@securecoms/agent-bridge 0.10.0 → 0.11.0

package/dist/bin.js

@@ -1371,6 +1371,24 @@ var MlsOperationQueue = class {
   }
 };
 
+// ../connect-sdk-ts/dist/groupkey/receive-classifier.js
+function classifyFailedRow(i) {
+  if (i.messageType === "welcome")
+    return "defer";
+  if (i.messageType !== "commit" && i.messageType !== "application")
+    return "defer";
+  if (i.heldGroupId !== null && i.rowGroupId === i.heldGroupId) {
+    const epochForVerdict = i.messageType === "commit" ? i.liveCommitEpoch : i.snapshotEpoch;
+    if (epochForVerdict === void 0 || typeof i.rowEpoch !== "number")
+      return "defer";
+    const dead = i.messageType === "commit" ? i.rowEpoch <= epochForVerdict : i.rowEpoch < epochForVerdict;
+    return dead ? "permanentlySkipped" : "defer";
+  }
+  if (i.heldGroupId !== null && i.retiredGroupIds !== null && i.retiredGroupIds.includes(i.rowGroupId))
+    return "retiredDrained";
+  return "defer";
+}
+
 // ../connect-sdk-ts/dist/groupkey/mls.js
 var LABEL = "agentvault-connect-v1";
 var DEFAULT_STUCK_THRESHOLD = 2;
@@ -1487,6 +1505,11 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
    *  the past-epoch {@link permanentlySkipped} drain. Read via
    *  {@link quarantineDrainedCount}. */
   quarantineDrained = 0;
+  /** Cumulative count of rows ack-drained because their group_id is RETIRED for
+   *  the channel (superseded fork-loser traffic). Distinct from the same-group
+   *  past-epoch {@link permanentlySkipped} drain. Read via
+   *  {@link retiredDrainedCount}. */
+  retiredDrained = 0;
   constructor(o) {
     this.o = o;
     this.suite = o.suite ?? "xchacha20poly1305";
@@ -1644,6 +1667,10 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
   quarantineDrainedCount() {
     return this.quarantineDrained;
   }
+  /** See {@link retiredDrained}. */
+  retiredDrainedCount() {
+    return this.retiredDrained;
+  }
   /** Evict the live in-memory MLS group manager for a channel. Used when the
    *  device leaves or deletes a channel: dropping the persisted store record is
    *  not enough on its own, because a warm manager keeps decrypting until the
@@ -1712,6 +1739,9 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
     if (cached)
       return cached;
     const saved = await this.o.store.load(channelId);
+    const again = this.managers.get(channelId);
+    if (again)
+      return again;
     if (!saved)
       throw new Error(`MlsGroupKeyProvider: no MLS state for channel ${channelId} (call ensureSession first)`);
     const mgr = new MLSGroupManager(saved.ciphersuite);
@@ -2271,9 +2301,18 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
    * should delegate to it.
    *
    * Returns null rather than throwing so every caller must decide explicitly what
-   * an unknown own-leaf means. The one caller today FAILS CLOSED on null by
-   * falling back to the positional path only for FOREIGN identities — it never
-   * uses null to justify guessing among an own identity's leaves.
+   * an unknown own-leaf means.
+   *
+   * ⚠️ The one caller today does NOT fail closed on null. In
+   * {@link removeDeviceFromLiveGroupUnlocked} the branch is
+   * `if (ownLeaf !== null && leaves.includes(ownLeaf))` — the `else` compares no
+   * identities at all, so a null return sends an OWN-identity removal down the
+   * positional `leaves[pos]` path, which is exactly the add-order guess the
+   * self-exclusion branch exists to avoid (RFC 9420 §7.1 leftmost-blank refill
+   * permutes that mapping after any Remove). Null is therefore currently
+   * indistinguishable from "foreign identity", and only the cardinality guard
+   * stands between it and evicting the wrong device of the same human.
+   * Correcting that is Phase 1b, not this comment.
    */
   ownLeafIndex(mgr) {
     const idx = mgr.state?.privatePath?.leafIndex;
@@ -2590,13 +2629,27 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
     }
   }
   /**
-   * Return the number of leaves the given identity holds in the live tree for
-   * `channelId`. Loads the manager from the store if not already cached.
+   * Return the number of leaves the given identity holds in THIS DEVICE'S view
+   * of the ratchet tree for `channelId`. Reads the cached manager, else loads
+   * one from the store; it makes no backend call, so the answer is only as
+   * current as the commits this device has already processed. A device that is
+   * behind, forked, or holding a superseded group answers from that state, not
+   * from the server's.
+   *
+   * ⚠️ THROWS (`no MLS state for channel …`) when there is no local state at
+   * all — it does not report 0 for "we have not joined yet". Callers that may
+   * run before {@link ensureSession} must handle the throw; see
+   * {@link hasLeafForIdentity} for the non-throwing, cache-only variant.
    *
    * Primarily used by the gate (S20) to assert that a peer-committer 409-retry
-   * does NOT create a duplicate leaf for an already-added device. A return value
-   * of 1 is the expected healthy state; 0 means not yet a member; > 1 means a
-   * duplicate-leaf bug fired (the S3 guard failed to suppress the re-Add).
+   * does NOT create a duplicate leaf for an already-added device. In THAT
+   * scenario each identity owns exactly one device, so 1 is healthy and > 1
+   * means the S3 guard failed to suppress the re-Add. That reading does NOT
+   * generalise: leaf credentials encode the IDENTITY, not the device, so a
+   * multi-device identity legitimately holds ONE LEAF PER DEVICE — the same
+   * premise {@link removeDeviceFromLiveGroupUnlocked}'s
+   * `leaves.length !== orderedDeviceIds.length` guard is built on. Read the
+   * count against the identity's expected device count, not against 1.
    */
   async leafCountForIdentity(channelId, identityId) {
     const mgr = await this.manager(channelId);
@@ -2757,16 +2810,45 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
   }
   async receiveOnce(deviceId) {
     const rows = await this.o.backend.pullDelivery(deviceId);
-    if (typeof process !== "undefined" && process.env?.SECURECOMS_TRACE_DELIVERY && rows.length) {
-      console.warn(`[trace] receiveOnce pulled ${rows.length}: ` + rows.map((r) => `${r.message_type}@e${r.epoch}/ch${(r.connect_channel_id || "-").slice(0, 8)}/g${(r.group_id || "-").slice(0, 8)}`).join(", "));
-    }
     const appEntries = [];
     const handshakeAcked = [];
     const supersededChannelIds = [];
-    const order = { welcome: 0, commit: 1, application: 2 };
-    rows.sort((a, b) => order[a.message_type] - order[b.message_type]);
-    for (const row of rows) {
+    const welcomes = rows.filter((r) => r.message_type === "welcome");
+    const nonWelcomes = rows.filter((r) => r.message_type !== "welcome");
+    const ordered = [...welcomes, ...nonWelcomes];
+    if (typeof process !== "undefined" && process.env?.SECURECOMS_TRACE_DELIVERY && ordered.length) {
+      console.warn(`[trace] receiveOnce pulled ${ordered.length}: ` + ordered.map((r) => `${r.message_type}@e${r.epoch}/ch${(r.connect_channel_id || "-").slice(0, 8)}/g${(r.group_id || "-").slice(0, 8)}`).join(", "));
+    }
+    const classCtx = /* @__PURE__ */ new Map();
+    const classCtxFor = async (cid) => {
+      let ctx = classCtx.get(cid);
+      if (!ctx) {
+        let heldGroupId = null;
+        let snapshotEpoch;
+        let retired = null;
+        try {
+          const mgr = await this.manager(cid);
+          heldGroupId = new TextDecoder().decode(mgr.groupId);
+          snapshotEpoch = Number(mgr.epoch);
+        } catch {
+          heldGroupId = null;
+          snapshotEpoch = void 0;
+        }
+        try {
+          retired = await this.o.store.loadRetiredGroupIds(cid);
+        } catch {
+          retired = null;
+        }
+        ctx = { heldGroupId, retired, snapshotEpoch, liveCommitEpoch: snapshotEpoch };
+        classCtx.set(cid, ctx);
+      }
+      return ctx;
+    };
+    for (const row of ordered) {
       try {
+        if (row.message_type !== "welcome" && row.connect_channel_id) {
+          await classCtxFor(row.connect_channel_id);
+        }
         if (row.message_type === "welcome") {
           const wcid = row.connect_channel_id;
           if (wcid) {
@@ -2803,15 +2885,25 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
           const cid = row.connect_channel_id;
           if (!cid)
             continue;
+          let advancedEpoch;
           await this.locks.run(cid, async () => {
             const mgr = await this.manager(cid);
             await mgr.decrypt(hexToBytes(row.payload));
             await this.o.store.save(cid, mgr.exportState());
+            advancedEpoch = Number(mgr.epoch);
           });
           this.recordDecryptSuccess(cid);
+          if (advancedEpoch !== void 0) {
+            const ctx = classCtx.get(cid);
+            if (ctx)
+              ctx.liveCommitEpoch = advancedEpoch;
+          }
           handshakeAcked.push(row.queue_id);
         } else {
           const envelope = JSON.parse(new TextDecoder().decode(hexToBytes(row.payload)));
+          if (row.connect_channel_id != null && envelope.channel_id !== row.connect_channel_id) {
+            throw new Error(`envelope/row channel binding mismatch: row=${row.connect_channel_id} envelope=${envelope.channel_id}`);
+          }
           const key = await this.locks.run(envelope.channel_id, () => this.exporterKey(envelope.enclave_id, envelope.channel_id, envelope.mls_group_epoch));
           const aad = await buildAssociatedData({
             message_id: envelope.message_id,
@@ -2839,18 +2931,25 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
         this.recordDecryptError(row, err);
         const cid = row.connect_channel_id;
         let drained = false;
-        if (cid && typeof row.epoch === "number") {
-          let liveEpoch;
-          try {
-            liveEpoch = await this.currentEpoch(cid);
-          } catch {
-            liveEpoch = void 0;
-          }
-          const permanentlyDead = liveEpoch !== void 0 && (row.message_type === "commit" ? row.epoch <= liveEpoch : row.message_type === "application" ? row.epoch < liveEpoch : false);
-          if (permanentlyDead) {
+        if (cid && row.message_type !== "welcome") {
+          const ctx = classCtx.get(cid);
+          const verdict = classifyFailedRow({
+            messageType: row.message_type,
+            rowGroupId: row.group_id,
+            rowEpoch: typeof row.epoch === "number" ? row.epoch : void 0,
+            heldGroupId: ctx?.heldGroupId ?? null,
+            retiredGroupIds: ctx?.retired ?? null,
+            snapshotEpoch: ctx?.snapshotEpoch,
+            liveCommitEpoch: ctx?.liveCommitEpoch
+          });
+          if (verdict === "permanentlySkipped") {
             handshakeAcked.push(row.queue_id);
             this.permanentlySkipped++;
             drained = true;
+          } else if (verdict === "retiredDrained") {
+            handshakeAcked.push(row.queue_id);
+            this.retiredDrained++;
+            drained = true;
           }
         }
         if (!drained && cid) {
@@ -2858,8 +2957,10 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
           if (e) {
             e.wedgedRun += 1;
             if (e.wedgedRun >= this.quarantineThreshold) {
-              handshakeAcked.push(row.queue_id);
-              this.quarantineDrained++;
+              if (row.message_type !== "welcome") {
+                handshakeAcked.push(row.queue_id);
+                this.quarantineDrained++;
+              }
               this.quarantineChannel(cid);
             }
           }
@@ -6549,6 +6650,8 @@ var BridgeAgent = class _BridgeAgent {
       filtered_room: this.filteredRoomMessages,
       rate_limited: this.rateLimitedSends,
       permanently_skipped: this.provider.permanentlySkippedCount(),
+      quarantine_drained: this.provider.quarantineDrainedCount(),
+      retired_drained: this.provider.retiredDrainedCount(),
       failed_attachments: this.failedAttachments,
       delivery_pings: this.pingsReceived,
       agent_sessions: this.authSessions,
@@ -6594,8 +6697,11 @@ var BridgeAgent = class _BridgeAgent {
       filteredRoomMessages: this.filteredRoomMessages,
       rateLimitedSends: this.rateLimitedSends,
       permanentlySkipped: this.provider.permanentlySkippedCount(),
+      quarantineDrained: this.provider.quarantineDrainedCount(),
+      retiredDrained: this.provider.retiredDrainedCount(),
       welcomeRequestsSent: this.welcomeRequestsSent,
-      failedAttachments: this.failedAttachments
+      failedAttachments: this.failedAttachments,
+      build: BRIDGE_VERSION
     };
   }
   async close() {

package/dist/bridge-agent.d.ts

@@ -851,6 +851,12 @@ export declare class BridgeAgent {
         rate_limited: number;
         /** Cumulative inbound rows acked-and-dropped because they were provably past-epoch undecryptable (forward-secrecy secret gone). */
         permanently_skipped: number;
+        /** SDK-6: cumulative rows ack-drained via QUARANTINE, distinct from the
+         *  same-group past-epoch permanently_skipped drain. */
+        quarantine_drained: number;
+        /** SDK-6: cumulative rows ack-drained because their group_id is RETIRED for
+         *  the channel (superseded fork-loser traffic). */
+        retired_drained: number;
         /** Track 5: cumulative artifact_share messages where download/decrypt/digest failed (fail-soft — acked, no redeliver). */
         failed_attachments: number;
         /** 2026-07-03 latency triage: delivery pings received on the WS stream.
@@ -940,9 +946,19 @@ export declare class BridgeAgent {
         filteredRoomMessages: number;
         rateLimitedSends: number;
         permanentlySkipped: number;
+        /** SDK-6: cumulative rows ack-drained via QUARANTINE, distinct from the
+         *  same-group past-epoch permanentlySkipped drain. */
+        quarantineDrained: number;
+        /** SDK-6: cumulative rows ack-drained because their group_id is RETIRED for
+         *  the channel (superseded fork-loser traffic). */
+        retiredDrained: number;
         welcomeRequestsSent: number;
         /** Track 5: cumulative artifact_share failures (download/decrypt/digest). */
         failedAttachments: number;
+        /** SDK-6: bridge build id, so a /v1/metrics reading captured across a daemon
+         * restart can be attributed to a version — counters are process-lifetime
+         * and zero on restart (spec §5.5). */
+        build: string;
     };
     close(): Promise<void>;
 }

package/dist/index.js

@@ -1268,6 +1268,24 @@ var MlsOperationQueue = class {
   }
 };
 
+// ../connect-sdk-ts/dist/groupkey/receive-classifier.js
+function classifyFailedRow(i) {
+  if (i.messageType === "welcome")
+    return "defer";
+  if (i.messageType !== "commit" && i.messageType !== "application")
+    return "defer";
+  if (i.heldGroupId !== null && i.rowGroupId === i.heldGroupId) {
+    const epochForVerdict = i.messageType === "commit" ? i.liveCommitEpoch : i.snapshotEpoch;
+    if (epochForVerdict === void 0 || typeof i.rowEpoch !== "number")
+      return "defer";
+    const dead = i.messageType === "commit" ? i.rowEpoch <= epochForVerdict : i.rowEpoch < epochForVerdict;
+    return dead ? "permanentlySkipped" : "defer";
+  }
+  if (i.heldGroupId !== null && i.retiredGroupIds !== null && i.retiredGroupIds.includes(i.rowGroupId))
+    return "retiredDrained";
+  return "defer";
+}
+
 // ../connect-sdk-ts/dist/groupkey/mls.js
 var LABEL = "agentvault-connect-v1";
 var DEFAULT_STUCK_THRESHOLD = 2;
@@ -1384,6 +1402,11 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
    *  the past-epoch {@link permanentlySkipped} drain. Read via
    *  {@link quarantineDrainedCount}. */
   quarantineDrained = 0;
+  /** Cumulative count of rows ack-drained because their group_id is RETIRED for
+   *  the channel (superseded fork-loser traffic). Distinct from the same-group
+   *  past-epoch {@link permanentlySkipped} drain. Read via
+   *  {@link retiredDrainedCount}. */
+  retiredDrained = 0;
   constructor(o) {
     this.o = o;
     this.suite = o.suite ?? "xchacha20poly1305";
@@ -1541,6 +1564,10 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
   quarantineDrainedCount() {
     return this.quarantineDrained;
   }
+  /** See {@link retiredDrained}. */
+  retiredDrainedCount() {
+    return this.retiredDrained;
+  }
   /** Evict the live in-memory MLS group manager for a channel. Used when the
    *  device leaves or deletes a channel: dropping the persisted store record is
    *  not enough on its own, because a warm manager keeps decrypting until the
@@ -1609,6 +1636,9 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
     if (cached)
       return cached;
     const saved = await this.o.store.load(channelId);
+    const again = this.managers.get(channelId);
+    if (again)
+      return again;
     if (!saved)
       throw new Error(`MlsGroupKeyProvider: no MLS state for channel ${channelId} (call ensureSession first)`);
     const mgr = new MLSGroupManager(saved.ciphersuite);
@@ -2168,9 +2198,18 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
    * should delegate to it.
    *
    * Returns null rather than throwing so every caller must decide explicitly what
-   * an unknown own-leaf means. The one caller today FAILS CLOSED on null by
-   * falling back to the positional path only for FOREIGN identities — it never
-   * uses null to justify guessing among an own identity's leaves.
+   * an unknown own-leaf means.
+   *
+   * ⚠️ The one caller today does NOT fail closed on null. In
+   * {@link removeDeviceFromLiveGroupUnlocked} the branch is
+   * `if (ownLeaf !== null && leaves.includes(ownLeaf))` — the `else` compares no
+   * identities at all, so a null return sends an OWN-identity removal down the
+   * positional `leaves[pos]` path, which is exactly the add-order guess the
+   * self-exclusion branch exists to avoid (RFC 9420 §7.1 leftmost-blank refill
+   * permutes that mapping after any Remove). Null is therefore currently
+   * indistinguishable from "foreign identity", and only the cardinality guard
+   * stands between it and evicting the wrong device of the same human.
+   * Correcting that is Phase 1b, not this comment.
    */
   ownLeafIndex(mgr) {
     const idx = mgr.state?.privatePath?.leafIndex;
@@ -2487,13 +2526,27 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
     }
   }
   /**
-   * Return the number of leaves the given identity holds in the live tree for
-   * `channelId`. Loads the manager from the store if not already cached.
+   * Return the number of leaves the given identity holds in THIS DEVICE'S view
+   * of the ratchet tree for `channelId`. Reads the cached manager, else loads
+   * one from the store; it makes no backend call, so the answer is only as
+   * current as the commits this device has already processed. A device that is
+   * behind, forked, or holding a superseded group answers from that state, not
+   * from the server's.
+   *
+   * ⚠️ THROWS (`no MLS state for channel …`) when there is no local state at
+   * all — it does not report 0 for "we have not joined yet". Callers that may
+   * run before {@link ensureSession} must handle the throw; see
+   * {@link hasLeafForIdentity} for the non-throwing, cache-only variant.
    *
    * Primarily used by the gate (S20) to assert that a peer-committer 409-retry
-   * does NOT create a duplicate leaf for an already-added device. A return value
-   * of 1 is the expected healthy state; 0 means not yet a member; > 1 means a
-   * duplicate-leaf bug fired (the S3 guard failed to suppress the re-Add).
+   * does NOT create a duplicate leaf for an already-added device. In THAT
+   * scenario each identity owns exactly one device, so 1 is healthy and > 1
+   * means the S3 guard failed to suppress the re-Add. That reading does NOT
+   * generalise: leaf credentials encode the IDENTITY, not the device, so a
+   * multi-device identity legitimately holds ONE LEAF PER DEVICE — the same
+   * premise {@link removeDeviceFromLiveGroupUnlocked}'s
+   * `leaves.length !== orderedDeviceIds.length` guard is built on. Read the
+   * count against the identity's expected device count, not against 1.
    */
   async leafCountForIdentity(channelId, identityId) {
     const mgr = await this.manager(channelId);
@@ -2654,16 +2707,45 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
   }
   async receiveOnce(deviceId) {
     const rows = await this.o.backend.pullDelivery(deviceId);
-    if (typeof process !== "undefined" && process.env?.SECURECOMS_TRACE_DELIVERY && rows.length) {
-      console.warn(`[trace] receiveOnce pulled ${rows.length}: ` + rows.map((r) => `${r.message_type}@e${r.epoch}/ch${(r.connect_channel_id || "-").slice(0, 8)}/g${(r.group_id || "-").slice(0, 8)}`).join(", "));
-    }
     const appEntries = [];
     const handshakeAcked = [];
     const supersededChannelIds = [];
-    const order = { welcome: 0, commit: 1, application: 2 };
-    rows.sort((a, b) => order[a.message_type] - order[b.message_type]);
-    for (const row of rows) {
+    const welcomes = rows.filter((r) => r.message_type === "welcome");
+    const nonWelcomes = rows.filter((r) => r.message_type !== "welcome");
+    const ordered = [...welcomes, ...nonWelcomes];
+    if (typeof process !== "undefined" && process.env?.SECURECOMS_TRACE_DELIVERY && ordered.length) {
+      console.warn(`[trace] receiveOnce pulled ${ordered.length}: ` + ordered.map((r) => `${r.message_type}@e${r.epoch}/ch${(r.connect_channel_id || "-").slice(0, 8)}/g${(r.group_id || "-").slice(0, 8)}`).join(", "));
+    }
+    const classCtx = /* @__PURE__ */ new Map();
+    const classCtxFor = async (cid) => {
+      let ctx = classCtx.get(cid);
+      if (!ctx) {
+        let heldGroupId = null;
+        let snapshotEpoch;
+        let retired = null;
+        try {
+          const mgr = await this.manager(cid);
+          heldGroupId = new TextDecoder().decode(mgr.groupId);
+          snapshotEpoch = Number(mgr.epoch);
+        } catch {
+          heldGroupId = null;
+          snapshotEpoch = void 0;
+        }
+        try {
+          retired = await this.o.store.loadRetiredGroupIds(cid);
+        } catch {
+          retired = null;
+        }
+        ctx = { heldGroupId, retired, snapshotEpoch, liveCommitEpoch: snapshotEpoch };
+        classCtx.set(cid, ctx);
+      }
+      return ctx;
+    };
+    for (const row of ordered) {
       try {
+        if (row.message_type !== "welcome" && row.connect_channel_id) {
+          await classCtxFor(row.connect_channel_id);
+        }
         if (row.message_type === "welcome") {
           const wcid = row.connect_channel_id;
           if (wcid) {
@@ -2700,15 +2782,25 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
           const cid = row.connect_channel_id;
           if (!cid)
             continue;
+          let advancedEpoch;
           await this.locks.run(cid, async () => {
             const mgr = await this.manager(cid);
             await mgr.decrypt(hexToBytes(row.payload));
             await this.o.store.save(cid, mgr.exportState());
+            advancedEpoch = Number(mgr.epoch);
           });
           this.recordDecryptSuccess(cid);
+          if (advancedEpoch !== void 0) {
+            const ctx = classCtx.get(cid);
+            if (ctx)
+              ctx.liveCommitEpoch = advancedEpoch;
+          }
           handshakeAcked.push(row.queue_id);
         } else {
           const envelope = JSON.parse(new TextDecoder().decode(hexToBytes(row.payload)));
+          if (row.connect_channel_id != null && envelope.channel_id !== row.connect_channel_id) {
+            throw new Error(`envelope/row channel binding mismatch: row=${row.connect_channel_id} envelope=${envelope.channel_id}`);
+          }
           const key = await this.locks.run(envelope.channel_id, () => this.exporterKey(envelope.enclave_id, envelope.channel_id, envelope.mls_group_epoch));
           const aad = await buildAssociatedData({
             message_id: envelope.message_id,
@@ -2736,18 +2828,25 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
         this.recordDecryptError(row, err);
         const cid = row.connect_channel_id;
         let drained = false;
-        if (cid && typeof row.epoch === "number") {
-          let liveEpoch;
-          try {
-            liveEpoch = await this.currentEpoch(cid);
-          } catch {
-            liveEpoch = void 0;
-          }
-          const permanentlyDead = liveEpoch !== void 0 && (row.message_type === "commit" ? row.epoch <= liveEpoch : row.message_type === "application" ? row.epoch < liveEpoch : false);
-          if (permanentlyDead) {
+        if (cid && row.message_type !== "welcome") {
+          const ctx = classCtx.get(cid);
+          const verdict = classifyFailedRow({
+            messageType: row.message_type,
+            rowGroupId: row.group_id,
+            rowEpoch: typeof row.epoch === "number" ? row.epoch : void 0,
+            heldGroupId: ctx?.heldGroupId ?? null,
+            retiredGroupIds: ctx?.retired ?? null,
+            snapshotEpoch: ctx?.snapshotEpoch,
+            liveCommitEpoch: ctx?.liveCommitEpoch
+          });
+          if (verdict === "permanentlySkipped") {
             handshakeAcked.push(row.queue_id);
             this.permanentlySkipped++;
             drained = true;
+          } else if (verdict === "retiredDrained") {
+            handshakeAcked.push(row.queue_id);
+            this.retiredDrained++;
+            drained = true;
           }
         }
         if (!drained && cid) {
@@ -2755,8 +2854,10 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
           if (e) {
             e.wedgedRun += 1;
             if (e.wedgedRun >= this.quarantineThreshold) {
-              handshakeAcked.push(row.queue_id);
-              this.quarantineDrained++;
+              if (row.message_type !== "welcome") {
+                handshakeAcked.push(row.queue_id);
+                this.quarantineDrained++;
+              }
               this.quarantineChannel(cid);
             }
           }
@@ -6405,6 +6506,8 @@ var BridgeAgent = class _BridgeAgent {
       filtered_room: this.filteredRoomMessages,
       rate_limited: this.rateLimitedSends,
       permanently_skipped: this.provider.permanentlySkippedCount(),
+      quarantine_drained: this.provider.quarantineDrainedCount(),
+      retired_drained: this.provider.retiredDrainedCount(),
       failed_attachments: this.failedAttachments,
       delivery_pings: this.pingsReceived,
       agent_sessions: this.authSessions,
@@ -6450,8 +6553,11 @@ var BridgeAgent = class _BridgeAgent {
       filteredRoomMessages: this.filteredRoomMessages,
       rateLimitedSends: this.rateLimitedSends,
       permanentlySkipped: this.provider.permanentlySkippedCount(),
+      quarantineDrained: this.provider.quarantineDrainedCount(),
+      retiredDrained: this.provider.retiredDrainedCount(),
       welcomeRequestsSent: this.welcomeRequestsSent,
-      failedAttachments: this.failedAttachments
+      failedAttachments: this.failedAttachments,
+      build: BRIDGE_VERSION
     };
   }
   async close() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securecoms/agent-bridge",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",