@securecoms/agent-bridge 0.9.0 → 0.11.0

package/dist/bridge-agent.d.ts

@@ -674,6 +674,58 @@ export declare class BridgeAgent {
      * the other enclaves in the set.
      */
     private refreshChannelMeta;
+    /** Cache for the server-side enclave enumeration (see enclavesToCover). */
+    private enclaveEnumCache;
+    /** Enclaves whose channel listing failed on the NEWEST sweep (audit HIGH:
+     * skip-one deleted the sweep's partial-coverage signal — observations_stale
+     * is a global max, so one healthy enclave masked a failed one). Surfaced on
+     * health() so partial coverage is never silent. */
+    private sweepEnclavesFailed;
+    /** Enclave ids whose channel listing has EVER succeeded this process, seeded
+     * with HOME (home is always expected to list; without the seed, a home
+     * failure right after a restart would read as "never succeeded" and slip
+     * through the expected-gap branch — weaker than the old abort-on-failure).
+     * A failure of a member of this set is a REGRESSION and degrades health; a
+     * failure of a never-succeeded enclave (partner: tenant-scoped 404, permanent
+     * pending backend authz) is an EXPECTED gap — reported, not degrading, or
+     * every federated agent would peg degraded forever. */
+    private readonly enclaveListEverSucceeded;
+    /** Warn-once-per-failure-streak, keyed by enclave id (cleared on success):
+     * a permanently-404ing partner enclave must not log 1440 lines a day. */
+    private readonly enclaveListWarned;
+    private static readonly ENCLAVE_ENUM_TTL_MS;
+    private enclaveEnumWarned;
+    /**
+     * C1 (split-brain Task 3): every enclave this agent must COVER — for the
+     * self-heal sweep and for channel-meta refresh alike. ONE helper on purpose:
+     * these two call sites had drifted (refreshChannelMeta looped home+learned,
+     * selfHealSweep looped nothing), and the drift is exactly what left both
+     * production agents with zero recovery coverage in their second enclave.
+     *
+     * The set is SERVER enumeration ∪ home ∪ store-learned:
+     *
+     *  - SERVER (`GET /api/v1/enclaves`, membership-scoped, federated included)
+     *    is the authoritative source. The store CANNOT be: channel_meta's only
+     *    writers are listChannels itself (circular — you learn enclave B by
+     *    having already listed B) and the receive pump's successfully-decrypted
+     *    loop, and a FORKED agent decrypts nothing, so the agent that most needs
+     *    sweeping in enclave B is precisely the one whose store never learned B.
+     *  - home + learned stay in the union as the degraded-mode floor: if the
+     *    enumeration endpoint is down, we sweep what we can rather than nothing,
+     *    and we warn (once) so the gap is diagnosable.
+     *
+     * The server result is cached for ENCLAVE_ENUM_TTL_MS so per-ingest-cycle
+     * callers (refreshChannelMeta) do not add an HTTP round-trip per cycle;
+     * membership changes are picked up within one TTL, which matches the sweep
+     * cadence this exists to serve.
+     *
+     * ⚠️ Residual gap, stated: the enumeration RETURNS cross-tenant partner
+     * enclaves, but `list_channels_in_enclave` is tenant-scoped and 404s them
+     * under this agent's bearer — so a partner enclave in this set still yields
+     * no channels. Callers must treat a per-enclave listing failure as skip-one,
+     * never abort-all. Closing that needs backend authz work, not daemon work.
+     */
+    private enclavesToCover;
     /** A live roster for a channel, or undefined if missing OR expired past the TTL. */
     private freshRoster;
     /**
@@ -799,6 +851,12 @@ export declare class BridgeAgent {
         rate_limited: number;
         /** Cumulative inbound rows acked-and-dropped because they were provably past-epoch undecryptable (forward-secrecy secret gone). */
         permanently_skipped: number;
+        /** SDK-6: cumulative rows ack-drained via QUARANTINE, distinct from the
+         *  same-group past-epoch permanently_skipped drain. */
+        quarantine_drained: number;
+        /** SDK-6: cumulative rows ack-drained because their group_id is RETIRED for
+         *  the channel (superseded fork-loser traffic). */
+        retired_drained: number;
         /** Track 5: cumulative artifact_share messages where download/decrypt/digest failed (fail-soft — acked, no redeliver). */
         failed_attachments: number;
         /** 2026-07-03 latency triage: delivery pings received on the WS stream.
@@ -836,6 +894,12 @@ export declare class BridgeAgent {
         degraded: boolean;
         /** M6: per-channel observations, newest sweep. Read from cache; no I/O. */
         channels: ChannelObservation[];
+        /** C1: enclaves whose channel listing failed on the newest sweep. Non-empty
+         * means partial coverage — those enclaves' channels were NOT probed. A
+         * PREVIOUSLY-SUCCEEDING (or home) entry also flips `degraded`; a
+         * never-succeeded entry (partner enclave, tenant-scoped 404) is reported
+         * here without degrading. */
+        sweep_enclaves_failed: string[];
         /** Optional memory-adapter counters (e.g. Hermes provider); present only when the active provider exposes stats(). */
         hermes_no_session?: number;
         hermes_skipped?: number;
@@ -882,9 +946,19 @@ export declare class BridgeAgent {
         filteredRoomMessages: number;
         rateLimitedSends: number;
         permanentlySkipped: number;
+        /** SDK-6: cumulative rows ack-drained via QUARANTINE, distinct from the
+         *  same-group past-epoch permanentlySkipped drain. */
+        quarantineDrained: number;
+        /** SDK-6: cumulative rows ack-drained because their group_id is RETIRED for
+         *  the channel (superseded fork-loser traffic). */
+        retiredDrained: number;
         welcomeRequestsSent: number;
         /** Track 5: cumulative artifact_share failures (download/decrypt/digest). */
         failedAttachments: number;
+        /** SDK-6: bridge build id, so a /v1/metrics reading captured across a daemon
+         * restart can be attributed to a version — counters are process-lifetime
+         * and zero on restart (spec §5.5). */
+        build: string;
     };
     close(): Promise<void>;
 }