@ibgib/core-gib 0.1.58 → 0.1.59

package/src/sync/sync-peer/sync-peer-types.mts

@@ -3,6 +3,7 @@
  */
 
 import { IbGibData_V1, IbGibRel8ns_V1, IbGib_V1 } from '@ibgib/ts-gib/dist/V1/types.mjs';
+import { IbGibAddr } from '@ibgib/ts-gib/dist/types.mjs';
 
 import { SubjectWitness } from '../../common/pubsub/subject/subject-types.mjs';
 import { SyncSagaContextData_V1, SyncSagaContextIbGib_V1, SyncSagaContextRel8ns_V1 } from '../sync-saga-context/sync-saga-context-types.mjs';
@@ -162,6 +163,12 @@ export interface SyncPeerWitness<TInitializeOpts extends InitializeSyncPeerOpts
      */
     payloadIbGibsDomainReceived$: SubjectWitness<IbGib_V1>;
 
+    currentSessionIdentity: KeystoneIbGib_V1 | undefined;
+    /**
+     * convenience getter for {@link currentSessionIdentity}
+     */
+    get currentSessionIdentityAddr(): IbGibAddr | undefined;
+
     /**
      * Pre-connect phase: creates the session keystone (S) locally, evolves
      * `senderIdentity` (I → I1) with a `sync` claim targeting S, and posts
@@ -174,7 +181,7 @@ export interface SyncPeerWitness<TInitializeOpts extends InitializeSyncPeerOpts
      * this reference for the remainder of the saga. The name `newSenderIdentity`
      * (I1) is intentionally scoped only within this method to avoid confusion.
      */
-    establishSessionIdentity(): Promise<KeystoneIbGib_V1 | undefined>;
+    establishSessionIdentity(): Promise<void>;
 
     /**
      * Establishes the connection context.
@@ -184,4 +191,14 @@ export interface SyncPeerWitness<TInitializeOpts extends InitializeSyncPeerOpts
      * @param opts Connection options, including the sagaId for the upcoming sync saga.
      */
     connect(opts?: { sagaId?: string }): Promise<void>;
+
+    // /**
+    //  * Returns the sender's long-lived primary/domain identity.
+    //  */
+    // getSenderIdentity(): KeystoneIbGib_V1 | undefined;
+
+    /**
+     * Evolves the session identity (S_n -> S_n+1) and signs targeting contextAddr.
+     */
+    signContext(opts: { contextAddr: IbGibAddr }): Promise<KeystoneIbGib_V1 | undefined>;
 }

package/src/sync/sync-peer/sync-peer-v1.mts

@@ -7,11 +7,8 @@
 import { extractErrorMsg } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
 import { getIbGibAddr } from '@ibgib/ts-gib/dist/helper.mjs';
 import { IbGib_V1 } from '@ibgib/ts-gib/dist/V1/types.mjs';
-import { IbGibAddr } from '@ibgib/ts-gib/dist/types.mjs';
-import { validateIbGibIntrinsically } from '@ibgib/ts-gib/dist/V1/validate-helper.mjs';
 
 import { GLOBAL_LOG_A_LOT } from '../../core-constants.mjs';
-import { SYNC_MSG_REL8N_NAME, SYNC_SAGA_PAYLOAD_ADDRS_DOMAIN } from '../sync-constants.mjs';
 import { SubjectWitness } from '../../common/pubsub/subject/subject-types.mjs';
 import { SyncSagaContextIbGib_V1 } from '../sync-saga-context/sync-saga-context-types.mjs';
 import {
@@ -19,19 +16,18 @@ import {
     SyncPeerRel8ns_V1, SyncPeerWitness
 } from './sync-peer-types.mjs';
 import { LightWitnessBase_V1 } from '../../witness/light-witness-base-v1.mjs';
-import { IbGibSpaceAny } from '../../witness/space/space-base-v1.mjs';
 import { newupSubject } from '../../common/pubsub/subject/subject-helper.mjs';
-import { authenticateContext, authorizeContext, validateContextAndSagaFrame } from '../sync-saga-context/sync-saga-context-helpers.mjs';
+import { authenticateContextIntrinsically, validateContextAndSagaFrame } from '../sync-saga-context/sync-saga-context-helpers.mjs';
 import { getFromSpace } from '../../witness/space/space-helper.mjs';
 import { getFullSyncSagaHistory, deriveSessionSecret } from '../sync-helpers.mjs';
-import { SyncSagaFrameDependencyGraph } from '../sync-types.mjs';
+import { SessionGenesisFrameDetails, SyncSagaFrameDependencyGraph } from '../sync-types.mjs';
 import { KeystoneService_V1 } from '../../keystone/keystone-service-v1.mjs';
 import { KeystoneIbGib_V1 } from '../../keystone/keystone-types.mjs';
-import { KEYSTONE_VERB_SYNC } from '../../keystone/keystone-constants.mjs';
+import { KEYSTONE_VERB_SYNC, } from '../../keystone/keystone-constants.mjs';
+import { getTjpAddr } from '../../common/other/ibgib-helper.mjs';
+import { IbGibAddr } from '@ibgib/ts-gib/dist/types.mjs';
 
 const logalot = GLOBAL_LOG_A_LOT;
-const logalotControlDomain = false;
-const lcControlDomain = '[ControlDomain]';
 
 
 /**
@@ -54,6 +50,54 @@ export abstract class SyncPeer_V1<
 
     public opts: TInitializeOpts | undefined;
     public payloadIbGibsDomainReceived$!: SubjectWitness<IbGib_V1>;
+    public currentSessionIdentity: KeystoneIbGib_V1 | undefined;
+    public get currentSessionIdentityAddr(): IbGibAddr | undefined {
+        return this.currentSessionIdentity ?
+            getIbGibAddr({ ibGib: this.currentSessionIdentity }) :
+            undefined;
+    }
+
+    // public getSenderIdentity(): KeystoneIbGib_V1 | undefined {
+    //     return this.opts?.senderIdentity;
+    // }
+
+    public async signContext({
+        contextAddr,
+    }: {
+        contextAddr: IbGibAddr;
+    }): Promise<KeystoneIbGib_V1 | undefined> {
+        const lc = `${this.lc}[${this.signContext.name}]`;
+        try {
+            if (!this.currentSessionIdentity) {
+                return undefined;
+            }
+            if (!this.opts) { throw new Error(`opts not initialized. (E: bcf5978aed789b0ebcbdc51971ebe826)`); }
+            const { fnSenderSecret, sagaId, localMetaspace, localSpace } = this.opts;
+            if (!fnSenderSecret) { throw new Error(`fnSenderSecret not initialized. (E: 207fd292a2e8c53c05fd0a74a4ae6d26)`); }
+            if (!sagaId) { throw new Error(`sagaId not initialized. (E: f2e35cc13ed873b638116188119d1826)`); }
+
+            const senderSecret = await fnSenderSecret();
+            const sessionSecret = await deriveSessionSecret({ senderSecret, sagaId });
+
+            const keystoneSvc = new KeystoneService_V1();
+            const evolved = await keystoneSvc.sign({
+                latestKeystone: this.currentSessionIdentity,
+                masterSecret: sessionSecret,
+                claim: {
+                    verb: KEYSTONE_VERB_SYNC,
+                    target: contextAddr,
+                },
+                metaspace: localMetaspace,
+                space: localSpace,
+            });
+
+            this.currentSessionIdentity = evolved;
+            return evolved;
+        } catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            throw error;
+        }
+    }
 
     get classname(): string {
         if (!this.data) { throw new Error(`(UNEXPECTED) this.data falsy? (E: 1ab1841e9338b54f3aa615fa37024826)`); }
@@ -127,7 +171,7 @@ export abstract class SyncPeer_V1<
      * hold a reference for subsequent per-turn signing. The name
      * `newSenderIdentity` (I1) is scoped only within this method.
      */
-    public async establishSessionIdentity(): Promise<KeystoneIbGib_V1 | undefined> {
+    public async establishSessionIdentity(): Promise<void> {
         const lc = `${this.lc}[${this.establishSessionIdentity.name}]`;
         try {
             if (logalot) { console.log(`${lc} starting... (I: f2a1b3c4d5e6f7a8b9c0d1e2f3a4b526)`); }
@@ -141,6 +185,9 @@ export abstract class SyncPeer_V1<
                 if (logalot) { console.log(`${lc} no senderIdentity/fnSenderSecret — skipping establish (I: f29348a77d1542326d14043ea4b69126)`); }
                 return undefined;
             }
+            const senderIdentityAddr = getIbGibAddr({ ibGib: senderIdentity });
+            const senderIdentityTjpAddr = getTjpAddr({ ibGib: senderIdentity });
+            if (!senderIdentityTjpAddr) { throw new Error(`(UNEXPECTED) senderIdentityTjpAddr falsy? (E: d5d8c3ab25a83a2c127904fe96de1526)`); }
 
             if (!sagaId) { throw new Error(`(UNEXPECTED) sagaId falsy? Must be set in initializeOpts before calling establishSessionIdentity. (E: c6ba389d51b8af07d82458f875cf9826)`); }
 
@@ -155,10 +202,19 @@ export abstract class SyncPeer_V1<
             if (!this.opts.sessionConnectPoolConfig) { throw new Error(`(UNEXPECTED) opts.sessionConnectPoolConfig falsy? (E: 3351fd566eb8bbd2f821bb08c4419826)`); }
             if (!this.opts.sessionSyncPoolConfig) { throw new Error(`(UNEXPECTED) opts.sessionSyncPoolConfig falsy? (E: dbffa810d9e7ff6079088deb5b8e7826)`); }
 
+            // session genesis keystone should have soft links to both
+            // targetAddrs and the sender identity that spawned it.
+            const frameDetails: SessionGenesisFrameDetails = {
+                senderIdentityAddr,
+                senderIdentityTjpAddr,
+            }
+            if (this.opts.targetAddrs) {
+                frameDetails.targetAddrs = this.opts.targetAddrs
+            }
             const sessionIdentity = await keystoneSvc.genesis({
                 masterSecret: sessionSecret,
                 configs: [this.opts.sessionConnectPoolConfig, this.opts.sessionSyncPoolConfig],
-                frameDetails: this.opts.targetAddrs ? { targetAddrs: this.opts.targetAddrs } : undefined,
+                frameDetails,
                 metaspace: localMetaspace,
                 space: localSpace,
             });
@@ -179,7 +235,7 @@ export abstract class SyncPeer_V1<
             // Step 3: Post both to the receiver (peer-specific).
             await this.postEstablishToReceiver({ newSenderIdentity, sessionIdentity });
 
-            return sessionIdentity;
+            this.currentSessionIdentity = sessionIdentity;
         } catch (error) {
             console.error(`${lc} ${extractErrorMsg(error)}`);
             throw error;
@@ -257,16 +313,12 @@ export abstract class SyncPeer_V1<
     //     }
     // }
 
-
-
-    protected async authenticateValidateAuthorize({
+    protected async authenticateAndValidate({
         context,
-        fullSagaHistory,
     }: {
         context: SyncSagaContextIbGib_V1,
-        fullSagaHistory: SyncSagaFrameDependencyGraph[],
     }): Promise<void> {
-        const lc = `${this.lc}[${this.authenticateValidateAuthorize.name}]`;
+        const lc = `${this.lc}[${this.authenticateAndValidate.name}]`;
         try {
             if (logalot) { console.log(`${lc} starting... (I: add238055cd84a222c5b8c89913af526)`); }
 
@@ -274,7 +326,8 @@ export abstract class SyncPeer_V1<
             const { localSpace } = this.opts;
 
             // first authenticate, because invalid authn is a non-starter
-            const authenticationErrors = await authenticateContext({
+            // (already validated intrinsically)
+            const authenticationErrors = await authenticateContextIntrinsically({
                 context,
                 space: localSpace,
             });
@@ -288,12 +341,6 @@ export abstract class SyncPeer_V1<
             if (validationErrors.length > 0) {
                 throw new Error(`invalid context received. validationErrors: ${validationErrors} (E: 8b34c875c968af29bc433138e57a7826)`);
             }
-            // we have a valid authentication that points to a valid context,
-            // but what exactly is authorized ?
-            const authorizationErrors = await authorizeContext({ context, fullSagaHistory });
-            if (authorizationErrors.length > 0) {
-                throw new Error(`invalid context authorization. authorizationErrors: ${authorizationErrors} (E: 8ddc284a758cf10ba829334c1babb826)`);
-            }
         } catch (error) {
             console.error(`${lc} ${extractErrorMsg(error)}`);
             throw error;
@@ -361,14 +408,12 @@ export abstract class SyncPeer_V1<
             // this is not just happening on the client, but this peer may be
             // the one receiving the context as well.
 
-            const sagaHistory_beforeSend = await getFullSyncSagaHistory({
-                sagaIbGib: context.sagaFrame,
-                space: this.opts.localSpace
-            });
+            // const sagaHistory_beforeSend = await getFullSyncSagaHistory({
+            //     sagaIbGib: context.sagaFrame,
+            //     space: this.opts.localSpace
+            // });
 
-            await this.authenticateValidateAuthorize({
-                context, fullSagaHistory: sagaHistory_beforeSend,
-            });
+            await this.authenticateAndValidate({ context });
 
             // at this point, we have a valid, authenticated, authorized context
 
@@ -389,9 +434,10 @@ export abstract class SyncPeer_V1<
                     space: this.opts.localSpace
                 });
 
-                await this.authenticateValidateAuthorize({
-                    context, fullSagaHistory: sagaHistory_afterSend,
-                });
+                // NOTE: I think this is the wrong place for this, as we must do this in the peer **before** storing any control ibgibs. This needs to be done in the continueSync I _think_ (not sure yet)
+                // await this.authenticateValidateAuthorize({
+                //     context, fullSagaHistory: sagaHistory_afterSend,
+                // });
 
                 return response;
             } else {

package/src/sync/sync-peer/sync-peer-websocket/sync-peer-websocket-constants.mts

@@ -0,0 +1,68 @@
+// #region SyncWebSocketMsgType enum
+
+export const SYNC_WEB_SOCKET_MSG_TYPE_AUTH_CHALLENGE_INIT = 'auth-challenge-init';
+export const SYNC_WEB_SOCKET_MSG_TYPE_AUTH_INIT = 'auth-init';
+export const SYNC_WEB_SOCKET_MSG_TYPE_AUTH_CHALLENGE = 'auth-challenge';
+export const SYNC_WEB_SOCKET_MSG_TYPE_AUTH_PROOF = 'auth-proof';
+export const SYNC_WEB_SOCKET_MSG_TYPE_AUTH_OK = 'auth-ok';
+export const SYNC_WEB_SOCKET_MSG_TYPE_AUTH_FAIL = 'auth-fail';
+export const SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME = 'sync-frame';
+export const SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME_RESPONSE = 'sync-frame-response';
+export const SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME_AUTHENTICATED = 'sync-frame-authenticated';
+export const SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME_RESPONSE_AUTHENTICATED = 'sync-frame-response-authenticated';
+export const SYNC_WEB_SOCKET_MSG_TYPE_DOMAIN_PAYLOAD = 'domain-payload';
+export const SYNC_WEB_SOCKET_MSG_TYPE_SYNC_ERROR = 'sync-error';
+
+/**
+ * Message types transmitted over the stateful WebSocket connection
+ * during a sync saga session handshake and execution.
+ */
+export type SyncWebSocketMsgType =
+    | typeof SYNC_WEB_SOCKET_MSG_TYPE_AUTH_CHALLENGE_INIT
+    | typeof SYNC_WEB_SOCKET_MSG_TYPE_AUTH_INIT
+    | typeof SYNC_WEB_SOCKET_MSG_TYPE_AUTH_CHALLENGE
+    | typeof SYNC_WEB_SOCKET_MSG_TYPE_AUTH_PROOF
+    | typeof SYNC_WEB_SOCKET_MSG_TYPE_AUTH_OK
+    | typeof SYNC_WEB_SOCKET_MSG_TYPE_AUTH_FAIL
+    | typeof SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME
+    | typeof SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME_RESPONSE
+    | typeof SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME_AUTHENTICATED
+    | typeof SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME_RESPONSE_AUTHENTICATED
+    | typeof SYNC_WEB_SOCKET_MSG_TYPE_DOMAIN_PAYLOAD
+    | typeof SYNC_WEB_SOCKET_MSG_TYPE_SYNC_ERROR
+    ;
+
+export const SyncWebSocketMsgType = {
+    /** Sent by server/receiver to trigger connection authentication. */
+    auth_challenge_init: SYNC_WEB_SOCKET_MSG_TYPE_AUTH_CHALLENGE_INIT,
+    /** Sent by client/sender to start the authentication handshake with the target session address. */
+    auth_init: SYNC_WEB_SOCKET_MSG_TYPE_AUTH_INIT,
+    /** Sent by server/receiver with dynamic connect challenges to be solved. */
+    auth_challenge: SYNC_WEB_SOCKET_MSG_TYPE_AUTH_CHALLENGE,
+    /** Sent by client/sender with proof of session keystone evolution solving challenges. */
+    auth_proof: SYNC_WEB_SOCKET_MSG_TYPE_AUTH_PROOF,
+    /** Sent by server/receiver signaling successful challenge resolution and upgrade to active sync. */
+    auth_ok: SYNC_WEB_SOCKET_MSG_TYPE_AUTH_OK,
+    /** Sent when authentication fails. */
+    auth_fail: SYNC_WEB_SOCKET_MSG_TYPE_AUTH_FAIL,
+    /** Sent by client/sender to transmit the next sync transaction context without payload ibgibs. */
+    sync_frame: SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME,
+    /** Sent by server/receiver responding with the next sync transaction context. */
+    sync_frame_response: SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME_RESPONSE,
+    /** Sent by server/receiver after context is validated/authenticated to signal payload transmission. */
+    sync_frame_authenticated: SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME_AUTHENTICATED,
+    /** Sent by client/sender after response context is validated/authenticated to signal payload transmission. */
+    sync_frame_response_authenticated: SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME_RESPONSE_AUTHENTICATED,
+    /** Sent to stream a single domain payload ibgib. */
+    domain_payload: SYNC_WEB_SOCKET_MSG_TYPE_DOMAIN_PAYLOAD,
+    /** Sent when a sync runtime execution error occurs. */
+    sync_error: SYNC_WEB_SOCKET_MSG_TYPE_SYNC_ERROR,
+} satisfies { readonly [key: string]: SyncWebSocketMsgType };
+
+export const SYNC_WEB_SOCKET_MSG_TYPE_VALID_VALUES: SyncWebSocketMsgType[] = Object.values(SyncWebSocketMsgType);
+
+export function isSyncWebSocketMsgType(value: any): value is SyncWebSocketMsgType {
+    return SYNC_WEB_SOCKET_MSG_TYPE_VALID_VALUES.includes(value);
+}
+
+// #endregion SyncWebSocketMsgType enum

package/src/sync/sync-peer/{sync-peer-websocket-receiver → sync-peer-websocket/sync-peer-websocket-receiver}/sync-peer-websocket-receiver-types.mts

@@ -5,8 +5,8 @@ import { IbGib_V1 } from '@ibgib/ts-gib/dist/V1/types.mjs';
 import {
     SyncPeerData_V1, SyncPeerRel8ns_V1, SyncPeerWitness,
     InitializeSyncPeerOpts, ConnectSyncPeerOpts
-} from '../sync-peer-types.mjs';
-import { SyncSagaCoordinator } from '../../sync-saga-coordinator.mjs';
+} from '../../sync-peer-types.mjs';
+import { SyncSagaCoordinator } from '../../../sync-saga-coordinator.mjs';
 
 /**
  * Data for the SyncPeerWebSocketReceiver witness.

package/src/sync/sync-peer/{sync-peer-websocket-receiver → sync-peer-websocket/sync-peer-websocket-receiver}/sync-peer-websocket-receiver-v1.mts

@@ -5,21 +5,25 @@
 import { extractErrorMsg, getUUID } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
 import { getIbGibAddr } from '@ibgib/ts-gib/dist/helper.mjs';
 import { IbGib_V1 } from '@ibgib/ts-gib/dist/V1/types.mjs';
-
-import { GLOBAL_LOG_A_LOT } from '../../../core-constants.mjs';
-import { SyncPeer_V1 } from '../sync-peer-v1.mjs';
-import { SyncSagaContextIbGib_V1 } from '../../sync-saga-context/sync-saga-context-types.mjs';
-import { authenticateContext } from '../../sync-saga-context/sync-saga-context-helpers.mjs';
-import { IbGibSpaceAny } from '../../../witness/space/space-base-v1.mjs';
-import { putInSpace, registerNewIbGib } from '../../../witness/space/space-helper.mjs';
+import { validateIbGibIntrinsically } from '@ibgib/ts-gib/dist/V1/validate-helper.mjs';
+
+import { GLOBAL_LOG_A_LOT } from '../../../../core-constants.mjs';
+import { SyncPeer_V1 } from '../../sync-peer-v1.mjs';
+import { SyncSagaContextIbGib_V1 } from '../../../sync-saga-context/sync-saga-context-types.mjs';
+import { authenticateContextIntrinsically } from '../../../sync-saga-context/sync-saga-context-helpers.mjs';
+import { IbGibSpaceAny } from '../../../../witness/space/space-base-v1.mjs';
+import { putInSpace, registerNewIbGib } from '../../../../witness/space/space-helper.mjs';
 import {
     ConnectSyncPeerWebSocketReceiverOpts,
     InitializeSyncPeerWebSocketReceiverOpts,
     SyncPeerWebSocketReceiverData_V1, SyncPeerWebSocketReceiverRel8ns_V1,
     SyncPeerWebSocketReceiverIbGib_V1
 } from './sync-peer-websocket-receiver-types.mjs';
-import { KeystoneIbGib_V1 } from '../../../keystone/keystone-types.mjs';
+import { KeystoneIbGib_V1 } from '../../../../keystone/keystone-types.mjs';
+import { SyncWebSocketMsgType } from '../sync-peer-websocket-constants.mjs';
 import { SESSION_KEYSTONE_POLICY, verifyConnectProof } from './sync-websocket-peer-helpers.mjs';
+import { getFullSyncSagaHistory } from '../../../sync-helpers.mjs';
+import { toDto } from '../../../../common/other/ibgib-helper.mjs';
 
 const logalot = GLOBAL_LOG_A_LOT || true;
 
@@ -59,6 +63,11 @@ export class SyncPeerWebSocketReceiver_V1
     protected demandedIds?: string[];
     protected sessionS_tjpAddr?: string;
 
+    // Runtime state variables for delayed payload streaming
+    protected pendingContext?: SyncSagaContextIbGib_V1;
+    protected pendingPayloadAddrs?: Set<string>;
+    protected pendingResponsePayloadsToSend: IbGib_V1[] = [];
+
     constructor(
         initialData: SyncPeerWebSocketReceiverData_V1,
         initialRel8ns?: SyncPeerWebSocketReceiverRel8ns_V1,
@@ -79,13 +88,13 @@ export class SyncPeerWebSocketReceiver_V1
         try {
             this.challengeUuid = await getUUID();
             socketWrapper.send(JSON.stringify({
-                type: 'auth-challenge-init',
+                type: SyncWebSocketMsgType.auth_challenge_init,
                 challengeUuid: this.challengeUuid
             }));
         } catch (error) {
             console.error(`${lc} failed triggering challenge init: ${extractErrorMsg(error)}`);
             socketWrapper.send(JSON.stringify({
-                type: 'auth-fail',
+                type: SyncWebSocketMsgType.auth_fail,
                 message: 'Internal server connect error'
             }));
         }
@@ -171,39 +180,90 @@ export class SyncPeerWebSocketReceiver_V1
             }
 
             // 2. Authenticated Runtime Sync Route
-            if (msg.type === 'domain-payload') {
+            if (msg.type === SyncWebSocketMsgType.domain_payload) {
                 const ibGib = msg.ibGib as IbGib_V1;
-                const tempSpace = await this.ensureLocalTempSpace();
-                await putInSpace({ space: tempSpace, ibGibs: [ibGib] });
-            } else if (msg.type === 'sync-frame') {
+                const validationErrors =
+                    await validateIbGibIntrinsically({ ibGib }) ?? [];
+                if (validationErrors.length > 0) {
+                    throw new Error(`controlIbGibs invalid intrinsically. validationErrors: ${validationErrors.join('|')} (E: 5ee1787d4cc53d3d2c55f3d4f2865226)`);
+                }
+
+                if (this.pendingContext && this.pendingPayloadAddrs) {
+                    const addr = getIbGibAddr({ ibGib });
+                    if (this.pendingPayloadAddrs.has(addr)) {
+                        const tempSpace = await this.ensureLocalTempSpace();
+                        await putInSpace({ space: tempSpace, ibGibs: [ibGib] });
+                        this.pendingPayloadAddrs.delete(addr);
+
+                        // If all expected payloads for the pending context are received
+                        if (this.pendingPayloadAddrs.size === 0) {
+                            const context = this.pendingContext;
+                            this.pendingContext = undefined;
+                            this.pendingPayloadAddrs = undefined;
+
+                            await this.executeIncomingSyncRequestAndRespond({ context });
+                        }
+                    } else {
+                        console.warn(`${lc} received payload not in expected list: ${addr}`);
+                    }
+                }
+            } else if (msg.type === SyncWebSocketMsgType.sync_frame) {
                 const context = msg.context as SyncSagaContextIbGib_V1;
 
-                // Process turn through coordinator
-                const responseCtx = await this.handleIncomingSyncRequest({ context });
-
-                if (responseCtx) {
-                    // Send outgoing payload domain ibgibs first
-                    const responsePayloads = responseCtx.payloadIbGibsDomain ?? [];
-                    for (const ibGib of responsePayloads) {
-                        this.socketWrapper.send(JSON.stringify({
-                            type: 'domain-payload',
-                            ibGib
-                        }));
+                // First, validate and authenticate the context
+                const allControlIbGibs: IbGib_V1[] = [
+                    toDto({ ibGib: context }),
+                    context.sagaFrame
+                ];
+                if (context.signedSessionIdentity) {
+                    allControlIbGibs.push(context.signedSessionIdentity);
+                }
+
+                for (const controlIbGib of allControlIbGibs) {
+                    const validationErrors =
+                        await validateIbGibIntrinsically({ ibGib: controlIbGib }) ?? [];
+                    if (validationErrors.length > 0) {
+                        throw new Error(`controlIbGibs invalid intrinsically. validationErrors: ${validationErrors.join('|')} (E: d40dfa87265a0b73c8ef784d1265ea26)`);
                     }
+                }
 
-                    // Send evolved context turn response
+                await this.authenticateAndValidate({ context });
+
+                // Put control ibgibs into durable space immediately for audit trail
+                for (const ibGib of allControlIbGibs) {
+                    await putInSpace({ space: this.opts!.localSpace, ibGibs: [ibGib] });
+                    await registerNewIbGib({ space: this.opts!.localSpace, ibGib });
+                }
+
+                // Check if payloads are expected
+                const expectedPayloadAddrs = context.data?.['@payloadAddrsDomain'] || [];
+                if (expectedPayloadAddrs.length > 0) {
+                    // Set up wait state and request payloads
+                    this.pendingContext = context;
+                    this.pendingPayloadAddrs = new Set(expectedPayloadAddrs);
                     this.socketWrapper.send(JSON.stringify({
-                        type: 'sync-frame-response',
-                        context: responseCtx
+                        type: SyncWebSocketMsgType.sync_frame_authenticated,
+                        contextAddr: getIbGibAddr({ ibGib: context })
                     }));
                 } else {
-                    if (logalot) { console.log(`${lc} synchronization session completed successfully.`); }
+                    // No payloads expected, process immediately
+                    await this.executeIncomingSyncRequestAndRespond({ context });
+                }
+            } else if (msg.type === SyncWebSocketMsgType.sync_frame_response_authenticated) {
+                // Alice authenticated our response context, stream our payloads now
+                const payloads = this.pendingResponsePayloadsToSend || [];
+                this.pendingResponsePayloadsToSend = [];
+                for (const ibGib of payloads) {
+                    this.socketWrapper.send(JSON.stringify({
+                        type: SyncWebSocketMsgType.domain_payload,
+                        ibGib
+                    }));
                 }
             }
         } catch (error) {
             console.error(`${lc} message frame handling failed: ${extractErrorMsg(error)}`);
             this.socketWrapper?.send(JSON.stringify({
-                type: this.isAuthenticated ? 'sync-error' : 'auth-fail',
+                type: this.isAuthenticated ? SyncWebSocketMsgType.sync_error : SyncWebSocketMsgType.auth_fail,
                 message: extractErrorMsg(error)
             }));
         }
@@ -217,7 +277,7 @@ export class SyncPeerWebSocketReceiver_V1
         const metaspace = this.opts!.localMetaspace;
         const space = this.opts!.localSpace;
 
-        if (msg.type === 'auth-init') {
+        if (msg.type === SyncWebSocketMsgType.auth_init) {
             const { sAddr } = msg;
             if (logalot) { console.log(`${lc} auth-init for ${sAddr}`); }
 
@@ -237,12 +297,12 @@ export class SyncPeerWebSocketReceiver_V1
             this.sessionS_tjpAddr = (past && past.length > 0) ? past[0] : getIbGibAddr({ ibGib: authorizedS });
 
             this.socketWrapper!.send(JSON.stringify({
-                type: 'auth-challenge',
+                type: SyncWebSocketMsgType.auth_challenge,
                 challengeUuid: this.challengeUuid,
                 demandedIds: this.demandedIds
             }));
 
-        } else if (msg.type === 'auth-proof') {
+        } else if (msg.type === SyncWebSocketMsgType.auth_proof) {
             const { proofFrame } = msg;
             if (logalot) { console.log(`${lc} verifying auth-proof...`); }
 
@@ -272,7 +332,7 @@ export class SyncPeerWebSocketReceiver_V1
             this.isAuthenticated = true;
 
             this.socketWrapper!.send(JSON.stringify({
-                type: 'auth-ok'
+                type: SyncWebSocketMsgType.auth_ok
             }));
         } else {
             throw new Error(`Unexpected message type ${msg.type} during connect phase (E: f67a0f47f8426c2b01af5bc3d0146b26)`);
@@ -280,57 +340,45 @@ export class SyncPeerWebSocketReceiver_V1
     }
 
     /**
-     * Executes the transaction turn through the local SyncSagaCoordinator.
+     * Executes the incoming sync request through the local SyncSagaCoordinator and sends response.
      */
-    public async handleIncomingSyncRequest({
-        context,
-        payloadIbGibsControl = [],
+    protected async executeIncomingSyncRequestAndRespond({
+        context
     }: {
         context: SyncSagaContextIbGib_V1;
-        payloadIbGibsControl?: IbGib_V1[];
-    }): Promise<SyncSagaContextIbGib_V1 | undefined> {
-        const lc = `${this.lc}[${this.handleIncomingSyncRequest.name}]`;
+    }): Promise<void> {
+        const lc = `${this.lc}[${this.executeIncomingSyncRequestAndRespond.name}]`;
         try {
-            if (logalot) { console.log(`${lc} starting incoming sync turn...`); }
+            if (logalot) { console.log(`${lc} executing incoming sync turn...`); }
 
             if (!this.opts) { throw new Error(`opts not initialized. (E: 0c98186714e85b9a08bb9d98daada826)`); }
             const { localCoordinator, localMetaspace, localSpace } = this.opts;
             const localTempSpace = await this.ensureLocalTempSpace();
 
-            // Put control ibgibs into durable space
-            const allControlIbGibs = [context, ...payloadIbGibsControl];
-            for (const ibGib of allControlIbGibs) {
-                await putInSpace({ space: localSpace, ibGibs: [ibGib] });
-                await registerNewIbGib({ space: localSpace, ibGib });
-            }
-
-            // Authenticate context signature
-            const authErrors = await authenticateContext({
-                context,
-                space: localSpace,
-            });
-            if (authErrors.length > 0) {
-                throw new Error(`Context authentication failed: ${authErrors.join(', ')} (E: 424bd9b03ff8a42df8b1a438ed393726)`);
-            }
-
-            // Put incoming domain payloads into temp space
-            if (context.payloadIbGibsDomain && context.payloadIbGibsDomain.length > 0) {
-                for (const ibGib of context.payloadIbGibsDomain) {
-                    await putInSpace({ space: localTempSpace, ibGibs: [ibGib] });
-                }
-            }
-
-            // Evolve frame and run next coordinator sync turn
             const responseCtx = await localCoordinator.continueSync({
                 sagaContext: context,
                 metaspace: localMetaspace,
                 mySpace: localSpace,
                 myTempSpace: localTempSpace,
+                peer: this,
             });
 
-            return responseCtx || undefined;
+            if (responseCtx) {
+                const responsePayloads = responseCtx.payloadIbGibsDomain ?? [];
+                delete responseCtx.payloadIbGibsDomain;
+
+                // Save payloads to stream once authenticated by Alice
+                this.pendingResponsePayloadsToSend = responsePayloads;
+
+                this.socketWrapper!.send(JSON.stringify({
+                    type: SyncWebSocketMsgType.sync_frame_response,
+                    context: responseCtx
+                }));
+            } else {
+                if (logalot) { console.log(`${lc} synchronization session completed successfully.`); }
+            }
         } catch (error) {
-            console.error(`${lc} handleIncomingSyncRequest turn execution failed: ${extractErrorMsg(error)}`);
+            console.error(`${lc} executeIncomingSyncRequestAndRespond failed: ${extractErrorMsg(error)}`);
             throw error;
         }
     }

package/src/sync/sync-peer/{sync-peer-websocket-receiver → sync-peer-websocket/sync-peer-websocket-receiver}/sync-websocket-peer-helpers.mts

@@ -11,17 +11,17 @@ import { validateIbGibAddr, validateIbGibIntrinsically } from '@ibgib/ts-gib/dis
 import { getGibInfo } from '@ibgib/ts-gib/dist/V1/transforms/transform-helper.mjs';
 import { IbGib_V1 } from '@ibgib/ts-gib/dist/V1/types.mjs';
 
-import { GLOBAL_LOG_A_LOT } from '../../../core-constants.mjs';
+import { GLOBAL_LOG_A_LOT } from '../../../../core-constants.mjs';
 import {
     KeystoneReplenishStrategy, KeystoneChallengeType, KeystoneIbGib_V1,
     KeystoneSolution, KeystoneChallenge
-} from '../../../keystone/keystone-types.mjs';
-import { parseKeystoneIb } from '../../../keystone/keystone-helpers.mjs';
-import { KeystoneStrategyFactory } from '../../../keystone/strategy/keystone-strategy-factory.mjs';
-import { KeystoneService_V1 } from '../../../keystone/keystone-service-v1.mjs';
-import { IbGibSpaceAny } from '../../../witness/space/space-base-v1.mjs';
-import { MetaspaceService } from '../../../witness/space/metaspace/metaspace-types.mjs';
-import { POOL_ID_CONNECT, KEYSTONE_VERB_CONNECT } from '../../../keystone/keystone-constants.mjs';
+} from '../../../../keystone/keystone-types.mjs';
+import { parseKeystoneIb } from '../../../../keystone/keystone-helpers.mjs';
+import { KeystoneStrategyFactory } from '../../../../keystone/strategy/keystone-strategy-factory.mjs';
+import { KeystoneService_V1 } from '../../../../keystone/keystone-service-v1.mjs';
+import { IbGibSpaceAny } from '../../../../witness/space/space-base-v1.mjs';
+import { MetaspaceService } from '../../../../witness/space/metaspace/metaspace-types.mjs';
+import { POOL_ID_CONNECT, KEYSTONE_VERB_CONNECT } from '../../../../keystone/keystone-constants.mjs';
 
 const logalot = GLOBAL_LOG_A_LOT