@abide/abide 0.112.0 → 0.114.0

package/src/compiler/emitClient.ts

@@ -7,6 +7,11 @@ import {
 } from '#shared/ANCHORS.ts'
 import { anchorMarkup } from '#shared/anchorMarkup.ts'
 import { CHILDREN } from '#shared/CHILDREN.ts'
+import { FOREIGN_ATTRIBUTES } from '#shared/FOREIGN_ATTRIBUTES.ts'
+import {
+    HTML_NAMESPACE,
+    INTEGRATION_POINTS,
+} from '#shared/INTEGRATION_POINTS.ts'
 import { RUNTIME_SPECIFIER, SHARED_SPECIFIER } from '#shared/SPECIFIERS.ts'
 import { type CheckerAnswer, UNCHECKED } from './CheckerAnswer.ts'
 import {
@@ -880,6 +885,9 @@ const SHARE_AT = '__shareAt'
 const PARENT = '__parent'
 // The document a built region makes its nodes with, read off `PARENT` once a build.
 const DOCUMENT = '__document'
+// The namespace a built region's top-level elements take, read off `PARENT` once a build.
+const SPACE = '__space'
+const HTML_SPACE = JSON.stringify(HTML_NAMESPACE)
 
 // A run's anchors while it holds markup (32.30), as the JS string literals a built run parses with.
 const RAW_OPEN_MARKUP = JSON.stringify(anchorMarkup(RAW_OPEN))
@@ -942,17 +950,29 @@ function emitMaker(
  *
  * A NESTED REGION IS AN EMPTY ANCHOR PAIR, filled by its own machinery on the mount's first run
  * (`fillEmpty`), and a component or a slot is the same pair filled by the child.
+ *
+ * 32.70 — AN ELEMENT IS BUILT IN THE NAMESPACE THE PARSER WOULD GIVE IT, read off the parent it goes
+ * into (`namespaceUnder`) rather than decided here: a component's root does not know it is invoked
+ * inside an `<svg>`, and a `<g>` made with `createElement` is an HTML element that draws nothing.
+ * Read once a build, and again only below an `<annotation-xml>`, which reads its children as HTML by
+ * the encoding it declares; below any other integration point (`INTEGRATION_POINTS`) a child is
+ * HTML's, and everywhere else it takes its parent's. `createElementNS` with
+ * HTML's namespace costs what `createElement` does (Chromium, 2026-10-22), and a build that makes
+ * no top-level element reads none.
  */
 function emitBuild(row: Cursor, anchored: boolean, lowering: Lowering): string {
     const lines: string[] = [
         `const ${DOCUMENT} = ${PARENT}.ownerDocument`,
         'const __built = []',
     ]
+    let readsSpace = false
     if (anchored)
         lines.push(
             `__built.push(${DOCUMENT}.createComment(${JSON.stringify(ROW_OPEN)}))`,
         )
     const render = buildRender(lowering)
+    // The expression each built element's namespace was, for its children to take.
+    const spaceOf = new Map<PlacedNode, string>()
     const into = (at: PlacedNode, node: string): string =>
         at.within === null
             ? `__built.push(${node})`
@@ -975,8 +995,19 @@ function emitBuild(row: Cursor, anchored: boolean, lowering: Lowering): string {
             for (const line of builtRun(at, lowering, into)) lines.push(line)
             continue
         }
+        const within = at.within
+        const space =
+            within === null
+                ? SPACE
+                : INTEGRATION_POINTS.has(within.tag)
+                  ? HTML_SPACE
+                  : within.tag === 'annotation-xml'
+                    ? `${lowering.use('namespaceUnder')}(${within.name})`
+                    : (spaceOf.get(within) ?? SPACE)
+        if (space === SPACE) readsSpace = true
+        spaceOf.set(at, space)
         lines.push(
-            `const ${at.name} = ${DOCUMENT}.createElement(${JSON.stringify(at.tag)})`,
+            `const ${at.name} = ${DOCUMENT}.createElementNS(${space}, ${JSON.stringify(at.tag)})`,
         )
         for (const one of classifyAttributes(
             at.holder as ElementNode,
@@ -984,7 +1015,13 @@ function emitBuild(row: Cursor, anchored: boolean, lowering: Lowering): string {
         )) {
             const value = builtAttribute(one, lowering, render)
             if (value === null) continue
-            const set = `${at.name}.setAttribute(${JSON.stringify(one.kind === 'merged' ? one.group?.name : one.attribute.name)}, `
+            const name =
+                one.kind === 'merged' ? one.group?.name : one.attribute.name
+            // 32.70 — one the parser would put in a namespace is written in it (`addAttribute`).
+            const set =
+                name !== undefined && FOREIGN_ATTRIBUTES.has(name)
+                    ? `${lowering.use('addAttribute')}(${at.name}, ${JSON.stringify(name)}, `
+                    : `${at.name}.setAttribute(${JSON.stringify(name)}, `
             // 32.37 — a whole-value attribute may be absent, which the server wrote as nothing.
             lines.push(
                 one.kind === 'dynamic'
@@ -994,6 +1031,12 @@ function emitBuild(row: Cursor, anchored: boolean, lowering: Lowering): string {
         }
         lines.push(into(at, at.name))
     }
+    if (readsSpace)
+        lines.splice(
+            1,
+            0,
+            `const ${SPACE} = ${lowering.use('namespaceUnder')}(${PARENT})`,
+        )
     lines.push('return __built')
     return lines.join('\n    ')
 }

package/src/server/bridgeRelay.ts

@@ -8,9 +8,10 @@
 //   POST /__abide/bridge          what the bridge reports, one frame per line: a turn's events, the
 //                                 MCP requests its Claude Code made, the turn's end or failure.
 //
-// A PAIRING IS TO A BROWSER — the `abide-caller` its page carries (26.5) — for as long as the bridge's
-// stream is open, or resumable. HELD IN THIS PROCESS: an app served by several needs a visitor's requests to reach
-// the one its bridge dialed.
+// A PAIRING IS TO A BROWSER — the `abide-caller` its page carries (26.5) — and to whoever was signed
+// in there when its code was minted (44.33), for as long as the bridge's stream is open, or
+// resumable. HELD IN THIS PROCESS: an app served by several needs a visitor's requests to reach the
+// one its bridge dialed.
 
 import { isFailed } from '#shared/Failed.ts'
 import { refuse } from '#shared/refuse.ts'
@@ -35,7 +36,8 @@ export type TurnItem = {
 
 /** One paired bridge: what it is sent, and the turns it is answering. */
 export type Bridge = {
-    caller: string
+    /** The browser and the sign-in it is paired to (`pairingKey`). 44.33. */
+    key: string
     token: string
     frames: Inbox<unknown>
     turns: Map<string, Inbox<TurnItem>>
@@ -53,40 +55,68 @@ const IDLE_GRACE = 30_000
 /** How long a pairing whose stream dropped waits to be resumed. 44.26. */
 export const RESUME_MILLISECONDS = 60_000
 
-const CODES = new Map<string, { caller: string; expires: number }>()
-const BY_CALLER = new Map<string, Bridge>()
+const CODES = new Map<string, { key: string; expires: number }>()
+const BY_KEY = new Map<string, Bridge>()
 const BY_TOKEN = new Map<string, Bridge>()
 const WATCHERS = new Map<string, Set<() => void>>()
+const FOLLOWERS = new Map<
+    string,
+    Set<(caller: string, signedIn: string) => void>
+>()
+
+/**
+ * What a pairing is filed under: the browser, and who was signed in there (`signedInAs`).
+ *
+ * 44.33 — ONE PER SIGN-IN, so pairing at a browser replaces only that sign-in's own bridge, and a
+ * page watching for one sign-in neither reaches another's nor keeps it from going idle (44.22).
+ */
+function pairingKey(caller: string, signedIn: string): string {
+    return `${caller}\n${signedIn}`
+}
 
 // 44.19 — the relay answers once the app has handed out a pairing command, and never before.
 let minted = false
 
-/** A single-use pairing code for `caller`, and when it stops standing. 44.14. */
-export function mintCode(caller: string): { code: string; expires: number } {
+/** A single-use pairing code for `caller` signed in as `signedIn`, and when it stops standing. 44.14. */
+export function mintCode(
+    caller: string,
+    signedIn: string,
+): { code: string; expires: number } {
     const now = Date.now()
     for (const [code, pairing] of CODES)
         if (pairing.expires <= now) CODES.delete(code)
     const code = randomToken(12, 'base64url')
     const expires = now + CODE_LIFETIME
-    CODES.set(code, { caller, expires })
+    CODES.set(code, { key: pairingKey(caller, signedIn), expires })
     minted = true
     return { code, expires }
 }
 
-/** The bridge paired to `caller`, if its stream is open. */
-export function pairedBridge(caller: string): Bridge | undefined {
-    return BY_CALLER.get(caller)
+/** The bridge paired to `caller` signed in as `signedIn`, if its stream is open. 44.33. */
+export function pairedBridge(
+    caller: string,
+    signedIn: string,
+): Bridge | undefined {
+    return BY_KEY.get(pairingKey(caller, signedIn))
 }
 
-/** Registers `wake` to run whenever `caller`'s pairing changes; the returned function undoes it. */
-export function watchPairing(caller: string, wake: () => void): () => void {
-    let watchers = WATCHERS.get(caller)
+/**
+ * Registers `wake` to run whenever the pairing of `caller` signed in as `signedIn` changes; the
+ * returned function undoes it.
+ */
+export function watchPairing(
+    caller: string,
+    signedIn: string,
+    wake: () => void,
+): () => void {
+    const key = pairingKey(caller, signedIn)
+    let watchers = WATCHERS.get(key)
     if (watchers === undefined) {
         watchers = new Set()
-        WATCHERS.set(caller, watchers)
+        WATCHERS.set(key, watchers)
     }
     watchers.add(wake)
-    const bridge = BY_CALLER.get(caller)
+    const bridge = BY_KEY.get(key)
     if (bridge !== undefined) {
         bridge.watched = true
         if (bridge.idle !== undefined) clearTimeout(bridge.idle)
@@ -95,8 +125,8 @@ export function watchPairing(caller: string, wake: () => void): () => void {
     return () => {
         watchers.delete(wake)
         if (watchers.size > 0) return
-        WATCHERS.delete(caller)
-        armIdle(caller)
+        WATCHERS.delete(key)
+        armIdle(key)
     }
 }
 
@@ -114,15 +144,15 @@ export function openTurn(bridge: Bridge): {
         inbox,
         close: () => {
             bridge.turns.delete(id)
-            if (!WATCHERS.has(bridge.caller)) armIdle(bridge.caller)
+            if (!WATCHERS.has(bridge.key)) armIdle(bridge.key)
         },
     }
 }
 
 // 44.22 — A BRIDGE A PAGE WATCHED, THAT NO PAGE WATCHES NOW AND THAT IS ANSWERING NO TURN, is sent
 // away once the grace runs.
-function armIdle(caller: string): void {
-    const bridge = BY_CALLER.get(caller)
+function armIdle(key: string): void {
+    const bridge = BY_KEY.get(key)
     if (
         bridge === undefined ||
         !bridge.watched ||
@@ -136,8 +166,40 @@ function armIdle(caller: string): void {
     }, IDLE_GRACE)
 }
 
-function wakeWatchers(caller: string): void {
-    for (const wake of WATCHERS.get(caller) ?? []) wake()
+function wakeWatchers(key: string): void {
+    for (const wake of WATCHERS.get(key) ?? []) wake()
+}
+
+/**
+ * Registers `follow` to hear who signs in at `caller` from here on, and the caller a sign-out rotates
+ * it to (26.9); the returned function undoes it.
+ *
+ * 44.34 — A STATUS STREAM OPENED BEFORE A SIGN-IN carries the cookies it was opened with, so it hears
+ * of the new one here rather than off its own request.
+ */
+export function followSignIn(
+    caller: string,
+    follow: (caller: string, signedIn: string) => void,
+): () => void {
+    let followers = FOLLOWERS.get(caller)
+    if (followers === undefined) {
+        followers = new Set()
+        FOLLOWERS.set(caller, followers)
+    }
+    followers.add(follow)
+    return () => {
+        followers.delete(follow)
+        if (followers.size === 0) FOLLOWERS.delete(caller)
+    }
+}
+
+/** Tells every status stream at `caller` that the browser is `now`, signed in as `signedIn`. 44.34. */
+export function signedInAt(
+    caller: string,
+    now: string,
+    signedIn: string,
+): void {
+    for (const follow of FOLLOWERS.get(caller) ?? []) follow(now, signedIn)
 }
 
 function item(
@@ -161,7 +223,7 @@ function item(
 }
 
 function dropBridge(bridge: Bridge): void {
-    if (BY_CALLER.get(bridge.caller) === bridge) BY_CALLER.delete(bridge.caller)
+    if (BY_KEY.get(bridge.key) === bridge) BY_KEY.delete(bridge.key)
     BY_TOKEN.delete(bridge.token)
     if (bridge.idle !== undefined) clearTimeout(bridge.idle)
     bridge.idle = undefined
@@ -175,7 +237,7 @@ function dropBridge(bridge: Bridge): void {
     }
     bridge.turns.clear()
     bridge.frames.close()
-    wakeWatchers(bridge.caller)
+    wakeWatchers(bridge.key)
 }
 
 /** Answers `/__abide/bridge`, or `undefined` until a pairing code has been minted. 44.19. */
@@ -199,24 +261,24 @@ function pair(request: Request): Response {
                 'This pairing code was not issued here, or it has been used, or it has expired.',
             ),
         )
-    const standing = BY_CALLER.get(pairing.caller)
+    const standing = BY_KEY.get(pairing.key)
     if (standing !== undefined) {
         standing.frames.push({ type: 'bye' })
         dropBridge(standing)
     }
     const bridge: Bridge = {
-        caller: pairing.caller,
+        key: pairing.key,
         token: randomToken(24, 'base64url'),
         frames: new Inbox(),
         turns: new Map(),
-        watched: WATCHERS.has(pairing.caller),
+        watched: WATCHERS.has(pairing.key),
         idle: undefined,
         held: undefined,
     }
-    BY_CALLER.set(bridge.caller, bridge)
+    BY_KEY.set(bridge.key, bridge)
     BY_TOKEN.set(bridge.token, bridge)
     bridge.frames.push({ type: 'paired', token: bridge.token })
-    wakeWatchers(bridge.caller)
+    wakeWatchers(bridge.key)
     return attach(bridge, request)
 }
 

package/src/server/claudeCode.ts

@@ -18,6 +18,7 @@ import {
 } from './assistant.ts'
 import { BRIDGE_VERSION } from './BRIDGE_VERSION.ts'
 import {
+    followSignIn,
     mintCode,
     openTurn,
     pairedBridge,
@@ -27,6 +28,7 @@ import { callerOf } from './callerOf.ts'
 import { appOrigin } from './config.ts'
 import { mcpFailure } from './generatedSurfaces.ts'
 import { Inbox } from './Inbox.ts'
+import { signedInAs } from './principal.ts'
 import { request } from './requestScope.ts'
 
 /** The Claude Code options a site may set for a turn, and the built-in tools it asks the visitor for. */
@@ -52,12 +54,12 @@ export type BridgeStatus = { paired: boolean; command: string | undefined }
 function claudeCodeProvider(config: ClaudeCodeConfig = {}): Provider {
     return {
         async *run(messages, tools, { maxTurns, signal }) {
-            const bridge = pairedBridge(askingCaller())
-            // 44.13 — nothing paired is the page's cue to show the command.
+            const bridge = pairedBridge(askingCaller(), signedInAs())
+            // 44.13, 44.33 — nothing paired by this sign-in is the page's cue to show the command.
             if (bridge === undefined)
                 throw refuse(
                     409,
-                    'No Claude Code is paired with this browser. claudeCode.bridgeCommand() is the command that pairs one.',
+                    'No Claude Code is paired with this browser as the one signed in. claudeCode.bridgeCommand() is the command that pairs one.',
                 )
             const turn = openTurn(bridge)
             bridge.frames.push({
@@ -130,11 +132,20 @@ function askingCaller(): string {
  * The command that pairs a bridge with this browser, and when its code stops standing. 44.14. The
  * `tools` it is given are written after its `--`, so the visitor running it grants them (44.29, 44.32).
  */
-function bridgeCommand({ tools }: PairingOptions = {}): {
+function bridgeCommand(options: PairingOptions = {}): {
     command: string
     expires: number
 } {
-    const { code, expires } = mintCode(askingCaller())
+    return commandFor(askingCaller(), signedInAs(), options)
+}
+
+/** The command pairing a bridge with `caller` signed in as `signedIn` (44.33). */
+function commandFor(
+    caller: string,
+    signedIn: string,
+    { tools }: PairingOptions,
+): { command: string; expires: number } {
+    const { code, expires } = mintCode(caller, signedIn)
     const site = `${appOrigin() ?? new URL(request().url).origin}${mounted('')}`
     const grant = tools?.length ? ` -- --tools ${tools.join(',')}` : ''
     return {
@@ -146,29 +157,50 @@ function bridgeCommand({ tools }: PairingOptions = {}): {
 /**
  * This browser's pairing as it changes: unpaired with the command to run, then paired the moment a
  * bridge connects, and unpaired again if it goes. 44.20.
+ *
+ * 44.34 — IT FOLLOWS WHOEVER SIGNS IN AT THE BROWSER, though its own request carries the cookies it
+ * opened with: a sign-in or a sign-out made since is the pairing it watches from then on, and the
+ * command it offers is that sign-in's.
  */
 async function* bridge(
     options: PairingOptions = {},
 ): AsyncGenerator<BridgeStatus> {
-    const caller = askingCaller()
+    let caller = askingCaller()
+    let signedIn = signedInAs()
     const signal = request().signal
     // A change landing while the loop was not waiting — paused at its `yield` — stays queued, so it
     // looks again; a look that finds nothing new yields nothing.
     const changes = new Inbox<undefined>()
     const waiting = changes[Symbol.asyncIterator]()
     const rouse = (): void => changes.push(undefined)
-    const unwatch = watchPairing(caller, rouse)
+    let watchingAs = ''
+    let unwatch = (): void => {}
+    let unfollow = (): void => {}
+    const follow = (now: string, next: string): void => {
+        caller = now
+        signedIn = next
+        rouse()
+    }
     signal.addEventListener('abort', rouse)
     let pairing: { command: string; expires: number } | undefined
     let said = ''
     try {
         while (!signal.aborted) {
-            const paired = pairedBridge(caller) !== undefined
+            const watching = `${caller} ${signedIn}`
+            if (watching !== watchingAs) {
+                unwatch()
+                unfollow()
+                unwatch = watchPairing(caller, signedIn, rouse)
+                unfollow = followSignIn(caller, follow)
+                watchingAs = watching
+                pairing = undefined
+            }
+            const paired = pairedBridge(caller, signedIn) !== undefined
             if (
                 !paired &&
                 (pairing === undefined || pairing.expires <= Date.now())
             )
-                pairing = bridgeCommand(options)
+                pairing = commandFor(caller, signedIn, options)
             const status: BridgeStatus = {
                 paired,
                 command: paired ? undefined : pairing?.command,
@@ -188,6 +220,7 @@ async function* bridge(
     } finally {
         signal.removeEventListener('abort', rouse)
         unwatch()
+        unfollow()
     }
 }
 

package/src/server/commands.ts

@@ -6,6 +6,7 @@
 import { resolve } from 'node:path' // bun exposes no path helpers of its own
 import { parseArgs } from 'node:util' // bun exposes no argv parser of its own yet
 import { MCP_ADDRESS, OPENAPI_ADDRESS } from '#shared/ADDRESSES.ts'
+import { IN_PROCESS_ORIGIN } from '#shared/IN_PROCESS_ORIGIN.ts'
 import { banner } from './banner.ts'
 import { type App, type AppHandle, enterApp } from './createApp.ts'
 import { stopOnSignalOrFault } from './faultPolicy.ts'
@@ -494,7 +495,7 @@ async function surfaceAt(
     const booted = await booting(host, app, given)
     if (typeof booted === 'number') return booted
     return (init) =>
-        booted.fetch(new Request(`http://abide.local${address}`, init))
+        booted.fetch(new Request(`${IN_PROCESS_ORIGIN}${address}`, init))
 }
 
 /**

package/src/server/config.ts

@@ -49,6 +49,16 @@ export interface Config {
     APP_DATA_DIR: string
 }
 
+// What a preload derives beside 27.3's three — the test preload's principal secret (38.120). Declared
+// above `config`, which resolves as it is built — and so is invalidated by an addition.
+const ADDED: Record<string, string> = {}
+
+/** Adds `values` to the derived layer, so every `onConfig` default and the env still win (27.2). */
+export function addDerived(values: Record<string, string>): void {
+    Object.assign(ADDED, values)
+    config.invalidate()
+}
+
 /** The resolved configuration: abide's derived values, then `onConfig`'s defaults, then the env. */
 export const config = reactive(resolve, { global: true })
 
@@ -100,7 +110,8 @@ function coerce(text: string, standing: unknown): unknown {
 }
 
 /**
- * The app's name, version and data directory, off its own `package.json` and the platform.
+ * The app's name, version and data directory, off its own `package.json` and the platform, and
+ * what `addDerived` added.
  *
  * 27.3 — a layer under the other two, so a config or an environment that carries one wins.
  */
@@ -108,6 +119,7 @@ function derived(): Record<string, string> {
     const manifest = APP_PACKAGE.current
     const name = manifest.name ?? 'app'
     return {
+        ...ADDED,
         APP_NAME: name,
         APP_VERSION: manifest.version ?? '0.0.0',
         // 36.4 — A PATH, and never created: an app that wants the directory makes it.

package/src/server/createApp.ts

@@ -7,6 +7,7 @@ import { existsSync } from 'node:fs' // bun exposes no sync existence check of i
 import { resolve } from 'node:path' // bun exposes no path helpers of its own
 import { FAILURE_STATUS_TEXT } from '#shared/FAILURE_STATUS_TEXT.ts'
 import { framingOf } from '#shared/framing.ts'
+import { IN_PROCESS_ORIGIN } from '#shared/IN_PROCESS_ORIGIN.ts'
 import { LONGEST_DELAY } from '#shared/LONGEST_DELAY.ts'
 import { namedLogger } from '#shared/log.ts'
 import { compose } from '#shared/Middleware.ts'
@@ -32,6 +33,7 @@ import { IDLE_TIMEOUT_SECONDS } from './IDLE_TIMEOUT_SECONDS.ts'
 import { installServer } from './installServer.ts'
 import { admitsMux, muxSocketOptions, upgraded } from './muxUpgrade.ts'
 import { plainAnswer } from './plainAnswer.ts'
+import { presumePrincipal } from './principal.ts'
 import { realOrAsGiven } from './realOrAsGiven.ts'
 import {
     type AnsweringApp,
@@ -60,7 +62,7 @@ export interface App {
     fetch(request: Request): Promise<Response>
     run<Result>(
         fn: () => Result | Promise<Result>,
-        options?: { request?: Request },
+        options?: { request?: Request; principal?: Record<string, unknown> },
     ): Promise<Result>
     listen(options?: {
         port?: number
@@ -289,11 +291,21 @@ export async function bootEntered(
     let stopping = false
     let bound: Bun.Server<unknown> | undefined
 
-    const run = async <Result>(
-        fn: () => Result | Promise<Result>,
-        options?: { request?: Request },
-    ): Promise<Result> =>
-        inReleasedScope(options?.request, async () => await fn(), answering)
+    const run: App['run'] = async (fn, options) => {
+        const claims = options?.principal
+        // 42.19 — a principal is a request's, so one given alone is given a request to be.
+        const request =
+            options?.request ??
+            (claims === undefined ? undefined : new Request(IN_PROCESS_ORIGIN))
+        return inReleasedScope(
+            request,
+            async () => {
+                if (claims !== undefined) presumePrincipal(claims)
+                return await fn()
+            },
+            answering,
+        )
+    }
 
     const fetch = async (given: Request): Promise<Response> => {
         if (stopping) return plainAnswer('the app is stopping', 503)

package/src/server/preload.ts

@@ -5,8 +5,13 @@
 // one place that runs first. The build is `createApp`'s own under `bun test` (42.16), so a test that
 // boots the app afterwards reuses it rather than building twice.
 
+import { addDerived } from './config.ts'
 import { appRoot, servedBuild } from './createApp.ts'
 
+// 38.120 — a sign-in seals under test where the app declared no secret: derived, so the app's
+// `onConfig` default and the env both still win (27.2), where an env value would beat the default.
+addDerived({ ABIDE_PRINCIPAL_SECRET: 'abide-test-principal-secret' })
+
 const root = appRoot(undefined)
 // A run from a directory that holds no app preloads nothing — nor from a workspace's root, whose
 // packages' `.abide` files are each their own app's rather than one app laid out across them.

package/src/server/principal.ts

@@ -18,10 +18,11 @@ import {
 import { refuse } from '#shared/refuse.ts'
 import { declare } from '#shared/rpc.ts'
 import { mountedOwn } from './answerRpc.ts'
-import { callerOrMint, mintCaller } from './callerOf.ts'
+import { signedInAt } from './bridgeRelay.ts'
+import { callerOf, callerOrMint, mintCaller } from './callerOf.ts'
 import { config, positiveSetting } from './config.ts'
 import { HOOKS, inOrder } from './hooks.ts'
-import { within } from './requestScope.ts'
+import { type RequestScope, type Sealed, within } from './requestScope.ts'
 
 // 26.18.
 const PRINCIPAL_COOKIE = 'abide-principal'
@@ -84,9 +85,7 @@ function seal(
  *
  * 26.13 — A BAD SIGNATURE, A LAPSED SEAL AND A MALFORMED COOKIE ARE ONE ANSWER: nothing.
  */
-function unseal(
-    sealed: string | null,
-): { claims: Record<string, unknown>; expires: number } | undefined {
+function unseal(sealed: string | null): Sealed | undefined {
     if (sealed === null) return undefined
     const [header, payload, signed, ...rest] = sealed.split('.')
     // ONE HEADER IS READ, abide's own: a token naming another `alg` — `none` above all — is no seal.
@@ -182,8 +181,8 @@ async function documentOf(
 function resolvePrincipal(): Promise<Principal> {
     const scope = within('principal')
     scope.principal ??= (async () => {
-        const opened = unseal(cookies().get(PRINCIPAL_COOKIE))
-        if (opened === undefined) return ANONYMOUS
+        const opened = openedSeal(scope)
+        if (opened === null) return ANONYMOUS
         let expires = opened.expires
         const life = ttl()
         if (expires - Date.now() < life / 2 && scope.applied === false) {
@@ -195,6 +194,51 @@ function resolvePrincipal(): Promise<Principal> {
     return scope.principal
 }
 
+/**
+ * This request's principal, resolved from `claims` as a sealed cookie's are, with no cookie written.
+ *
+ * 42.19 — `App.run`'s `principal`, which is why it throws where `principal.set` does.
+ */
+export function presumePrincipal(claims: Record<string, unknown>): void {
+    const scope = within('App.run principal')
+    if (!isRecord(claims))
+        throw new Error(
+            'abide: App.run takes a principal of claims, as principal.set does. RULEBOOK 26.11.',
+        )
+    const expires = Date.now() + ttl()
+    scope.principal = documentOf(claims, expires)
+    scope.opened = { claims: asSealed(claims), expires }
+}
+
+/** What this request's principal cookie opened to, read and verified once a request. */
+function openedSeal(scope: RequestScope): Sealed | null {
+    if (scope.opened === undefined)
+        scope.opened = unseal(cookies().get(PRINCIPAL_COOKIE)) ?? null
+    return scope.opened
+}
+
+/** `claims` as a later request opens them from their seal: through JSON, and `exp` and `iat` aside. */
+function asSealed(claims: Record<string, unknown>): Record<string, unknown> {
+    const { exp: _, iat: __, ...sealed } = JSON.parse(JSON.stringify(claims))
+    return sealed
+}
+
+/** Who `opened` signs in, as one string: its claims as JSON, or `null`'s. 44.33. */
+function identityOf(opened: Sealed | null): string {
+    return JSON.stringify(opened === null ? null : opened.claims)
+}
+
+/**
+ * Who this request is signed in as, as one string.
+ *
+ * 44.33 — THE CLAIMS, NOT THE RESOLVED DOCUMENT: what `onPrincipal` reads off them can change
+ * between requests, and a seal sealed again for another life (26.15) holds the same claims. Read
+ * synchronously, off the cookie, so the pairing command stays a plain call.
+ */
+export function signedInAs(): string {
+    return identityOf(openedSeal(within('claudeCode')))
+}
+
 /**
  * Signs this caller in with `claims`, sealing them into the cookie.
  *
@@ -219,6 +263,11 @@ async function set(claims: Record<string, unknown>): Promise<void> {
     scope.response.headers.set(PRINCIPAL_HEADER, 'set')
     const resolved = documentOf(claims, expires)
     scope.principal = resolved
+    scope.opened = { claims: asSealed(claims), expires }
+    // 44.34 — a status stream opened before this sign-in follows it.
+    const caller = callerOf()
+    if (caller !== undefined)
+        signedInAt(caller, caller, identityOf(scope.opened))
     principalMembers().document.set(await resolved)
     PRINCIPAL_LOG.debug('set')
 }
@@ -233,8 +282,12 @@ function clear(): void {
     const scope = within('principal.clear')
     cookies().delete(PRINCIPAL_COOKIE)
     scope.response.headers.set(PRINCIPAL_HEADER, 'clear')
+    const signedOut = callerOf()
     const minted = mintCaller(scope)
     scope.principal = Promise.resolve(ANONYMOUS)
+    scope.opened = null
+    // 44.34 — and one opened before this sign-out follows it to the caller it rotated to.
+    if (signedOut !== undefined) signedInAt(signedOut, minted, identityOf(null))
     principalMembers().document.set(ANONYMOUS)
     principalMembers().caller.set(minted)
     PRINCIPAL_LOG.debug('clear')