@geohar/un-bien 0.7.0

package/dist/session/bridge.js

@@ -0,0 +1,134 @@
+import { BrokerRemote } from "./broker_remote.js";
+import { PiForwardClient } from "../transport/pi_forward_client.js";
+import { MeshClient } from "../mesh/client.js";
+import { buildTopologySnapshot, discoverTopology, } from "../mesh/siblings.js";
+import { canonicalizeEd25519PublicKey, encodeEd25519PublicKey, } from "../mesh/encoding.js";
+import { listOwnerPubkeys } from "../pairing/storage.js";
+function compareAscii(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function validateAlias(alias, field) {
+    if (typeof alias !== "string" || alias.length === 0 || alias.includes(":")) {
+        throw new Error(`mesh: ${field} is not a valid routing alias`);
+    }
+    return alias;
+}
+function validateLegacyPcLabel(label, field) {
+    if (typeof label !== "string" || label.length === 0) {
+        throw new Error(`mesh: ${field} is not a valid legacy PC label`);
+    }
+    return label;
+}
+function ownTopology(snapshot, expectedSelfPubkey) {
+    const selfPubkey = canonicalizeEd25519PublicKey(snapshot.self?.pcPubkey, "self public key");
+    if (selfPubkey !== expectedSelfPubkey) {
+        throw new Error("mesh: topology self public key does not match relay identity");
+    }
+    const selfLabel = validateAlias(snapshot.self.pcLabel, "self.pcLabel");
+    const selfLegacyPcLabel = validateLegacyPcLabel(snapshot.self.legacyPcLabel, "self.legacyPcLabel");
+    const self = Object.freeze({
+        pcLabel: selfLabel,
+        pcPubkey: selfPubkey,
+        legacyPcLabel: selfLegacyPcLabel,
+    });
+    const siblingKeys = new Set();
+    const siblingAliases = new Set();
+    const normalizedSiblings = [];
+    for (const [index, sibling] of snapshot.siblings.entries()) {
+        const pcPubkey = canonicalizeEd25519PublicKey(sibling.pcPubkey, `siblings[${index}].pcPubkey`);
+        if (pcPubkey === selfPubkey)
+            continue;
+        const pcLabel = validateAlias(sibling.pcLabel, `siblings[${index}].pcLabel`);
+        const legacyPcLabel = validateLegacyPcLabel(sibling.legacyPcLabel, `siblings[${index}].legacyPcLabel`);
+        if (pcLabel === selfLabel || siblingAliases.has(pcLabel)) {
+            throw new Error("mesh: duplicate sibling routing alias");
+        }
+        if (siblingKeys.has(pcPubkey)) {
+            throw new Error("mesh: duplicate sibling public key");
+        }
+        siblingAliases.add(pcLabel);
+        siblingKeys.add(pcPubkey);
+        normalizedSiblings.push(Object.freeze({ pcLabel, pcPubkey, legacyPcLabel }));
+    }
+    normalizedSiblings.sort((left, right) => compareAscii(left.pcPubkey, right.pcPubkey));
+    return Object.freeze({ self, siblings: Object.freeze(normalizedSiblings) });
+}
+async function discoverStandaloneTopology(opts) {
+    const silent = {
+        warn: (_message) => {
+            /* metadata stays silent in TUI */
+        },
+    };
+    try {
+        const owners = await listOwnerPubkeys();
+        return await discoverTopology({
+            client: new MeshClient(opts.relayUrl, {
+                ...(opts.meshRequestTimeoutMs === undefined
+                    ? {}
+                    : { requestTimeoutMs: opts.meshRequestTimeoutMs }),
+            }),
+            ownerEpks: owners,
+            myPubkey: opts.keypair.publicKey,
+            log: silent,
+        });
+    }
+    catch {
+        return buildTopologySnapshot(opts.keypair.publicKey, []);
+    }
+}
+export async function attachCrossPcBridge(opts) {
+    const expectedSelfPubkey = encodeEd25519PublicKey(opts.keypair.publicKey, "relay public key");
+    const topology = ownTopology(opts.topology ?? (await discoverStandaloneTopology(opts)), expectedSelfPubkey);
+    // No Relay listeners exist until all standalone discovery has completed.
+    const piForward = new PiForwardClient(opts.relay);
+    let brokerRemote;
+    try {
+        brokerRemote = new BrokerRemote({
+            broker: opts.broker,
+            pi: piForward,
+            topology,
+            activateOnConstruct: false,
+            log: opts.log ?? (() => { }),
+        });
+    }
+    catch (error) {
+        piForward.detach();
+        throw error;
+    }
+    let state = "dormant";
+    return {
+        brokerRemote,
+        piForward,
+        topology,
+        activate() {
+            if (state !== "dormant")
+                return;
+            try {
+                brokerRemote.activate();
+                state = "active";
+            }
+            catch (error) {
+                state = "detached";
+                try {
+                    brokerRemote.detach();
+                }
+                finally {
+                    piForward.detach();
+                }
+                throw error;
+            }
+        },
+        detach() {
+            if (state === "detached")
+                return;
+            state = "detached";
+            try {
+                brokerRemote.detach();
+            }
+            finally {
+                piForward.detach();
+            }
+        },
+    };
+}
+//# sourceMappingURL=bridge.js.map

package/dist/session/bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../../src/session/bridge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GAEjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAoCzD,SAAS,YAAY,CAAC,IAAY,EAAE,KAAa;IAC/C,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,+BAA+B,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc,EAAE,KAAa;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,iCAAiC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAClB,QAA8B,EAC9B,kBAA0B;IAE1B,MAAM,UAAU,GAAG,4BAA4B,CAC7C,QAAQ,CAAC,IAAI,EAAE,QAAQ,EACvB,iBAAiB,CAClB,CAAC;IACF,IAAI,UAAU,KAAK,kBAAkB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACvE,MAAM,iBAAiB,GAAG,qBAAqB,CAC7C,QAAQ,CAAC,IAAI,CAAC,aAAa,EAC3B,oBAAoB,CACrB,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;QACzB,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,UAAU;QACpB,aAAa,EAAE,iBAAiB;KACjC,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,MAAM,kBAAkB,GAMpB,EAAE,CAAC;IACP,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3D,MAAM,QAAQ,GAAG,4BAA4B,CAC3C,OAAO,CAAC,QAAQ,EAChB,YAAY,KAAK,YAAY,CAC9B,CAAC;QACF,IAAI,QAAQ,KAAK,UAAU;YAAE,SAAS;QACtC,MAAM,OAAO,GAAG,aAAa,CAC3B,OAAO,CAAC,OAAO,EACf,YAAY,KAAK,WAAW,CAC7B,CAAC;QACF,MAAM,aAAa,GAAG,qBAAqB,CACzC,OAAO,CAAC,aAAa,EACrB,YAAY,KAAK,iBAAiB,CACnC,CAAC;QACF,IAAI,OAAO,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5B,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1B,kBAAkB,CAAC,IAAI,CACrB,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CACpD,CAAC;IACJ,CAAC;IACD,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACtC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAC5C,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,IAAyB;IAEzB,MAAM,MAAM,GAAG;QACb,IAAI,EAAE,CAAC,QAAgB,EAAQ,EAAE;YAC/B,kCAAkC;QACpC,CAAC;KACF,CAAC;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACxC,OAAO,MAAM,gBAAgB,CAAC;YAC5B,MAAM,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE;gBACpC,GAAG,CAAC,IAAI,CAAC,oBAAoB,KAAK,SAAS;oBACzC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,EAAE,CAAC;aACrD,CAAC;YACF,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YAChC,GAAG,EAAE,MAAM;SACZ,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAyB;IAEzB,MAAM,kBAAkB,GAAG,sBAAsB,CAC/C,IAAI,CAAC,OAAO,CAAC,SAAS,EACtB,kBAAkB,CACnB,CAAC;IACF,MAAM,QAAQ,GAAG,WAAW,CAC1B,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,0BAA0B,CAAC,IAAI,CAAC,CAAC,EACzD,kBAAkB,CACnB,CAAC;IAEF,yEAAyE;IACzE,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,YAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,YAAY,GAAG,IAAI,YAAY,CAAC;YAC9B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,EAAE,EAAE,SAAS;YACb,QAAQ;YACR,mBAAmB,EAAE,KAAK;YAC1B,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAS,EAAE,GAAE,CAAC,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,SAAS,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,KAAK,GAAsC,SAAS,CAAC;IACzD,OAAO;QACL,YAAY;QACZ,SAAS;QACT,QAAQ;QACR,QAAQ;YACN,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO;YAChC,IAAI,CAAC;gBACH,YAAY,CAAC,QAAQ,EAAE,CAAC;gBACxB,KAAK,GAAG,QAAQ,CAAC;YACnB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,KAAK,GAAG,UAAU,CAAC;gBACnB,IAAI,CAAC;oBACH,YAAY,CAAC,MAAM,EAAE,CAAC;gBACxB,CAAC;wBAAS,CAAC;oBACT,SAAS,CAAC,MAAM,EAAE,CAAC;gBACrB,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM;YACJ,IAAI,KAAK,KAAK,UAAU;gBAAE,OAAO;YACjC,KAAK,GAAG,UAAU,CAAC;YACnB,IAAI,CAAC;gBACH,YAAY,CAAC,MAAM,EAAE,CAAC;YACxB,CAAC;oBAAS,CAAC;gBACT,SAAS,CAAC,MAAM,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/session/broker.d.ts

@@ -0,0 +1,189 @@
+import type { Server } from "node:net";
+import { type Envelope } from "./envelope.js";
+/**
+ * Structured view of one mesh peer (plan/38). The `address` is the canonical
+ * routing key; the other fields let a client group/label peers WITHOUT parsing
+ * the address string. `pc` is undefined for local peers (filled cross-PC in
+ * Fase 2). Returned by `list_peers` as `peers_detailed`.
+ */
+export interface PeerInfo {
+    /** Cross-PC label; undefined for a local peer. */
+    pc?: string;
+    /** Working directory (realpath). Empty string for a legacy peer (no cwd). */
+    cwd: string;
+    /** Clean leaf name (carries a `#N` only on a same-(cwd,name) collision). */
+    name: string;
+    /** Canonical address — the broker's Map key and the `to`/`from` on the wire. */
+    address: string;
+}
+/**
+ * THE sole encoder of a peer address (plan/38): `[<pc>:]<cwd>@<nome>`.
+ *
+ * - `cwd` present → `<cwd>@<nome>` (the `@` separates name from path so a `/`
+ *   in the path never confuses lookup, which is exact-match anyway).
+ * - `cwd` empty (legacy peer that sent no cwd) → `address == name`, preserving
+ *   pre-plan/38 behavior so a mixed mesh keeps routing.
+ * - `pc` present (cross-PC, Fase 2) → prefixed `<pc>:`.
+ *
+ * Does NOT sanitize — callers sanitize the `name` once (see `sanitizeMeshName`)
+ * before composing, so an already-appended `#N` collision suffix survives.
+ * Everyone else ECHOES `peer.address` verbatim; only the broker composes.
+ */
+export declare function composeAddress(parts: {
+    pc?: string;
+    cwd: string;
+    name: string;
+}): string;
+/**
+ * Sanitize a requested mesh name to a safe leaf while PRESERVING a trailing
+ * `#N` collision suffix (which the cwd-lock or a prior assignment may have
+ * added — `sanitizeSegment` alone would mangle `#`→`-`). The base is run through
+ * `sanitizeSegment` (af66d04); an unusable base (empty / reserved keyword) falls
+ * back to `"agent"`.
+ */
+export declare function sanitizeMeshName(raw: string): string;
+/**
+ * Broker hosted by the session leader. Accepts UDS connections, maintains a
+ * `name → connection` map, routes envelopes per the `to` field, and appends
+ * each routed message to an `audit.jsonl` log.
+ *
+ * Auto-suffix on name collision: when a peer registers a name already taken,
+ * the broker assigns `<name>#N` and returns it in the register ack.
+ *
+ * ## ACK protocol (plan/25 Wave 0; reliable delivery per plan/34)
+ *
+ * For **unicast non-broker** envelopes the broker synchronously emits an ACK
+ * envelope back to the sender once it has delivered:
+ *
+ *   - target online → deliver envelope, ACK `received`
+ *   - no such peer  → silent drop (sender times out)
+ *
+ * plan/34 removed the busy-drop: a message that arrives while the target is
+ * mid-turn is **always delivered**, never dropped. The Pi harness
+ * (`sendMessage(triggerTurn:true)`) enqueues mid-turn messages and processes
+ * them in the upcoming turn, so the broker needs no busy gate or mailbox.
+ * Consequently `busy` is no longer a possible ACK status for unicast new
+ * work — the sender always gets `received`. (Turn-lifecycle / working
+ * indicators live in `index.ts` via room_meta over the relay, not here.)
+ *
+ * Broadcast/multicast/broker-addressed envelopes are not ACKed (no single
+ * authoritative recipient or no semantic match). The audit log carries the
+ * ACK status (`received | denied | none`) per envelope.
+ */
+export interface BrokerOptions {
+    server: Server;
+    auditPath?: string;
+    /** Optional callback invoked after each successful route (testing/observability). */
+    onRouted?: (env: Envelope, deliveredTo: string[]) => void;
+}
+/**
+ * Hook the broker calls before doing local routing, so cross-PC prefixes
+ * (`<pc_label>:<peer_name>`) can be handed off to a remote forwarder
+ * without baking transport knowledge into the broker. Wave C (plan/25)
+ * wires `broker_remote.ts` here.
+ */
+export interface RemoteRouter {
+    /**
+     * Try to claim responsibility for routing this envelope cross-PC.
+     * Returns true if claimed (broker MUST NOT also deliver locally). Returns
+     * false if the envelope should fall through to local routing — e.g., the
+     * prefix matches the local `pc_label`, the prefix is not a known remote
+     * label (backward-compat for local names containing `:`), or there's no
+     * prefix at all.
+     */
+    tryRouteOutbound(env: Envelope): boolean;
+    /** Aggregated remote peer addresses (`<pc_label>:<cwd>@<nome>`) for the
+     *  `list_peers` reply's `peers` (string) field. Empty when nothing known. */
+    listRemotePeers(): string[];
+    /** Structured remote roster (plan/38 Fase 2): one `PeerInfo` per cross-PC
+     *  peer with `pc` filled (the sibling label), `cwd`/`name` from the sibling's
+     *  inventory, and `address` prefixed `<pc>:<cwd>@<nome>`. Powers the
+     *  `peers_detailed` half of `list_peers` so clients group by `pc`/`cwd`
+     *  without parsing. Empty when nothing known. */
+    listRemotePeerInfos(): PeerInfo[];
+}
+export interface ConditionalRemoteRouterHost {
+    clearRemoteRouter(expected: RemoteRouter): void;
+}
+/** Local outcome of a cross-PC envelope injection. broker_remote uses this
+ *  to construct the ACK envelope it sends back via the relay. plan/34: `busy`
+ *  is gone — injection always delivers when the peer exists. */
+export type RemoteInjectStatus = "received" | "denied";
+export declare class Broker {
+    private readonly peers;
+    private readonly auditPath?;
+    private readonly onRouted?;
+    private readonly server;
+    /** Plan/25 Wave C: optional handoff for cross-PC routing. Null = local only. */
+    private remoteRouter;
+    constructor(opts: BrokerOptions);
+    /** Attach (or detach with null) a cross-PC router. Idempotent. */
+    setRemoteRouter(router: RemoteRouter | null): void;
+    /** Clear only when the caller still owns the active router slot. */
+    clearRemoteRouter(expected: RemoteRouter): void;
+    /**
+     * Plan/25 Wave C entry point: deliver an envelope that arrived from a
+     * remote PC (via relay forward) into the local UDS mesh. Skips the
+     * `force from = conn.name` rule (that defense is anti-spoof for local
+     * peers; cross-PC has its own defense via the relay's verified `from_pc`).
+     *
+     * Returns the ACK status so the caller (broker_remote) can pack and
+     * forward an ACK envelope back across the relay:
+     *   - `received` — target exists, envelope delivered (plan/34: always
+     *     delivered when the peer is online — the Pi harness enqueues mid-turn
+     *     messages, so there is no busy-drop)
+     *   - `denied` — no such local peer (or write failed) — caller maps to
+     *     transport_error or denied ACK as it sees fit
+     */
+    injectFromRemote(env: Envelope): RemoteInjectStatus;
+    /** Peers currently registered. Snapshot, safe to read. */
+    peerNames(): string[];
+    close(): Promise<void>;
+    private _handleConnection;
+    private _onData;
+    private _handleLine;
+    private _handleRegister;
+    /**
+     * Answer a read-only `list_peers` request from an UNREGISTERED connection
+     * (the `unbien peers` CLI probe). Returns true when the line was such a
+     * probe — the reply is written and the connection stays unregistered: no
+     * name assigned, no `peer_joined`/`peer_left` broadcast, no sibling push, so
+     * querying the roster from the shell never perturbs the mesh. Returns false
+     * (not a probe) so the caller falls through to the register handshake.
+     */
+    private _tryObserverProbe;
+    /** Local UDS peer names plus cross-PC `<pc>:<peer>` entries from the remote
+     *  router (empty when no bridge). Shared by the registered `list_peers`
+     *  handler and the unregistered observer probe. */
+    private _allPeerNames;
+    /** Structured roster of LOCAL UDS peers (plan/38): one `PeerInfo` each, no
+     *  `pc` (they're on this machine). Public so the cross-PC router
+     *  (`broker_remote`) can read the authoritative local inventory directly to
+     *  push to siblings — no `list_peers` round-trip, no stale cache. */
+    localPeerInfos(): PeerInfo[];
+    /** Structured roster (plan/38): local peers (no `pc`) + cross-PC peers with
+     *  `pc`/`cwd`/`name` filled by the remote router (Fase 2). */
+    private _allPeerInfos;
+    /**
+     * Resolve a free `(name, address)` for a register, keyed by **(cwd, name)**
+     * (plan/38): the collision check is on the composed ADDRESS, so a name only
+     * collides with another peer in the SAME cwd. `#N` is appended to the name
+     * (matching the cwd-lock's suffix scheme) until the address is free; for a
+     * legacy peer (cwd "") the address is the name, preserving global-name `#N`.
+     */
+    private _identityForRegister;
+    private _dropPeerAt;
+    private _onClose;
+    private _route;
+    private _resolveTargets;
+    /**
+     * Writes an ACK envelope to the original sender's socket. Synchronous —
+     * the caller is inside `_route` and must keep busy-check/busy-set atomic.
+     * Broker → sender: `from="broker"`, `to=env.from`, `re=env.id`,
+     * `body={type:"ack", status, target}`.
+     */
+    private _sendAckToSender;
+    private _handleBrokerMessage;
+    private _broadcastSystem;
+    private _appendAudit;
+}