@ibgib/space-gib 0.0.2 → 0.0.3

package/dist/server/server.mjs

@@ -19065,7 +19065,7 @@ var KeystoneService_V1 = class _KeystoneService_V1 {
   }
 };
 
-// ../../libs/core-gib/dist/sync/sync-peer/sync-peer-websocket-receiver/sync-websocket-peer-helpers.mjs
+// ../../libs/core-gib/dist/sync/sync-peer/sync-peer-websocket/sync-peer-websocket-receiver/sync-websocket-peer-helpers.mjs
 var logalot42 = GLOBAL_LOG_A_LOT2;
 var SESSION_KEYSTONE_POLICY = {
   COMMON: {
@@ -20998,6 +20998,23 @@ async function validateContextAndSagaFrame({ context }) {
     } else {
       errors.push(`context.sagaFrame is falsy. (E: b4edd88f4963f493789f83b29ba2df26)`);
     }
+    if (context.sagaFrameMsg) {
+      const sagaFrameMsgErrors = await validateIbGibIntrinsically({ ibGib: context.sagaFrameMsg }) ?? [];
+      sagaFrameMsgErrors.forEach((x) => errors.push(x));
+      if (context.sagaFrame) {
+        const expectedMsgAddr = context.sagaFrame.rel8ns?.[SYNC_MSG_REL8N_NAME]?.[0];
+        if (expectedMsgAddr) {
+          const actualMsgAddr = getIbGibAddr({ ibGib: context.sagaFrameMsg });
+          if (actualMsgAddr !== expectedMsgAddr) {
+            errors.push(`context.sagaFrameMsg address (${actualMsgAddr}) does not match the stone address referenced in sagaFrame relations (${expectedMsgAddr}). (E: a983b271fcae46bbad7e82098bc24826)`);
+          }
+        } else {
+          errors.push(`context.sagaFrame is missing the message stone relation '${SYNC_MSG_REL8N_NAME}'. (E: da872cf3a8d46dbbad89d0a68d712826)`);
+        }
+      }
+    } else {
+      errors.push(`context.sagaFrameMsg is falsy. (E: ed405a72ab0d8bbdca7b9605d8f9a26)`);
+    }
     if (errors.length > 0) {
       return errors;
     }
@@ -21012,34 +21029,190 @@ async function validateContextAndSagaFrame({ context }) {
     }
   }
 }
-async function authenticateContext({}) {
-  const lc2 = `[${authenticateContext.name}]`;
+async function authenticateContextIntrinsically({
+  context,
+  space
+  // stageInProtocol,
+}) {
+  const lc2 = `[${authenticateContextIntrinsically.name}]`;
   try {
     if (logalot53) {
       console.log(`${lc2} starting... (I: 3c34e8f1d6ef965f98725c88459ea926)`);
     }
-    console.warn(`${lc2}[NAG] not thrown. not implemented right now after removing all identity-related code. (W: e5fad31cfb49eef198a189a82dbcf726)`);
-    return [];
-  } catch (error) {
-    console.error(`${lc2} ${extractErrorMsg(error)}`);
-    throw error;
-  } finally {
-    if (logalot53) {
-      console.log(`${lc2} complete.`);
+    const errors = [];
+    if (!context.data) {
+      throw new Error(`(UNEXPECTED) context.data falsy? (E: 3e4ddd0eb4b828ad489658d88d9a6326)`);
     }
-  }
-}
-async function authorizeContext({ context, fullSagaHistory }) {
-  const lc2 = `[${authorizeContext.name}]`;
-  try {
-    if (logalot53) {
-      console.log(`${lc2} starting... (I: 48c918b41ceec0cd489ca3b8819e6826)`);
+    if (!context.rel8ns) {
+      throw new Error(`(UNEXPECTED) context.rel8ns falsy? (E: 8026589d4fed69c828334ee842074326)`);
     }
-    console.error(`${lc2} NAG ERROR (NOT THROWN): not implemented. authorize business logic (v1 must have this, but later when we are working on admin vs. student)(E: bc3a78f2dab18ab64c36d055a4b50526)`);
-    return [];
+    const { sagaFrame, signedSessionIdentity: currSessionIdentity } = context;
+    if (!sagaFrame.data) {
+      throw new Error(`(UNEXPECTED) sagaFrame.data falsy? (E: b61cc82d25984c92f75db74a5a855b26)`);
+    }
+    if (!currSessionIdentity) {
+      console.error(`${lc2}[NAG][not thrown] sagaFrame.data.sessionIdentityTjpAddr logic needs to be added in coordinator (E: 4fc47800a1086c917a47381824280826)`);
+      if (sagaFrame.data.sessionIdentityTjpAddr) {
+        errors.push("Context has no session identity, but sync saga frame shows a session identity (sagaFrame.data.sessionIdentityTjpAddr is truthy). (E: 69dd6cdc2e1859c0f3d62958c4339826)");
+        return errors;
+      } else if (context.rel8ns.sessionIdentity) {
+        errors.push("Context has no signed session identity, but context.rel8ns.sessionIdentity is truthy. (E: 96a04a8a6c88ea8bf88118f89ad8e326)");
+        return errors;
+      } else {
+        if (logalot53) {
+          console.log(`${lc2} context has no signedSessionIdentity and sync saga frame doesn't state there should be session identity. So nothing further to authenticate - returning early with no authentication errors. (I: d708735f9a2899ee98f762b8a09ed826)`);
+        }
+        return [];
+      }
+    }
+    const currSessionIdentityAddr = getIbGibAddr({ ibGib: currSessionIdentity });
+    const prevSessionIdentityAddrs_accordingToContextRel8ns = context.rel8ns?.sessionIdentity ?? [];
+    if (prevSessionIdentityAddrs_accordingToContextRel8ns.length === 0) {
+      errors.push(`context.rel8ns.sessionIdentity is falsy/empty but context.signedSessionIdentity is present. (E: 66f906421eb2468c0b33f908a3cf2826)`);
+      return errors;
+    }
+    if (prevSessionIdentityAddrs_accordingToContextRel8ns.length > 1) {
+      errors.push(`context.rel8ns.sessionIdentity has multiple identity addrs. (E: 489428bfe6fdaa4cd885b938dc4c5826)`);
+      return errors;
+    }
+    const prevSessionIdentityAddr = prevSessionIdentityAddrs_accordingToContextRel8ns[0];
+    const resGetLatestAddr = await getLatestAddrs({ addrs: [prevSessionIdentityAddr], space });
+    if (!resGetLatestAddr) {
+      throw new Error(`(UNEXPECTED) resGetLatestAddr for prevSessionIdentityAddr in space (${space.ib}) falsy? (E: 7b207e5cbcec9037ea5adbe822ead826)`);
+    }
+    if (!resGetLatestAddr.data) {
+      throw new Error(`(UNEXPECTED) resGetLatestAddr.data for prevSessionIdentityAddr in space (${space.ib}) falsy? (E: de4eb8d730c8c4dcb59c8b9c79277826)`);
+    }
+    if (!resGetLatestAddr.data.success) {
+      throw new Error(`(UNEXPECTED) resGetLatestAddr.data.success falsy? (E: c94298dfd9684ad6a87eb748459aa826)`);
+    }
+    const { latestAddrsMap } = resGetLatestAddr.data;
+    if (!latestAddrsMap) {
+      throw new Error(`(UNEXPECTED) resGetLatestAddr.data.latestAddrsMap falsy? (E: 19f1fd5fe798cf2e5fa923919169d826)`);
+    }
+    if (Object.keys(latestAddrsMap).length !== 1) {
+      throw new Error(`(UNEXPECTED) Object.keys(latestAddrsMap).length !== 1? (E: fe526a0747589c6427a8bcc86da34a26)`);
+    }
+    const prevSessionIdentityAddr_latest = latestAddrsMap[prevSessionIdentityAddr];
+    if (!prevSessionIdentityAddr_latest) {
+      errors.push(`prevSessionIdentityAddr (${prevSessionIdentityAddr}) not found in space (${space.ib}). this should have been the incoming prevSessionIdentityAddr (E: f6d042bd6b54819998653228dee34226)`);
+      return errors;
+    }
+    if (prevSessionIdentityAddr !== prevSessionIdentityAddr_latest) {
+      if (prevSessionIdentityAddr_latest === currSessionIdentityAddr) {
+      } else {
+        errors.push(`context.rel8ns.sessionIdentity does not point to the most recent in the space (${space.ib}). (E: 2f8288f53c87b6aa47bd2178d9df0c26)`);
+        console.log(`context: ${pretty(toDto2({ ibGib: context }))}`);
+        console.log(`prevSessionIdentityAddr (context.rel8ns.sessionIdentity): ${prevSessionIdentityAddr}`);
+        console.log(`prevSessionIdentityAddr_latest: ${prevSessionIdentityAddr_latest}`);
+        console.log(`currSessionIdentity (context.signedSessionIdentity): ${pretty(toDto2({
+          ibGib: {
+            ib: currSessionIdentity.ib,
+            gib: currSessionIdentity.gib,
+            rel8ns: currSessionIdentity.rel8ns,
+            data: {
+              ...currSessionIdentity.data,
+              challengePools: currSessionIdentity.data.challengePools.map((p) => {
+                return { ...p, challenges: {} };
+              })
+            }
+          }
+        }))}`);
+        console.log(`currSessionIdentityAddr: ${currSessionIdentityAddr}`);
+        return errors;
+      }
+    }
+    const resGetPrevSessionIdentity = await getFromSpace({ addr: prevSessionIdentityAddr, space });
+    if (!resGetPrevSessionIdentity.success || resGetPrevSessionIdentity.ibGibs?.length !== 1) {
+      errors.push(`could not fetch latest sender identity ${prevSessionIdentityAddr} from space (${space.ib}). (E: fd48c3e64c9fa4efd8a1f8280af18226)`);
+      return errors;
+    }
+    const prevSessionIdentity = resGetPrevSessionIdentity.ibGibs[0];
+    const sessionIdentityTjp = await getTjpIbGib({ ibGib: prevSessionIdentity, naive: true, space });
+    if (!sessionIdentityTjp) {
+      throw new Error(`(UNEXPECTED) couldn't get sessionIdentityTjp in space (${space.ib})? we have already gotten the identity itself in the space, so we would expect the entire timeline to exist in it. (E: 9be0382ff1c8a0e77645ea38c096f826)`);
+    }
+    const sessionIdentityTjpAddr = getIbGibAddr({ ibGib: sessionIdentityTjp });
+    if (sessionIdentityTjpAddr !== sagaFrame.data.sessionIdentityTjpAddr) {
+      throw new Error(`(UNEXPECTED) sessionIdentityTjpAddr !== sagaFrame.data.sessionIdentityTjpAddr? (E: c9a4ad5c2728fe38e86afc58e4abaf26)`);
+    }
+    const sessionGenesisFrameDetails = sessionIdentityTjp.data.frameDetails;
+    if (!sessionGenesisFrameDetails) {
+      errors.push(`Invalid session identity tjp: sessionIdentityTjp.data.frameDetails is falsy. (E: 0187f8f804a84256281720586620b826)`);
+      return errors;
+    }
+    const { senderIdentityAddr, senderIdentityTjpAddr } = sessionGenesisFrameDetails;
+    if (!senderIdentityAddr) {
+      throw new Error(`sessionGenesisFrameDetails.senderIdentityAddr falsy (E: 02a0c80a3ead9e3af8af4cf3b156e826)`);
+    }
+    if (!senderIdentityTjpAddr) {
+      throw new Error(`sessionGenesisFrameDetails.senderIdentityTjpAddr falsy (E: 271928090ff5dc56d4bb63d8d5c68826)`);
+    }
+    const resGetLatestAddr_senderIdentity = await getLatestAddrs({ addrs: [senderIdentityTjpAddr, senderIdentityAddr], space });
+    if (!resGetLatestAddr_senderIdentity) {
+      throw new Error(`(UNEXPECTED) resGetLatestAddr_senderIdentity for prevSessionIdentityAddr in space (${space.ib}) falsy? (E: 2e4ae8083b6fb7cbb8fae2a519062926)`);
+    }
+    if (!resGetLatestAddr_senderIdentity.data) {
+      throw new Error(`(UNEXPECTED) resGetLatestAddr_senderIdentity.data for prevSessionIdentityAddr in space (${space.ib}) falsy? (E: 2e231850c2a898cc282b4b2841056826)`);
+    }
+    if (!resGetLatestAddr_senderIdentity.data.success) {
+      throw new Error(`(UNEXPECTED) resGetLatestAddr_senderIdentity.data.success falsy? (E: e93508f03e0475925875b00746ffd826)`);
+    }
+    const { latestAddrsMap: latestAddrsMap_senderIdentity } = resGetLatestAddr_senderIdentity.data;
+    if (!latestAddrsMap_senderIdentity) {
+      throw new Error(`(UNEXPECTED) resGetLatestAddr_senderIdentity.data.latestAddrsMap falsy? (E: 87a91e3f9968ad9ba79cdfe8cd878326)`);
+    }
+    if (Object.keys(latestAddrsMap_senderIdentity).length !== 2 && senderIdentityTjpAddr !== senderIdentityAddr) {
+      throw new Error(`(UNEXPECTED) Object.keys(latestAddrsMap_senderIdentity).length !== 2 && senderIdentityTjpAddr !== senderIdentityAddr? (E: fe46bd584853d8e1e8e2d11f52012826)`);
+    }
+    const senderIdentityTjpAddr_latest = latestAddrsMap_senderIdentity[senderIdentityTjpAddr];
+    const senderIdentityAddr_latest = latestAddrsMap_senderIdentity[senderIdentityAddr];
+    if (!senderIdentityAddr_latest) {
+      throw new Error(`(UNEXPECTED) senderIdentityAddr_latest falsy? (E: e151798ae2e9241578d09948937c4b26)`);
+    }
+    if (senderIdentityTjpAddr_latest !== senderIdentityAddr_latest) {
+      throw new Error(`senderIdentityTjpAddr_latest !== senderIdentityAddr_latest (E: 52478a1053589e72665031a853cc1826)`);
+    }
+    const resGetSenderIdentity_latest = await getFromSpace({
+      addr: senderIdentityAddr_latest,
+      space
+    });
+    if (!resGetSenderIdentity_latest.success || resGetSenderIdentity_latest.ibGibs?.length !== 1) {
+      errors.push(`could not fetch latest sender identity ${prevSessionIdentityAddr} from space (${space.ib}). (E: 3565ff0ed458f5a2384c40b16e849826)`);
+      return errors;
+    }
+    const senderIdentity_latest = resGetSenderIdentity_latest.ibGibs[0];
+    if (!senderIdentity_latest.data.proofs) {
+      errors.push(`Invalid sender identity. Proofs empty/falsy. (E: ebf488853061614d2b5b137828119526)`);
+      return errors;
+    }
+    const syncClaim = senderIdentity_latest.data.proofs.find((p) => p.claim.verb === KEYSTONE_VERB_SYNC)?.claim;
+    if (!syncClaim) {
+      errors.push(`Most recent senderIdentity has no proof whose claim.verb === ${KEYSTONE_VERB_SYNC}. (E: b0f488ecccbbfe43d9a0b7c8a29d7826)`);
+      return errors;
+    }
+    if (syncClaim.target !== sessionIdentityTjpAddr) {
+      errors.push(`Most recent sender identity claim has claim.verb === ${KEYSTONE_VERB_SYNC} but DOES NOT target expected session identity addr ${prevSessionIdentityAddr}. (E: 3e7f18d99848969be8586423d5ccb826)`);
+      return errors;
+    }
+    const keystoneSvc = new KeystoneService_V1();
+    const transitionErrors = await keystoneSvc.validate({
+      currentIbGib: currSessionIdentity,
+      prevIbGib: prevSessionIdentity
+    });
+    if (transitionErrors.length > 0) {
+      errors.push(`Invalid session identity transition: ${transitionErrors.join(", ")} (E: da1c81c6d3c86aec3254f48fe7514226)`);
+    }
+    const contextAddr = getIbGibAddr({ ibGib: context });
+    const targetsThisContext = currSessionIdentity.data?.proofs?.some((p) => p.claim.target === contextAddr);
+    if (!targetsThisContext) {
+      errors.push(`Session identity signature does not target current context ibgib (${contextAddr}). (E: acae68938c287178c878d1b88bebb826)`);
+    }
+    return errors;
   } catch (error) {
-    console.error(`${lc2} ${extractErrorMsg(error)}`);
-    throw error;
+    const emsg = `${lc2} ${extractErrorMsg(error)}`;
+    console.error(emsg);
+    return [`authentication produced an error: ${emsg} (E: 45e014b82af81993d936611ca6fc4d26)`];
   } finally {
     if (logalot53) {
       console.log(`${lc2} complete.`);
@@ -21053,6 +21226,90 @@ var SyncPeer_V1 = class _SyncPeer_V1 extends LightWitnessBase_V1 {
   lc = `[${_SyncPeer_V1.name}]`;
   opts;
   payloadIbGibsDomainReceived$;
+  currentSessionIdentity;
+  get currentSessionIdentityAddr() {
+    return this.currentSessionIdentity ? getIbGibAddr({ ibGib: this.currentSessionIdentity }) : void 0;
+  }
+  // public getSenderIdentity(): KeystoneIbGib_V1 | undefined {
+  //     return this.opts?.senderIdentity;
+  // }
+  async signContext({ contextAddr }) {
+    const lc2 = `${this.lc}[${this.signContext.name}]`;
+    try {
+      if (!this.currentSessionIdentity) {
+        return void 0;
+      }
+      if (!this.opts) {
+        throw new Error(`opts not initialized. (E: bcf5978aed789b0ebcbdc51971ebe826)`);
+      }
+      const { fnSenderSecret, sagaId, localMetaspace, localSpace } = this.opts;
+      if (!fnSenderSecret) {
+        throw new Error(`fnSenderSecret not initialized. (E: 207fd292a2e8c53c05fd0a74a4ae6d26)`);
+      }
+      if (!sagaId) {
+        throw new Error(`sagaId not initialized. (E: f2e35cc13ed873b638116188119d1826)`);
+      }
+      const senderSecret = await fnSenderSecret();
+      const sessionSecret = await deriveSessionSecret({ senderSecret, sagaId });
+      const keystoneSvc = new KeystoneService_V1();
+      const evolved = await keystoneSvc.sign({
+        latestKeystone: this.currentSessionIdentity,
+        masterSecret: sessionSecret,
+        claim: {
+          verb: KEYSTONE_VERB_SYNC,
+          target: contextAddr
+        },
+        metaspace: localMetaspace,
+        space: localSpace
+      });
+      this.currentSessionIdentity = evolved;
+      return evolved;
+    } catch (error) {
+      console.error(`${lc2} ${extractErrorMsg(error)}`);
+      throw error;
+    }
+  }
+  /**
+  * Evolves the session identity (S_n -> S_n+1) solving the demanded connect challenges.
+  */
+  async signContextConnect({ challengeUuid, demandedIds }) {
+    const lc2 = `${this.lc}[${this.signContextConnect.name}]`;
+    try {
+      if (!this.currentSessionIdentity) {
+        return void 0;
+      }
+      if (!this.opts) {
+        throw new Error(`opts not initialized. (E: bcf5978aed789b0ebcbdc51971ebe826)`);
+      }
+      const { fnSenderSecret, sagaId, localMetaspace, localSpace } = this.opts;
+      if (!fnSenderSecret) {
+        throw new Error(`fnSenderSecret not initialized. (E: 207fd292a2e8c53c05fd0a74a4ae6d26)`);
+      }
+      if (!sagaId) {
+        throw new Error(`sagaId not initialized. (E: f2e35cc13ed873b638116188119d1826)`);
+      }
+      const senderSecret = await fnSenderSecret();
+      const sessionSecret = await deriveSessionSecret({ senderSecret, sagaId });
+      const keystoneSvc = new KeystoneService_V1();
+      const evolved = await keystoneSvc.sign({
+        latestKeystone: this.currentSessionIdentity,
+        masterSecret: sessionSecret,
+        poolId: POOL_ID_CONNECT,
+        requiredChallengeIds: demandedIds,
+        claim: {
+          verb: KEYSTONE_VERB_CONNECT,
+          target: challengeUuid
+        },
+        metaspace: localMetaspace,
+        space: localSpace
+      });
+      this.currentSessionIdentity = evolved;
+      return evolved;
+    } catch (error) {
+      console.error(`${lc2} ${extractErrorMsg(error)}`);
+      throw error;
+    }
+  }
   get classname() {
     if (!this.data) {
       throw new Error(`(UNEXPECTED) this.data falsy? (E: 1ab1841e9338b54f3aa615fa37024826)`);
@@ -21124,6 +21381,11 @@ var SyncPeer_V1 = class _SyncPeer_V1 extends LightWitnessBase_V1 {
         }
         return void 0;
       }
+      const senderIdentityAddr = getIbGibAddr({ ibGib: senderIdentity });
+      const senderIdentityTjpAddr = getTjpAddr({ ibGib: senderIdentity });
+      if (!senderIdentityTjpAddr) {
+        throw new Error(`(UNEXPECTED) senderIdentityTjpAddr falsy? (E: d5d8c3ab25a83a2c127904fe96de1526)`);
+      }
       if (!sagaId) {
         throw new Error(`(UNEXPECTED) sagaId falsy? Must be set in initializeOpts before calling establishSessionIdentity. (E: c6ba389d51b8af07d82458f875cf9826)`);
       }
@@ -21139,10 +21401,17 @@ var SyncPeer_V1 = class _SyncPeer_V1 extends LightWitnessBase_V1 {
       if (!this.opts.sessionSyncPoolConfig) {
         throw new Error(`(UNEXPECTED) opts.sessionSyncPoolConfig falsy? (E: dbffa810d9e7ff6079088deb5b8e7826)`);
       }
+      const frameDetails = {
+        senderIdentityAddr,
+        senderIdentityTjpAddr
+      };
+      if (this.opts.targetAddrs) {
+        frameDetails.targetAddrs = this.opts.targetAddrs;
+      }
       const sessionIdentity = await keystoneSvc.genesis({
         masterSecret: sessionSecret,
         configs: [this.opts.sessionConnectPoolConfig, this.opts.sessionSyncPoolConfig],
-        frameDetails: this.opts.targetAddrs ? { targetAddrs: this.opts.targetAddrs } : void 0,
+        frameDetails,
         metaspace: localMetaspace,
         space: localSpace
       });
@@ -21158,7 +21427,7 @@ var SyncPeer_V1 = class _SyncPeer_V1 extends LightWitnessBase_V1 {
         space: localSpace
       });
       await this.postEstablishToReceiver({ newSenderIdentity, sessionIdentity });
-      return sessionIdentity;
+      this.currentSessionIdentity = sessionIdentity;
     } catch (error) {
       console.error(`${lc2} ${extractErrorMsg(error)}`);
       throw error;
@@ -21231,8 +21500,8 @@ var SyncPeer_V1 = class _SyncPeer_V1 extends LightWitnessBase_V1 {
   //         if (logalot) { console.log(`${lc} complete.`); }
   //     }
   // }
-  async authenticateValidateAuthorize({ context, fullSagaHistory }) {
-    const lc2 = `${this.lc}[${this.authenticateValidateAuthorize.name}]`;
+  async authenticateAndValidate({ context }) {
+    const lc2 = `${this.lc}[${this.authenticateAndValidate.name}]`;
     try {
       if (logalot54) {
         console.log(`${lc2} starting... (I: add238055cd84a222c5b8c89913af526)`);
@@ -21241,7 +21510,7 @@ var SyncPeer_V1 = class _SyncPeer_V1 extends LightWitnessBase_V1 {
         throw new Error(`(UNEXPECTED) opts falsy in authenticateValidateAuthorize (E: b7e5a8ad99d84e1ba8d8f7facd288826)`);
       }
       const { localSpace } = this.opts;
-      const authenticationErrors = await authenticateContext({
+      const authenticationErrors = await authenticateContextIntrinsically({
         context,
         space: localSpace
       });
@@ -21252,10 +21521,6 @@ var SyncPeer_V1 = class _SyncPeer_V1 extends LightWitnessBase_V1 {
       if (validationErrors.length > 0) {
         throw new Error(`invalid context received. validationErrors: ${validationErrors} (E: 8b34c875c968af29bc433138e57a7826)`);
       }
-      const authorizationErrors = await authorizeContext({ context, fullSagaHistory });
-      if (authorizationErrors.length > 0) {
-        throw new Error(`invalid context authorization. authorizationErrors: ${authorizationErrors} (E: 8ddc284a758cf10ba829334c1babb826)`);
-      }
     } catch (error) {
       console.error(`${lc2} ${extractErrorMsg(error)}`);
       throw error;
@@ -21286,24 +21551,13 @@ var SyncPeer_V1 = class _SyncPeer_V1 extends LightWitnessBase_V1 {
       if (!context.sagaFrame) {
         throw new Error(`context.sagaFrame falsy. (E: a33dd88aa108e2bad9e885885731ce26)`);
       }
-      const sagaHistory_beforeSend = await getFullSyncSagaHistory({
-        sagaIbGib: context.sagaFrame,
-        space: this.opts.localSpace
-      });
-      await this.authenticateValidateAuthorize({
-        context,
-        fullSagaHistory: sagaHistory_beforeSend
-      });
+      await this.authenticateAndValidate({ context });
       const response = await this.sendContextRequest(context);
       if (response) {
         const sagaHistory_afterSend = await getFullSyncSagaHistory({
           sagaIbGib: context.sagaFrame,
           space: this.opts.localSpace
         });
-        await this.authenticateValidateAuthorize({
-          context,
-          fullSagaHistory: sagaHistory_afterSend
-        });
         return response;
       } else {
         if (logalot54) {
@@ -21354,7 +21608,48 @@ var SyncPeer_V1 = class _SyncPeer_V1 extends LightWitnessBase_V1 {
   }
 };
 
-// ../../libs/core-gib/dist/sync/sync-peer/sync-peer-websocket-receiver/sync-peer-websocket-receiver-v1.mjs
+// ../../libs/core-gib/dist/sync/sync-peer/sync-peer-websocket/sync-peer-websocket-constants.mjs
+var SYNC_WEB_SOCKET_MSG_TYPE_AUTH_CHALLENGE_INIT = "auth-challenge-init";
+var SYNC_WEB_SOCKET_MSG_TYPE_AUTH_INIT = "auth-init";
+var SYNC_WEB_SOCKET_MSG_TYPE_AUTH_CHALLENGE = "auth-challenge";
+var SYNC_WEB_SOCKET_MSG_TYPE_AUTH_PROOF = "auth-proof";
+var SYNC_WEB_SOCKET_MSG_TYPE_AUTH_OK = "auth-ok";
+var SYNC_WEB_SOCKET_MSG_TYPE_AUTH_FAIL = "auth-fail";
+var SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME = "sync-frame";
+var SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME_RESPONSE = "sync-frame-response";
+var SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME_AUTHENTICATED = "sync-frame-authenticated";
+var SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME_RESPONSE_AUTHENTICATED = "sync-frame-response-authenticated";
+var SYNC_WEB_SOCKET_MSG_TYPE_DOMAIN_PAYLOAD = "domain-payload";
+var SYNC_WEB_SOCKET_MSG_TYPE_SYNC_ERROR = "sync-error";
+var SyncWebSocketMsgType = {
+  /** Sent by server/receiver to trigger connection authentication. */
+  auth_challenge_init: SYNC_WEB_SOCKET_MSG_TYPE_AUTH_CHALLENGE_INIT,
+  /** Sent by client/sender to start the authentication handshake with the target session address. */
+  auth_init: SYNC_WEB_SOCKET_MSG_TYPE_AUTH_INIT,
+  /** Sent by server/receiver with dynamic connect challenges to be solved. */
+  auth_challenge: SYNC_WEB_SOCKET_MSG_TYPE_AUTH_CHALLENGE,
+  /** Sent by client/sender with proof of session keystone evolution solving challenges. */
+  auth_proof: SYNC_WEB_SOCKET_MSG_TYPE_AUTH_PROOF,
+  /** Sent by server/receiver signaling successful challenge resolution and upgrade to active sync. */
+  auth_ok: SYNC_WEB_SOCKET_MSG_TYPE_AUTH_OK,
+  /** Sent when authentication fails. */
+  auth_fail: SYNC_WEB_SOCKET_MSG_TYPE_AUTH_FAIL,
+  /** Sent by client/sender to transmit the next sync transaction context without payload ibgibs. */
+  sync_frame: SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME,
+  /** Sent by server/receiver responding with the next sync transaction context. */
+  sync_frame_response: SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME_RESPONSE,
+  /** Sent by server/receiver after context is validated/authenticated to signal payload transmission. */
+  sync_frame_authenticated: SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME_AUTHENTICATED,
+  /** Sent by client/sender after response context is validated/authenticated to signal payload transmission. */
+  sync_frame_response_authenticated: SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME_RESPONSE_AUTHENTICATED,
+  /** Sent to stream a single domain payload ibgib. */
+  domain_payload: SYNC_WEB_SOCKET_MSG_TYPE_DOMAIN_PAYLOAD,
+  /** Sent when a sync runtime execution error occurs. */
+  sync_error: SYNC_WEB_SOCKET_MSG_TYPE_SYNC_ERROR
+};
+var SYNC_WEB_SOCKET_MSG_TYPE_VALID_VALUES = Object.values(SyncWebSocketMsgType);
+
+// ../../libs/core-gib/dist/sync/sync-peer/sync-peer-websocket/sync-peer-websocket-receiver/sync-peer-websocket-receiver-v1.mjs
 var logalot55 = GLOBAL_LOG_A_LOT2 || true;
 var SyncPeerWebSocketReceiver_V1 = class _SyncPeerWebSocketReceiver_V1 extends SyncPeer_V1 {
   lc = `[${_SyncPeerWebSocketReceiver_V1.name}]`;
@@ -21367,6 +21662,10 @@ var SyncPeerWebSocketReceiver_V1 = class _SyncPeerWebSocketReceiver_V1 extends S
   challengeUuid;
   demandedIds;
   sessionS_tjpAddr;
+  // Runtime state variables for delayed payload streaming
+  pendingContext;
+  pendingPayloadAddrs;
+  pendingResponsePayloadsToSend = [];
   constructor(initialData, initialRel8ns) {
     super(initialData, initialRel8ns);
   }
@@ -21381,13 +21680,13 @@ var SyncPeerWebSocketReceiver_V1 = class _SyncPeerWebSocketReceiver_V1 extends S
     try {
       this.challengeUuid = await getUUID();
       socketWrapper.send(JSON.stringify({
-        type: "auth-challenge-init",
+        type: SyncWebSocketMsgType.auth_challenge_init,
         challengeUuid: this.challengeUuid
       }));
     } catch (error) {
       console.error(`${lc2} failed triggering challenge init: ${extractErrorMsg(error)}`);
       socketWrapper.send(JSON.stringify({
-        type: "auth-fail",
+        type: SyncWebSocketMsgType.auth_fail,
         message: "Internal server connect error"
       }));
     }
@@ -21459,37 +21758,82 @@ var SyncPeerWebSocketReceiver_V1 = class _SyncPeerWebSocketReceiver_V1 extends S
         await this.handleConnectFrame(msg);
         return;
       }
-      if (msg.type === "domain-payload") {
+      if (msg.type === SyncWebSocketMsgType.domain_payload) {
         const ibGib = msg.ibGib;
-        const tempSpace = await this.ensureLocalTempSpace();
-        await putInSpace({ space: tempSpace, ibGibs: [ibGib] });
-      } else if (msg.type === "sync-frame") {
+        const validationErrors = await validateIbGibIntrinsically({ ibGib }) ?? [];
+        if (validationErrors.length > 0) {
+          throw new Error(`controlIbGibs invalid intrinsically. validationErrors: ${validationErrors.join("|")} (E: 5ee1787d4cc53d3d2c55f3d4f2865226)`);
+        }
+        if (this.pendingContext && this.pendingPayloadAddrs) {
+          const addr = getIbGibAddr({ ibGib });
+          if (this.pendingPayloadAddrs.has(addr)) {
+            const tempSpace = await this.ensureLocalTempSpace();
+            await putInSpace({ space: tempSpace, ibGibs: [ibGib] });
+            this.pendingPayloadAddrs.delete(addr);
+            if (this.pendingPayloadAddrs.size === 0) {
+              const context = this.pendingContext;
+              this.pendingContext = void 0;
+              this.pendingPayloadAddrs = void 0;
+              await this.executeIncomingSyncRequestAndRespond({ context });
+            }
+          } else {
+            console.warn(`${lc2} received payload not in expected list: ${addr}`);
+          }
+        }
+      } else if (msg.type === SyncWebSocketMsgType.sync_frame) {
         const context = msg.context;
-        const responseCtx = await this.handleIncomingSyncRequest({ context });
-        if (responseCtx) {
-          const responsePayloads = responseCtx.payloadIbGibsDomain ?? [];
-          for (const ibGib of responsePayloads) {
-            this.socketWrapper.send(JSON.stringify({
-              type: "domain-payload",
-              ibGib
-            }));
+        const allControlIbGibs = [
+          toDto2({ ibGib: context }),
+          context.sagaFrame,
+          context.sagaFrameMsg
+        ];
+        if (context.signedSessionIdentity) {
+          allControlIbGibs.push(context.signedSessionIdentity);
+        }
+        for (const controlIbGib of allControlIbGibs) {
+          const validationErrors = await validateIbGibIntrinsically({ ibGib: controlIbGib }) ?? [];
+          if (validationErrors.length > 0) {
+            throw new Error(`controlIbGibs invalid intrinsically. validationErrors: ${validationErrors.join("|")} (E: d40dfa87265a0b73c8ef784d1265ea26)`);
           }
+        }
+        await this.authenticateAndValidate({ context });
+        for (const ibGib of allControlIbGibs) {
+          await putInSpace({ space: this.opts.localSpace, ibGibs: [ibGib] });
+          await registerNewIbGib({ space: this.opts.localSpace, ibGib });
+        }
+        const expectedPayloadAddrs = context.data?.["@payloadAddrsDomain"] || [];
+        if (expectedPayloadAddrs.length > 0) {
+          this.pendingContext = context;
+          this.pendingPayloadAddrs = new Set(expectedPayloadAddrs);
           this.socketWrapper.send(JSON.stringify({
-            type: "sync-frame-response",
-            context: responseCtx
+            type: SyncWebSocketMsgType.sync_frame_authenticated,
+            contextAddr: getIbGibAddr({ ibGib: context })
           }));
         } else {
-          if (logalot55) {
-            console.log(`${lc2} synchronization session completed successfully.`);
-          }
+          await this.executeIncomingSyncRequestAndRespond({ context });
+        }
+      } else if (msg.type === SyncWebSocketMsgType.sync_frame_response_authenticated) {
+        const payloads = this.pendingResponsePayloadsToSend || [];
+        this.pendingResponsePayloadsToSend = [];
+        for (const ibGib of payloads) {
+          this.socketWrapper.send(JSON.stringify({
+            type: SyncWebSocketMsgType.domain_payload,
+            ibGib
+          }));
         }
       }
     } catch (error) {
       console.error(`${lc2} message frame handling failed: ${extractErrorMsg(error)}`);
-      this.socketWrapper?.send(JSON.stringify({
-        type: this.isAuthenticated ? "sync-error" : "auth-fail",
-        message: extractErrorMsg(error)
-      }));
+      try {
+        this.socketWrapper?.send(JSON.stringify({
+          type: this.isAuthenticated ? SyncWebSocketMsgType.sync_error : SyncWebSocketMsgType.auth_fail,
+          message: extractErrorMsg(error)
+        }));
+      } catch (nestedError) {
+        console.error(`${lc2}[nested catch] failed to send error frame: ${extractErrorMsg(nestedError)}`);
+      } finally {
+        this.socketWrapper?.close();
+      }
     }
   }
   /**
@@ -21499,7 +21843,7 @@ var SyncPeerWebSocketReceiver_V1 = class _SyncPeerWebSocketReceiver_V1 extends S
     const lc2 = `${this.lc}[${this.handleConnectFrame.name}]`;
     const metaspace = this.opts.localMetaspace;
     const space = this.opts.localSpace;
-    if (msg.type === "auth-init") {
+    if (msg.type === SyncWebSocketMsgType.auth_init) {
       const { sAddr } = msg;
       if (logalot55) {
         console.log(`${lc2} auth-init for ${sAddr}`);
@@ -21514,11 +21858,11 @@ var SyncPeerWebSocketReceiver_V1 = class _SyncPeerWebSocketReceiver_V1 extends S
       const past = authorizedS.rel8ns?.past;
       this.sessionS_tjpAddr = past && past.length > 0 ? past[0] : getIbGibAddr({ ibGib: authorizedS });
       this.socketWrapper.send(JSON.stringify({
-        type: "auth-challenge",
+        type: SyncWebSocketMsgType.auth_challenge,
         challengeUuid: this.challengeUuid,
         demandedIds: this.demandedIds
       }));
-    } else if (msg.type === "auth-proof") {
+    } else if (msg.type === SyncWebSocketMsgType.auth_proof) {
       const { proofFrame } = msg;
       if (logalot55) {
         console.log(`${lc2} verifying auth-proof...`);
@@ -21538,57 +21882,54 @@ var SyncPeerWebSocketReceiver_V1 = class _SyncPeerWebSocketReceiver_V1 extends S
         demandedIds: this.demandedIds
       });
       await metaspace.put({ ibGibs: [proofFrame], space });
+      await metaspace.registerNewIbGib({ ibGib: proofFrame, space });
       if (logalot55) {
         console.log(`${lc2} connect validation successful! Connection upgraded to active sync session.`);
       }
       this.isAuthenticated = true;
       this.socketWrapper.send(JSON.stringify({
-        type: "auth-ok"
+        type: SyncWebSocketMsgType.auth_ok
       }));
     } else {
       throw new Error(`Unexpected message type ${msg.type} during connect phase (E: f67a0f47f8426c2b01af5bc3d0146b26)`);
     }
   }
   /**
-   * Executes the transaction turn through the local SyncSagaCoordinator.
+   * Executes the incoming sync request through the local SyncSagaCoordinator and sends response.
    */
-  async handleIncomingSyncRequest({ context, payloadIbGibsControl = [] }) {
-    const lc2 = `${this.lc}[${this.handleIncomingSyncRequest.name}]`;
+  async executeIncomingSyncRequestAndRespond({ context }) {
+    const lc2 = `${this.lc}[${this.executeIncomingSyncRequestAndRespond.name}]`;
     try {
       if (logalot55) {
-        console.log(`${lc2} starting incoming sync turn...`);
+        console.log(`${lc2} executing incoming sync turn...`);
       }
       if (!this.opts) {
         throw new Error(`opts not initialized. (E: 0c98186714e85b9a08bb9d98daada826)`);
       }
       const { localCoordinator, localMetaspace, localSpace } = this.opts;
       const localTempSpace = await this.ensureLocalTempSpace();
-      const allControlIbGibs = [context, ...payloadIbGibsControl];
-      for (const ibGib of allControlIbGibs) {
-        await putInSpace({ space: localSpace, ibGibs: [ibGib] });
-        await registerNewIbGib({ space: localSpace, ibGib });
-      }
-      const authErrors = await authenticateContext({
-        context,
-        space: localSpace
-      });
-      if (authErrors.length > 0) {
-        throw new Error(`Context authentication failed: ${authErrors.join(", ")} (E: 424bd9b03ff8a42df8b1a438ed393726)`);
-      }
-      if (context.payloadIbGibsDomain && context.payloadIbGibsDomain.length > 0) {
-        for (const ibGib of context.payloadIbGibsDomain) {
-          await putInSpace({ space: localTempSpace, ibGibs: [ibGib] });
-        }
-      }
       const responseCtx = await localCoordinator.continueSync({
         sagaContext: context,
         metaspace: localMetaspace,
         mySpace: localSpace,
-        myTempSpace: localTempSpace
+        myTempSpace: localTempSpace,
+        peer: this
       });
-      return responseCtx || void 0;
+      if (responseCtx) {
+        const responsePayloads = responseCtx.payloadIbGibsDomain ?? [];
+        delete responseCtx.payloadIbGibsDomain;
+        this.pendingResponsePayloadsToSend = responsePayloads;
+        this.socketWrapper.send(JSON.stringify({
+          type: SyncWebSocketMsgType.sync_frame_response,
+          context: responseCtx
+        }));
+      } else {
+        if (logalot55) {
+          console.log(`${lc2} synchronization session completed successfully.`);
+        }
+      }
     } catch (error) {
-      console.error(`${lc2} handleIncomingSyncRequest turn execution failed: ${extractErrorMsg(error)}`);
+      console.error(`${lc2} executeIncomingSyncRequestAndRespond failed: ${extractErrorMsg(error)}`);
       throw error;
     }
   }
@@ -22263,8 +22604,8 @@ function createStandardPoolConfig(opts) {
 }
 
 // ../../libs/core-gib/dist/sync/sync-saga-coordinator.mjs
-var logalot58 = GLOBAL_LOG_A_LOT2;
-var logalotControlDomain = false;
+var logalot58 = GLOBAL_LOG_A_LOT2 || true;
+var logalotControlDomain = true;
 var lcControlDomain = "[ControlDomain]";
 var SyncSagaCoordinator = class _SyncSagaCoordinator {
   lc = `[${_SyncSagaCoordinator.name}]`;
@@ -22369,7 +22710,7 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
           sessionSyncPoolConfig: this.defaultSessionSyncPoolConfig(),
           targetAddrs
         });
-        const sessionIdentity = await peer.establishSessionIdentity();
+        await peer.establishSessionIdentity();
         await peer.connect({ sagaId });
         const { initFrame, initDomainGraph } = await this.createInitFrame({
           sagaId,
@@ -22377,7 +22718,8 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
           conflictStrategy,
           metaspace,
           localSpace,
-          tempSpace
+          tempSpace,
+          peer
         });
         await this.executeSagaLoop({
           initFrame,
@@ -22417,7 +22759,7 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
    * @returns next context result if another round, else if commit returns
    * null
    */
-  async continueSync({ sagaContext, mySpace, myTempSpace, metaspace }) {
+  async continueSync({ sagaContext, mySpace, myTempSpace, metaspace, peer }) {
     const lc2 = `${this.lc}[${this.continueSync.name}]`;
     try {
       if (logalot58) {
@@ -22447,7 +22789,10 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
         sagaFrame: frame,
         localSpace: mySpace,
         payloadIbGibsDomain,
-        metaspace
+        metaspace,
+        sessionIdentityAddr: sagaContext.rel8ns?.sessionIdentity?.[0],
+        peer,
+        skipSign: true
       });
       const immediateValidationErrors = await validateContextAndSagaFrame({
         context: responseCtx
@@ -22523,7 +22868,9 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
          */
         payloadIbGibsDomain: nextDomainIbGibs,
         localSpace,
-        metaspace
+        metaspace,
+        sessionIdentityAddr: peer.currentSessionIdentityAddr,
+        peer
       });
       if (logalotControlDomain) {
         const domainAddrs = nextDomainIbGibs.map((p) => getIbGibAddr({ ibGib: p }));
@@ -22559,6 +22906,14 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
       if (contextAndSagaFrameValidationErrors.length > 0) {
         throw new Error(`contextAndSagaFrameValidationErrors: ${contextAndSagaFrameValidationErrors} (E: 6eebe8e7fa437c00a8cde3ada3c66826)`);
       }
+      const returnContextErrors = await this.validateReturnContext({
+        requestCtx,
+        responseCtx,
+        localSpace
+      });
+      if (returnContextErrors.length > 0) {
+        throw new Error(`validateReturnContext errors: ${returnContextErrors.join(", ")} (E: cb8a023b9d0728cceb09fa3da0bb8226)`);
+      }
       const responsePayloadAddrsDomain = responseCtx.data[SYNC_SAGA_PAYLOAD_ADDRS_DOMAIN] || [];
       if (responsePayloadAddrsDomain.length > 0) {
         responseCtx.payloadIbGibsDomain = await this.pollForDomainPayloads({
@@ -22623,7 +22978,7 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
    * the other ibgibs that are related to this context stone should already be
    * put/registered in {@link localSpace}.
    */
-  async createSyncSagaContext({ sagaFrame, payloadIbGibsDomain, metaspace, localSpace }) {
+  async createSyncSagaContext({ sagaFrame, payloadIbGibsDomain, metaspace, localSpace, sessionIdentityAddr, peer, skipSign }) {
     const lc2 = `[${this.createSyncSagaContext.name}]`;
     try {
       if (logalot58) {
@@ -22650,6 +23005,18 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
       const rel8ns = {
         sagaFrame: [getIbGibAddr({ ibGib: sagaFrame })]
       };
+      let sessionIdentity = void 0;
+      if (sessionIdentityAddr) {
+        sessionIdentityAddr = await metaspace.getLatestAddr({ addr: sessionIdentityAddr, space: localSpace }) ?? sessionIdentityAddr;
+        const resGet = await getFromSpace({ addr: sessionIdentityAddr, space: localSpace });
+        if (resGet.success && resGet.ibGibs?.length === 1) {
+          sessionIdentity = resGet.ibGibs[0];
+          rel8ns.sessionIdentity = [sessionIdentityAddr];
+        } else {
+          debugger;
+          throw new Error(`Couldn't get sessionIdentityAddr (${sessionIdentityAddr}) in space: ${localSpace.ib} (E: 5c29e80d68dbd1749866c358be093826)`);
+        }
+      }
       const ib = await getSyncSagaContextIb({ data });
       const contextIbGib = await Factory_V1.stone({
         parentPrimitiveIb: SYNC_SAGA_CONTEXT_ATOM,
@@ -22657,6 +23024,11 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
         data,
         rel8ns
       });
+      const contextAddr = getIbGibAddr({ ibGib: contextIbGib });
+      let signedSessionIdentity = void 0;
+      if (sessionIdentity && !skipSign) {
+        signedSessionIdentity = await peer.signContext({ contextAddr });
+      }
       await putInSpace({ ibGib: contextIbGib, space: localSpace });
       await registerNewIbGib({
         ibGib: contextIbGib,
@@ -22664,9 +23036,20 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
         fnBroadcast: void 0
       });
       contextIbGib.sagaFrame = sagaFrame;
+      const { msgStones } = await getSyncSagaFrameDependencyGraph({
+        sagaIbGib: sagaFrame,
+        localSpace
+      });
+      if (msgStones.length !== 1) {
+        throw new Error(`(UNEXPECTED) msgStones.length !== 1 inside createSyncSagaContext? (E: a98165cf46ab4e82b7bd5e45a273b826)`);
+      }
+      contextIbGib.sagaFrameMsg = msgStones[0];
       if (payloadIbGibsDomain && payloadIbGibsDomain.length > 0) {
         contextIbGib.payloadIbGibsDomain = payloadIbGibsDomain;
       }
+      if (signedSessionIdentity) {
+        contextIbGib.signedSessionIdentity = signedSessionIdentity;
+      }
       return contextIbGib;
     } catch (error) {
       console.error(`${lc2} ${extractErrorMsg(error)}`);
@@ -22753,7 +23136,7 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
    * Generates the first frame containing the Knowledge Map of the Local Space.
    * This is sent to the Receiver to begin Gap Analysis.
    */
-  async createInitFrame({ sagaId, domainIbGibs, conflictStrategy, metaspace, localSpace, tempSpace }) {
+  async createInitFrame({ sagaId, domainIbGibs, conflictStrategy, metaspace, localSpace, tempSpace, peer }) {
     const lc2 = `${this.lc}[${this.createInitFrame.name}]`;
     try {
       if (logalot58) {
@@ -22788,7 +23171,8 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
         msgStones: [initStone],
         conflictStrategy,
         metaspace,
-        localSpace
+        localSpace,
+        sessionIdentity: peer.currentSessionIdentity
       });
       if (logalot58) {
         console.log(`${lc2} sagaFrame (init): ${pretty(sagaFrame)} (I: b3d6a8be69248f18713cc3073cb08626)`);
@@ -22803,6 +23187,39 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
       }
     }
   }
+  /**
+   * Validates that the return context received from a peer is a valid
+   * continuation of the outbound context and that the session identity
+   * is consistent.
+   */
+  async validateReturnContext({ requestCtx, responseCtx, localSpace }) {
+    const lc2 = `${this.lc}[${this.validateReturnContext.name}]`;
+    const errors = [];
+    try {
+      if (requestCtx.sagaFrame && responseCtx.sagaFrame) {
+        const requestFrameAddr = getIbGibAddr({ ibGib: requestCtx.sagaFrame });
+        const responseFrameAddr = getIbGibAddr({ ibGib: responseCtx.sagaFrame });
+        const isContinuation = await isPastFrame({
+          olderAddr: requestFrameAddr,
+          newerAddr: responseFrameAddr,
+          space: localSpace
+        });
+        if (!isContinuation) {
+          errors.push(`Response saga frame (${responseFrameAddr}) is not a valid continuation of request saga frame (${requestFrameAddr}). (E: 2c85e8d97318ff24ac8a02bd3a068226)`);
+        }
+      } else {
+        errors.push(`Missing sagaFrame on requestCtx or responseCtx. (E: b65c68ff891000ddca8d22384a088226)`);
+      }
+      const expectedSessionIdAddr = requestCtx.signedSessionIdentity ? getIbGibAddr({ ibGib: requestCtx.signedSessionIdentity }) : requestCtx.rel8ns?.sessionIdentity?.[0];
+      const responseSessionIdAddr = responseCtx.rel8ns?.sessionIdentity?.[0];
+      if (expectedSessionIdAddr !== responseSessionIdAddr) {
+        errors.push(`Session identity mismatch. Expected ${expectedSessionIdAddr}, got ${responseSessionIdAddr}. (E: ab98716bca88d2243cc822187768226)`);
+      }
+    } catch (error) {
+      errors.push(`Error during validateReturnContext: ${extractErrorMsg(error)} (E: da878e1239aa88ee27bdfca005c28226)`);
+    }
+    return errors;
+  }
   /**
    * Helper to poll for streaming domain payloads and put them in the
    * local {@link tempSpace}.
@@ -24090,7 +24507,7 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
   /**
    * Evolves the saga timeline with a new frame.
    */
-  async evolveSyncSagaIbGib({ prevSagaIbGib, conflictStrategy, msgStones, localSpace, metaspace }) {
+  async evolveSyncSagaIbGib({ prevSagaIbGib, conflictStrategy, msgStones, localSpace, metaspace, sessionIdentity }) {
     const lc2 = `${this.lc}[${this.evolveSyncSagaIbGib.name}]`;
     try {
       if (!msgStones || msgStones.length === 0) {
@@ -24148,6 +24565,13 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
           isTjp: true,
           conflictStrategy
         };
+        if (sessionIdentity) {
+          const sessionIdentityTjpAddr = getTjpAddr({ ibGib: sessionIdentity });
+          if (!sessionIdentityTjpAddr) {
+            throw new Error(`(UNEXPECTED) sessionIdentity is truthy but sessionIdentityTjpAddr falsy? (E: f52004c10288987a6886f4e8fdf90826)`);
+          }
+          data.sessionIdentityTjpAddr = sessionIdentityTjpAddr;
+        }
         const ib = await getSyncIb({ data });
         const stoneAddrs = msgStones.map((s) => getIbGibAddr({ ibGib: s }));
         const rel8ns = { [SYNC_MSG_REL8N_NAME]: stoneAddrs };
@@ -24339,6 +24763,10 @@ var SyncUpgradeHandlerBase = class _SyncUpgradeHandlerBase extends ServeGibHandl
         },
         onClose(callback) {
           socket.on("close", callback);
+        },
+        close() {
+          socket.write(encodeCloseFrame());
+          socket.end();
         }
       };
       await receiverPeer.bindSocket(socketWrapper);
@@ -24351,7 +24779,9 @@ var SyncUpgradeHandlerBase = class _SyncUpgradeHandlerBase extends ServeGibHandl
   }
   async parseParamsImpl(reqCtx) {
     const match = reqCtx.pathname.match(this.regex);
-    if (!match) return void 0;
+    if (!match) {
+      return void 0;
+    }
     const domainIb = decodeURIComponent(match[1]);
     const domainGib = decodeURIComponent(match[2]);
     const domainAddr = getIbGibAddr({ ib: domainIb, gib: domainGib });