chainlesschain 0.81.0 → 0.143.0

package/src/lib/topic-classifier.js

@@ -398,3 +398,108 @@ export function classifyTopic(text, opts = {}) {
 export function _resetState() {
   _customLexicons.clear();
 }
+
+
+// ===== V2 Surface: Topic Classifier governance overlay (CLI v0.140.0) =====
+export const TOPIC_CLS_PROFILE_MATURITY_V2 = Object.freeze({
+  PENDING: "pending", ACTIVE: "active", STALE: "stale", ARCHIVED: "archived",
+});
+export const TOPIC_CLS_JOB_LIFECYCLE_V2 = Object.freeze({
+  QUEUED: "queued", RUNNING: "running", COMPLETED: "completed", FAILED: "failed", CANCELLED: "cancelled",
+});
+
+const _tcpTrans = new Map([
+  [TOPIC_CLS_PROFILE_MATURITY_V2.PENDING, new Set([TOPIC_CLS_PROFILE_MATURITY_V2.ACTIVE, TOPIC_CLS_PROFILE_MATURITY_V2.ARCHIVED])],
+  [TOPIC_CLS_PROFILE_MATURITY_V2.ACTIVE, new Set([TOPIC_CLS_PROFILE_MATURITY_V2.STALE, TOPIC_CLS_PROFILE_MATURITY_V2.ARCHIVED])],
+  [TOPIC_CLS_PROFILE_MATURITY_V2.STALE, new Set([TOPIC_CLS_PROFILE_MATURITY_V2.ACTIVE, TOPIC_CLS_PROFILE_MATURITY_V2.ARCHIVED])],
+  [TOPIC_CLS_PROFILE_MATURITY_V2.ARCHIVED, new Set()],
+]);
+const _tcpTerminal = new Set([TOPIC_CLS_PROFILE_MATURITY_V2.ARCHIVED]);
+const _tcjTrans = new Map([
+  [TOPIC_CLS_JOB_LIFECYCLE_V2.QUEUED, new Set([TOPIC_CLS_JOB_LIFECYCLE_V2.RUNNING, TOPIC_CLS_JOB_LIFECYCLE_V2.CANCELLED])],
+  [TOPIC_CLS_JOB_LIFECYCLE_V2.RUNNING, new Set([TOPIC_CLS_JOB_LIFECYCLE_V2.COMPLETED, TOPIC_CLS_JOB_LIFECYCLE_V2.FAILED, TOPIC_CLS_JOB_LIFECYCLE_V2.CANCELLED])],
+  [TOPIC_CLS_JOB_LIFECYCLE_V2.COMPLETED, new Set()],
+  [TOPIC_CLS_JOB_LIFECYCLE_V2.FAILED, new Set()],
+  [TOPIC_CLS_JOB_LIFECYCLE_V2.CANCELLED, new Set()],
+]);
+
+const _tcpsV2 = new Map();
+const _tcjsV2 = new Map();
+let _tcpMaxActivePerOwner = 8;
+let _tcpMaxPendingJobsPerProfile = 20;
+let _tcpIdleMs = 14 * 24 * 60 * 60 * 1000;
+let _tcjStuckMs = 5 * 60 * 1000;
+
+function _tcpPos(n, lbl) { const v = Math.floor(Number(n)); if (!Number.isFinite(v) || v <= 0) throw new Error(`${lbl} must be positive integer`); return v; }
+
+export function setMaxActiveTopicClsProfilesPerOwnerV2(n) { _tcpMaxActivePerOwner = _tcpPos(n, "maxActiveTopicClsProfilesPerOwner"); }
+export function getMaxActiveTopicClsProfilesPerOwnerV2() { return _tcpMaxActivePerOwner; }
+export function setMaxPendingTopicClsJobsPerProfileV2(n) { _tcpMaxPendingJobsPerProfile = _tcpPos(n, "maxPendingTopicClsJobsPerProfile"); }
+export function getMaxPendingTopicClsJobsPerProfileV2() { return _tcpMaxPendingJobsPerProfile; }
+export function setTopicClsProfileIdleMsV2(n) { _tcpIdleMs = _tcpPos(n, "topicClsProfileIdleMs"); }
+export function getTopicClsProfileIdleMsV2() { return _tcpIdleMs; }
+export function setTopicClsJobStuckMsV2(n) { _tcjStuckMs = _tcpPos(n, "topicClsJobStuckMs"); }
+export function getTopicClsJobStuckMsV2() { return _tcjStuckMs; }
+
+export function _resetStateTopicClsV2() {
+  _tcpsV2.clear(); _tcjsV2.clear();
+  _tcpMaxActivePerOwner = 8; _tcpMaxPendingJobsPerProfile = 20;
+  _tcpIdleMs = 14 * 24 * 60 * 60 * 1000; _tcjStuckMs = 5 * 60 * 1000;
+}
+
+export function registerTopicClsProfileV2({ id, owner, model, metadata } = {}) {
+  if (!id || typeof id !== "string") throw new Error("id is required");
+  if (!owner || typeof owner !== "string") throw new Error("owner is required");
+  if (_tcpsV2.has(id)) throw new Error(`topic cls profile ${id} already registered`);
+  const now = Date.now();
+  const p = { id, owner, model: model || "default", status: TOPIC_CLS_PROFILE_MATURITY_V2.PENDING, createdAt: now, updatedAt: now, activatedAt: null, archivedAt: null, lastTouchedAt: now, metadata: { ...(metadata || {}) } };
+  _tcpsV2.set(id, p);
+  return { ...p, metadata: { ...p.metadata } };
+}
+function _tcpCheckP(from, to) { const a = _tcpTrans.get(from); if (!a || !a.has(to)) throw new Error(`invalid topic cls profile transition ${from} → ${to}`); }
+function _tcpCountActive(owner) { let n = 0; for (const p of _tcpsV2.values()) if (p.owner === owner && p.status === TOPIC_CLS_PROFILE_MATURITY_V2.ACTIVE) n++; return n; }
+
+export function activateTopicClsProfileV2(id) {
+  const p = _tcpsV2.get(id); if (!p) throw new Error(`topic cls profile ${id} not found`);
+  _tcpCheckP(p.status, TOPIC_CLS_PROFILE_MATURITY_V2.ACTIVE);
+  const recovery = p.status === TOPIC_CLS_PROFILE_MATURITY_V2.STALE;
+  if (!recovery) { const c = _tcpCountActive(p.owner); if (c >= _tcpMaxActivePerOwner) throw new Error(`max active topic cls profiles per owner (${_tcpMaxActivePerOwner}) reached for ${p.owner}`); }
+  const now = Date.now(); p.status = TOPIC_CLS_PROFILE_MATURITY_V2.ACTIVE; p.updatedAt = now; p.lastTouchedAt = now; if (!p.activatedAt) p.activatedAt = now;
+  return { ...p, metadata: { ...p.metadata } };
+}
+export function staleTopicClsProfileV2(id) { const p = _tcpsV2.get(id); if (!p) throw new Error(`topic cls profile ${id} not found`); _tcpCheckP(p.status, TOPIC_CLS_PROFILE_MATURITY_V2.STALE); p.status = TOPIC_CLS_PROFILE_MATURITY_V2.STALE; p.updatedAt = Date.now(); return { ...p, metadata: { ...p.metadata } }; }
+export function archiveTopicClsProfileV2(id) { const p = _tcpsV2.get(id); if (!p) throw new Error(`topic cls profile ${id} not found`); _tcpCheckP(p.status, TOPIC_CLS_PROFILE_MATURITY_V2.ARCHIVED); const now = Date.now(); p.status = TOPIC_CLS_PROFILE_MATURITY_V2.ARCHIVED; p.updatedAt = now; if (!p.archivedAt) p.archivedAt = now; return { ...p, metadata: { ...p.metadata } }; }
+export function touchTopicClsProfileV2(id) { const p = _tcpsV2.get(id); if (!p) throw new Error(`topic cls profile ${id} not found`); if (_tcpTerminal.has(p.status)) throw new Error(`cannot touch terminal topic cls profile ${id}`); const now = Date.now(); p.lastTouchedAt = now; p.updatedAt = now; return { ...p, metadata: { ...p.metadata } }; }
+export function getTopicClsProfileV2(id) { const p = _tcpsV2.get(id); if (!p) return null; return { ...p, metadata: { ...p.metadata } }; }
+export function listTopicClsProfilesV2() { return [..._tcpsV2.values()].map((p) => ({ ...p, metadata: { ...p.metadata } })); }
+
+function _tcjCountPending(profileId) { let n = 0; for (const j of _tcjsV2.values()) if (j.profileId === profileId && (j.status === TOPIC_CLS_JOB_LIFECYCLE_V2.QUEUED || j.status === TOPIC_CLS_JOB_LIFECYCLE_V2.RUNNING)) n++; return n; }
+
+export function createTopicClsJobV2({ id, profileId, text, metadata } = {}) {
+  if (!id || typeof id !== "string") throw new Error("id is required");
+  if (!profileId || typeof profileId !== "string") throw new Error("profileId is required");
+  if (_tcjsV2.has(id)) throw new Error(`topic cls job ${id} already exists`);
+  if (!_tcpsV2.has(profileId)) throw new Error(`topic cls profile ${profileId} not found`);
+  const pending = _tcjCountPending(profileId);
+  if (pending >= _tcpMaxPendingJobsPerProfile) throw new Error(`max pending topic cls jobs per profile (${_tcpMaxPendingJobsPerProfile}) reached for ${profileId}`);
+  const now = Date.now();
+  const j = { id, profileId, text: text || "", status: TOPIC_CLS_JOB_LIFECYCLE_V2.QUEUED, createdAt: now, updatedAt: now, startedAt: null, settledAt: null, metadata: { ...(metadata || {}) } };
+  _tcjsV2.set(id, j);
+  return { ...j, metadata: { ...j.metadata } };
+}
+function _tcjCheckJ(from, to) { const a = _tcjTrans.get(from); if (!a || !a.has(to)) throw new Error(`invalid topic cls job transition ${from} → ${to}`); }
+export function startTopicClsJobV2(id) { const j = _tcjsV2.get(id); if (!j) throw new Error(`topic cls job ${id} not found`); _tcjCheckJ(j.status, TOPIC_CLS_JOB_LIFECYCLE_V2.RUNNING); const now = Date.now(); j.status = TOPIC_CLS_JOB_LIFECYCLE_V2.RUNNING; j.updatedAt = now; if (!j.startedAt) j.startedAt = now; return { ...j, metadata: { ...j.metadata } }; }
+export function completeTopicClsJobV2(id) { const j = _tcjsV2.get(id); if (!j) throw new Error(`topic cls job ${id} not found`); _tcjCheckJ(j.status, TOPIC_CLS_JOB_LIFECYCLE_V2.COMPLETED); const now = Date.now(); j.status = TOPIC_CLS_JOB_LIFECYCLE_V2.COMPLETED; j.updatedAt = now; if (!j.settledAt) j.settledAt = now; return { ...j, metadata: { ...j.metadata } }; }
+export function failTopicClsJobV2(id, reason) { const j = _tcjsV2.get(id); if (!j) throw new Error(`topic cls job ${id} not found`); _tcjCheckJ(j.status, TOPIC_CLS_JOB_LIFECYCLE_V2.FAILED); const now = Date.now(); j.status = TOPIC_CLS_JOB_LIFECYCLE_V2.FAILED; j.updatedAt = now; if (!j.settledAt) j.settledAt = now; if (reason) j.metadata.failReason = String(reason); return { ...j, metadata: { ...j.metadata } }; }
+export function cancelTopicClsJobV2(id, reason) { const j = _tcjsV2.get(id); if (!j) throw new Error(`topic cls job ${id} not found`); _tcjCheckJ(j.status, TOPIC_CLS_JOB_LIFECYCLE_V2.CANCELLED); const now = Date.now(); j.status = TOPIC_CLS_JOB_LIFECYCLE_V2.CANCELLED; j.updatedAt = now; if (!j.settledAt) j.settledAt = now; if (reason) j.metadata.cancelReason = String(reason); return { ...j, metadata: { ...j.metadata } }; }
+export function getTopicClsJobV2(id) { const j = _tcjsV2.get(id); if (!j) return null; return { ...j, metadata: { ...j.metadata } }; }
+export function listTopicClsJobsV2() { return [..._tcjsV2.values()].map((j) => ({ ...j, metadata: { ...j.metadata } })); }
+
+export function autoStaleIdleTopicClsProfilesV2({ now } = {}) { const t = now ?? Date.now(); const flipped = []; for (const p of _tcpsV2.values()) if (p.status === TOPIC_CLS_PROFILE_MATURITY_V2.ACTIVE && (t - p.lastTouchedAt) >= _tcpIdleMs) { p.status = TOPIC_CLS_PROFILE_MATURITY_V2.STALE; p.updatedAt = t; flipped.push(p.id); } return { flipped, count: flipped.length }; }
+export function autoFailStuckTopicClsJobsV2({ now } = {}) { const t = now ?? Date.now(); const flipped = []; for (const j of _tcjsV2.values()) if (j.status === TOPIC_CLS_JOB_LIFECYCLE_V2.RUNNING && j.startedAt != null && (t - j.startedAt) >= _tcjStuckMs) { j.status = TOPIC_CLS_JOB_LIFECYCLE_V2.FAILED; j.updatedAt = t; if (!j.settledAt) j.settledAt = t; j.metadata.failReason = "auto-fail-stuck"; flipped.push(j.id); } return { flipped, count: flipped.length }; }
+
+export function getTopicClassifierGovStatsV2() {
+  const profilesByStatus = {}; for (const s of Object.values(TOPIC_CLS_PROFILE_MATURITY_V2)) profilesByStatus[s] = 0; for (const p of _tcpsV2.values()) profilesByStatus[p.status]++;
+  const jobsByStatus = {}; for (const s of Object.values(TOPIC_CLS_JOB_LIFECYCLE_V2)) jobsByStatus[s] = 0; for (const j of _tcjsV2.values()) jobsByStatus[j.status]++;
+  return { totalTopicClsProfilesV2: _tcpsV2.size, totalTopicClsJobsV2: _tcjsV2.size, maxActiveTopicClsProfilesPerOwner: _tcpMaxActivePerOwner, maxPendingTopicClsJobsPerProfile: _tcpMaxPendingJobsPerProfile, topicClsProfileIdleMs: _tcpIdleMs, topicClsJobStuckMs: _tcjStuckMs, profilesByStatus, jobsByStatus };
+}

package/src/lib/trust-security.js

@@ -471,3 +471,393 @@ export function _resetState() {
   _satMessages.clear();
   _hsmDevices.clear();
 }
+
+/* ── V2 Surface (Phase 68-71) ─────────────────────────────
+ * Strictly additive. Two parallel state machines:
+ *   - HSM device maturity (4 states, retired terminal)
+ *   - Satellite transmission lifecycle (5 states, 3 terminals)
+ * Per-operator active-device cap + per-device pending-transmission cap.
+ * Auto-flip: stale devices → retired; stuck sending transmissions → failed.
+ */
+
+export const HSM_MATURITY_V2 = Object.freeze({
+  PROVISIONAL: "provisional",
+  ACTIVE: "active",
+  DEGRADED: "degraded",
+  RETIRED: "retired",
+});
+
+export const TRANSMISSION_V2 = Object.freeze({
+  QUEUED: "queued",
+  SENDING: "sending",
+  CONFIRMED: "confirmed",
+  FAILED: "failed",
+  CANCELED: "canceled",
+});
+
+const _HSM_TRANSITIONS_V2 = new Map([
+  [
+    HSM_MATURITY_V2.PROVISIONAL,
+    new Set([HSM_MATURITY_V2.ACTIVE, HSM_MATURITY_V2.RETIRED]),
+  ],
+  [
+    HSM_MATURITY_V2.ACTIVE,
+    new Set([HSM_MATURITY_V2.DEGRADED, HSM_MATURITY_V2.RETIRED]),
+  ],
+  [
+    HSM_MATURITY_V2.DEGRADED,
+    new Set([HSM_MATURITY_V2.ACTIVE, HSM_MATURITY_V2.RETIRED]),
+  ],
+]);
+const _HSM_TERMINAL_V2 = new Set([HSM_MATURITY_V2.RETIRED]);
+
+const _TRANSMISSION_TRANSITIONS_V2 = new Map([
+  [
+    TRANSMISSION_V2.QUEUED,
+    new Set([
+      TRANSMISSION_V2.SENDING,
+      TRANSMISSION_V2.CANCELED,
+      TRANSMISSION_V2.FAILED,
+    ]),
+  ],
+  [
+    TRANSMISSION_V2.SENDING,
+    new Set([
+      TRANSMISSION_V2.CONFIRMED,
+      TRANSMISSION_V2.FAILED,
+      TRANSMISSION_V2.CANCELED,
+    ]),
+  ],
+]);
+const _TRANSMISSION_TERMINAL_V2 = new Set([
+  TRANSMISSION_V2.CONFIRMED,
+  TRANSMISSION_V2.FAILED,
+  TRANSMISSION_V2.CANCELED,
+]);
+
+export const TS_DEFAULT_MAX_ACTIVE_DEVICES_PER_OPERATOR = 8;
+export const TS_DEFAULT_MAX_PENDING_TRANSMISSIONS_PER_DEVICE = 20;
+export const TS_DEFAULT_DEVICE_IDLE_MS = 30 * 86400000;
+export const TS_DEFAULT_TRANSMISSION_STUCK_MS = 2 * 60000;
+
+let _tsMaxActiveDevicesPerOperator = TS_DEFAULT_MAX_ACTIVE_DEVICES_PER_OPERATOR;
+let _tsMaxPendingTransmissionsPerDevice =
+  TS_DEFAULT_MAX_PENDING_TRANSMISSIONS_PER_DEVICE;
+let _tsDeviceIdleMs = TS_DEFAULT_DEVICE_IDLE_MS;
+let _tsTransmissionStuckMs = TS_DEFAULT_TRANSMISSION_STUCK_MS;
+
+const _devicesV2 = new Map();
+const _transmissionsV2 = new Map();
+
+function _positiveIntV2(n, label) {
+  const f = Math.floor(n);
+  if (!Number.isFinite(f) || f <= 0)
+    throw new Error(`${label} must be a positive integer`);
+  return f;
+}
+
+export function getMaxActiveDevicesPerOperator() {
+  return _tsMaxActiveDevicesPerOperator;
+}
+export function setMaxActiveDevicesPerOperator(n) {
+  _tsMaxActiveDevicesPerOperator = _positiveIntV2(
+    n,
+    "maxActiveDevicesPerOperator",
+  );
+  return _tsMaxActiveDevicesPerOperator;
+}
+export function getMaxPendingTransmissionsPerDevice() {
+  return _tsMaxPendingTransmissionsPerDevice;
+}
+export function setMaxPendingTransmissionsPerDevice(n) {
+  _tsMaxPendingTransmissionsPerDevice = _positiveIntV2(
+    n,
+    "maxPendingTransmissionsPerDevice",
+  );
+  return _tsMaxPendingTransmissionsPerDevice;
+}
+export function getDeviceIdleMs() {
+  return _tsDeviceIdleMs;
+}
+export function setDeviceIdleMs(n) {
+  _tsDeviceIdleMs = _positiveIntV2(n, "deviceIdleMs");
+  return _tsDeviceIdleMs;
+}
+export function getTransmissionStuckMs() {
+  return _tsTransmissionStuckMs;
+}
+export function setTransmissionStuckMs(n) {
+  _tsTransmissionStuckMs = _positiveIntV2(n, "transmissionStuckMs");
+  return _tsTransmissionStuckMs;
+}
+
+export function getActiveDeviceCount(operator) {
+  let c = 0;
+  for (const d of _devicesV2.values()) {
+    if (d.status === HSM_MATURITY_V2.RETIRED) continue;
+    if (d.status === HSM_MATURITY_V2.PROVISIONAL) continue;
+    if (operator !== undefined && d.operator !== operator) continue;
+    c++;
+  }
+  return c;
+}
+
+export function getPendingTransmissionCount(deviceId) {
+  let c = 0;
+  for (const t of _transmissionsV2.values()) {
+    if (_TRANSMISSION_TERMINAL_V2.has(t.status)) continue;
+    if (deviceId !== undefined && t.deviceId !== deviceId) continue;
+    c++;
+  }
+  return c;
+}
+
+const _VALID_VENDORS = new Set(Object.values(HSM_VENDOR));
+
+export function registerDeviceV2({
+  id,
+  operator,
+  vendor,
+  initialStatus,
+  metadata,
+} = {}) {
+  if (!id) throw new Error("id required");
+  if (!operator) throw new Error("operator required");
+  if (!vendor || !_VALID_VENDORS.has(vendor)) throw new Error("invalid vendor");
+  if (_devicesV2.has(id)) throw new Error(`device ${id} already exists`);
+  const status = initialStatus ?? HSM_MATURITY_V2.PROVISIONAL;
+  if (!Object.values(HSM_MATURITY_V2).includes(status))
+    throw new Error(`invalid initial status ${status}`);
+  const countsActive =
+    status !== HSM_MATURITY_V2.RETIRED &&
+    status !== HSM_MATURITY_V2.PROVISIONAL;
+  if (
+    countsActive &&
+    getActiveDeviceCount(operator) >= _tsMaxActiveDevicesPerOperator
+  )
+    throw new Error(`operator ${operator} active device cap reached`);
+  const now = _now();
+  const d = {
+    id,
+    operator,
+    vendor,
+    status,
+    metadata: metadata ? { ...metadata } : {},
+    createdAt: now,
+    updatedAt: now,
+    activatedAt: status === HSM_MATURITY_V2.ACTIVE ? now : null,
+    lastUsedAt: now,
+  };
+  _devicesV2.set(id, d);
+  return { ...d, metadata: { ...d.metadata } };
+}
+
+export function getDeviceV2(id) {
+  const d = _devicesV2.get(id);
+  return d ? { ...d, metadata: { ...d.metadata } } : null;
+}
+
+export function listDevicesV2({ operator, status } = {}) {
+  const out = [];
+  for (const d of _devicesV2.values()) {
+    if (operator !== undefined && d.operator !== operator) continue;
+    if (status !== undefined && d.status !== status) continue;
+    out.push({ ...d, metadata: { ...d.metadata } });
+  }
+  return out;
+}
+
+export function setDeviceMaturityV2(id, nextStatus, { reason, metadata } = {}) {
+  const d = _devicesV2.get(id);
+  if (!d) throw new Error(`device ${id} not found`);
+  if (_HSM_TERMINAL_V2.has(d.status))
+    throw new Error(`device ${id} is terminal (${d.status})`);
+  const allowed = _HSM_TRANSITIONS_V2.get(d.status);
+  if (!allowed || !allowed.has(nextStatus))
+    throw new Error(`illegal transition ${d.status} → ${nextStatus}`);
+  const wasActive =
+    d.status !== HSM_MATURITY_V2.PROVISIONAL &&
+    d.status !== HSM_MATURITY_V2.RETIRED;
+  const willBeActive =
+    nextStatus !== HSM_MATURITY_V2.PROVISIONAL &&
+    nextStatus !== HSM_MATURITY_V2.RETIRED;
+  if (!wasActive && willBeActive) {
+    if (getActiveDeviceCount(d.operator) >= _tsMaxActiveDevicesPerOperator)
+      throw new Error(`operator ${d.operator} active device cap reached`);
+  }
+  d.status = nextStatus;
+  d.updatedAt = _now();
+  if (reason !== undefined) d.reason = reason;
+  if (metadata) d.metadata = { ...d.metadata, ...metadata };
+  if (nextStatus === HSM_MATURITY_V2.ACTIVE && !d.activatedAt)
+    d.activatedAt = d.updatedAt;
+  return { ...d, metadata: { ...d.metadata } };
+}
+
+export function activateDevice(id, opts) {
+  return setDeviceMaturityV2(id, HSM_MATURITY_V2.ACTIVE, opts);
+}
+export function degradeDevice(id, opts) {
+  return setDeviceMaturityV2(id, HSM_MATURITY_V2.DEGRADED, opts);
+}
+export function retireDevice(id, opts) {
+  return setDeviceMaturityV2(id, HSM_MATURITY_V2.RETIRED, opts);
+}
+
+export function touchDeviceUsage(id) {
+  const d = _devicesV2.get(id);
+  if (!d) throw new Error(`device ${id} not found`);
+  d.lastUsedAt = _now();
+  return { ...d, metadata: { ...d.metadata } };
+}
+
+export function enqueueTransmissionV2({
+  id,
+  deviceId,
+  provider,
+  payload,
+  metadata,
+} = {}) {
+  if (!id) throw new Error("id required");
+  if (!deviceId) throw new Error("deviceId required");
+  if (!provider) throw new Error("provider required");
+  if (!payload) throw new Error("payload required");
+  const d = _devicesV2.get(deviceId);
+  if (!d) throw new Error(`device ${deviceId} not found`);
+  if (_transmissionsV2.has(id))
+    throw new Error(`transmission ${id} already exists`);
+  if (
+    getPendingTransmissionCount(deviceId) >= _tsMaxPendingTransmissionsPerDevice
+  )
+    throw new Error(`device ${deviceId} pending transmission cap reached`);
+  const now = _now();
+  const t = {
+    id,
+    deviceId,
+    provider,
+    payload,
+    status: TRANSMISSION_V2.QUEUED,
+    metadata: metadata ? { ...metadata } : {},
+    createdAt: now,
+    updatedAt: now,
+    startedAt: null,
+  };
+  _transmissionsV2.set(id, t);
+  return { ...t, metadata: { ...t.metadata } };
+}
+
+export function getTransmissionV2(id) {
+  const t = _transmissionsV2.get(id);
+  return t ? { ...t, metadata: { ...t.metadata } } : null;
+}
+
+export function listTransmissionsV2({ deviceId, status } = {}) {
+  const out = [];
+  for (const t of _transmissionsV2.values()) {
+    if (deviceId !== undefined && t.deviceId !== deviceId) continue;
+    if (status !== undefined && t.status !== status) continue;
+    out.push({ ...t, metadata: { ...t.metadata } });
+  }
+  return out;
+}
+
+export function setTransmissionStatusV2(
+  id,
+  nextStatus,
+  { reason, metadata } = {},
+) {
+  const t = _transmissionsV2.get(id);
+  if (!t) throw new Error(`transmission ${id} not found`);
+  if (_TRANSMISSION_TERMINAL_V2.has(t.status))
+    throw new Error(`transmission ${id} is terminal (${t.status})`);
+  const allowed = _TRANSMISSION_TRANSITIONS_V2.get(t.status);
+  if (!allowed || !allowed.has(nextStatus))
+    throw new Error(`illegal transition ${t.status} → ${nextStatus}`);
+  t.status = nextStatus;
+  t.updatedAt = _now();
+  if (reason !== undefined) t.reason = reason;
+  if (metadata) t.metadata = { ...t.metadata, ...metadata };
+  if (nextStatus === TRANSMISSION_V2.SENDING && !t.startedAt)
+    t.startedAt = t.updatedAt;
+  return { ...t, metadata: { ...t.metadata } };
+}
+
+export function startTransmission(id, opts) {
+  return setTransmissionStatusV2(id, TRANSMISSION_V2.SENDING, opts);
+}
+export function confirmTransmission(id, opts) {
+  return setTransmissionStatusV2(id, TRANSMISSION_V2.CONFIRMED, opts);
+}
+export function failTransmission(id, opts) {
+  return setTransmissionStatusV2(id, TRANSMISSION_V2.FAILED, opts);
+}
+export function cancelTransmission(id, opts) {
+  return setTransmissionStatusV2(id, TRANSMISSION_V2.CANCELED, opts);
+}
+
+export function autoRetireIdleDevices({ now } = {}) {
+  const cutoff = (now ?? _now()) - _tsDeviceIdleMs;
+  const flipped = [];
+  for (const d of _devicesV2.values()) {
+    if (
+      d.status !== HSM_MATURITY_V2.ACTIVE &&
+      d.status !== HSM_MATURITY_V2.DEGRADED
+    )
+      continue;
+    if ((d.lastUsedAt ?? d.createdAt) > cutoff) continue;
+    d.status = HSM_MATURITY_V2.RETIRED;
+    d.updatedAt = now ?? _now();
+    d.reason = "auto_retire_idle";
+    flipped.push(d.id);
+  }
+  return flipped;
+}
+
+export function autoFailStuckTransmissions({ now } = {}) {
+  const cutoff = (now ?? _now()) - _tsTransmissionStuckMs;
+  const flipped = [];
+  for (const t of _transmissionsV2.values()) {
+    if (t.status !== TRANSMISSION_V2.SENDING) continue;
+    if (!t.startedAt || t.startedAt > cutoff) continue;
+    t.status = TRANSMISSION_V2.FAILED;
+    t.updatedAt = now ?? _now();
+    t.reason = "auto_fail_stuck";
+    flipped.push(t.id);
+  }
+  return flipped;
+}
+
+function _zeroByEnum(enumObj) {
+  const out = {};
+  for (const v of Object.values(enumObj)) out[v] = 0;
+  return out;
+}
+
+export function getTrustSecurityStatsV2() {
+  const devices = [..._devicesV2.values()];
+  const transmissions = [..._transmissionsV2.values()];
+  const devicesByStatus = _zeroByEnum(HSM_MATURITY_V2);
+  for (const d of devices) devicesByStatus[d.status]++;
+  const transmissionsByStatus = _zeroByEnum(TRANSMISSION_V2);
+  for (const t of transmissions) transmissionsByStatus[t.status]++;
+  return {
+    totalDevicesV2: devices.length,
+    totalTransmissionsV2: transmissions.length,
+    maxActiveDevicesPerOperator: _tsMaxActiveDevicesPerOperator,
+    maxPendingTransmissionsPerDevice: _tsMaxPendingTransmissionsPerDevice,
+    deviceIdleMs: _tsDeviceIdleMs,
+    transmissionStuckMs: _tsTransmissionStuckMs,
+    devicesByStatus,
+    transmissionsByStatus,
+  };
+}
+
+export function _resetStateV2() {
+  _devicesV2.clear();
+  _transmissionsV2.clear();
+  _tsMaxActiveDevicesPerOperator = TS_DEFAULT_MAX_ACTIVE_DEVICES_PER_OPERATOR;
+  _tsMaxPendingTransmissionsPerDevice =
+    TS_DEFAULT_MAX_PENDING_TRANSMISSIONS_PER_DEVICE;
+  _tsDeviceIdleMs = TS_DEFAULT_DEVICE_IDLE_MS;
+  _tsTransmissionStuckMs = TS_DEFAULT_TRANSMISSION_STUCK_MS;
+}