@ibgib/space-gib 0.0.2 → 0.0.4

package/dist/server/server.mjs

@@ -7261,7 +7261,7 @@ async function getGraphProjection_Live({ ibGibs, ibGibAddrs, gotten, tjpAddrsAlr
         rel8nNames.forEach((rel8nName) => {
           const rel8dAddrs = rel8ns[rel8nName] ?? [];
           rel8dAddrs.forEach((rel8dAddr) => {
-            if (!rel8dAddrsNotYetGotten.includes(rel8dAddr) && !ibGibs.some((x) => getIbGibAddr({ ibGib: x }) === rel8dAddr)) {
+            if (!rel8dAddrsNotYetGotten.includes(rel8dAddr) && !ibGibs.some((x) => getIbGibAddr({ ibGib: x }) === rel8dAddr) && !isPrimitive({ gib: getIbAndGib({ ibGibAddr: rel8dAddr }).gib })) {
               rel8dAddrsNotYetGotten.push(rel8dAddr);
             }
           });
@@ -17650,6 +17650,8 @@ var KEYSTONE_REPLENISH_STRATEGY_VALID_VALUES = Object.values(KeystoneReplenishSt
 var KEYSTONE_ATOM = "keystone";
 var KEYSTONE_POOL_ID_REGEXP = /^\w[\w\-.]*$/;
 var KEYSTONE_SALT_REGEXP = /^[a-zA-Z0-9\-_]{1,64}$/;
+var KEYSTONE_USERNAME_REGEXP = /^[a-zA-Z0-9_\-.]{1,63}$/;
+var KEYSTONE_DESCRIPTION_REGEXP = /^[a-zA-Z0-9\s.,!?:;'"\-()[\]_+=@#$%&*\/]{0,128}$/;
 var KEYSTONE_HASH_MAX_ROUNDS = 1e3;
 var KEYSTONE_VERB_REVOKE = "revoke";
 var KEYSTONE_VERB_MANAGE = "manage";
@@ -17938,7 +17940,7 @@ async function parseKeystoneIb({ ib }) {
     }
   }
 }
-function getDeterministicRequirements({ pool, requiredChallengeIds, targetAddr }) {
+async function getDeterministicRequirements({ pool, requiredChallengeIds, targetAddr }) {
   const behavior = pool.config.behavior;
   const mandatory = /* @__PURE__ */ new Set();
   let available = Object.keys(pool.challenges);
@@ -17954,19 +17956,20 @@ function getDeterministicRequirements({ pool, requiredChallengeIds, targetAddr }
     }
     available = available.filter((id) => !mandatory.has(id));
   }
-  if (behavior.targetBindingChars > 0 && targetAddr) {
-    const { gib } = getIbAndGib({ ibGibAddr: targetAddr });
-    if (gib) {
-      const prefixes = gib !== GIB ? gib.substring(0, behavior.targetBindingChars).toLowerCase() : "abc";
-      for (const char of prefixes) {
-        const bucket = pool.bindingMap[char] || [];
-        const match = bucket.find((id) => available.includes(id));
-        if (!match) {
-          throw new Error(`Entropy Exhaustion. Cannot satisfy binding for char '${char}'. (E: 341b95dc3a58be3e083d1d9c4a0c4925)`);
-        }
-        mandatory.add(match);
-        available = available.filter((id) => id !== match);
+  if (behavior.targetBindingCount > 0 && targetAddr) {
+    let sortedAvailable = [...available].sort();
+    let currentHash = await hash({ s: targetAddr });
+    for (let i = 0; i < behavior.targetBindingCount; i++) {
+      if (sortedAvailable.length === 0) {
+        throw new Error(`Entropy Exhaustion. Cannot satisfy target binding. Sorted available pool is empty. (E: 341b95dc3a58be3e083d1d9c4a0c4925)`);
       }
+      const hashBigInt = BigInt("0x" + currentHash);
+      const index = Number(hashBigInt % BigInt(sortedAvailable.length));
+      const selectedId = sortedAvailable[index];
+      mandatory.add(selectedId);
+      sortedAvailable.splice(index, 1);
+      available = available.filter((id) => id !== selectedId);
+      currentHash = await hash({ s: currentHash });
     }
   }
   if (behavior.selectSequentially > 0) {
@@ -17980,22 +17983,6 @@ function getDeterministicRequirements({ pool, requiredChallengeIds, targetAddr }
   }
   return { mandatoryIds: mandatory, availableIds: available };
 }
-function addToBindingMap(map, challengeId) {
-  const firstChar = challengeId.charAt(0).toLowerCase();
-  if (/[0-9a-f]/.test(firstChar)) {
-    if (!map[firstChar]) {
-      map[firstChar] = [];
-    }
-    map[firstChar].push(challengeId);
-  } else {
-    throw new Error(`invalid challengeId (${challengeId}). Must start with a hex character. (E: c96ed8460de89e28c801370a0f07f826)`);
-  }
-}
-function removeFromBindingMap(map, challengeId) {
-  for (const key of Object.keys(map)) {
-    map[key] = map[key].filter((id) => id !== challengeId);
-  }
-}
 function resolveTargetPool({ pools, poolId, poolFilter, verb }) {
   const lc2 = `[resolveTargetPool]`;
   try {
@@ -18034,10 +18021,10 @@ function resolveTargetPool({ pools, poolId, poolFilter, verb }) {
     throw error;
   }
 }
-function selectChallengeIds({ pool, targetAddr, requiredChallengeIds }) {
+async function selectChallengeIds({ pool, targetAddr, requiredChallengeIds }) {
   const lc2 = `[selectChallengeIds]`;
   try {
-    const { mandatoryIds, availableIds } = getDeterministicRequirements({
+    const { mandatoryIds, availableIds } = await getDeterministicRequirements({
       pool,
       requiredChallengeIds,
       targetAddr
@@ -18073,11 +18060,6 @@ async function applyReplenishmentStrategy({ prevPools, targetPoolId, consumedIds
     const poolSecret = await strategy.derivePoolSecret({ masterSecret });
     const timestamp = Date.now().toString();
     const strategyType = config.behavior.replenish;
-    consumedIds.forEach((id) => {
-      if (pool.bindingMap) {
-        removeFromBindingMap(pool.bindingMap, id);
-      }
-    });
     if (strategyType === KeystoneReplenishStrategy.topUp) {
       consumedIds.forEach((id) => delete pool.challenges[id]);
       for (let i = 0; i < consumedIds.length; i++) {
@@ -18092,14 +18074,9 @@ async function applyReplenishmentStrategy({ prevPools, targetPoolId, consumedIds
           challengeId: newId
         });
         pool.challenges[newId] = await strategy.generateChallenge({ solution });
-        if (!pool.bindingMap) {
-          pool.bindingMap = {};
-        }
-        addToBindingMap(pool.bindingMap, newId);
       }
     } else if (strategyType === KeystoneReplenishStrategy.replaceAll) {
       pool.challenges = {};
-      pool.bindingMap = {};
       for (let i = 0; i < config.behavior.size; i++) {
         const newId = await generateOpaqueChallengeId({
           salt: config.salt,
@@ -18112,13 +18089,11 @@ async function applyReplenishmentStrategy({ prevPools, targetPoolId, consumedIds
           challengeId: newId
         });
         pool.challenges[newId] = await strategy.generateChallenge({ solution });
-        addToBindingMap(pool.bindingMap, newId);
       }
     } else if (strategyType === KeystoneReplenishStrategy.consume) {
       consumedIds.forEach((id) => delete pool.challenges[id]);
     } else if (strategyType === KeystoneReplenishStrategy.deleteAll) {
       pool.challenges = {};
-      pool.bindingMap = {};
     } else {
       throw new Error(`Unknown replenish strategy: ${strategyType}. Valid list: ${pretty(KEYSTONE_REPLENISH_STRATEGY_VALID_VALUES)} (E: 0acf56f1e1486240080e11e8046d0825)`);
     }
@@ -18230,10 +18205,14 @@ async function validateChallengePool({ pool }) {
         errors.push(`${lc2} pool.config.id falsy (E: 31d7943d95f877326d5f4ea14463d626)`);
       }
       if (pool.config.behavior) {
-        const { size } = pool.config.behavior;
+        const { size, selectSequentially, selectRandomly, targetBindingCount } = pool.config.behavior;
         if (!size || size === 0) {
           errors.push(`${lc2} invalid pool.config.behavior.size (${size}). Must be positive integer. (E: b221e36ec102bdc944552248ce8fe626)`);
         }
+        const totalRequested = (selectSequentially || 0) + (selectRandomly || 0) + (targetBindingCount || 0);
+        if (totalRequested >= size) {
+          errors.push(`${lc2} Total requested challenges (${totalRequested}) cannot equal or exceed pool size (${size}) to prevent full pool exposure and selection exhaustion. (E: 81cb834f826315264bca81c15fca58f1)`);
+        }
       } else {
         errors.push(`${lc2} pool.config.behavior falsy (E: bede081c066c39732eefe2f92e296326)`);
       }
@@ -18259,6 +18238,27 @@ async function validateChallengePool({ pool }) {
     }
   }
 }
+function validateKeystoneMetadata({ data }) {
+  const lc2 = `[validateKeystoneMetadata]`;
+  const errors = [];
+  const checkDetails = (details, source) => {
+    if (!details)
+      return;
+    if (details.username !== void 0) {
+      if (typeof details.username !== "string" || !KEYSTONE_USERNAME_REGEXP.test(details.username)) {
+        errors.push(`${lc2} invalid username in ${source} (${details.username}). Must match ${KEYSTONE_USERNAME_REGEXP}`);
+      }
+    }
+    if (details.description !== void 0) {
+      if (typeof details.description !== "string" || !KEYSTONE_DESCRIPTION_REGEXP.test(details.description)) {
+        errors.push(`${lc2} invalid description in ${source} (${details.description}). Must match ${KEYSTONE_DESCRIPTION_REGEXP}`);
+      }
+    }
+  };
+  checkDetails(data.frameDetails, "frameDetails");
+  checkDetails(data.checkpointDetails, "checkpointDetails");
+  return errors;
+}
 async function validateGenesisKeystone({ keystoneIbGib }) {
   const lc2 = `[${validateGenesisKeystone.name}]`;
   try {
@@ -18267,6 +18267,8 @@ async function validateGenesisKeystone({ keystoneIbGib }) {
     }
     const errors = [];
     const { data, rel8ns } = keystoneIbGib;
+    const metadataErrors = validateKeystoneMetadata({ data });
+    metadataErrors.forEach((x) => errors.push(x));
     if (data.proofs && data.proofs.length > 0) {
       errors.push(`${lc2} proofs already exist on genesis keystone. (E: 7a5e15f20918f1bbd8ffb62857dcd526)`);
     }
@@ -18306,6 +18308,8 @@ async function validateKeystoneTransition({ currentIbGib, prevIbGib }) {
     }
     const currData = currentIbGib.data;
     const prevData = prevIbGib.data;
+    const metadataErrors = validateKeystoneMetadata({ data: currData });
+    metadataErrors.forEach((x) => errors.push(x));
     const currDataN = currData.n ?? -2;
     const prevDataN = prevData.n ?? -2;
     if (currDataN < 0) {
@@ -18359,7 +18363,7 @@ async function verifyProofAgainstPool({ proof, pool, errors }) {
         errors.push(`Policy Violation: Pool ${pool.id} used for unauthorized verb ${proof.claim.verb}`);
       }
     }
-    const { mandatoryIds, availableIds } = getDeterministicRequirements({
+    const { mandatoryIds, availableIds } = await getDeterministicRequirements({
       pool,
       requiredChallengeIds: proof.requiredChallengeIds,
       targetAddr: proof.claim.target
@@ -18641,7 +18645,6 @@ var KeystoneService_V1 = class _KeystoneService_V1 {
         const strategy = KeystoneStrategyFactory.create({ config });
         const poolSecret = await strategy.derivePoolSecret({ masterSecret });
         const challenges = {};
-        const bindingMap = {};
         const targetSize = config.behavior.size;
         const timestamp = Date.now().toString();
         for (let i = 0; i < targetSize; i++) {
@@ -18657,13 +18660,11 @@ var KeystoneService_V1 = class _KeystoneService_V1 {
           });
           const challenge = await strategy.generateChallenge({ solution });
           challenges[challengeId] = challenge;
-          addToBindingMap(bindingMap, challengeId);
         }
         challengePools.push({
           id: config.id,
           config,
-          challenges,
-          bindingMap
+          challenges
         });
       }
       if (challengePools.length === 0) {
@@ -18712,7 +18713,7 @@ var KeystoneService_V1 = class _KeystoneService_V1 {
       if (logalot41) {
         console.log(`${lc2} Selected pool: ${pool.id} (size: ${Object.keys(pool.challenges).length}) (I: 6b26d6f4aad18380f2b3a0989b592826)`);
       }
-      const idsToSolve = selectChallengeIds({
+      const idsToSolve = await selectChallengeIds({
         pool,
         targetAddr: claim.target,
         requiredChallengeIds
@@ -18870,7 +18871,7 @@ var KeystoneService_V1 = class _KeystoneService_V1 {
         verb: KEYSTONE_VERB_REVOKE,
         target: getIbGibAddr({ ibGib: latestKeystone })
       };
-      const idsToSolve = selectChallengeIds({
+      const idsToSolve = await selectChallengeIds({
         pool,
         targetAddr: claim.target,
         requiredChallengeIds: []
@@ -18966,7 +18967,7 @@ var KeystoneService_V1 = class _KeystoneService_V1 {
         // Scope creates a cryptographic commitment to WHICH pools are being added
         scope: JSON.stringify({ add: newPools.map((p) => p.id) })
       };
-      const idsToSolve = selectChallengeIds({
+      const idsToSolve = await selectChallengeIds({
         pool: adminPool,
         targetAddr: target
       });
@@ -19065,7 +19066,7 @@ var KeystoneService_V1 = class _KeystoneService_V1 {
   }
 };
 
-// ../../libs/core-gib/dist/sync/sync-peer/sync-peer-websocket-receiver/sync-websocket-peer-helpers.mjs
+// ../../libs/core-gib/dist/sync/sync-peer/sync-peer-websocket/sync-peer-websocket-receiver/sync-websocket-peer-helpers.mjs
 var logalot42 = GLOBAL_LOG_A_LOT2;
 var SESSION_KEYSTONE_POLICY = {
   COMMON: {
@@ -19080,7 +19081,7 @@ var SESSION_KEYSTONE_POLICY = {
     SIZE: 10,
     SELECT_SEQUENTIALLY: 2,
     SELECT_RANDOMLY: 2,
-    TARGET_BINDING_CHARS: 0,
+    TARGET_BINDING_COUNT: 0,
     SERVER_DEMAND_COUNT: 3
   }
 };
@@ -19245,8 +19246,10 @@ async function validateAndRegisterEvolveKeystone({ domainAddr, keystoneIbGib, re
     if (intrinsicErrors && intrinsicErrors.length > 0) {
       throw new Error(`Intrinsic keystone validation failed: ${intrinsicErrors.join(", ")} (E: 38ea984585edc6ee88d2a698c7895826)`);
     }
-    const { tjpGib } = getGibInfo({ ibGibAddr: addr });
-    const expectedTjpGib = getGibInfo({ ibGibAddr: domainAddr }).punctiliarHash;
+    const infoAddr = getGibInfo({ ibGibAddr: addr });
+    const tjpGib = infoAddr.tjpGib ?? infoAddr.punctiliarHash;
+    const infoDomain = getGibInfo({ ibGibAddr: domainAddr });
+    const expectedTjpGib = infoDomain.tjpGib ?? infoDomain.punctiliarHash;
     if (tjpGib !== expectedTjpGib) {
       throw new Error(`Keystone tjpGib (${tjpGib}) does not match URL domainAddr tjpGib (${expectedTjpGib})`);
     }
@@ -19579,9 +19582,6 @@ var KeystoneGenesisHandler = class _KeystoneGenesisHandler extends ServeGibHandl
       await metaspace.put({ ibGibs: [keystoneIbGib], space });
       await metaspace.registerNewIbGib({ ibGib: keystoneIbGib, space });
       console.log(`${lc2} domain created and keystone persisted: ${addr}`);
-      if (logalot45) {
-        console.log(`${lc2} keystoneIbGib: ${pretty(keystoneIbGib)} (I: d598c6ff7a48997d585b84c19c464826)`);
-      }
       return this.ok({ success: true, addr }, 201);
     } catch (error) {
       const emsg = extractErrorMsg(error);
@@ -19820,64 +19820,82 @@ function performConnect(req, socket) {
 }
 var WebSocketFrameDecoder = class {
   buffer = Buffer.alloc(0);
+  fragments = [];
   /** Adds new data chunk from TCP socket. */
   addChunk(chunk) {
     this.buffer = Buffer.concat([this.buffer, chunk]);
   }
   /**
-   * Parses the next complete text frame from the accumulated buffer.
+   * Parses the next complete text message, assembling fragments if necessary.
    * Returns:
-   * - `string` if a complete text frame was decoded successfully (and consumes those bytes).
+   * - `string` if a complete text message was assembled/decoded (and consumes those bytes).
    * - `null` if the buffer is incomplete or we need more data.
    * - `throws Error` on protocol errors or close frames.
    */
   nextFrame() {
-    if (this.buffer.length < 2) {
-      return null;
-    }
-    const opcode = this.buffer[0] & 15;
-    if (opcode === 8) {
-      throw new Error("Close frame received");
-    }
-    if (opcode !== 1) {
-      throw new Error(`Unsupported WebSocket opcode: 0x${opcode.toString(16)}`);
-    }
-    const secondByte = this.buffer[1];
-    const masked = (secondByte & 128) !== 0;
-    let payloadLen = secondByte & 127;
-    let headerLen = 2;
-    if (payloadLen === 126) {
-      if (this.buffer.length < 4) {
+    while (true) {
+      if (this.buffer.length < 2) {
         return null;
       }
-      payloadLen = this.buffer.readUInt16BE(2);
-      headerLen = 4;
-    } else if (payloadLen === 127) {
-      if (this.buffer.length < 10) {
+      const firstByte = this.buffer[0];
+      const fin = (firstByte & 128) !== 0;
+      const opcode = firstByte & 15;
+      if (opcode === 8) {
+        throw new Error("Close frame received");
+      }
+      const isContinuation = opcode === 0;
+      const isText = opcode === 1;
+      if (!isContinuation && !isText) {
+        throw new Error(`Unsupported WebSocket opcode: 0x${opcode.toString(16)}`);
+      }
+      if (isContinuation && this.fragments.length === 0) {
+        throw new Error("Continuation frame received without an active message.");
+      }
+      if (isText && this.fragments.length > 0) {
+        throw new Error("New message frame received before previous one completed.");
+      }
+      const secondByte = this.buffer[1];
+      const masked = (secondByte & 128) !== 0;
+      let payloadLen = secondByte & 127;
+      let headerLen = 2;
+      if (payloadLen === 126) {
+        if (this.buffer.length < 4) {
+          return null;
+        }
+        payloadLen = this.buffer.readUInt16BE(2);
+        headerLen = 4;
+      } else if (payloadLen === 127) {
+        if (this.buffer.length < 10) {
+          return null;
+        }
+        payloadLen = Number(this.buffer.readBigUInt64BE(2));
+        headerLen = 10;
+      }
+      const maskLen = masked ? 4 : 0;
+      const totalFrameLen = headerLen + maskLen + payloadLen;
+      if (this.buffer.length < totalFrameLen) {
         return null;
       }
-      payloadLen = Number(this.buffer.readBigUInt64BE(2));
-      headerLen = 10;
-    }
-    const maskLen = masked ? 4 : 0;
-    const totalFrameLen = headerLen + maskLen + payloadLen;
-    if (this.buffer.length < totalFrameLen) {
-      return null;
-    }
-    const frameData = this.buffer.subarray(0, totalFrameLen);
-    this.buffer = this.buffer.subarray(totalFrameLen);
-    let payloadStart = headerLen;
-    if (masked) {
-      const mask = frameData.subarray(payloadStart, payloadStart + 4);
-      payloadStart += 4;
-      const payload = Buffer.from(frameData.subarray(payloadStart));
-      for (let i = 0; i < payload.length; i++) {
-        payload[i] ^= mask[i % 4];
-      }
-      return payload.toString("utf-8");
-    } else {
-      const payload = frameData.subarray(payloadStart);
-      return payload.toString("utf-8");
+      const frameData = this.buffer.subarray(0, totalFrameLen);
+      this.buffer = this.buffer.subarray(totalFrameLen);
+      let payloadStart = headerLen;
+      let payload;
+      if (masked) {
+        const mask = frameData.subarray(payloadStart, payloadStart + 4);
+        payloadStart += 4;
+        payload = Buffer.from(frameData.subarray(payloadStart));
+        for (let i = 0; i < payload.length; i++) {
+          payload[i] ^= mask[i % 4];
+        }
+      } else {
+        payload = Buffer.from(frameData.subarray(payloadStart));
+      }
+      this.fragments.push(payload);
+      if (fin) {
+        const completePayload = Buffer.concat(this.fragments);
+        this.fragments = [];
+        return completePayload.toString("utf-8");
+      }
     }
   }
 };
@@ -20063,12 +20081,10 @@ async function applyTransforms({ src, createdIbGibs_Running, dnaAddrsToApplyToSt
       const dnaAddrToApply = dnaAddrsToApplyToStoreVersion_MUTATES_IN_PLACE.splice(0, 1)[0];
       const dnaIbGib_IntermediateArray = allLocalIbGibs.filter((x) => getIbGibAddr({ ibGib: x }) === dnaAddrToApply);
       let dnaIbGib;
-      if (dnaIbGib_IntermediateArray.length === 1) {
+      if (dnaIbGib_IntermediateArray.length > 0) {
         dnaIbGib = dnaIbGib_IntermediateArray[0];
-      } else if (dnaIbGib_IntermediateArray.length === 0) {
-        throw new Error(`dna ibGib not found in supplied allLocalIbGibs. dnaAddr: ${dnaAddrToApply}. (E: 7f56826852cf48a79ab8af16bf27e284)`);
       } else {
-        throw new Error(`More than one ibGib in allLocalIbGibs with the dna address of ${dnaAddrToApply}? (E: a726134f4cc14a4fb2ed2d39d22af17c)(UNEXPECTED)`);
+        throw new Error(`dna ibGib not found in supplied allLocalIbGibs. dnaAddr: ${dnaAddrToApply}. (E: 7f56826852cf48a79ab8af16bf27e284)`);
       }
       let argTransform = clone(dnaIbGib.data);
       argTransform.src = src;
@@ -20998,6 +21014,23 @@ async function validateContextAndSagaFrame({ context }) {
     } else {
       errors.push(`context.sagaFrame is falsy. (E: b4edd88f4963f493789f83b29ba2df26)`);
     }
+    if (context.sagaFrameMsg) {
+      const sagaFrameMsgErrors = await validateIbGibIntrinsically({ ibGib: context.sagaFrameMsg }) ?? [];
+      sagaFrameMsgErrors.forEach((x) => errors.push(x));
+      if (context.sagaFrame) {
+        const expectedMsgAddr = context.sagaFrame.rel8ns?.[SYNC_MSG_REL8N_NAME]?.[0];
+        if (expectedMsgAddr) {
+          const actualMsgAddr = getIbGibAddr({ ibGib: context.sagaFrameMsg });
+          if (actualMsgAddr !== expectedMsgAddr) {
+            errors.push(`context.sagaFrameMsg address (${actualMsgAddr}) does not match the stone address referenced in sagaFrame relations (${expectedMsgAddr}). (E: a983b271fcae46bbad7e82098bc24826)`);
+          }
+        } else {
+          errors.push(`context.sagaFrame is missing the message stone relation '${SYNC_MSG_REL8N_NAME}'. (E: da872cf3a8d46dbbad89d0a68d712826)`);
+        }
+      }
+    } else {
+      errors.push(`context.sagaFrameMsg is falsy. (E: ed405a72ab0d8bbdca7b9605d8f9a26)`);
+    }
     if (errors.length > 0) {
       return errors;
     }
@@ -21012,34 +21045,190 @@ async function validateContextAndSagaFrame({ context }) {
     }
   }
 }
-async function authenticateContext({}) {
-  const lc2 = `[${authenticateContext.name}]`;
+async function authenticateContextIntrinsically({
+  context,
+  space
+  // stageInProtocol,
+}) {
+  const lc2 = `[${authenticateContextIntrinsically.name}]`;
   try {
     if (logalot53) {
       console.log(`${lc2} starting... (I: 3c34e8f1d6ef965f98725c88459ea926)`);
     }
-    console.warn(`${lc2}[NAG] not thrown. not implemented right now after removing all identity-related code. (W: e5fad31cfb49eef198a189a82dbcf726)`);
-    return [];
-  } catch (error) {
-    console.error(`${lc2} ${extractErrorMsg(error)}`);
-    throw error;
-  } finally {
-    if (logalot53) {
-      console.log(`${lc2} complete.`);
+    const errors = [];
+    if (!context.data) {
+      throw new Error(`(UNEXPECTED) context.data falsy? (E: 3e4ddd0eb4b828ad489658d88d9a6326)`);
     }
-  }
-}
-async function authorizeContext({ context, fullSagaHistory }) {
-  const lc2 = `[${authorizeContext.name}]`;
-  try {
-    if (logalot53) {
-      console.log(`${lc2} starting... (I: 48c918b41ceec0cd489ca3b8819e6826)`);
+    if (!context.rel8ns) {
+      throw new Error(`(UNEXPECTED) context.rel8ns falsy? (E: 8026589d4fed69c828334ee842074326)`);
     }
-    console.error(`${lc2} NAG ERROR (NOT THROWN): not implemented. authorize business logic (v1 must have this, but later when we are working on admin vs. student)(E: bc3a78f2dab18ab64c36d055a4b50526)`);
-    return [];
+    const { sagaFrame, signedSessionIdentity: currSessionIdentity } = context;
+    if (!sagaFrame.data) {
+      throw new Error(`(UNEXPECTED) sagaFrame.data falsy? (E: b61cc82d25984c92f75db74a5a855b26)`);
+    }
+    if (!currSessionIdentity) {
+      console.error(`${lc2}[NAG][not thrown] sagaFrame.data.sessionIdentityTjpAddr logic needs to be added in coordinator (E: 4fc47800a1086c917a47381824280826)`);
+      if (sagaFrame.data.sessionIdentityTjpAddr) {
+        errors.push("Context has no session identity, but sync saga frame shows a session identity (sagaFrame.data.sessionIdentityTjpAddr is truthy). (E: 69dd6cdc2e1859c0f3d62958c4339826)");
+        return errors;
+      } else if (context.rel8ns.sessionIdentity) {
+        errors.push("Context has no signed session identity, but context.rel8ns.sessionIdentity is truthy. (E: 96a04a8a6c88ea8bf88118f89ad8e326)");
+        return errors;
+      } else {
+        if (logalot53) {
+          console.log(`${lc2} context has no signedSessionIdentity and sync saga frame doesn't state there should be session identity. So nothing further to authenticate - returning early with no authentication errors. (I: d708735f9a2899ee98f762b8a09ed826)`);
+        }
+        return [];
+      }
+    }
+    const currSessionIdentityAddr = getIbGibAddr({ ibGib: currSessionIdentity });
+    const prevSessionIdentityAddrs_accordingToContextRel8ns = context.rel8ns?.sessionIdentity ?? [];
+    if (prevSessionIdentityAddrs_accordingToContextRel8ns.length === 0) {
+      errors.push(`context.rel8ns.sessionIdentity is falsy/empty but context.signedSessionIdentity is present. (E: 66f906421eb2468c0b33f908a3cf2826)`);
+      return errors;
+    }
+    if (prevSessionIdentityAddrs_accordingToContextRel8ns.length > 1) {
+      errors.push(`context.rel8ns.sessionIdentity has multiple identity addrs. (E: 489428bfe6fdaa4cd885b938dc4c5826)`);
+      return errors;
+    }
+    const prevSessionIdentityAddr = prevSessionIdentityAddrs_accordingToContextRel8ns[0];
+    const resGetLatestAddr = await getLatestAddrs({ addrs: [prevSessionIdentityAddr], space });
+    if (!resGetLatestAddr) {
+      throw new Error(`(UNEXPECTED) resGetLatestAddr for prevSessionIdentityAddr in space (${space.ib}) falsy? (E: 7b207e5cbcec9037ea5adbe822ead826)`);
+    }
+    if (!resGetLatestAddr.data) {
+      throw new Error(`(UNEXPECTED) resGetLatestAddr.data for prevSessionIdentityAddr in space (${space.ib}) falsy? (E: de4eb8d730c8c4dcb59c8b9c79277826)`);
+    }
+    if (!resGetLatestAddr.data.success) {
+      throw new Error(`(UNEXPECTED) resGetLatestAddr.data.success falsy? (E: c94298dfd9684ad6a87eb748459aa826)`);
+    }
+    const { latestAddrsMap } = resGetLatestAddr.data;
+    if (!latestAddrsMap) {
+      throw new Error(`(UNEXPECTED) resGetLatestAddr.data.latestAddrsMap falsy? (E: 19f1fd5fe798cf2e5fa923919169d826)`);
+    }
+    if (Object.keys(latestAddrsMap).length !== 1) {
+      throw new Error(`(UNEXPECTED) Object.keys(latestAddrsMap).length !== 1? (E: fe526a0747589c6427a8bcc86da34a26)`);
+    }
+    const prevSessionIdentityAddr_latest = latestAddrsMap[prevSessionIdentityAddr];
+    if (!prevSessionIdentityAddr_latest) {
+      errors.push(`prevSessionIdentityAddr (${prevSessionIdentityAddr}) not found in space (${space.ib}). this should have been the incoming prevSessionIdentityAddr (E: f6d042bd6b54819998653228dee34226)`);
+      return errors;
+    }
+    if (prevSessionIdentityAddr !== prevSessionIdentityAddr_latest) {
+      if (prevSessionIdentityAddr_latest === currSessionIdentityAddr) {
+      } else {
+        errors.push(`context.rel8ns.sessionIdentity does not point to the most recent in the space (${space.ib}). (E: 2f8288f53c87b6aa47bd2178d9df0c26)`);
+        console.log(`context: ${pretty(toDto2({ ibGib: context }))}`);
+        console.log(`prevSessionIdentityAddr (context.rel8ns.sessionIdentity): ${prevSessionIdentityAddr}`);
+        console.log(`prevSessionIdentityAddr_latest: ${prevSessionIdentityAddr_latest}`);
+        console.log(`currSessionIdentity (context.signedSessionIdentity): ${pretty(toDto2({
+          ibGib: {
+            ib: currSessionIdentity.ib,
+            gib: currSessionIdentity.gib,
+            rel8ns: currSessionIdentity.rel8ns,
+            data: {
+              ...currSessionIdentity.data,
+              challengePools: currSessionIdentity.data.challengePools.map((p) => {
+                return { ...p, challenges: {} };
+              })
+            }
+          }
+        }))}`);
+        console.log(`currSessionIdentityAddr: ${currSessionIdentityAddr}`);
+        return errors;
+      }
+    }
+    const resGetPrevSessionIdentity = await getFromSpace({ addr: prevSessionIdentityAddr, space });
+    if (!resGetPrevSessionIdentity.success || resGetPrevSessionIdentity.ibGibs?.length !== 1) {
+      errors.push(`could not fetch latest sender identity ${prevSessionIdentityAddr} from space (${space.ib}). (E: fd48c3e64c9fa4efd8a1f8280af18226)`);
+      return errors;
+    }
+    const prevSessionIdentity = resGetPrevSessionIdentity.ibGibs[0];
+    const sessionIdentityTjp = await getTjpIbGib({ ibGib: prevSessionIdentity, naive: true, space });
+    if (!sessionIdentityTjp) {
+      throw new Error(`(UNEXPECTED) couldn't get sessionIdentityTjp in space (${space.ib})? we have already gotten the identity itself in the space, so we would expect the entire timeline to exist in it. (E: 9be0382ff1c8a0e77645ea38c096f826)`);
+    }
+    const sessionIdentityTjpAddr = getIbGibAddr({ ibGib: sessionIdentityTjp });
+    if (sessionIdentityTjpAddr !== sagaFrame.data.sessionIdentityTjpAddr) {
+      throw new Error(`(UNEXPECTED) sessionIdentityTjpAddr !== sagaFrame.data.sessionIdentityTjpAddr? (E: c9a4ad5c2728fe38e86afc58e4abaf26)`);
+    }
+    const sessionGenesisFrameDetails = sessionIdentityTjp.data.frameDetails;
+    if (!sessionGenesisFrameDetails) {
+      errors.push(`Invalid session identity tjp: sessionIdentityTjp.data.frameDetails is falsy. (E: 0187f8f804a84256281720586620b826)`);
+      return errors;
+    }
+    const { senderIdentityAddr, senderIdentityTjpAddr } = sessionGenesisFrameDetails;
+    if (!senderIdentityAddr) {
+      throw new Error(`sessionGenesisFrameDetails.senderIdentityAddr falsy (E: 02a0c80a3ead9e3af8af4cf3b156e826)`);
+    }
+    if (!senderIdentityTjpAddr) {
+      throw new Error(`sessionGenesisFrameDetails.senderIdentityTjpAddr falsy (E: 271928090ff5dc56d4bb63d8d5c68826)`);
+    }
+    const resGetLatestAddr_senderIdentity = await getLatestAddrs({ addrs: [senderIdentityTjpAddr, senderIdentityAddr], space });
+    if (!resGetLatestAddr_senderIdentity) {
+      throw new Error(`(UNEXPECTED) resGetLatestAddr_senderIdentity for prevSessionIdentityAddr in space (${space.ib}) falsy? (E: 2e4ae8083b6fb7cbb8fae2a519062926)`);
+    }
+    if (!resGetLatestAddr_senderIdentity.data) {
+      throw new Error(`(UNEXPECTED) resGetLatestAddr_senderIdentity.data for prevSessionIdentityAddr in space (${space.ib}) falsy? (E: 2e231850c2a898cc282b4b2841056826)`);
+    }
+    if (!resGetLatestAddr_senderIdentity.data.success) {
+      throw new Error(`(UNEXPECTED) resGetLatestAddr_senderIdentity.data.success falsy? (E: e93508f03e0475925875b00746ffd826)`);
+    }
+    const { latestAddrsMap: latestAddrsMap_senderIdentity } = resGetLatestAddr_senderIdentity.data;
+    if (!latestAddrsMap_senderIdentity) {
+      throw new Error(`(UNEXPECTED) resGetLatestAddr_senderIdentity.data.latestAddrsMap falsy? (E: 87a91e3f9968ad9ba79cdfe8cd878326)`);
+    }
+    if (Object.keys(latestAddrsMap_senderIdentity).length !== 2 && senderIdentityTjpAddr !== senderIdentityAddr) {
+      throw new Error(`(UNEXPECTED) Object.keys(latestAddrsMap_senderIdentity).length !== 2 && senderIdentityTjpAddr !== senderIdentityAddr? (E: fe46bd584853d8e1e8e2d11f52012826)`);
+    }
+    const senderIdentityTjpAddr_latest = latestAddrsMap_senderIdentity[senderIdentityTjpAddr];
+    const senderIdentityAddr_latest = latestAddrsMap_senderIdentity[senderIdentityAddr];
+    if (!senderIdentityAddr_latest) {
+      throw new Error(`(UNEXPECTED) senderIdentityAddr_latest falsy? (E: e151798ae2e9241578d09948937c4b26)`);
+    }
+    if (senderIdentityTjpAddr_latest !== senderIdentityAddr_latest) {
+      throw new Error(`senderIdentityTjpAddr_latest !== senderIdentityAddr_latest (E: 52478a1053589e72665031a853cc1826)`);
+    }
+    const resGetSenderIdentity_latest = await getFromSpace({
+      addr: senderIdentityAddr_latest,
+      space
+    });
+    if (!resGetSenderIdentity_latest.success || resGetSenderIdentity_latest.ibGibs?.length !== 1) {
+      errors.push(`could not fetch latest sender identity ${prevSessionIdentityAddr} from space (${space.ib}). (E: 3565ff0ed458f5a2384c40b16e849826)`);
+      return errors;
+    }
+    const senderIdentity_latest = resGetSenderIdentity_latest.ibGibs[0];
+    if (!senderIdentity_latest.data.proofs) {
+      errors.push(`Invalid sender identity. Proofs empty/falsy. (E: ebf488853061614d2b5b137828119526)`);
+      return errors;
+    }
+    const syncClaim = senderIdentity_latest.data.proofs.find((p) => p.claim.verb === KEYSTONE_VERB_SYNC)?.claim;
+    if (!syncClaim) {
+      errors.push(`Most recent senderIdentity has no proof whose claim.verb === ${KEYSTONE_VERB_SYNC}. (E: b0f488ecccbbfe43d9a0b7c8a29d7826)`);
+      return errors;
+    }
+    if (syncClaim.target !== sessionIdentityTjpAddr) {
+      errors.push(`Most recent sender identity claim has claim.verb === ${KEYSTONE_VERB_SYNC} but DOES NOT target expected session identity addr ${prevSessionIdentityAddr}. (E: 3e7f18d99848969be8586423d5ccb826)`);
+      return errors;
+    }
+    const keystoneSvc = new KeystoneService_V1();
+    const transitionErrors = await keystoneSvc.validate({
+      currentIbGib: currSessionIdentity,
+      prevIbGib: prevSessionIdentity
+    });
+    if (transitionErrors.length > 0) {
+      errors.push(`Invalid session identity transition: ${transitionErrors.join(", ")} (E: da1c81c6d3c86aec3254f48fe7514226)`);
+    }
+    const contextAddr = getIbGibAddr({ ibGib: context });
+    const targetsThisContext = currSessionIdentity.data?.proofs?.some((p) => p.claim.target === contextAddr);
+    if (!targetsThisContext) {
+      errors.push(`Session identity signature does not target current context ibgib (${contextAddr}). (E: acae68938c287178c878d1b88bebb826)`);
+    }
+    return errors;
   } catch (error) {
-    console.error(`${lc2} ${extractErrorMsg(error)}`);
-    throw error;
+    const emsg = `${lc2} ${extractErrorMsg(error)}`;
+    console.error(emsg);
+    return [`authentication produced an error: ${emsg} (E: 45e014b82af81993d936611ca6fc4d26)`];
   } finally {
     if (logalot53) {
       console.log(`${lc2} complete.`);
@@ -21053,6 +21242,90 @@ var SyncPeer_V1 = class _SyncPeer_V1 extends LightWitnessBase_V1 {
   lc = `[${_SyncPeer_V1.name}]`;
   opts;
   payloadIbGibsDomainReceived$;
+  currentSessionIdentity;
+  get currentSessionIdentityAddr() {
+    return this.currentSessionIdentity ? getIbGibAddr({ ibGib: this.currentSessionIdentity }) : void 0;
+  }
+  // public getSenderIdentity(): KeystoneIbGib_V1 | undefined {
+  //     return this.opts?.senderIdentity;
+  // }
+  async signContext({ contextAddr }) {
+    const lc2 = `${this.lc}[${this.signContext.name}]`;
+    try {
+      if (!this.currentSessionIdentity) {
+        return void 0;
+      }
+      if (!this.opts) {
+        throw new Error(`opts not initialized. (E: bcf5978aed789b0ebcbdc51971ebe826)`);
+      }
+      const { fnSenderSecret, sagaId, localMetaspace, localSpace } = this.opts;
+      if (!fnSenderSecret) {
+        throw new Error(`fnSenderSecret not initialized. (E: 207fd292a2e8c53c05fd0a74a4ae6d26)`);
+      }
+      if (!sagaId) {
+        throw new Error(`sagaId not initialized. (E: f2e35cc13ed873b638116188119d1826)`);
+      }
+      const senderSecret = await fnSenderSecret();
+      const sessionSecret = await deriveSessionSecret({ senderSecret, sagaId });
+      const keystoneSvc = new KeystoneService_V1();
+      const evolved = await keystoneSvc.sign({
+        latestKeystone: this.currentSessionIdentity,
+        masterSecret: sessionSecret,
+        claim: {
+          verb: KEYSTONE_VERB_SYNC,
+          target: contextAddr
+        },
+        metaspace: localMetaspace,
+        space: localSpace
+      });
+      this.currentSessionIdentity = evolved;
+      return evolved;
+    } catch (error) {
+      console.error(`${lc2} ${extractErrorMsg(error)}`);
+      throw error;
+    }
+  }
+  /**
+  * Evolves the session identity (S_n -> S_n+1) solving the demanded connect challenges.
+  */
+  async signContextConnect({ challengeUuid, demandedIds }) {
+    const lc2 = `${this.lc}[${this.signContextConnect.name}]`;
+    try {
+      if (!this.currentSessionIdentity) {
+        return void 0;
+      }
+      if (!this.opts) {
+        throw new Error(`opts not initialized. (E: bcf5978aed789b0ebcbdc51971ebe826)`);
+      }
+      const { fnSenderSecret, sagaId, localMetaspace, localSpace } = this.opts;
+      if (!fnSenderSecret) {
+        throw new Error(`fnSenderSecret not initialized. (E: 207fd292a2e8c53c05fd0a74a4ae6d26)`);
+      }
+      if (!sagaId) {
+        throw new Error(`sagaId not initialized. (E: f2e35cc13ed873b638116188119d1826)`);
+      }
+      const senderSecret = await fnSenderSecret();
+      const sessionSecret = await deriveSessionSecret({ senderSecret, sagaId });
+      const keystoneSvc = new KeystoneService_V1();
+      const evolved = await keystoneSvc.sign({
+        latestKeystone: this.currentSessionIdentity,
+        masterSecret: sessionSecret,
+        poolId: POOL_ID_CONNECT,
+        requiredChallengeIds: demandedIds,
+        claim: {
+          verb: KEYSTONE_VERB_CONNECT,
+          target: challengeUuid
+        },
+        metaspace: localMetaspace,
+        space: localSpace
+      });
+      this.currentSessionIdentity = evolved;
+      return evolved;
+    } catch (error) {
+      console.error(`${lc2} ${extractErrorMsg(error)}`);
+      throw error;
+    }
+  }
   get classname() {
     if (!this.data) {
       throw new Error(`(UNEXPECTED) this.data falsy? (E: 1ab1841e9338b54f3aa615fa37024826)`);
@@ -21124,6 +21397,11 @@ var SyncPeer_V1 = class _SyncPeer_V1 extends LightWitnessBase_V1 {
         }
         return void 0;
       }
+      const senderIdentityAddr = getIbGibAddr({ ibGib: senderIdentity });
+      const senderIdentityTjpAddr = getTjpAddr({ ibGib: senderIdentity });
+      if (!senderIdentityTjpAddr) {
+        throw new Error(`(UNEXPECTED) senderIdentityTjpAddr falsy? (E: d5d8c3ab25a83a2c127904fe96de1526)`);
+      }
       if (!sagaId) {
         throw new Error(`(UNEXPECTED) sagaId falsy? Must be set in initializeOpts before calling establishSessionIdentity. (E: c6ba389d51b8af07d82458f875cf9826)`);
       }
@@ -21139,10 +21417,17 @@ var SyncPeer_V1 = class _SyncPeer_V1 extends LightWitnessBase_V1 {
       if (!this.opts.sessionSyncPoolConfig) {
         throw new Error(`(UNEXPECTED) opts.sessionSyncPoolConfig falsy? (E: dbffa810d9e7ff6079088deb5b8e7826)`);
       }
+      const frameDetails = {
+        senderIdentityAddr,
+        senderIdentityTjpAddr
+      };
+      if (this.opts.targetAddrs) {
+        frameDetails.targetAddrs = this.opts.targetAddrs;
+      }
       const sessionIdentity = await keystoneSvc.genesis({
         masterSecret: sessionSecret,
         configs: [this.opts.sessionConnectPoolConfig, this.opts.sessionSyncPoolConfig],
-        frameDetails: this.opts.targetAddrs ? { targetAddrs: this.opts.targetAddrs } : void 0,
+        frameDetails,
         metaspace: localMetaspace,
         space: localSpace
       });
@@ -21158,7 +21443,7 @@ var SyncPeer_V1 = class _SyncPeer_V1 extends LightWitnessBase_V1 {
         space: localSpace
       });
       await this.postEstablishToReceiver({ newSenderIdentity, sessionIdentity });
-      return sessionIdentity;
+      this.currentSessionIdentity = sessionIdentity;
     } catch (error) {
       console.error(`${lc2} ${extractErrorMsg(error)}`);
       throw error;
@@ -21231,8 +21516,8 @@ var SyncPeer_V1 = class _SyncPeer_V1 extends LightWitnessBase_V1 {
   //         if (logalot) { console.log(`${lc} complete.`); }
   //     }
   // }
-  async authenticateValidateAuthorize({ context, fullSagaHistory }) {
-    const lc2 = `${this.lc}[${this.authenticateValidateAuthorize.name}]`;
+  async authenticateAndValidate({ context }) {
+    const lc2 = `${this.lc}[${this.authenticateAndValidate.name}]`;
     try {
       if (logalot54) {
         console.log(`${lc2} starting... (I: add238055cd84a222c5b8c89913af526)`);
@@ -21241,7 +21526,7 @@ var SyncPeer_V1 = class _SyncPeer_V1 extends LightWitnessBase_V1 {
         throw new Error(`(UNEXPECTED) opts falsy in authenticateValidateAuthorize (E: b7e5a8ad99d84e1ba8d8f7facd288826)`);
       }
       const { localSpace } = this.opts;
-      const authenticationErrors = await authenticateContext({
+      const authenticationErrors = await authenticateContextIntrinsically({
         context,
         space: localSpace
       });
@@ -21252,10 +21537,6 @@ var SyncPeer_V1 = class _SyncPeer_V1 extends LightWitnessBase_V1 {
       if (validationErrors.length > 0) {
         throw new Error(`invalid context received. validationErrors: ${validationErrors} (E: 8b34c875c968af29bc433138e57a7826)`);
       }
-      const authorizationErrors = await authorizeContext({ context, fullSagaHistory });
-      if (authorizationErrors.length > 0) {
-        throw new Error(`invalid context authorization. authorizationErrors: ${authorizationErrors} (E: 8ddc284a758cf10ba829334c1babb826)`);
-      }
     } catch (error) {
       console.error(`${lc2} ${extractErrorMsg(error)}`);
       throw error;
@@ -21286,24 +21567,13 @@ var SyncPeer_V1 = class _SyncPeer_V1 extends LightWitnessBase_V1 {
       if (!context.sagaFrame) {
         throw new Error(`context.sagaFrame falsy. (E: a33dd88aa108e2bad9e885885731ce26)`);
       }
-      const sagaHistory_beforeSend = await getFullSyncSagaHistory({
-        sagaIbGib: context.sagaFrame,
-        space: this.opts.localSpace
-      });
-      await this.authenticateValidateAuthorize({
-        context,
-        fullSagaHistory: sagaHistory_beforeSend
-      });
+      await this.authenticateAndValidate({ context });
       const response = await this.sendContextRequest(context);
       if (response) {
         const sagaHistory_afterSend = await getFullSyncSagaHistory({
           sagaIbGib: context.sagaFrame,
           space: this.opts.localSpace
         });
-        await this.authenticateValidateAuthorize({
-          context,
-          fullSagaHistory: sagaHistory_afterSend
-        });
         return response;
       } else {
         if (logalot54) {
@@ -21354,7 +21624,48 @@ var SyncPeer_V1 = class _SyncPeer_V1 extends LightWitnessBase_V1 {
   }
 };
 
-// ../../libs/core-gib/dist/sync/sync-peer/sync-peer-websocket-receiver/sync-peer-websocket-receiver-v1.mjs
+// ../../libs/core-gib/dist/sync/sync-peer/sync-peer-websocket/sync-peer-websocket-constants.mjs
+var SYNC_WEB_SOCKET_MSG_TYPE_AUTH_CHALLENGE_INIT = "auth-challenge-init";
+var SYNC_WEB_SOCKET_MSG_TYPE_AUTH_INIT = "auth-init";
+var SYNC_WEB_SOCKET_MSG_TYPE_AUTH_CHALLENGE = "auth-challenge";
+var SYNC_WEB_SOCKET_MSG_TYPE_AUTH_PROOF = "auth-proof";
+var SYNC_WEB_SOCKET_MSG_TYPE_AUTH_OK = "auth-ok";
+var SYNC_WEB_SOCKET_MSG_TYPE_AUTH_FAIL = "auth-fail";
+var SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME = "sync-frame";
+var SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME_RESPONSE = "sync-frame-response";
+var SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME_AUTHENTICATED = "sync-frame-authenticated";
+var SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME_RESPONSE_AUTHENTICATED = "sync-frame-response-authenticated";
+var SYNC_WEB_SOCKET_MSG_TYPE_DOMAIN_PAYLOAD = "domain-payload";
+var SYNC_WEB_SOCKET_MSG_TYPE_SYNC_ERROR = "sync-error";
+var SyncWebSocketMsgType = {
+  /** Sent by server/receiver to trigger connection authentication. */
+  auth_challenge_init: SYNC_WEB_SOCKET_MSG_TYPE_AUTH_CHALLENGE_INIT,
+  /** Sent by client/sender to start the authentication handshake with the target session address. */
+  auth_init: SYNC_WEB_SOCKET_MSG_TYPE_AUTH_INIT,
+  /** Sent by server/receiver with dynamic connect challenges to be solved. */
+  auth_challenge: SYNC_WEB_SOCKET_MSG_TYPE_AUTH_CHALLENGE,
+  /** Sent by client/sender with proof of session keystone evolution solving challenges. */
+  auth_proof: SYNC_WEB_SOCKET_MSG_TYPE_AUTH_PROOF,
+  /** Sent by server/receiver signaling successful challenge resolution and upgrade to active sync. */
+  auth_ok: SYNC_WEB_SOCKET_MSG_TYPE_AUTH_OK,
+  /** Sent when authentication fails. */
+  auth_fail: SYNC_WEB_SOCKET_MSG_TYPE_AUTH_FAIL,
+  /** Sent by client/sender to transmit the next sync transaction context without payload ibgibs. */
+  sync_frame: SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME,
+  /** Sent by server/receiver responding with the next sync transaction context. */
+  sync_frame_response: SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME_RESPONSE,
+  /** Sent by server/receiver after context is validated/authenticated to signal payload transmission. */
+  sync_frame_authenticated: SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME_AUTHENTICATED,
+  /** Sent by client/sender after response context is validated/authenticated to signal payload transmission. */
+  sync_frame_response_authenticated: SYNC_WEB_SOCKET_MSG_TYPE_SYNC_FRAME_RESPONSE_AUTHENTICATED,
+  /** Sent to stream a single domain payload ibgib. */
+  domain_payload: SYNC_WEB_SOCKET_MSG_TYPE_DOMAIN_PAYLOAD,
+  /** Sent when a sync runtime execution error occurs. */
+  sync_error: SYNC_WEB_SOCKET_MSG_TYPE_SYNC_ERROR
+};
+var SYNC_WEB_SOCKET_MSG_TYPE_VALID_VALUES = Object.values(SyncWebSocketMsgType);
+
+// ../../libs/core-gib/dist/sync/sync-peer/sync-peer-websocket/sync-peer-websocket-receiver/sync-peer-websocket-receiver-v1.mjs
 var logalot55 = GLOBAL_LOG_A_LOT2 || true;
 var SyncPeerWebSocketReceiver_V1 = class _SyncPeerWebSocketReceiver_V1 extends SyncPeer_V1 {
   lc = `[${_SyncPeerWebSocketReceiver_V1.name}]`;
@@ -21367,6 +21678,11 @@ var SyncPeerWebSocketReceiver_V1 = class _SyncPeerWebSocketReceiver_V1 extends S
   challengeUuid;
   demandedIds;
   sessionS_tjpAddr;
+  // Runtime state variables for delayed payload streaming
+  pendingContext;
+  pendingPayloadAddrs;
+  pendingResponsePayloadsToSend = [];
+  receivedPayloads = [];
   constructor(initialData, initialRel8ns) {
     super(initialData, initialRel8ns);
   }
@@ -21381,13 +21697,13 @@ var SyncPeerWebSocketReceiver_V1 = class _SyncPeerWebSocketReceiver_V1 extends S
     try {
       this.challengeUuid = await getUUID();
       socketWrapper.send(JSON.stringify({
-        type: "auth-challenge-init",
+        type: SyncWebSocketMsgType.auth_challenge_init,
         challengeUuid: this.challengeUuid
       }));
     } catch (error) {
       console.error(`${lc2} failed triggering challenge init: ${extractErrorMsg(error)}`);
       socketWrapper.send(JSON.stringify({
-        type: "auth-fail",
+        type: SyncWebSocketMsgType.auth_fail,
         message: "Internal server connect error"
       }));
     }
@@ -21459,37 +21775,89 @@ var SyncPeerWebSocketReceiver_V1 = class _SyncPeerWebSocketReceiver_V1 extends S
         await this.handleConnectFrame(msg);
         return;
       }
-      if (msg.type === "domain-payload") {
+      if (msg.type === SyncWebSocketMsgType.domain_payload) {
         const ibGib = msg.ibGib;
-        const tempSpace = await this.ensureLocalTempSpace();
-        await putInSpace({ space: tempSpace, ibGibs: [ibGib] });
-      } else if (msg.type === "sync-frame") {
+        const validationErrors = await validateIbGibIntrinsically({ ibGib }) ?? [];
+        if (validationErrors.length > 0) {
+          throw new Error(`controlIbGibs invalid intrinsically. validationErrors: ${validationErrors.join("|")} (E: 5ee1787d4cc53d3d2c55f3d4f2865226)`);
+        }
+        const pendingPayloadAddrs = this.pendingPayloadAddrs;
+        if (this.pendingContext && pendingPayloadAddrs) {
+          const addr = getIbGibAddr({ ibGib });
+          if (pendingPayloadAddrs.has(addr)) {
+            const tempSpace = await this.ensureLocalTempSpace();
+            await putInSpace({ space: tempSpace, ibGibs: [ibGib] });
+            this.receivedPayloads.push(ibGib);
+            pendingPayloadAddrs.delete(addr);
+            if (pendingPayloadAddrs.size === 0 && this.pendingPayloadAddrs !== void 0) {
+              const context = this.pendingContext;
+              context.payloadIbGibsDomain = this.receivedPayloads;
+              this.receivedPayloads = [];
+              this.pendingContext = void 0;
+              this.pendingPayloadAddrs = void 0;
+              await this.executeIncomingSyncRequestAndRespond({ context });
+            }
+          } else {
+            console.warn(`${lc2} received payload not in expected list: ${addr}`);
+          }
+        }
+      } else if (msg.type === SyncWebSocketMsgType.sync_frame) {
         const context = msg.context;
-        const responseCtx = await this.handleIncomingSyncRequest({ context });
-        if (responseCtx) {
-          const responsePayloads = responseCtx.payloadIbGibsDomain ?? [];
-          for (const ibGib of responsePayloads) {
-            this.socketWrapper.send(JSON.stringify({
-              type: "domain-payload",
-              ibGib
-            }));
+        const allControlIbGibs = [
+          toDto2({ ibGib: context }),
+          context.sagaFrame,
+          context.sagaFrameMsg
+        ];
+        if (context.signedSessionIdentity) {
+          allControlIbGibs.push(context.signedSessionIdentity);
+        }
+        for (const controlIbGib of allControlIbGibs) {
+          const validationErrors = await validateIbGibIntrinsically({ ibGib: controlIbGib }) ?? [];
+          if (validationErrors.length > 0) {
+            throw new Error(`controlIbGibs invalid intrinsically. validationErrors: ${validationErrors.join("|")} (E: d40dfa87265a0b73c8ef784d1265ea26)`);
           }
+        }
+        await this.authenticateAndValidate({ context });
+        for (const ibGib of allControlIbGibs) {
+          await putInSpace({ space: this.opts.localSpace, ibGibs: [ibGib] });
+          await registerNewIbGib({ space: this.opts.localSpace, ibGib });
+        }
+        const expectedPayloadAddrs = context.data?.["@payloadAddrsDomain"] || [];
+        if (expectedPayloadAddrs.length > 0) {
+          this.pendingContext = context;
+          this.pendingPayloadAddrs = new Set(expectedPayloadAddrs);
+          this.receivedPayloads = [];
           this.socketWrapper.send(JSON.stringify({
-            type: "sync-frame-response",
-            context: responseCtx
+            type: SyncWebSocketMsgType.sync_frame_authenticated,
+            contextAddr: getIbGibAddr({ ibGib: context })
           }));
         } else {
-          if (logalot55) {
-            console.log(`${lc2} synchronization session completed successfully.`);
-          }
+          await this.executeIncomingSyncRequestAndRespond({ context });
         }
+      } else if (msg.type === SyncWebSocketMsgType.sync_frame_response_authenticated) {
+        const payloads = this.pendingResponsePayloadsToSend || [];
+        this.pendingResponsePayloadsToSend = [];
+        for (const ibGib of payloads) {
+          this.socketWrapper.send(JSON.stringify({
+            type: SyncWebSocketMsgType.domain_payload,
+            ibGib
+          }));
+        }
+      } else {
+        throw new Error(`(UNEXPECTED) msg.type is ${msg.type}? not expected at this time (E: bad7c4fa1958b1976904cb884e624826)`);
       }
     } catch (error) {
       console.error(`${lc2} message frame handling failed: ${extractErrorMsg(error)}`);
-      this.socketWrapper?.send(JSON.stringify({
-        type: this.isAuthenticated ? "sync-error" : "auth-fail",
-        message: extractErrorMsg(error)
-      }));
+      try {
+        this.socketWrapper?.send(JSON.stringify({
+          type: this.isAuthenticated ? SyncWebSocketMsgType.sync_error : SyncWebSocketMsgType.auth_fail,
+          message: extractErrorMsg(error)
+        }));
+      } catch (nestedError) {
+        console.error(`${lc2}[nested catch] failed to send error frame: ${extractErrorMsg(nestedError)}`);
+      } finally {
+        this.socketWrapper?.close();
+      }
     }
   }
   /**
@@ -21499,7 +21867,7 @@ var SyncPeerWebSocketReceiver_V1 = class _SyncPeerWebSocketReceiver_V1 extends S
     const lc2 = `${this.lc}[${this.handleConnectFrame.name}]`;
     const metaspace = this.opts.localMetaspace;
     const space = this.opts.localSpace;
-    if (msg.type === "auth-init") {
+    if (msg.type === SyncWebSocketMsgType.auth_init) {
       const { sAddr } = msg;
       if (logalot55) {
         console.log(`${lc2} auth-init for ${sAddr}`);
@@ -21514,11 +21882,11 @@ var SyncPeerWebSocketReceiver_V1 = class _SyncPeerWebSocketReceiver_V1 extends S
       const past = authorizedS.rel8ns?.past;
       this.sessionS_tjpAddr = past && past.length > 0 ? past[0] : getIbGibAddr({ ibGib: authorizedS });
       this.socketWrapper.send(JSON.stringify({
-        type: "auth-challenge",
+        type: SyncWebSocketMsgType.auth_challenge,
         challengeUuid: this.challengeUuid,
         demandedIds: this.demandedIds
       }));
-    } else if (msg.type === "auth-proof") {
+    } else if (msg.type === SyncWebSocketMsgType.auth_proof) {
       const { proofFrame } = msg;
       if (logalot55) {
         console.log(`${lc2} verifying auth-proof...`);
@@ -21538,57 +21906,54 @@ var SyncPeerWebSocketReceiver_V1 = class _SyncPeerWebSocketReceiver_V1 extends S
         demandedIds: this.demandedIds
       });
       await metaspace.put({ ibGibs: [proofFrame], space });
+      await metaspace.registerNewIbGib({ ibGib: proofFrame, space });
       if (logalot55) {
         console.log(`${lc2} connect validation successful! Connection upgraded to active sync session.`);
       }
       this.isAuthenticated = true;
       this.socketWrapper.send(JSON.stringify({
-        type: "auth-ok"
+        type: SyncWebSocketMsgType.auth_ok
       }));
     } else {
       throw new Error(`Unexpected message type ${msg.type} during connect phase (E: f67a0f47f8426c2b01af5bc3d0146b26)`);
     }
   }
   /**
-   * Executes the transaction turn through the local SyncSagaCoordinator.
+   * Executes the incoming sync request through the local SyncSagaCoordinator and sends response.
    */
-  async handleIncomingSyncRequest({ context, payloadIbGibsControl = [] }) {
-    const lc2 = `${this.lc}[${this.handleIncomingSyncRequest.name}]`;
+  async executeIncomingSyncRequestAndRespond({ context }) {
+    const lc2 = `${this.lc}[${this.executeIncomingSyncRequestAndRespond.name}]`;
     try {
       if (logalot55) {
-        console.log(`${lc2} starting incoming sync turn...`);
+        console.log(`${lc2} executing incoming sync turn...`);
       }
       if (!this.opts) {
         throw new Error(`opts not initialized. (E: 0c98186714e85b9a08bb9d98daada826)`);
       }
       const { localCoordinator, localMetaspace, localSpace } = this.opts;
       const localTempSpace = await this.ensureLocalTempSpace();
-      const allControlIbGibs = [context, ...payloadIbGibsControl];
-      for (const ibGib of allControlIbGibs) {
-        await putInSpace({ space: localSpace, ibGibs: [ibGib] });
-        await registerNewIbGib({ space: localSpace, ibGib });
-      }
-      const authErrors = await authenticateContext({
-        context,
-        space: localSpace
-      });
-      if (authErrors.length > 0) {
-        throw new Error(`Context authentication failed: ${authErrors.join(", ")} (E: 424bd9b03ff8a42df8b1a438ed393726)`);
-      }
-      if (context.payloadIbGibsDomain && context.payloadIbGibsDomain.length > 0) {
-        for (const ibGib of context.payloadIbGibsDomain) {
-          await putInSpace({ space: localTempSpace, ibGibs: [ibGib] });
-        }
-      }
       const responseCtx = await localCoordinator.continueSync({
         sagaContext: context,
         metaspace: localMetaspace,
         mySpace: localSpace,
-        myTempSpace: localTempSpace
+        myTempSpace: localTempSpace,
+        peer: this
       });
-      return responseCtx || void 0;
+      if (responseCtx) {
+        const responsePayloads = responseCtx.payloadIbGibsDomain ?? [];
+        delete responseCtx.payloadIbGibsDomain;
+        this.pendingResponsePayloadsToSend = responsePayloads;
+        this.socketWrapper.send(JSON.stringify({
+          type: SyncWebSocketMsgType.sync_frame_response,
+          context: responseCtx
+        }));
+      } else {
+        if (logalot55) {
+          console.log(`${lc2} synchronization session completed successfully.`);
+        }
+      }
     } catch (error) {
-      console.error(`${lc2} handleIncomingSyncRequest turn execution failed: ${extractErrorMsg(error)}`);
+      console.error(`${lc2} executeIncomingSyncRequestAndRespond failed: ${extractErrorMsg(error)}`);
       throw error;
     }
   }
@@ -21701,7 +22066,7 @@ async function appendToTimeline({ timeline, rel8nInfos, rel8nRemovalInfos, timel
           skipLock
         });
       }
-      metaspace.registerNewIbGib({ ibGib: newTimelineIbGib2, space });
+      await metaspace.registerNewIbGib({ ibGib: newTimelineIbGib2, space });
       return newTimelineIbGib2;
     };
     const newTimelineIbGib = skipLock ? await fn() : await execInSpaceWithLocking({
@@ -22168,7 +22533,7 @@ var KeystoneConfigBuilderBase = class {
       replenish: this._replenish,
       selectSequentially: this._seq,
       selectRandomly: this._rand,
-      targetBindingChars: this._targetBinding
+      targetBindingCount: this._targetBinding
     };
   }
   /**
@@ -22263,8 +22628,8 @@ function createStandardPoolConfig(opts) {
 }
 
 // ../../libs/core-gib/dist/sync/sync-saga-coordinator.mjs
-var logalot58 = GLOBAL_LOG_A_LOT2;
-var logalotControlDomain = false;
+var logalot58 = GLOBAL_LOG_A_LOT2 || true;
+var logalotControlDomain = true;
 var lcControlDomain = "[ControlDomain]";
 var SyncSagaCoordinator = class _SyncSagaCoordinator {
   lc = `[${_SyncSagaCoordinator.name}]`;
@@ -22369,7 +22734,7 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
           sessionSyncPoolConfig: this.defaultSessionSyncPoolConfig(),
           targetAddrs
         });
-        const sessionIdentity = await peer.establishSessionIdentity();
+        await peer.establishSessionIdentity();
         await peer.connect({ sagaId });
         const { initFrame, initDomainGraph } = await this.createInitFrame({
           sagaId,
@@ -22377,7 +22742,8 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
           conflictStrategy,
           metaspace,
           localSpace,
-          tempSpace
+          tempSpace,
+          peer
         });
         await this.executeSagaLoop({
           initFrame,
@@ -22417,7 +22783,7 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
    * @returns next context result if another round, else if commit returns
    * null
    */
-  async continueSync({ sagaContext, mySpace, myTempSpace, metaspace }) {
+  async continueSync({ sagaContext, mySpace, myTempSpace, metaspace, peer }) {
     const lc2 = `${this.lc}[${this.continueSync.name}]`;
     try {
       if (logalot58) {
@@ -22447,7 +22813,10 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
         sagaFrame: frame,
         localSpace: mySpace,
         payloadIbGibsDomain,
-        metaspace
+        metaspace,
+        sessionIdentityAddr: sagaContext.rel8ns?.sessionIdentity?.[0],
+        peer,
+        skipSign: true
       });
       const immediateValidationErrors = await validateContextAndSagaFrame({
         context: responseCtx
@@ -22513,102 +22882,116 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
           await subscription.unsubscribe();
         }
       }));
-      const requestCtx = await this.createSyncSagaContext({
-        sagaFrame: currentFrame,
-        /**
-         * init frame: empty
-         * ack frame: possible push offers
-         * delta frame: requested ibgibs or commit offer
-         * commit frame: empty
-         */
-        payloadIbGibsDomain: nextDomainIbGibs,
-        localSpace,
-        metaspace
-      });
-      if (logalotControlDomain) {
-        const domainAddrs = nextDomainIbGibs.map((p) => getIbGibAddr({ ibGib: p }));
-        console.log(`${lc2}${lcControlDomain} SENDER TRANSMIT -> peer.witness (I: 5b0081803698770f0bf64992220b312)`);
-        console.log(`${lc2}${lcControlDomain}   Context: ${getIbGibAddr({ ibGib: requestCtx })}`);
-        console.log(`${lc2}${lcControlDomain}   Frame: ${getIbGibAddr({ ibGib: currentFrame })}`);
-        console.log(`${lc2}${lcControlDomain}   DOMAIN Payloads (${domainAddrs.length}): ${domainAddrs.join(", ") || "(none)"}`);
-      }
-      updates$.next(requestCtx);
-      peer.setOptionalOpts({ localSpace, localTempSpace: tempSpace });
-      const responseCtx = await peer.witness(requestCtx);
-      if (!responseCtx) {
-        if (currentFrame) {
-          const msg = await getSyncSagaMessageFromFrame({ frameIbGib: currentFrame, space: localSpace });
-          if (msg?.data?.stage === SyncStage.commit) {
-            if (logalot58) {
-              console.log(`${lc2} Sender sent Commit. Peer returned no response. Saga Complete. (I: 26f9ee073858ca78b8284753368b5226)`);
+      try {
+        const requestCtx = await this.createSyncSagaContext({
+          sagaFrame: currentFrame,
+          /**
+           * init frame: empty
+           * ack frame: possible push offers
+           * delta frame: requested ibgibs or commit offer
+           * commit frame: empty
+           */
+          payloadIbGibsDomain: nextDomainIbGibs,
+          localSpace,
+          metaspace,
+          sessionIdentityAddr: peer.currentSessionIdentityAddr,
+          peer
+        });
+        if (logalotControlDomain) {
+          const domainAddrs = nextDomainIbGibs.map((p) => getIbGibAddr({ ibGib: p }));
+          console.log(`${lc2}${lcControlDomain} SENDER TRANSMIT -> peer.witness (I: 5b0081803698770f0bf64992220b312)`);
+          console.log(`${lc2}${lcControlDomain}   Context: ${getIbGibAddr({ ibGib: requestCtx })}`);
+          console.log(`${lc2}${lcControlDomain}   Frame: ${getIbGibAddr({ ibGib: currentFrame })}`);
+          console.log(`${lc2}${lcControlDomain}   DOMAIN Payloads (${domainAddrs.length}): ${domainAddrs.join(", ") || "(none)"}`);
+        }
+        updates$.next(requestCtx);
+        peer.setOptionalOpts({ localSpace, localTempSpace: tempSpace });
+        const responseCtx = await peer.witness(requestCtx);
+        if (!responseCtx) {
+          if (currentFrame) {
+            const msg = await getSyncSagaMessageFromFrame({ frameIbGib: currentFrame, space: localSpace });
+            if (msg?.data?.stage === SyncStage.commit) {
+              if (logalot58) {
+                console.log(`${lc2} Sender sent Commit. Peer returned no response. Saga Complete. (I: 26f9ee073858ca78b8284753368b5226)`);
+              }
+              currentFrame = null;
+              break;
+            } else {
+              throw new Error(`(UNEXPECTED) responseCtx falsy and currentFrame truthy, but we're not in the commit stage? This may be expected ultimately, but atow I am not seeing this as being expected. (E: cc34498962bd370deeff351fac939f26)`);
             }
-            currentFrame = null;
-            break;
           } else {
-            throw new Error(`(UNEXPECTED) responseCtx falsy and currentFrame truthy, but we're not in the commit stage? This may be expected ultimately, but atow I am not seeing this as being expected. (E: cc34498962bd370deeff351fac939f26)`);
+            throw new Error(`(UNEXPECTED) no response and currentFrame falsy? (E: 8d1085ea2f28cfc3f9c922649864a826)`);
           }
-        } else {
-          throw new Error(`(UNEXPECTED) no response and currentFrame falsy? (E: 8d1085ea2f28cfc3f9c922649864a826)`);
         }
-      }
-      if (!responseCtx.data) {
-        throw new Error(`(UNEXPECTED) responseCtx.data falsy? (E: a969992bae53ab18a827ec58aec15826)`);
-      }
-      updates$.next(responseCtx);
-      const contextAndSagaFrameValidationErrors = await validateContextAndSagaFrame({ context: responseCtx });
-      if (contextAndSagaFrameValidationErrors.length > 0) {
-        throw new Error(`contextAndSagaFrameValidationErrors: ${contextAndSagaFrameValidationErrors} (E: 6eebe8e7fa437c00a8cde3ada3c66826)`);
-      }
-      const responsePayloadAddrsDomain = responseCtx.data[SYNC_SAGA_PAYLOAD_ADDRS_DOMAIN] || [];
-      if (responsePayloadAddrsDomain.length > 0) {
-        responseCtx.payloadIbGibsDomain = await this.pollForDomainPayloads({
-          expectedAddrs: responsePayloadAddrsDomain,
-          pollIntervalMs: 20,
-          // relatively arbitrary right now
-          domainPayloadsMap,
-          tempSpace
+        if (!responseCtx.data) {
+          throw new Error(`(UNEXPECTED) responseCtx.data falsy? (E: a969992bae53ab18a827ec58aec15826)`);
+        }
+        updates$.next(responseCtx);
+        const contextAndSagaFrameValidationErrors = await validateContextAndSagaFrame({ context: responseCtx });
+        if (contextAndSagaFrameValidationErrors.length > 0) {
+          throw new Error(`contextAndSagaFrameValidationErrors: ${contextAndSagaFrameValidationErrors} (E: 6eebe8e7fa437c00a8cde3ada3c66826)`);
+        }
+        const returnContextErrors = await this.validateReturnContext({
+          requestCtx,
+          responseCtx,
+          localSpace
         });
-      }
-      if (!responseCtx.sagaFrame) {
-        throw new Error(`(UNEXPECTED) responseCtx.sagaFrame falsy? the Peer should have set this when it got the response back from the remote. (E: e650adadf9a2063ec6764a1e31d3d826)`);
-      }
-      if (logalotControlDomain) {
-        const responseControlAddrs = responseCtx.data?.["@payloadAddrsControl"] || [];
-        console.log(`${lc2}${lcControlDomain} SENDER RECEIVED <- peer.witness (I: 3dc76a9744d89a4fc3e2f076c2be4826)`);
-        console.log(`${lc2}${lcControlDomain}   Response Context: ${getIbGibAddr({ ibGib: responseCtx })}`);
-        console.log(`${lc2}${lcControlDomain}   Response Saga Frame: ${getIbGibAddr({ ibGib: responseCtx.sagaFrame })}`);
-        console.log(`${lc2}${lcControlDomain}   CONTROL Payloads (${responseControlAddrs.length}): ${responseControlAddrs.join(", ") || "(none)"}`);
-        console.log(`${lc2}${lcControlDomain}   DOMAIN Payloads (${responsePayloadAddrsDomain.length}): ${responsePayloadAddrsDomain.join(", ") || "(none)"}`);
-      }
-      const contextResult = await this.handleResponseSagaContext({
-        sagaContext: responseCtx,
-        initDomainGraph,
-        mySpace: localSpace,
-        myTempSpace: tempSpace,
-        metaspace
-      });
-      if (!contextResult) {
-        console.error(`${lc2} NAG ERROR (DOES NOT THROW): does this ever hit now? (E: e04d02efc2a8e72a88b79f1f0f95ca26)`);
-        break;
-      } else if (contextResult.nextFrameInfo?.sagaComplete) {
-        if (logalot58) {
-          console.log(`${lc2} Handler returned null (Saga End). (I: 123bf9e7dca8886de72553a8d4f29e26)`);
+        if (returnContextErrors.length > 0) {
+          throw new Error(`validateReturnContext errors: ${returnContextErrors.join(", ")} (E: cb8a023b9d0728cceb09fa3da0bb8226)`);
+        }
+        const responsePayloadAddrsDomain = responseCtx.data[SYNC_SAGA_PAYLOAD_ADDRS_DOMAIN] || [];
+        if (responsePayloadAddrsDomain.length > 0) {
+          responseCtx.payloadIbGibsDomain = await this.pollForDomainPayloads({
+            expectedAddrs: responsePayloadAddrsDomain,
+            pollIntervalMs: 20,
+            // relatively arbitrary right now
+            domainPayloadsMap,
+            tempSpace
+          });
         }
-        break;
-      }
-      if (contextResult.errorMsg) {
-        throw new Error(`Couldn't handle response saga context. errorMsg: ${contextResult.errorMsg} (E: c948e81d513b2a0eb8b8afa878edc626)`);
-      } else if (!contextResult.nextFrameInfo) {
-        throw new Error(`(UNEXPECTED) contextResult.nextFrameInfo falsy? (E: c287a82e823e662a77923278e2418826)`);
-      }
-      const { frame, payloadIbGibsDomain } = contextResult.nextFrameInfo;
-      currentFrame = frame;
-      nextDomainIbGibs = [...payloadIbGibsDomain || []];
-      if (logalotControlDomain) {
-        const handlerDomainAddrs = nextDomainIbGibs.map((p) => getIbGibAddr({ ibGib: p }));
-        console.log(`${lc2}${lcControlDomain} HANDLER RESULT -> next iteration (I: 6b0d88c4c28857ccd812381515bd7826)`);
-        console.log(`${lc2}${lcControlDomain}   Next Frame: ${getIbGibAddr({ ibGib: currentFrame })}`);
-        console.log(`${lc2}${lcControlDomain}   DOMAIN for next (${handlerDomainAddrs.length}): ${handlerDomainAddrs.join(", ") || "(none)"}`);
+        if (!responseCtx.sagaFrame) {
+          throw new Error(`(UNEXPECTED) responseCtx.sagaFrame falsy? the Peer should have set this when it got the response back from the remote. (E: e650adadf9a2063ec6764a1e31d3d826)`);
+        }
+        if (logalotControlDomain) {
+          const responseControlAddrs = responseCtx.data?.["@payloadAddrsControl"] || [];
+          console.log(`${lc2}${lcControlDomain} SENDER RECEIVED <- peer.witness (I: 3dc76a9744d89a4fc3e2f076c2be4826)`);
+          console.log(`${lc2}${lcControlDomain}   Response Context: ${getIbGibAddr({ ibGib: responseCtx })}`);
+          console.log(`${lc2}${lcControlDomain}   Response Saga Frame: ${getIbGibAddr({ ibGib: responseCtx.sagaFrame })}`);
+          console.log(`${lc2}${lcControlDomain}   CONTROL Payloads (${responseControlAddrs.length}): ${responseControlAddrs.join(", ") || "(none)"}`);
+          console.log(`${lc2}${lcControlDomain}   DOMAIN Payloads (${responsePayloadAddrsDomain.length}): ${responsePayloadAddrsDomain.join(", ") || "(none)"}`);
+        }
+        const contextResult = await this.handleResponseSagaContext({
+          sagaContext: responseCtx,
+          initDomainGraph,
+          mySpace: localSpace,
+          myTempSpace: tempSpace,
+          metaspace
+        });
+        if (!contextResult) {
+          console.error(`${lc2} NAG ERROR (DOES NOT THROW): does this ever hit now? (E: e04d02efc2a8e72a88b79f1f0f95ca26)`);
+          break;
+        } else if (contextResult.nextFrameInfo?.sagaComplete) {
+          if (logalot58) {
+            console.log(`${lc2} Handler returned null (Saga End). (I: 123bf9e7dca8886de72553a8d4f29e26)`);
+          }
+          break;
+        }
+        if (contextResult.errorMsg) {
+          throw new Error(`Couldn't handle response saga context. errorMsg: ${contextResult.errorMsg} (E: c948e81d513b2a0eb8b8afa878edc626)`);
+        } else if (!contextResult.nextFrameInfo) {
+          throw new Error(`(UNEXPECTED) contextResult.nextFrameInfo falsy? (E: c287a82e823e662a77923278e2418826)`);
+        }
+        const { frame, payloadIbGibsDomain } = contextResult.nextFrameInfo;
+        currentFrame = frame;
+        nextDomainIbGibs = [...payloadIbGibsDomain || []];
+        if (logalotControlDomain) {
+          const handlerDomainAddrs = nextDomainIbGibs.map((p) => getIbGibAddr({ ibGib: p }));
+          console.log(`${lc2}${lcControlDomain} HANDLER RESULT -> next iteration (I: 6b0d88c4c28857ccd812381515bd7826)`);
+          console.log(`${lc2}${lcControlDomain}   Next Frame: ${getIbGibAddr({ ibGib: currentFrame })}`);
+          console.log(`${lc2}${lcControlDomain}   DOMAIN for next (${handlerDomainAddrs.length}): ${handlerDomainAddrs.join(", ") || "(none)"}`);
+        }
+      } finally {
+        await subscription.unsubscribe();
       }
     }
   }
@@ -22623,7 +23006,7 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
    * the other ibgibs that are related to this context stone should already be
    * put/registered in {@link localSpace}.
    */
-  async createSyncSagaContext({ sagaFrame, payloadIbGibsDomain, metaspace, localSpace }) {
+  async createSyncSagaContext({ sagaFrame, payloadIbGibsDomain, metaspace, localSpace, sessionIdentityAddr, peer, skipSign }) {
     const lc2 = `[${this.createSyncSagaContext.name}]`;
     try {
       if (logalot58) {
@@ -22650,6 +23033,18 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
       const rel8ns = {
         sagaFrame: [getIbGibAddr({ ibGib: sagaFrame })]
       };
+      let sessionIdentity = void 0;
+      if (sessionIdentityAddr) {
+        sessionIdentityAddr = await metaspace.getLatestAddr({ addr: sessionIdentityAddr, space: localSpace }) ?? sessionIdentityAddr;
+        const resGet = await getFromSpace({ addr: sessionIdentityAddr, space: localSpace });
+        if (resGet.success && resGet.ibGibs?.length === 1) {
+          sessionIdentity = resGet.ibGibs[0];
+          rel8ns.sessionIdentity = [sessionIdentityAddr];
+        } else {
+          debugger;
+          throw new Error(`Couldn't get sessionIdentityAddr (${sessionIdentityAddr}) in space: ${localSpace.ib} (E: 5c29e80d68dbd1749866c358be093826)`);
+        }
+      }
       const ib = await getSyncSagaContextIb({ data });
       const contextIbGib = await Factory_V1.stone({
         parentPrimitiveIb: SYNC_SAGA_CONTEXT_ATOM,
@@ -22657,6 +23052,11 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
         data,
         rel8ns
       });
+      const contextAddr = getIbGibAddr({ ibGib: contextIbGib });
+      let signedSessionIdentity = void 0;
+      if (sessionIdentity && !skipSign) {
+        signedSessionIdentity = await peer.signContext({ contextAddr });
+      }
       await putInSpace({ ibGib: contextIbGib, space: localSpace });
       await registerNewIbGib({
         ibGib: contextIbGib,
@@ -22664,9 +23064,20 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
         fnBroadcast: void 0
       });
       contextIbGib.sagaFrame = sagaFrame;
+      const { msgStones } = await getSyncSagaFrameDependencyGraph({
+        sagaIbGib: sagaFrame,
+        localSpace
+      });
+      if (msgStones.length !== 1) {
+        throw new Error(`(UNEXPECTED) msgStones.length !== 1 inside createSyncSagaContext? (E: a98165cf46ab4e82b7bd5e45a273b826)`);
+      }
+      contextIbGib.sagaFrameMsg = msgStones[0];
       if (payloadIbGibsDomain && payloadIbGibsDomain.length > 0) {
         contextIbGib.payloadIbGibsDomain = payloadIbGibsDomain;
       }
+      if (signedSessionIdentity) {
+        contextIbGib.signedSessionIdentity = signedSessionIdentity;
+      }
       return contextIbGib;
     } catch (error) {
       console.error(`${lc2} ${extractErrorMsg(error)}`);
@@ -22753,7 +23164,7 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
    * Generates the first frame containing the Knowledge Map of the Local Space.
    * This is sent to the Receiver to begin Gap Analysis.
    */
-  async createInitFrame({ sagaId, domainIbGibs, conflictStrategy, metaspace, localSpace, tempSpace }) {
+  async createInitFrame({ sagaId, domainIbGibs, conflictStrategy, metaspace, localSpace, tempSpace, peer }) {
     const lc2 = `${this.lc}[${this.createInitFrame.name}]`;
     try {
       if (logalot58) {
@@ -22788,7 +23199,8 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
         msgStones: [initStone],
         conflictStrategy,
         metaspace,
-        localSpace
+        localSpace,
+        sessionIdentity: peer.currentSessionIdentity
       });
       if (logalot58) {
         console.log(`${lc2} sagaFrame (init): ${pretty(sagaFrame)} (I: b3d6a8be69248f18713cc3073cb08626)`);
@@ -22803,6 +23215,39 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
       }
     }
   }
+  /**
+   * Validates that the return context received from a peer is a valid
+   * continuation of the outbound context and that the session identity
+   * is consistent.
+   */
+  async validateReturnContext({ requestCtx, responseCtx, localSpace }) {
+    const lc2 = `${this.lc}[${this.validateReturnContext.name}]`;
+    const errors = [];
+    try {
+      if (requestCtx.sagaFrame && responseCtx.sagaFrame) {
+        const requestFrameAddr = getIbGibAddr({ ibGib: requestCtx.sagaFrame });
+        const responseFrameAddr = getIbGibAddr({ ibGib: responseCtx.sagaFrame });
+        const isContinuation = await isPastFrame({
+          olderAddr: requestFrameAddr,
+          newerAddr: responseFrameAddr,
+          space: localSpace
+        });
+        if (!isContinuation) {
+          errors.push(`Response saga frame (${responseFrameAddr}) is not a valid continuation of request saga frame (${requestFrameAddr}). (E: 2c85e8d97318ff24ac8a02bd3a068226)`);
+        }
+      } else {
+        errors.push(`Missing sagaFrame on requestCtx or responseCtx. (E: b65c68ff891000ddca8d22384a088226)`);
+      }
+      const expectedSessionIdAddr = requestCtx.signedSessionIdentity ? getIbGibAddr({ ibGib: requestCtx.signedSessionIdentity }) : requestCtx.rel8ns?.sessionIdentity?.[0];
+      const responseSessionIdAddr = responseCtx.rel8ns?.sessionIdentity?.[0];
+      if (expectedSessionIdAddr !== responseSessionIdAddr) {
+        errors.push(`Session identity mismatch. Expected ${expectedSessionIdAddr}, got ${responseSessionIdAddr}. (E: ab98716bca88d2243cc822187768226)`);
+      }
+    } catch (error) {
+      errors.push(`Error during validateReturnContext: ${extractErrorMsg(error)} (E: da878e1239aa88ee27bdfca005c28226)`);
+    }
+    return errors;
+  }
   /**
    * Helper to poll for streaming domain payloads and put them in the
    * local {@link tempSpace}.
@@ -22816,7 +23261,8 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
         console.log(`${lc2} starting... (I: 26dce86bfca572939885798802d6e926)`);
       }
       let resultDomainPayloads = [];
-      let pending = [...expectedAddrs];
+      const uniqueExpectedAddrs = [...new Set(expectedAddrs)];
+      let pending = [...uniqueExpectedAddrs];
       const start = Date.now();
       const timeoutMs = 5 * 60 * 1e3;
       while (pending.length > 0) {
@@ -22842,8 +23288,8 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
           await delay(pollIntervalMs);
         }
       }
-      if (expectedAddrs.length !== resultDomainPayloads.length) {
-        throw new Error(`(UNEXPECTED) expectedAddrs.length !== resultDomainPayloads.length? at this point, we expect all of the payload ibgibs to have been received. (E: 03749a7478c4b8b28bfc86951887a826)`);
+      if (uniqueExpectedAddrs.length !== resultDomainPayloads.length) {
+        throw new Error(`(UNEXPECTED) uniqueExpectedAddrs.length !== resultDomainPayloads.length? at this point, we expect all of the payload ibgibs to have been received. (E: 03749a7478c4b8b28bfc86951887a826)`);
       }
       return resultDomainPayloads;
     } catch (error) {
@@ -23293,11 +23739,11 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
         throw new Error(`${lc2} Peer reported terminal conflicts. (E: 23a0096ee05a2ccfa89334e8f156b426)`);
       }
       const outgoingPayloadIbGibsDomain_conflicts = [];
+      const activeConflicts = [];
       if (conflicts.length > 0) {
         if (logalot58) {
           console.log(`${lc2} [CONFLICT DEBUG] Processing ${conflicts.length} non-terminal conflicts`);
         }
-        proposeCommit = false;
         for (const conflict of conflicts) {
           const {
             receiverTipAddr,
@@ -23356,13 +23802,26 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
             const deltaPayloadIbGib = deltaGraph[deltaPayloadAddr];
             outgoingPayloadIbGibsDomain_conflicts.push(deltaPayloadIbGib);
           });
-          if (conflict.accretivePayloadAddrs) {
-            throw new Error(`(UNEXPECTED) conflict.accretivePayloadAddrs already truthy? This is expected to be falsy at this point in the sync. (E: 6b6b1846779867849cbde208f4374326)`);
+          const isFastForward = latestCommonFrameAddr === receiverTipAddr;
+          if (isFastForward) {
+            if (logalot58) {
+              console.log(`${lc2} [CONFLICT DEBUG] TJP ${tjpAddr}: Fast-forward detected (receiver behind sender). Excluding from active conflicts and sending delta payload.`);
+            }
+          } else {
+            if (conflict.accretivePayloadAddrs) {
+              throw new Error(`(UNEXPECTED) conflict.accretivePayloadAddrs already truthy? This is expected to be falsy at this point in the sync. (E: 6b6b1846779867849cbde208f4374326)`);
+            }
+            conflict.accretivePayloadAddrs = accretivePayloadAddrs;
+            activeConflicts.push(conflict);
           }
-          conflict.accretivePayloadAddrs = accretivePayloadAddrs;
+        }
+        if (activeConflicts.length > 0) {
+          proposeCommit = false;
+        } else {
+          proposeCommit = true;
         }
         if (logalot58) {
-          console.log(`${lc2} [CONFLICT DEBUG] Finished processing ${conflicts.length} conflicts. outgoingPayloadIbGibsDomain_conflicts.length (total outgoing payload ibgibs for ALL conflicts): ${outgoingPayloadIbGibsDomain_conflicts.length}`);
+          console.log(`${lc2} [CONFLICT DEBUG] Finished processing ${conflicts.length} conflicts. Active (divergent) conflicts: ${activeConflicts.length}. outgoingPayloadIbGibsDomain_conflicts.length (total outgoing payload ibgibs for ALL conflicts): ${outgoingPayloadIbGibsDomain_conflicts.length}`);
         }
       } else {
         if (logalot58) {
@@ -23391,7 +23850,7 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
         /**
          * these are the modified conflicts with additional information.
          */
-        conflicts,
+        conflicts: activeConflicts,
         /**
          * we're sending these domain ibgibs as payload (they were
          * requested by receiver and/or they are being sent as delta
@@ -24090,7 +24549,7 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
   /**
    * Evolves the saga timeline with a new frame.
    */
-  async evolveSyncSagaIbGib({ prevSagaIbGib, conflictStrategy, msgStones, localSpace, metaspace }) {
+  async evolveSyncSagaIbGib({ prevSagaIbGib, conflictStrategy, msgStones, localSpace, metaspace, sessionIdentity }) {
     const lc2 = `${this.lc}[${this.evolveSyncSagaIbGib.name}]`;
     try {
       if (!msgStones || msgStones.length === 0) {
@@ -24148,6 +24607,13 @@ var SyncSagaCoordinator = class _SyncSagaCoordinator {
           isTjp: true,
           conflictStrategy
         };
+        if (sessionIdentity) {
+          const sessionIdentityTjpAddr = getTjpAddr({ ibGib: sessionIdentity });
+          if (!sessionIdentityTjpAddr) {
+            throw new Error(`(UNEXPECTED) sessionIdentity is truthy but sessionIdentityTjpAddr falsy? (E: f52004c10288987a6886f4e8fdf90826)`);
+          }
+          data.sessionIdentityTjpAddr = sessionIdentityTjpAddr;
+        }
         const ib = await getSyncIb({ data });
         const stoneAddrs = msgStones.map((s) => getIbGibAddr({ ibGib: s }));
         const rel8ns = { [SYNC_MSG_REL8N_NAME]: stoneAddrs };
@@ -24314,9 +24780,26 @@ var SyncUpgradeHandlerBase = class _SyncUpgradeHandlerBase extends ServeGibHandl
         sagaId: void 0
         // Resolved dynamically inside runtime turns
       });
+      socket.on("error", (err) => {
+        if (logalot59) {
+          console.warn(`[SyncUpgradeHandlerBase] Socket error: ${extractErrorMsg(err)}`);
+        }
+        try {
+          socket.destroy();
+        } catch (e) {
+        }
+      });
       const socketWrapper = {
         send(data) {
-          socket.write(encodeTextFrame(data));
+          if (socket.writable) {
+            try {
+              socket.write(encodeTextFrame(data));
+            } catch (e) {
+              if (logalot59) {
+                console.warn(`[SyncUpgradeHandlerBase] failed to write message frame: ${extractErrorMsg(e)}`);
+              }
+            }
+          }
         },
         onMessage(callback) {
           const decoder = new WebSocketFrameDecoder();
@@ -24332,13 +24815,27 @@ var SyncUpgradeHandlerBase = class _SyncUpgradeHandlerBase extends ServeGibHandl
               if (logalot59) {
                 console.warn(`[SyncUpgradeHandlerBase] closing connection due to decoder error: ${extractErrorMsg(error)}`);
               }
-              socket.write(encodeCloseFrame());
+              if (socket.writable) {
+                try {
+                  socket.write(encodeCloseFrame());
+                } catch (e) {
+                }
+              }
               socket.end();
             }
           });
         },
         onClose(callback) {
           socket.on("close", callback);
+        },
+        close() {
+          if (socket.writable) {
+            try {
+              socket.write(encodeCloseFrame());
+            } catch (e) {
+            }
+          }
+          socket.end();
         }
       };
       await receiverPeer.bindSocket(socketWrapper);
@@ -24351,7 +24848,9 @@ var SyncUpgradeHandlerBase = class _SyncUpgradeHandlerBase extends ServeGibHandl
   }
   async parseParamsImpl(reqCtx) {
     const match = reqCtx.pathname.match(this.regex);
-    if (!match) return void 0;
+    if (!match) {
+      return void 0;
+    }
     const domainIb = decodeURIComponent(match[1]);
     const domainGib = decodeURIComponent(match[2]);
     const domainAddr = getIbGibAddr({ ib: domainIb, gib: domainGib });