
+  for (const i of _identitiesV2.values()) {
+    if (i.connectorId === connectorId && i.status === "provisioned") n += 1;
+  }
+  return n;
+}
+
+export function getRunningSyncCountV2(connectorId) {
+  let n = 0;
+  for (const j of _syncJobsV2.values()) {
+    if (j.connectorId === connectorId && j.status === "running") n += 1;
+  }
+  return n;
+}
+
+function _copyIdentityV2(i) {
+  return { ...i, metadata: { ...i.metadata } };
+}
+function _copySyncV2(j) {
+  return { ...j, metadata: { ...j.metadata } };
+}
+
+export function registerIdentityV2(
+  id,
+  { connectorId, externalId, metadata = {}, now = Date.now() } = {},
+) {
+  if (!id || typeof id !== "string") throw new Error("id must be a string");
+  if (!connectorId || typeof connectorId !== "string")
+    throw new Error("connectorId must be a string");
+  if (!externalId || typeof externalId !== "string")
+    throw new Error("externalId must be a string");
+  if (_identitiesV2.has(id)) throw new Error(`identity ${id} already exists`);
+  const i = {
+    id,
+    connectorId,
+    externalId,
+    status: "pending",
+    createdAt: now,
+    lastSeenAt: now,
+    provisionedAt: null,
+    deprovisionedAt: null,
+    metadata: { ...metadata },
+  };
+  _identitiesV2.set(id, i);
+  return _copyIdentityV2(i);
+}
+
+export function getIdentityV2(id) {
+  const i = _identitiesV2.get(id);
+  return i ? _copyIdentityV2(i) : null;
+}
+
+export function listIdentitiesV2({ connectorId, status } = {}) {
+  const out = [];
+  for (const i of _identitiesV2.values()) {
+    if (connectorId && i.connectorId !== connectorId) continue;
+    if (status && i.status !== status) continue;
+    out.push(_copyIdentityV2(i));
+  }
+  return out;
+}
+
+export function setIdentityStatusV2(id, next, { now = Date.now() } = {}) {
+  const i = _identitiesV2.get(id);
+  if (!i) throw new Error(`identity ${id} not found`);
+  if (!IDENTITY_TRANSITIONS_V2.has(next))
+    throw new Error(`unknown identity status: ${next}`);
+  if (IDENTITY_TERMINALS_V2.has(i.status))
+    throw new Error(`identity ${id} is in terminal state ${i.status}`);
+  const allowed = IDENTITY_TRANSITIONS_V2.get(i.status);
+  if (!allowed.has(next))
+    throw new Error(`cannot transition identity from ${i.status} to ${next}`);
+  if (next === "provisioned") {
+    if (i.status === "pending") {
+      const count = getProvisionedCountV2(i.connectorId);
+      if (count >= _maxProvisionedPerConnectorV2)
+        throw new Error(
+          `connector ${i.connectorId} already at provisioned cap (${_maxProvisionedPerConnectorV2})`,
+        );
+    }
+    if (!i.provisionedAt) i.provisionedAt = now;
+  }
+  if (next === "deprovisioned" && !i.deprovisionedAt) i.deprovisionedAt = now;
+  i.status = next;
+  i.lastSeenAt = now;
+  return _copyIdentityV2(i);
+}
+
+export function provisionIdentityV2(id, opts) {
+  return setIdentityStatusV2(id, "provisioned", opts);
+}
+export function suspendIdentityV2(id, opts) {
+  return setIdentityStatusV2(id, "suspended", opts);
+}
+export function deprovisionIdentityV2(id, opts) {
+  return setIdentityStatusV2(id, "deprovisioned", opts);
+}
+
+export function touchIdentityV2(id, { now = Date.now() } = {}) {
+  const i = _identitiesV2.get(id);
+  if (!i) throw new Error(`identity ${id} not found`);
+  i.lastSeenAt = now;
+  return _copyIdentityV2(i);
+}
+
+export function createSyncJobV2(
+  id,
+  { connectorId, kind = "full", metadata = {}, now = Date.now() } = {},
+) {
+  if (!id || typeof id !== "string") throw new Error("id must be a string");
+  if (!connectorId || typeof connectorId !== "string")
+    throw new Error("connectorId must be a string");
+  if (_syncJobsV2.has(id)) throw new Error(`syncJob ${id} already exists`);
+  const j = {
+    id,
+    connectorId,
+    kind,
+    status: "queued",
+    createdAt: now,
+    lastSeenAt: now,
+    startedAt: null,
+    finishedAt: null,
+    metadata: { ...metadata },
+  };
+  _syncJobsV2.set(id, j);
+  return _copySyncV2(j);
+}
+
+export function getSyncJobV2(id) {
+  const j = _syncJobsV2.get(id);
+  return j ? _copySyncV2(j) : null;
+}
+
+export function listSyncJobsV2({ connectorId, status } = {}) {
+  const out = [];
+  for (const j of _syncJobsV2.values()) {
+    if (connectorId && j.connectorId !== connectorId) continue;
+    if (status && j.status !== status) continue;
+    out.push(_copySyncV2(j));
+  }
+  return out;
+}
+
+export function setSyncJobStatusV2(id, next, { now = Date.now() } = {}) {
+  const j = _syncJobsV2.get(id);
+  if (!j) throw new Error(`syncJob ${id} not found`);
+  if (!SYNC_TRANSITIONS_V2.has(next))
+    throw new Error(`unknown syncJob status: ${next}`);
+  if (SYNC_TERMINALS_V2.has(j.status))
+    throw new Error(`syncJob ${id} is in terminal state ${j.status}`);
+  const allowed = SYNC_TRANSITIONS_V2.get(j.status);
+  if (!allowed.has(next))
+    throw new Error(`cannot transition syncJob from ${j.status} to ${next}`);
+  if (next === "running" && j.status === "queued") {
+    const count = getRunningSyncCountV2(j.connectorId);
+    if (count >= _maxRunningSyncPerConnectorV2)
+      throw new Error(
+        `connector ${j.connectorId} already at running-sync cap (${_maxRunningSyncPerConnectorV2})`,
+      );
+    if (!j.startedAt) j.startedAt = now;
+  }
+  if (SYNC_TERMINALS_V2.has(next) && !j.finishedAt) j.finishedAt = now;
+  j.status = next;
+  j.lastSeenAt = now;
+  return _copySyncV2(j);
+}
+
+export function startSyncJobV2(id, opts) {
+  return setSyncJobStatusV2(id, "running", opts);
+}
+export function succeedSyncJobV2(id, opts) {
+  return setSyncJobStatusV2(id, "succeeded", opts);
+}
+export function failSyncJobV2(id, opts) {
+  return setSyncJobStatusV2(id, "failed", opts);
+}
+export function cancelSyncJobV2(id, opts) {
+  return setSyncJobStatusV2(id, "cancelled", opts);
+}
+
+export function autoDeprovisionIdleIdentitiesV2({ now = Date.now() } = {}) {
+  const flipped = [];
+  for (const i of _identitiesV2.values()) {
+    if (i.status === "deprovisioned" || i.status === "pending") continue;
+    if (now - i.lastSeenAt > _identityIdleMsV2) {
+      i.status = "deprovisioned";
+      i.lastSeenAt = now;
+      if (!i.deprovisionedAt) i.deprovisionedAt = now;
+      flipped.push(_copyIdentityV2(i));
+    }
+  }
+  return flipped;
+}
+
+export function autoFailStuckSyncJobsV2({ now = Date.now() } = {}) {
+  const flipped = [];
+  for (const j of _syncJobsV2.values()) {
+    if (j.status !== "running") continue;
+    const ref = j.startedAt ?? j.lastSeenAt;
+    if (now - ref > _syncStuckMsV2) {
+      j.status = "failed";
+      j.lastSeenAt = now;
+      if (!j.finishedAt) j.finishedAt = now;
+      flipped.push(_copySyncV2(j));
+    }
+  }
+  return flipped;
+}
+
+export function getScimManagerStatsV2() {
+  const identitiesByStatus = {};
+  for (const v of Object.values(IDENTITY_LIFECYCLE_V2))
+    identitiesByStatus[v] = 0;
+  for (const i of _identitiesV2.values()) identitiesByStatus[i.status] += 1;
+
+  const syncJobsByStatus = {};
+  for (const v of Object.values(SYNC_JOB_V2)) syncJobsByStatus[v] = 0;
+  for (const j of _syncJobsV2.values()) syncJobsByStatus[j.status] += 1;
+
+  return {
+    totalIdentitiesV2: _identitiesV2.size,
+    totalSyncJobsV2: _syncJobsV2.size,
+    maxProvisionedPerConnector: _maxProvisionedPerConnectorV2,
+    maxRunningSyncPerConnector: _maxRunningSyncPerConnectorV2,
+    identityIdleMs: _identityIdleMsV2,
+    syncStuckMs: _syncStuckMsV2,
+    identitiesByStatus,
+    syncJobsByStatus,
+  };
+}
+
+export function _resetStateScimManagerV2() {
+  _identitiesV2.clear();
+  _syncJobsV2.clear();
+  _maxProvisionedPerConnectorV2 = SCIM_DEFAULT_MAX_PROVISIONED_PER_CONNECTOR;
+  _maxRunningSyncPerConnectorV2 = SCIM_DEFAULT_MAX_RUNNING_SYNC_PER_CONNECTOR;
+  _identityIdleMsV2 = SCIM_DEFAULT_IDENTITY_IDLE_MS;
+  _syncStuckMsV2 = SCIM_DEFAULT_SYNC_STUCK_MS;
+}

package/src/lib/service-container.js

@@ -181,3 +181,84 @@ export class ServiceContainer {
 export function createServiceContainer() {
   return new ServiceContainer();
 }
+
+// ===== V2 Surface: Service Container governance overlay (CLI v0.141.0) =====
+export const SVC_CONTAINER_MATURITY_V2 = Object.freeze({
+  PENDING: "pending", ACTIVE: "active", DEGRADED: "degraded", DECOMMISSIONED: "decommissioned",
+});
+export const SVC_RESOLUTION_LIFECYCLE_V2 = Object.freeze({
+  QUEUED: "queued", RESOLVING: "resolving", RESOLVED: "resolved", FAILED: "failed", CANCELLED: "cancelled",
+});
+const _svcCTrans = new Map([
+  [SVC_CONTAINER_MATURITY_V2.PENDING, new Set([SVC_CONTAINER_MATURITY_V2.ACTIVE, SVC_CONTAINER_MATURITY_V2.DECOMMISSIONED])],
+  [SVC_CONTAINER_MATURITY_V2.ACTIVE, new Set([SVC_CONTAINER_MATURITY_V2.DEGRADED, SVC_CONTAINER_MATURITY_V2.DECOMMISSIONED])],
+  [SVC_CONTAINER_MATURITY_V2.DEGRADED, new Set([SVC_CONTAINER_MATURITY_V2.ACTIVE, SVC_CONTAINER_MATURITY_V2.DECOMMISSIONED])],
+  [SVC_CONTAINER_MATURITY_V2.DECOMMISSIONED, new Set()],
+]);
+const _svcCTerminal = new Set([SVC_CONTAINER_MATURITY_V2.DECOMMISSIONED]);
+const _svcRTrans = new Map([
+  [SVC_RESOLUTION_LIFECYCLE_V2.QUEUED, new Set([SVC_RESOLUTION_LIFECYCLE_V2.RESOLVING, SVC_RESOLUTION_LIFECYCLE_V2.CANCELLED])],
+  [SVC_RESOLUTION_LIFECYCLE_V2.RESOLVING, new Set([SVC_RESOLUTION_LIFECYCLE_V2.RESOLVED, SVC_RESOLUTION_LIFECYCLE_V2.FAILED, SVC_RESOLUTION_LIFECYCLE_V2.CANCELLED])],
+  [SVC_RESOLUTION_LIFECYCLE_V2.RESOLVED, new Set()],
+  [SVC_RESOLUTION_LIFECYCLE_V2.FAILED, new Set()],
+  [SVC_RESOLUTION_LIFECYCLE_V2.CANCELLED, new Set()],
+]);
+const _svcCsV2 = new Map();
+const _svcRsV2 = new Map();
+let _svcMaxActivePerOwner = 8, _svcMaxPendingResPerContainer = 25, _svcIdleMs = 60 * 60 * 1000, _svcStuckMs = 30 * 1000;
+function _svcPos(n, label) { const v = Math.floor(Number(n)); if (!Number.isFinite(v) || v <= 0) throw new Error(`${label} must be positive integer`); return v; }
+function _svcCheckC(from, to) { const a = _svcCTrans.get(from); if (!a || !a.has(to)) throw new Error(`invalid svc container transition ${from} → ${to}`); }
+function _svcCheckR(from, to) { const a = _svcRTrans.get(from); if (!a || !a.has(to)) throw new Error(`invalid svc resolution transition ${from} → ${to}`); }
+export function setMaxActiveSvcContainersPerOwnerV2(n) { _svcMaxActivePerOwner = _svcPos(n, "maxActiveSvcContainersPerOwner"); }
+export function getMaxActiveSvcContainersPerOwnerV2() { return _svcMaxActivePerOwner; }
+export function setMaxPendingSvcResolutionsPerContainerV2(n) { _svcMaxPendingResPerContainer = _svcPos(n, "maxPendingSvcResolutionsPerContainer"); }
+export function getMaxPendingSvcResolutionsPerContainerV2() { return _svcMaxPendingResPerContainer; }
+export function setSvcContainerIdleMsV2(n) { _svcIdleMs = _svcPos(n, "svcContainerIdleMs"); }
+export function getSvcContainerIdleMsV2() { return _svcIdleMs; }
+export function setSvcResolutionStuckMsV2(n) { _svcStuckMs = _svcPos(n, "svcResolutionStuckMs"); }
+export function getSvcResolutionStuckMsV2() { return _svcStuckMs; }
+export function _resetStateServiceContainerV2() { _svcCsV2.clear(); _svcRsV2.clear(); _svcMaxActivePerOwner = 8; _svcMaxPendingResPerContainer = 25; _svcIdleMs = 60 * 60 * 1000; _svcStuckMs = 30 * 1000; }
+export function registerSvcContainerV2({ id, owner, scope, metadata } = {}) {
+  if (!id) throw new Error("svc container id required"); if (!owner) throw new Error("svc container owner required");
+  if (_svcCsV2.has(id)) throw new Error(`svc container ${id} already registered`);
+  const now = Date.now();
+  const c = { id, owner, scope: scope || "default", status: SVC_CONTAINER_MATURITY_V2.PENDING, createdAt: now, updatedAt: now, activatedAt: null, decommissionedAt: null, lastTouchedAt: now, metadata: { ...(metadata || {}) } };
+  _svcCsV2.set(id, c); return { ...c, metadata: { ...c.metadata } };
+}
+function _svcCountActive(owner) { let n = 0; for (const c of _svcCsV2.values()) if (c.owner === owner && c.status === SVC_CONTAINER_MATURITY_V2.ACTIVE) n++; return n; }
+export function activateSvcContainerV2(id) {
+  const c = _svcCsV2.get(id); if (!c) throw new Error(`svc container ${id} not found`);
+  _svcCheckC(c.status, SVC_CONTAINER_MATURITY_V2.ACTIVE);
+  const recovery = c.status === SVC_CONTAINER_MATURITY_V2.DEGRADED;
+  if (!recovery && _svcCountActive(c.owner) >= _svcMaxActivePerOwner) throw new Error(`max active svc containers for owner ${c.owner} reached`);
+  const now = Date.now(); c.status = SVC_CONTAINER_MATURITY_V2.ACTIVE; c.updatedAt = now; c.lastTouchedAt = now; if (!c.activatedAt) c.activatedAt = now;
+  return { ...c, metadata: { ...c.metadata } };
+}
+export function degradeSvcContainerV2(id) { const c = _svcCsV2.get(id); if (!c) throw new Error(`svc container ${id} not found`); _svcCheckC(c.status, SVC_CONTAINER_MATURITY_V2.DEGRADED); c.status = SVC_CONTAINER_MATURITY_V2.DEGRADED; c.updatedAt = Date.now(); return { ...c, metadata: { ...c.metadata } }; }
+export function decommissionSvcContainerV2(id) { const c = _svcCsV2.get(id); if (!c) throw new Error(`svc container ${id} not found`); _svcCheckC(c.status, SVC_CONTAINER_MATURITY_V2.DECOMMISSIONED); const now = Date.now(); c.status = SVC_CONTAINER_MATURITY_V2.DECOMMISSIONED; c.updatedAt = now; if (!c.decommissionedAt) c.decommissionedAt = now; return { ...c, metadata: { ...c.metadata } }; }
+export function touchSvcContainerV2(id) { const c = _svcCsV2.get(id); if (!c) throw new Error(`svc container ${id} not found`); if (_svcCTerminal.has(c.status)) throw new Error(`cannot touch terminal svc container ${id}`); const now = Date.now(); c.lastTouchedAt = now; c.updatedAt = now; return { ...c, metadata: { ...c.metadata } }; }
+export function getSvcContainerV2(id) { const c = _svcCsV2.get(id); if (!c) return null; return { ...c, metadata: { ...c.metadata } }; }
+export function listSvcContainersV2() { return [..._svcCsV2.values()].map((c) => ({ ...c, metadata: { ...c.metadata } })); }
+function _svcCountPending(containerId) { let n = 0; for (const r of _svcRsV2.values()) if (r.containerId === containerId && (r.status === SVC_RESOLUTION_LIFECYCLE_V2.QUEUED || r.status === SVC_RESOLUTION_LIFECYCLE_V2.RESOLVING)) n++; return n; }
+export function createSvcResolutionV2({ id, containerId, token, metadata } = {}) {
+  if (!id) throw new Error("svc resolution id required"); if (!containerId) throw new Error("svc resolution containerId required");
+  if (_svcRsV2.has(id)) throw new Error(`svc resolution ${id} already exists`);
+  if (!_svcCsV2.has(containerId)) throw new Error(`svc container ${containerId} not found`);
+  if (_svcCountPending(containerId) >= _svcMaxPendingResPerContainer) throw new Error(`max pending svc resolutions for container ${containerId} reached`);
+  const now = Date.now();
+  const r = { id, containerId, token: token || "", status: SVC_RESOLUTION_LIFECYCLE_V2.QUEUED, createdAt: now, updatedAt: now, startedAt: null, settledAt: null, metadata: { ...(metadata || {}) } };
+  _svcRsV2.set(id, r); return { ...r, metadata: { ...r.metadata } };
+}
+export function resolvingSvcResolutionV2(id) { const r = _svcRsV2.get(id); if (!r) throw new Error(`svc resolution ${id} not found`); _svcCheckR(r.status, SVC_RESOLUTION_LIFECYCLE_V2.RESOLVING); const now = Date.now(); r.status = SVC_RESOLUTION_LIFECYCLE_V2.RESOLVING; r.updatedAt = now; if (!r.startedAt) r.startedAt = now; return { ...r, metadata: { ...r.metadata } }; }
+export function resolveSvcResolutionV2(id) { const r = _svcRsV2.get(id); if (!r) throw new Error(`svc resolution ${id} not found`); _svcCheckR(r.status, SVC_RESOLUTION_LIFECYCLE_V2.RESOLVED); const now = Date.now(); r.status = SVC_RESOLUTION_LIFECYCLE_V2.RESOLVED; r.updatedAt = now; if (!r.settledAt) r.settledAt = now; return { ...r, metadata: { ...r.metadata } }; }
+export function failSvcResolutionV2(id, reason) { const r = _svcRsV2.get(id); if (!r) throw new Error(`svc resolution ${id} not found`); _svcCheckR(r.status, SVC_RESOLUTION_LIFECYCLE_V2.FAILED); const now = Date.now(); r.status = SVC_RESOLUTION_LIFECYCLE_V2.FAILED; r.updatedAt = now; if (!r.settledAt) r.settledAt = now; if (reason) r.metadata.failReason = String(reason); return { ...r, metadata: { ...r.metadata } }; }
+export function cancelSvcResolutionV2(id, reason) { const r = _svcRsV2.get(id); if (!r) throw new Error(`svc resolution ${id} not found`); _svcCheckR(r.status, SVC_RESOLUTION_LIFECYCLE_V2.CANCELLED); const now = Date.now(); r.status = SVC_RESOLUTION_LIFECYCLE_V2.CANCELLED; r.updatedAt = now; if (!r.settledAt) r.settledAt = now; if (reason) r.metadata.cancelReason = String(reason); return { ...r, metadata: { ...r.metadata } }; }
+export function getSvcResolutionV2(id) { const r = _svcRsV2.get(id); if (!r) return null; return { ...r, metadata: { ...r.metadata } }; }
+export function listSvcResolutionsV2() { return [..._svcRsV2.values()].map((r) => ({ ...r, metadata: { ...r.metadata } })); }
+export function autoDegradeIdleSvcContainersV2({ now } = {}) { const t = now ?? Date.now(); const flipped = []; for (const c of _svcCsV2.values()) if (c.status === SVC_CONTAINER_MATURITY_V2.ACTIVE && (t - c.lastTouchedAt) >= _svcIdleMs) { c.status = SVC_CONTAINER_MATURITY_V2.DEGRADED; c.updatedAt = t; flipped.push(c.id); } return { flipped, count: flipped.length }; }
+export function autoFailStuckSvcResolutionsV2({ now } = {}) { const t = now ?? Date.now(); const flipped = []; for (const r of _svcRsV2.values()) if (r.status === SVC_RESOLUTION_LIFECYCLE_V2.RESOLVING && r.startedAt != null && (t - r.startedAt) >= _svcStuckMs) { r.status = SVC_RESOLUTION_LIFECYCLE_V2.FAILED; r.updatedAt = t; if (!r.settledAt) r.settledAt = t; r.metadata.failReason = "auto-fail-stuck"; flipped.push(r.id); } return { flipped, count: flipped.length }; }
+export function getServiceContainerGovStatsV2() {
+  const containersByStatus = {}; for (const v of Object.values(SVC_CONTAINER_MATURITY_V2)) containersByStatus[v] = 0; for (const c of _svcCsV2.values()) containersByStatus[c.status]++;
+  const resolutionsByStatus = {}; for (const v of Object.values(SVC_RESOLUTION_LIFECYCLE_V2)) resolutionsByStatus[v] = 0; for (const r of _svcRsV2.values()) resolutionsByStatus[r.status]++;
+  return { totalSvcContainersV2: _svcCsV2.size, totalSvcResolutionsV2: _svcRsV2.size, maxActiveSvcContainersPerOwner: _svcMaxActivePerOwner, maxPendingSvcResolutionsPerContainer: _svcMaxPendingResPerContainer, svcContainerIdleMs: _svcIdleMs, svcResolutionStuckMs: _svcStuckMs, containersByStatus, resolutionsByStatus };
+}

package/src/lib/session-consolidator.js

@@ -123,3 +123,108 @@ export async function consolidateJsonlSession(sessionId, options = {}) {
     },
   );
 }
+
+
+// ===== V2 Surface: Session Consolidator governance overlay (CLI v0.134.0) =====
+export const CONSOL_PROFILE_MATURITY_V2 = Object.freeze({
+  PENDING: "pending", ACTIVE: "active", PAUSED: "paused", ARCHIVED: "archived",
+});
+export const CONSOL_JOB_LIFECYCLE_V2 = Object.freeze({
+  QUEUED: "queued", RUNNING: "running", COMPLETED: "completed", FAILED: "failed", CANCELLED: "cancelled",
+});
+
+const _scProfTrans = new Map([
+  [CONSOL_PROFILE_MATURITY_V2.PENDING, new Set([CONSOL_PROFILE_MATURITY_V2.ACTIVE, CONSOL_PROFILE_MATURITY_V2.ARCHIVED])],
+  [CONSOL_PROFILE_MATURITY_V2.ACTIVE, new Set([CONSOL_PROFILE_MATURITY_V2.PAUSED, CONSOL_PROFILE_MATURITY_V2.ARCHIVED])],
+  [CONSOL_PROFILE_MATURITY_V2.PAUSED, new Set([CONSOL_PROFILE_MATURITY_V2.ACTIVE, CONSOL_PROFILE_MATURITY_V2.ARCHIVED])],
+  [CONSOL_PROFILE_MATURITY_V2.ARCHIVED, new Set()],
+]);
+const _scProfTerminal = new Set([CONSOL_PROFILE_MATURITY_V2.ARCHIVED]);
+const _scJobTrans = new Map([
+  [CONSOL_JOB_LIFECYCLE_V2.QUEUED, new Set([CONSOL_JOB_LIFECYCLE_V2.RUNNING, CONSOL_JOB_LIFECYCLE_V2.CANCELLED])],
+  [CONSOL_JOB_LIFECYCLE_V2.RUNNING, new Set([CONSOL_JOB_LIFECYCLE_V2.COMPLETED, CONSOL_JOB_LIFECYCLE_V2.FAILED, CONSOL_JOB_LIFECYCLE_V2.CANCELLED])],
+  [CONSOL_JOB_LIFECYCLE_V2.COMPLETED, new Set()],
+  [CONSOL_JOB_LIFECYCLE_V2.FAILED, new Set()],
+  [CONSOL_JOB_LIFECYCLE_V2.CANCELLED, new Set()],
+]);
+
+const _scProfiles = new Map();
+const _scJobs = new Map();
+let _scMaxActivePerOwner = 8;
+let _scMaxPendingPerProfile = 12;
+let _scProfileIdleMs = 7 * 24 * 60 * 60 * 1000;
+let _scJobStuckMs = 10 * 60 * 1000;
+
+function _scPos(n, lbl) { const v = Math.floor(Number(n)); if (!Number.isFinite(v) || v <= 0) throw new Error(`${lbl} must be positive integer`); return v; }
+
+export function setMaxActiveConsolProfilesPerOwnerV2(n) { _scMaxActivePerOwner = _scPos(n, "maxActiveConsolProfilesPerOwner"); }
+export function getMaxActiveConsolProfilesPerOwnerV2() { return _scMaxActivePerOwner; }
+export function setMaxPendingConsolJobsPerProfileV2(n) { _scMaxPendingPerProfile = _scPos(n, "maxPendingConsolJobsPerProfile"); }
+export function getMaxPendingConsolJobsPerProfileV2() { return _scMaxPendingPerProfile; }
+export function setConsolProfileIdleMsV2(n) { _scProfileIdleMs = _scPos(n, "consolProfileIdleMs"); }
+export function getConsolProfileIdleMsV2() { return _scProfileIdleMs; }
+export function setConsolJobStuckMsV2(n) { _scJobStuckMs = _scPos(n, "consolJobStuckMs"); }
+export function getConsolJobStuckMsV2() { return _scJobStuckMs; }
+
+export function _resetStateSessionConsolidatorV2() {
+  _scProfiles.clear(); _scJobs.clear();
+  _scMaxActivePerOwner = 8; _scMaxPendingPerProfile = 12;
+  _scProfileIdleMs = 7 * 24 * 60 * 60 * 1000; _scJobStuckMs = 10 * 60 * 1000;
+}
+
+export function registerConsolProfileV2({ id, owner, scope, metadata } = {}) {
+  if (!id || typeof id !== "string") throw new Error("id is required");
+  if (!owner || typeof owner !== "string") throw new Error("owner is required");
+  if (_scProfiles.has(id)) throw new Error(`consol profile ${id} already registered`);
+  const now = Date.now();
+  const p = { id, owner, scope: scope || "agent", status: CONSOL_PROFILE_MATURITY_V2.PENDING, createdAt: now, updatedAt: now, activatedAt: null, archivedAt: null, lastTouchedAt: now, metadata: { ...(metadata || {}) } };
+  _scProfiles.set(id, p);
+  return { ...p, metadata: { ...p.metadata } };
+}
+function _scCheckP(from, to) { const a = _scProfTrans.get(from); if (!a || !a.has(to)) throw new Error(`invalid consol profile transition ${from} → ${to}`); }
+function _scCountActive(owner) { let n = 0; for (const p of _scProfiles.values()) if (p.owner === owner && p.status === CONSOL_PROFILE_MATURITY_V2.ACTIVE) n++; return n; }
+
+export function activateConsolProfileV2(id) {
+  const p = _scProfiles.get(id); if (!p) throw new Error(`consol profile ${id} not found`);
+  _scCheckP(p.status, CONSOL_PROFILE_MATURITY_V2.ACTIVE);
+  const recovery = p.status === CONSOL_PROFILE_MATURITY_V2.PAUSED;
+  if (!recovery) { const a = _scCountActive(p.owner); if (a >= _scMaxActivePerOwner) throw new Error(`max active consol profiles per owner (${_scMaxActivePerOwner}) reached for ${p.owner}`); }
+  const now = Date.now(); p.status = CONSOL_PROFILE_MATURITY_V2.ACTIVE; p.updatedAt = now; p.lastTouchedAt = now; if (!p.activatedAt) p.activatedAt = now;
+  return { ...p, metadata: { ...p.metadata } };
+}
+export function pauseConsolProfileV2(id) { const p = _scProfiles.get(id); if (!p) throw new Error(`consol profile ${id} not found`); _scCheckP(p.status, CONSOL_PROFILE_MATURITY_V2.PAUSED); p.status = CONSOL_PROFILE_MATURITY_V2.PAUSED; p.updatedAt = Date.now(); return { ...p, metadata: { ...p.metadata } }; }
+export function archiveConsolProfileV2(id) { const p = _scProfiles.get(id); if (!p) throw new Error(`consol profile ${id} not found`); _scCheckP(p.status, CONSOL_PROFILE_MATURITY_V2.ARCHIVED); const now = Date.now(); p.status = CONSOL_PROFILE_MATURITY_V2.ARCHIVED; p.updatedAt = now; if (!p.archivedAt) p.archivedAt = now; return { ...p, metadata: { ...p.metadata } }; }
+export function touchConsolProfileV2(id) { const p = _scProfiles.get(id); if (!p) throw new Error(`consol profile ${id} not found`); if (_scProfTerminal.has(p.status)) throw new Error(`cannot touch terminal consol profile ${id}`); const now = Date.now(); p.lastTouchedAt = now; p.updatedAt = now; return { ...p, metadata: { ...p.metadata } }; }
+export function getConsolProfileV2(id) { const p = _scProfiles.get(id); if (!p) return null; return { ...p, metadata: { ...p.metadata } }; }
+export function listConsolProfilesV2() { return [..._scProfiles.values()].map((p) => ({ ...p, metadata: { ...p.metadata } })); }
+
+function _scCountPending(pid) { let n = 0; for (const j of _scJobs.values()) if (j.profileId === pid && (j.status === CONSOL_JOB_LIFECYCLE_V2.QUEUED || j.status === CONSOL_JOB_LIFECYCLE_V2.RUNNING)) n++; return n; }
+
+export function createConsolJobV2({ id, profileId, sessionId, metadata } = {}) {
+  if (!id || typeof id !== "string") throw new Error("id is required");
+  if (!profileId || typeof profileId !== "string") throw new Error("profileId is required");
+  if (_scJobs.has(id)) throw new Error(`consol job ${id} already exists`);
+  if (!_scProfiles.has(profileId)) throw new Error(`consol profile ${profileId} not found`);
+  const pending = _scCountPending(profileId);
+  if (pending >= _scMaxPendingPerProfile) throw new Error(`max pending consol jobs per profile (${_scMaxPendingPerProfile}) reached for ${profileId}`);
+  const now = Date.now();
+  const j = { id, profileId, sessionId: sessionId || null, status: CONSOL_JOB_LIFECYCLE_V2.QUEUED, createdAt: now, updatedAt: now, startedAt: null, settledAt: null, metadata: { ...(metadata || {}) } };
+  _scJobs.set(id, j);
+  return { ...j, metadata: { ...j.metadata } };
+}
+function _scCheckJ(from, to) { const a = _scJobTrans.get(from); if (!a || !a.has(to)) throw new Error(`invalid consol job transition ${from} → ${to}`); }
+export function startConsolJobV2(id) { const j = _scJobs.get(id); if (!j) throw new Error(`consol job ${id} not found`); _scCheckJ(j.status, CONSOL_JOB_LIFECYCLE_V2.RUNNING); const now = Date.now(); j.status = CONSOL_JOB_LIFECYCLE_V2.RUNNING; j.updatedAt = now; if (!j.startedAt) j.startedAt = now; return { ...j, metadata: { ...j.metadata } }; }
+export function completeConsolJobV2(id) { const j = _scJobs.get(id); if (!j) throw new Error(`consol job ${id} not found`); _scCheckJ(j.status, CONSOL_JOB_LIFECYCLE_V2.COMPLETED); const now = Date.now(); j.status = CONSOL_JOB_LIFECYCLE_V2.COMPLETED; j.updatedAt = now; if (!j.settledAt) j.settledAt = now; return { ...j, metadata: { ...j.metadata } }; }
+export function failConsolJobV2(id, reason) { const j = _scJobs.get(id); if (!j) throw new Error(`consol job ${id} not found`); _scCheckJ(j.status, CONSOL_JOB_LIFECYCLE_V2.FAILED); const now = Date.now(); j.status = CONSOL_JOB_LIFECYCLE_V2.FAILED; j.updatedAt = now; if (!j.settledAt) j.settledAt = now; if (reason) j.metadata.failReason = String(reason); return { ...j, metadata: { ...j.metadata } }; }
+export function cancelConsolJobV2(id, reason) { const j = _scJobs.get(id); if (!j) throw new Error(`consol job ${id} not found`); _scCheckJ(j.status, CONSOL_JOB_LIFECYCLE_V2.CANCELLED); const now = Date.now(); j.status = CONSOL_JOB_LIFECYCLE_V2.CANCELLED; j.updatedAt = now; if (!j.settledAt) j.settledAt = now; if (reason) j.metadata.cancelReason = String(reason); return { ...j, metadata: { ...j.metadata } }; }
+export function getConsolJobV2(id) { const j = _scJobs.get(id); if (!j) return null; return { ...j, metadata: { ...j.metadata } }; }
+export function listConsolJobsV2() { return [..._scJobs.values()].map((j) => ({ ...j, metadata: { ...j.metadata } })); }
+
+export function autoPauseIdleConsolProfilesV2({ now } = {}) { const t = now ?? Date.now(); const flipped = []; for (const p of _scProfiles.values()) if (p.status === CONSOL_PROFILE_MATURITY_V2.ACTIVE && (t - p.lastTouchedAt) >= _scProfileIdleMs) { p.status = CONSOL_PROFILE_MATURITY_V2.PAUSED; p.updatedAt = t; flipped.push(p.id); } return { flipped, count: flipped.length }; }
+export function autoFailStuckConsolJobsV2({ now } = {}) { const t = now ?? Date.now(); const flipped = []; for (const j of _scJobs.values()) if (j.status === CONSOL_JOB_LIFECYCLE_V2.RUNNING && j.startedAt != null && (t - j.startedAt) >= _scJobStuckMs) { j.status = CONSOL_JOB_LIFECYCLE_V2.FAILED; j.updatedAt = t; if (!j.settledAt) j.settledAt = t; j.metadata.failReason = "auto-fail-stuck"; flipped.push(j.id); } return { flipped, count: flipped.length }; }
+
+export function getSessionConsolidatorStatsV2() {
+  const profilesByStatus = {}; for (const s of Object.values(CONSOL_PROFILE_MATURITY_V2)) profilesByStatus[s] = 0; for (const p of _scProfiles.values()) profilesByStatus[p.status]++;
+  const jobsByStatus = {}; for (const s of Object.values(CONSOL_JOB_LIFECYCLE_V2)) jobsByStatus[s] = 0; for (const j of _scJobs.values()) jobsByStatus[j.status]++;
+  return { totalProfilesV2: _scProfiles.size, totalJobsV2: _scJobs.size, maxActiveConsolProfilesPerOwner: _scMaxActivePerOwner, maxPendingConsolJobsPerProfile: _scMaxPendingPerProfile, consolProfileIdleMs: _scProfileIdleMs, consolJobStuckMs: _scJobStuckMs, profilesByStatus, jobsByStatus };
+}

package/src/lib/session-hooks.js

@@ -229,3 +229,84 @@ function withTimeout(promise, ms, label) {
   });
   return Promise.race([promise, timeout]).finally(() => clearTimeout(t));
 }
+
+// ===== V2 Surface: Session Hooks governance overlay (CLI v0.142.0) =====
+export const SHOK_PROFILE_MATURITY_V2 = Object.freeze({
+  PENDING: "pending", ACTIVE: "active", DISABLED: "disabled", RETIRED: "retired",
+});
+export const SHOK_INVOCATION_LIFECYCLE_V2 = Object.freeze({
+  QUEUED: "queued", RUNNING: "running", COMPLETED: "completed", FAILED: "failed", CANCELLED: "cancelled",
+});
+const _shokPTrans = new Map([
+  [SHOK_PROFILE_MATURITY_V2.PENDING, new Set([SHOK_PROFILE_MATURITY_V2.ACTIVE, SHOK_PROFILE_MATURITY_V2.RETIRED])],
+  [SHOK_PROFILE_MATURITY_V2.ACTIVE, new Set([SHOK_PROFILE_MATURITY_V2.DISABLED, SHOK_PROFILE_MATURITY_V2.RETIRED])],
+  [SHOK_PROFILE_MATURITY_V2.DISABLED, new Set([SHOK_PROFILE_MATURITY_V2.ACTIVE, SHOK_PROFILE_MATURITY_V2.RETIRED])],
+  [SHOK_PROFILE_MATURITY_V2.RETIRED, new Set()],
+]);
+const _shokPTerminal = new Set([SHOK_PROFILE_MATURITY_V2.RETIRED]);
+const _shokITrans = new Map([
+  [SHOK_INVOCATION_LIFECYCLE_V2.QUEUED, new Set([SHOK_INVOCATION_LIFECYCLE_V2.RUNNING, SHOK_INVOCATION_LIFECYCLE_V2.CANCELLED])],
+  [SHOK_INVOCATION_LIFECYCLE_V2.RUNNING, new Set([SHOK_INVOCATION_LIFECYCLE_V2.COMPLETED, SHOK_INVOCATION_LIFECYCLE_V2.FAILED, SHOK_INVOCATION_LIFECYCLE_V2.CANCELLED])],
+  [SHOK_INVOCATION_LIFECYCLE_V2.COMPLETED, new Set()],
+  [SHOK_INVOCATION_LIFECYCLE_V2.FAILED, new Set()],
+  [SHOK_INVOCATION_LIFECYCLE_V2.CANCELLED, new Set()],
+]);
+const _shokPsV2 = new Map();
+const _shokIsV2 = new Map();
+let _shokMaxActive = 12, _shokMaxPending = 25, _shokIdleMs = 30 * 24 * 60 * 60 * 1000, _shokStuckMs = 30 * 1000;
+function _shokPos(n, label) { const v = Math.floor(Number(n)); if (!Number.isFinite(v) || v <= 0) throw new Error(`${label} must be positive integer`); return v; }
+function _shokCheckP(from, to) { const a = _shokPTrans.get(from); if (!a || !a.has(to)) throw new Error(`invalid shok profile transition ${from} → ${to}`); }
+function _shokCheckI(from, to) { const a = _shokITrans.get(from); if (!a || !a.has(to)) throw new Error(`invalid shok invocation transition ${from} → ${to}`); }
+export function setMaxActiveShokProfilesPerOwnerV2(n) { _shokMaxActive = _shokPos(n, "maxActiveShokProfilesPerOwner"); }
+export function getMaxActiveShokProfilesPerOwnerV2() { return _shokMaxActive; }
+export function setMaxPendingShokInvocationsPerProfileV2(n) { _shokMaxPending = _shokPos(n, "maxPendingShokInvocationsPerProfile"); }
+export function getMaxPendingShokInvocationsPerProfileV2() { return _shokMaxPending; }
+export function setShokProfileIdleMsV2(n) { _shokIdleMs = _shokPos(n, "shokProfileIdleMs"); }
+export function getShokProfileIdleMsV2() { return _shokIdleMs; }
+export function setShokInvocationStuckMsV2(n) { _shokStuckMs = _shokPos(n, "shokInvocationStuckMs"); }
+export function getShokInvocationStuckMsV2() { return _shokStuckMs; }
+export function _resetStateSessionHooksV2() { _shokPsV2.clear(); _shokIsV2.clear(); _shokMaxActive = 12; _shokMaxPending = 25; _shokIdleMs = 30 * 24 * 60 * 60 * 1000; _shokStuckMs = 30 * 1000; }
+export function registerShokProfileV2({ id, owner, event, metadata } = {}) {
+  if (!id) throw new Error("shok profile id required"); if (!owner) throw new Error("shok profile owner required");
+  if (_shokPsV2.has(id)) throw new Error(`shok profile ${id} already registered`);
+  const now = Date.now();
+  const p = { id, owner, event: event || "preTurn", status: SHOK_PROFILE_MATURITY_V2.PENDING, createdAt: now, updatedAt: now, activatedAt: null, retiredAt: null, lastTouchedAt: now, metadata: { ...(metadata || {}) } };
+  _shokPsV2.set(id, p); return { ...p, metadata: { ...p.metadata } };
+}
+function _shokCountActive(owner) { let n = 0; for (const p of _shokPsV2.values()) if (p.owner === owner && p.status === SHOK_PROFILE_MATURITY_V2.ACTIVE) n++; return n; }
+export function activateShokProfileV2(id) {
+  const p = _shokPsV2.get(id); if (!p) throw new Error(`shok profile ${id} not found`);
+  _shokCheckP(p.status, SHOK_PROFILE_MATURITY_V2.ACTIVE);
+  const recovery = p.status === SHOK_PROFILE_MATURITY_V2.DISABLED;
+  if (!recovery && _shokCountActive(p.owner) >= _shokMaxActive) throw new Error(`max active shok profiles for owner ${p.owner} reached`);
+  const now = Date.now(); p.status = SHOK_PROFILE_MATURITY_V2.ACTIVE; p.updatedAt = now; p.lastTouchedAt = now; if (!p.activatedAt) p.activatedAt = now;
+  return { ...p, metadata: { ...p.metadata } };
+}
+export function disableShokProfileV2(id) { const p = _shokPsV2.get(id); if (!p) throw new Error(`shok profile ${id} not found`); _shokCheckP(p.status, SHOK_PROFILE_MATURITY_V2.DISABLED); p.status = SHOK_PROFILE_MATURITY_V2.DISABLED; p.updatedAt = Date.now(); return { ...p, metadata: { ...p.metadata } }; }
+export function retireShokProfileV2(id) { const p = _shokPsV2.get(id); if (!p) throw new Error(`shok profile ${id} not found`); _shokCheckP(p.status, SHOK_PROFILE_MATURITY_V2.RETIRED); const now = Date.now(); p.status = SHOK_PROFILE_MATURITY_V2.RETIRED; p.updatedAt = now; if (!p.retiredAt) p.retiredAt = now; return { ...p, metadata: { ...p.metadata } }; }
+export function touchShokProfileV2(id) { const p = _shokPsV2.get(id); if (!p) throw new Error(`shok profile ${id} not found`); if (_shokPTerminal.has(p.status)) throw new Error(`cannot touch terminal shok profile ${id}`); const now = Date.now(); p.lastTouchedAt = now; p.updatedAt = now; return { ...p, metadata: { ...p.metadata } }; }
+export function getShokProfileV2(id) { const p = _shokPsV2.get(id); if (!p) return null; return { ...p, metadata: { ...p.metadata } }; }
+export function listShokProfilesV2() { return [..._shokPsV2.values()].map((p) => ({ ...p, metadata: { ...p.metadata } })); }
+function _shokCountPending(profileId) { let n = 0; for (const i of _shokIsV2.values()) if (i.profileId === profileId && (i.status === SHOK_INVOCATION_LIFECYCLE_V2.QUEUED || i.status === SHOK_INVOCATION_LIFECYCLE_V2.RUNNING)) n++; return n; }
+export function createShokInvocationV2({ id, profileId, payload, metadata } = {}) {
+  if (!id) throw new Error("shok invocation id required"); if (!profileId) throw new Error("shok invocation profileId required");
+  if (_shokIsV2.has(id)) throw new Error(`shok invocation ${id} already exists`);
+  if (!_shokPsV2.has(profileId)) throw new Error(`shok profile ${profileId} not found`);
+  if (_shokCountPending(profileId) >= _shokMaxPending) throw new Error(`max pending shok invocations for profile ${profileId} reached`);
+  const now = Date.now();
+  const i = { id, profileId, payload: payload || "", status: SHOK_INVOCATION_LIFECYCLE_V2.QUEUED, createdAt: now, updatedAt: now, startedAt: null, settledAt: null, metadata: { ...(metadata || {}) } };
+  _shokIsV2.set(id, i); return { ...i, metadata: { ...i.metadata } };
+}
+export function runningShokInvocationV2(id) { const i = _shokIsV2.get(id); if (!i) throw new Error(`shok invocation ${id} not found`); _shokCheckI(i.status, SHOK_INVOCATION_LIFECYCLE_V2.RUNNING); const now = Date.now(); i.status = SHOK_INVOCATION_LIFECYCLE_V2.RUNNING; i.updatedAt = now; if (!i.startedAt) i.startedAt = now; return { ...i, metadata: { ...i.metadata } }; }
+export function completeShokInvocationV2(id) { const i = _shokIsV2.get(id); if (!i) throw new Error(`shok invocation ${id} not found`); _shokCheckI(i.status, SHOK_INVOCATION_LIFECYCLE_V2.COMPLETED); const now = Date.now(); i.status = SHOK_INVOCATION_LIFECYCLE_V2.COMPLETED; i.updatedAt = now; if (!i.settledAt) i.settledAt = now; return { ...i, metadata: { ...i.metadata } }; }
+export function failShokInvocationV2(id, reason) { const i = _shokIsV2.get(id); if (!i) throw new Error(`shok invocation ${id} not found`); _shokCheckI(i.status, SHOK_INVOCATION_LIFECYCLE_V2.FAILED); const now = Date.now(); i.status = SHOK_INVOCATION_LIFECYCLE_V2.FAILED; i.updatedAt = now; if (!i.settledAt) i.settledAt = now; if (reason) i.metadata.failReason = String(reason); return { ...i, metadata: { ...i.metadata } }; }
+export function cancelShokInvocationV2(id, reason) { const i = _shokIsV2.get(id); if (!i) throw new Error(`shok invocation ${id} not found`); _shokCheckI(i.status, SHOK_INVOCATION_LIFECYCLE_V2.CANCELLED); const now = Date.now(); i.status = SHOK_INVOCATION_LIFECYCLE_V2.CANCELLED; i.updatedAt = now; if (!i.settledAt) i.settledAt = now; if (reason) i.metadata.cancelReason = String(reason); return { ...i, metadata: { ...i.metadata } }; }
+export function getShokInvocationV2(id) { const i = _shokIsV2.get(id); if (!i) return null; return { ...i, metadata: { ...i.metadata } }; }
+export function listShokInvocationsV2() { return [..._shokIsV2.values()].map((i) => ({ ...i, metadata: { ...i.metadata } })); }
+export function autoDisableIdleShokProfilesV2({ now } = {}) { const t = now ?? Date.now(); const flipped = []; for (const p of _shokPsV2.values()) if (p.status === SHOK_PROFILE_MATURITY_V2.ACTIVE && (t - p.lastTouchedAt) >= _shokIdleMs) { p.status = SHOK_PROFILE_MATURITY_V2.DISABLED; p.updatedAt = t; flipped.push(p.id); } return { flipped, count: flipped.length }; }
+export function autoFailStuckShokInvocationsV2({ now } = {}) { const t = now ?? Date.now(); const flipped = []; for (const i of _shokIsV2.values()) if (i.status === SHOK_INVOCATION_LIFECYCLE_V2.RUNNING && i.startedAt != null && (t - i.startedAt) >= _shokStuckMs) { i.status = SHOK_INVOCATION_LIFECYCLE_V2.FAILED; i.updatedAt = t; if (!i.settledAt) i.settledAt = t; i.metadata.failReason = "auto-fail-stuck"; flipped.push(i.id); } return { flipped, count: flipped.length }; }
+export function getSessionHooksGovStatsV2() {
+  const profilesByStatus = {}; for (const v of Object.values(SHOK_PROFILE_MATURITY_V2)) profilesByStatus[v] = 0; for (const p of _shokPsV2.values()) profilesByStatus[p.status]++;
+  const invocationsByStatus = {}; for (const v of Object.values(SHOK_INVOCATION_LIFECYCLE_V2)) invocationsByStatus[v] = 0; for (const i of _shokIsV2.values()) invocationsByStatus[i.status]++;
+  return { totalShokProfilesV2: _shokPsV2.size, totalShokInvocationsV2: _shokIsV2.size, maxActiveShokProfilesPerOwner: _shokMaxActive, maxPendingShokInvocationsPerProfile: _shokMaxPending, shokProfileIdleMs: _shokIdleMs, shokInvocationStuckMs: _shokStuckMs, profilesByStatus, invocationsByStatus };
+}