@abide/abide 0.113.0 → 0.114.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @abide/abide
 
+## 0.114.0
+
+### Minor Changes
+
+- 595ccb1: a Claude Code pairing belongs to the sign-in that minted its code — another sign-in at the browser is refused 409 and offered its own, and an open bridge status follows a sign-in or sign-out ([`7036ed1`](https://github.com/briancray/abide/commit/7036ed181763c74eaf72ad4550e05c9d63a2d6ab))
+
 ## 0.113.0
 
 ### Minor Changes

package/docs/REGISTRY.md

@@ -338,10 +338,10 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 
 | Name | Signature | Meaning | Rules |
 | --- | --- | --- | --- |
-| `claudeCode` | `(config?: ClaudeCodeConfig) => Provider` | The visitor's own Claude Code, reached through the bridge paired with their browser, as a provider. | 44.5, 44.13, 44.17, 44.18, 44.19, 44.24, 44.25, 44.27, 44.30 |
+| `claudeCode` | `(config?: ClaudeCodeConfig) => Provider` | The visitor's own Claude Code, reached through the bridge paired with their browser, as a provider. | 44.5, 44.13, 44.17, 44.18, 44.19, 44.24, 44.25, 44.27, 44.30, 44.33 |
 | `ClaudeCodeConfig` | `{ model?: string; fallbackModel?: string; systemPrompt?: string; appendSystemPrompt?: string; effort?: 'low' \| 'medium' \| 'high' \| 'xhigh' \| 'max'; maxBudgetUsd?: number; betas?: string[]; disallowedTools?: string[]; tools?: string[] }` | The Claude Code options a site may set for a turn, and the built-in tools it asks the visitor for. | 44.16, 44.29 |
-| `claudeCode.bridgeCommand` | `(options?: { tools?: string[] }) => { command: string; expires: number }` | The command that pairs a bridge with this browser, granting the built-in tools it is given. | 44.14, 44.32 |
-| `claudeCode.bridge` | `(options?: { tools?: string[] }) => AsyncGenerator<BridgeStatus>` | This browser's pairing, as it changes. | 44.20, 44.22, 44.32 |
+| `claudeCode.bridgeCommand` | `(options?: { tools?: string[] }) => { command: string; expires: number }` | The command that pairs a bridge with this browser, granting the built-in tools it is given. | 44.14, 44.32, 44.33 |
+| `claudeCode.bridge` | `(options?: { tools?: string[] }) => AsyncGenerator<BridgeStatus>` | This browser's pairing, as it changes. | 44.20, 44.22, 44.32, 44.33, 44.34 |
 | `BridgeStatus` | `{ paired: boolean; command: string \| undefined }` | Whether a bridge is paired, and the command that pairs one where none is. | 44.20 |
 | `/__abide/bridge` | `GET`, `POST` | Where a bridge pairs, and is relayed its turns. | 36.7, 44.14, 44.15, 44.19, 44.23, 44.26, 16.57, 16.78 |
 

package/docs/RULEBOOK.md

@@ -3191,6 +3191,14 @@ and naming it `unfinished` where it ended without a `done`.
 44.32 A command `claudeCode.bridgeCommand` or `claudeCode.bridge` mints with `tools` MUST grant
 those built-in tools after its `--` as `--tools`, and one minted without `tools` MUST carry no `--`.
 
+44.33 A pairing MUST be to the claims the principal was sealed with (26.11), or to none, where its
+code was minted, and `claudeCode` and `claudeCode.bridge` MUST read it as absent to a request from
+that browser carrying any other.
+
+44.34 A `claudeCode.bridge` stream MUST yield the pairing of whoever a `principal.set` or a
+`principal.clear` made at its browser since it opened signs in, at the caller 26.9 rotates it to,
+and the command it yields MUST pair that one.
+
 # 45. Offline
 
 45.1 Where `ABIDE_OFFLINE` is on, a page `abide build` built MUST register the worker

package/docs/abide.md

@@ -5644,6 +5644,8 @@ Pass the same `tools` to `claudeCode.bridge` or `claudeCode.bridgeCommand` and t
 
 The visitor pairs once per visit by running a command, which dials out to the site. Asking with nothing paired is refused 409.
 
+The tools the conversation calls run as the visitor, on the sign-in their ask carried, so a tool reads `principal` as any handler does. The pairing belongs to that sign-in too. If someone else signs in at the same browser, their asks are refused 409 and the status offers them a command of their own, so nobody's turn runs on another member's Claude Code.
+
 | Name | What it does for the CRM |
 | --- | --- |
 | `claudeCode.bridge` | Streams this browser's pairing: unpaired with the command to run, then paired. |
@@ -7860,9 +7862,9 @@ Generated surfaces: what is written in place rather than imported.
 
 | Name | Signature | Meaning | Rules |
 | --- | --- | --- | --- |
-| `claudeCode` | `(config?: ClaudeCodeConfig) => Provider` | The visitor's own Claude Code, reached through the bridge paired with their browser, as a provider. | [44.5](/rulebook#44.5), [44.13](/rulebook#44.13), [44.17](/rulebook#44.17), [44.18](/rulebook#44.18), [44.19](/rulebook#44.19), [44.24](/rulebook#44.24), [44.25](/rulebook#44.25), [44.27](/rulebook#44.27), [44.30](/rulebook#44.30) |
-| `claudeCode.bridgeCommand` | `(options?: { tools?: string[] }) => { command: string; expires: number }` | The command that pairs a bridge with this browser, granting the built-in tools it is given. | [44.14](/rulebook#44.14), [44.32](/rulebook#44.32) |
-| `claudeCode.bridge` | `(options?: { tools?: string[] }) => AsyncGenerator<BridgeStatus>` | This browser's pairing, as it changes. | [44.20](/rulebook#44.20), [44.22](/rulebook#44.22), [44.32](/rulebook#44.32) |
+| `claudeCode` | `(config?: ClaudeCodeConfig) => Provider` | The visitor's own Claude Code, reached through the bridge paired with their browser, as a provider. | [44.5](/rulebook#44.5), [44.13](/rulebook#44.13), [44.17](/rulebook#44.17), [44.18](/rulebook#44.18), [44.19](/rulebook#44.19), [44.24](/rulebook#44.24), [44.25](/rulebook#44.25), [44.27](/rulebook#44.27), [44.30](/rulebook#44.30), [44.33](/rulebook#44.33) |
+| `claudeCode.bridgeCommand` | `(options?: { tools?: string[] }) => { command: string; expires: number }` | The command that pairs a bridge with this browser, granting the built-in tools it is given. | [44.14](/rulebook#44.14), [44.32](/rulebook#44.32), [44.33](/rulebook#44.33) |
+| `claudeCode.bridge` | `(options?: { tools?: string[] }) => AsyncGenerator<BridgeStatus>` | This browser's pairing, as it changes. | [44.20](/rulebook#44.20), [44.22](/rulebook#44.22), [44.32](/rulebook#44.32), [44.33](/rulebook#44.33), [44.34](/rulebook#44.34) |
 | `/__abide/bridge` | `GET`, `POST` | Where a bridge pairs, and is relayed its turns. | [36.7](/rulebook#36.7), [44.14](/rulebook#44.14), [44.15](/rulebook#44.15), [44.19](/rulebook#44.19), [44.23](/rulebook#44.23), [44.26](/rulebook#44.26), [16.57](/rulebook#16.57), [16.78](/rulebook#16.78) |
 
 ## Taught in

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@abide/abide",
-    "version": "0.113.0",
+    "version": "0.114.0",
     "type": "module",
     "description": "Isomorphic type-safe framework for reactive async interfaces for humans and machines",
     "license": "MIT",

package/src/server/bridgeRelay.ts

@@ -8,9 +8,10 @@
 //   POST /__abide/bridge          what the bridge reports, one frame per line: a turn's events, the
 //                                 MCP requests its Claude Code made, the turn's end or failure.
 //
-// A PAIRING IS TO A BROWSER — the `abide-caller` its page carries (26.5) — for as long as the bridge's
-// stream is open, or resumable. HELD IN THIS PROCESS: an app served by several needs a visitor's requests to reach
-// the one its bridge dialed.
+// A PAIRING IS TO A BROWSER — the `abide-caller` its page carries (26.5) — and to whoever was signed
+// in there when its code was minted (44.33), for as long as the bridge's stream is open, or
+// resumable. HELD IN THIS PROCESS: an app served by several needs a visitor's requests to reach the
+// one its bridge dialed.
 
 import { isFailed } from '#shared/Failed.ts'
 import { refuse } from '#shared/refuse.ts'
@@ -35,7 +36,8 @@ export type TurnItem = {
 
 /** One paired bridge: what it is sent, and the turns it is answering. */
 export type Bridge = {
-    caller: string
+    /** The browser and the sign-in it is paired to (`pairingKey`). 44.33. */
+    key: string
     token: string
     frames: Inbox<unknown>
     turns: Map<string, Inbox<TurnItem>>
@@ -53,40 +55,68 @@ const IDLE_GRACE = 30_000
 /** How long a pairing whose stream dropped waits to be resumed. 44.26. */
 export const RESUME_MILLISECONDS = 60_000
 
-const CODES = new Map<string, { caller: string; expires: number }>()
-const BY_CALLER = new Map<string, Bridge>()
+const CODES = new Map<string, { key: string; expires: number }>()
+const BY_KEY = new Map<string, Bridge>()
 const BY_TOKEN = new Map<string, Bridge>()
 const WATCHERS = new Map<string, Set<() => void>>()
+const FOLLOWERS = new Map<
+    string,
+    Set<(caller: string, signedIn: string) => void>
+>()
+
+/**
+ * What a pairing is filed under: the browser, and who was signed in there (`signedInAs`).
+ *
+ * 44.33 — ONE PER SIGN-IN, so pairing at a browser replaces only that sign-in's own bridge, and a
+ * page watching for one sign-in neither reaches another's nor keeps it from going idle (44.22).
+ */
+function pairingKey(caller: string, signedIn: string): string {
+    return `${caller}\n${signedIn}`
+}
 
 // 44.19 — the relay answers once the app has handed out a pairing command, and never before.
 let minted = false
 
-/** A single-use pairing code for `caller`, and when it stops standing. 44.14. */
-export function mintCode(caller: string): { code: string; expires: number } {
+/** A single-use pairing code for `caller` signed in as `signedIn`, and when it stops standing. 44.14. */
+export function mintCode(
+    caller: string,
+    signedIn: string,
+): { code: string; expires: number } {
     const now = Date.now()
     for (const [code, pairing] of CODES)
         if (pairing.expires <= now) CODES.delete(code)
     const code = randomToken(12, 'base64url')
     const expires = now + CODE_LIFETIME
-    CODES.set(code, { caller, expires })
+    CODES.set(code, { key: pairingKey(caller, signedIn), expires })
     minted = true
     return { code, expires }
 }
 
-/** The bridge paired to `caller`, if its stream is open. */
-export function pairedBridge(caller: string): Bridge | undefined {
-    return BY_CALLER.get(caller)
+/** The bridge paired to `caller` signed in as `signedIn`, if its stream is open. 44.33. */
+export function pairedBridge(
+    caller: string,
+    signedIn: string,
+): Bridge | undefined {
+    return BY_KEY.get(pairingKey(caller, signedIn))
 }
 
-/** Registers `wake` to run whenever `caller`'s pairing changes; the returned function undoes it. */
-export function watchPairing(caller: string, wake: () => void): () => void {
-    let watchers = WATCHERS.get(caller)
+/**
+ * Registers `wake` to run whenever the pairing of `caller` signed in as `signedIn` changes; the
+ * returned function undoes it.
+ */
+export function watchPairing(
+    caller: string,
+    signedIn: string,
+    wake: () => void,
+): () => void {
+    const key = pairingKey(caller, signedIn)
+    let watchers = WATCHERS.get(key)
     if (watchers === undefined) {
         watchers = new Set()
-        WATCHERS.set(caller, watchers)
+        WATCHERS.set(key, watchers)
     }
     watchers.add(wake)
-    const bridge = BY_CALLER.get(caller)
+    const bridge = BY_KEY.get(key)
     if (bridge !== undefined) {
         bridge.watched = true
         if (bridge.idle !== undefined) clearTimeout(bridge.idle)
@@ -95,8 +125,8 @@ export function watchPairing(caller: string, wake: () => void): () => void {
     return () => {
         watchers.delete(wake)
         if (watchers.size > 0) return
-        WATCHERS.delete(caller)
-        armIdle(caller)
+        WATCHERS.delete(key)
+        armIdle(key)
     }
 }
 
@@ -114,15 +144,15 @@ export function openTurn(bridge: Bridge): {
         inbox,
         close: () => {
             bridge.turns.delete(id)
-            if (!WATCHERS.has(bridge.caller)) armIdle(bridge.caller)
+            if (!WATCHERS.has(bridge.key)) armIdle(bridge.key)
         },
     }
 }
 
 // 44.22 — A BRIDGE A PAGE WATCHED, THAT NO PAGE WATCHES NOW AND THAT IS ANSWERING NO TURN, is sent
 // away once the grace runs.
-function armIdle(caller: string): void {
-    const bridge = BY_CALLER.get(caller)
+function armIdle(key: string): void {
+    const bridge = BY_KEY.get(key)
     if (
         bridge === undefined ||
         !bridge.watched ||
@@ -136,8 +166,40 @@ function armIdle(caller: string): void {
     }, IDLE_GRACE)
 }
 
-function wakeWatchers(caller: string): void {
-    for (const wake of WATCHERS.get(caller) ?? []) wake()
+function wakeWatchers(key: string): void {
+    for (const wake of WATCHERS.get(key) ?? []) wake()
+}
+
+/**
+ * Registers `follow` to hear who signs in at `caller` from here on, and the caller a sign-out rotates
+ * it to (26.9); the returned function undoes it.
+ *
+ * 44.34 — A STATUS STREAM OPENED BEFORE A SIGN-IN carries the cookies it was opened with, so it hears
+ * of the new one here rather than off its own request.
+ */
+export function followSignIn(
+    caller: string,
+    follow: (caller: string, signedIn: string) => void,
+): () => void {
+    let followers = FOLLOWERS.get(caller)
+    if (followers === undefined) {
+        followers = new Set()
+        FOLLOWERS.set(caller, followers)
+    }
+    followers.add(follow)
+    return () => {
+        followers.delete(follow)
+        if (followers.size === 0) FOLLOWERS.delete(caller)
+    }
+}
+
+/** Tells every status stream at `caller` that the browser is `now`, signed in as `signedIn`. 44.34. */
+export function signedInAt(
+    caller: string,
+    now: string,
+    signedIn: string,
+): void {
+    for (const follow of FOLLOWERS.get(caller) ?? []) follow(now, signedIn)
 }
 
 function item(
@@ -161,7 +223,7 @@ function item(
 }
 
 function dropBridge(bridge: Bridge): void {
-    if (BY_CALLER.get(bridge.caller) === bridge) BY_CALLER.delete(bridge.caller)
+    if (BY_KEY.get(bridge.key) === bridge) BY_KEY.delete(bridge.key)
     BY_TOKEN.delete(bridge.token)
     if (bridge.idle !== undefined) clearTimeout(bridge.idle)
     bridge.idle = undefined
@@ -175,7 +237,7 @@ function dropBridge(bridge: Bridge): void {
     }
     bridge.turns.clear()
     bridge.frames.close()
-    wakeWatchers(bridge.caller)
+    wakeWatchers(bridge.key)
 }
 
 /** Answers `/__abide/bridge`, or `undefined` until a pairing code has been minted. 44.19. */
@@ -199,24 +261,24 @@ function pair(request: Request): Response {
                 'This pairing code was not issued here, or it has been used, or it has expired.',
             ),
         )
-    const standing = BY_CALLER.get(pairing.caller)
+    const standing = BY_KEY.get(pairing.key)
     if (standing !== undefined) {
         standing.frames.push({ type: 'bye' })
         dropBridge(standing)
     }
     const bridge: Bridge = {
-        caller: pairing.caller,
+        key: pairing.key,
         token: randomToken(24, 'base64url'),
         frames: new Inbox(),
         turns: new Map(),
-        watched: WATCHERS.has(pairing.caller),
+        watched: WATCHERS.has(pairing.key),
         idle: undefined,
         held: undefined,
     }
-    BY_CALLER.set(bridge.caller, bridge)
+    BY_KEY.set(bridge.key, bridge)
     BY_TOKEN.set(bridge.token, bridge)
     bridge.frames.push({ type: 'paired', token: bridge.token })
-    wakeWatchers(bridge.caller)
+    wakeWatchers(bridge.key)
     return attach(bridge, request)
 }
 

package/src/server/claudeCode.ts

@@ -18,6 +18,7 @@ import {
 } from './assistant.ts'
 import { BRIDGE_VERSION } from './BRIDGE_VERSION.ts'
 import {
+    followSignIn,
     mintCode,
     openTurn,
     pairedBridge,
@@ -27,6 +28,7 @@ import { callerOf } from './callerOf.ts'
 import { appOrigin } from './config.ts'
 import { mcpFailure } from './generatedSurfaces.ts'
 import { Inbox } from './Inbox.ts'
+import { signedInAs } from './principal.ts'
 import { request } from './requestScope.ts'
 
 /** The Claude Code options a site may set for a turn, and the built-in tools it asks the visitor for. */
@@ -52,12 +54,12 @@ export type BridgeStatus = { paired: boolean; command: string | undefined }
 function claudeCodeProvider(config: ClaudeCodeConfig = {}): Provider {
     return {
         async *run(messages, tools, { maxTurns, signal }) {
-            const bridge = pairedBridge(askingCaller())
-            // 44.13 — nothing paired is the page's cue to show the command.
+            const bridge = pairedBridge(askingCaller(), signedInAs())
+            // 44.13, 44.33 — nothing paired by this sign-in is the page's cue to show the command.
             if (bridge === undefined)
                 throw refuse(
                     409,
-                    'No Claude Code is paired with this browser. claudeCode.bridgeCommand() is the command that pairs one.',
+                    'No Claude Code is paired with this browser as the one signed in. claudeCode.bridgeCommand() is the command that pairs one.',
                 )
             const turn = openTurn(bridge)
             bridge.frames.push({
@@ -130,11 +132,20 @@ function askingCaller(): string {
  * The command that pairs a bridge with this browser, and when its code stops standing. 44.14. The
  * `tools` it is given are written after its `--`, so the visitor running it grants them (44.29, 44.32).
  */
-function bridgeCommand({ tools }: PairingOptions = {}): {
+function bridgeCommand(options: PairingOptions = {}): {
     command: string
     expires: number
 } {
-    const { code, expires } = mintCode(askingCaller())
+    return commandFor(askingCaller(), signedInAs(), options)
+}
+
+/** The command pairing a bridge with `caller` signed in as `signedIn` (44.33). */
+function commandFor(
+    caller: string,
+    signedIn: string,
+    { tools }: PairingOptions,
+): { command: string; expires: number } {
+    const { code, expires } = mintCode(caller, signedIn)
     const site = `${appOrigin() ?? new URL(request().url).origin}${mounted('')}`
     const grant = tools?.length ? ` -- --tools ${tools.join(',')}` : ''
     return {
@@ -146,29 +157,50 @@ function bridgeCommand({ tools }: PairingOptions = {}): {
 /**
  * This browser's pairing as it changes: unpaired with the command to run, then paired the moment a
  * bridge connects, and unpaired again if it goes. 44.20.
+ *
+ * 44.34 — IT FOLLOWS WHOEVER SIGNS IN AT THE BROWSER, though its own request carries the cookies it
+ * opened with: a sign-in or a sign-out made since is the pairing it watches from then on, and the
+ * command it offers is that sign-in's.
  */
 async function* bridge(
     options: PairingOptions = {},
 ): AsyncGenerator<BridgeStatus> {
-    const caller = askingCaller()
+    let caller = askingCaller()
+    let signedIn = signedInAs()
     const signal = request().signal
     // A change landing while the loop was not waiting — paused at its `yield` — stays queued, so it
     // looks again; a look that finds nothing new yields nothing.
     const changes = new Inbox<undefined>()
     const waiting = changes[Symbol.asyncIterator]()
     const rouse = (): void => changes.push(undefined)
-    const unwatch = watchPairing(caller, rouse)
+    let watchingAs = ''
+    let unwatch = (): void => {}
+    let unfollow = (): void => {}
+    const follow = (now: string, next: string): void => {
+        caller = now
+        signedIn = next
+        rouse()
+    }
     signal.addEventListener('abort', rouse)
     let pairing: { command: string; expires: number } | undefined
     let said = ''
     try {
         while (!signal.aborted) {
-            const paired = pairedBridge(caller) !== undefined
+            const watching = `${caller} ${signedIn}`
+            if (watching !== watchingAs) {
+                unwatch()
+                unfollow()
+                unwatch = watchPairing(caller, signedIn, rouse)
+                unfollow = followSignIn(caller, follow)
+                watchingAs = watching
+                pairing = undefined
+            }
+            const paired = pairedBridge(caller, signedIn) !== undefined
             if (
                 !paired &&
                 (pairing === undefined || pairing.expires <= Date.now())
             )
-                pairing = bridgeCommand(options)
+                pairing = commandFor(caller, signedIn, options)
             const status: BridgeStatus = {
                 paired,
                 command: paired ? undefined : pairing?.command,
@@ -188,6 +220,7 @@ async function* bridge(
     } finally {
         signal.removeEventListener('abort', rouse)
         unwatch()
+        unfollow()
     }
 }
 

package/src/server/principal.ts

@@ -18,10 +18,11 @@ import {
 import { refuse } from '#shared/refuse.ts'
 import { declare } from '#shared/rpc.ts'
 import { mountedOwn } from './answerRpc.ts'
-import { callerOrMint, mintCaller } from './callerOf.ts'
+import { signedInAt } from './bridgeRelay.ts'
+import { callerOf, callerOrMint, mintCaller } from './callerOf.ts'
 import { config, positiveSetting } from './config.ts'
 import { HOOKS, inOrder } from './hooks.ts'
-import { within } from './requestScope.ts'
+import { type RequestScope, type Sealed, within } from './requestScope.ts'
 
 // 26.18.
 const PRINCIPAL_COOKIE = 'abide-principal'
@@ -84,9 +85,7 @@ function seal(
  *
  * 26.13 — A BAD SIGNATURE, A LAPSED SEAL AND A MALFORMED COOKIE ARE ONE ANSWER: nothing.
  */
-function unseal(
-    sealed: string | null,
-): { claims: Record<string, unknown>; expires: number } | undefined {
+function unseal(sealed: string | null): Sealed | undefined {
     if (sealed === null) return undefined
     const [header, payload, signed, ...rest] = sealed.split('.')
     // ONE HEADER IS READ, abide's own: a token naming another `alg` — `none` above all — is no seal.
@@ -182,8 +181,8 @@ async function documentOf(
 function resolvePrincipal(): Promise<Principal> {
     const scope = within('principal')
     scope.principal ??= (async () => {
-        const opened = unseal(cookies().get(PRINCIPAL_COOKIE))
-        if (opened === undefined) return ANONYMOUS
+        const opened = openedSeal(scope)
+        if (opened === null) return ANONYMOUS
         let expires = opened.expires
         const life = ttl()
         if (expires - Date.now() < life / 2 && scope.applied === false) {
@@ -206,7 +205,38 @@ export function presumePrincipal(claims: Record<string, unknown>): void {
         throw new Error(
             'abide: App.run takes a principal of claims, as principal.set does. RULEBOOK 26.11.',
         )
-    scope.principal = documentOf(claims, Date.now() + ttl())
+    const expires = Date.now() + ttl()
+    scope.principal = documentOf(claims, expires)
+    scope.opened = { claims: asSealed(claims), expires }
+}
+
+/** What this request's principal cookie opened to, read and verified once a request. */
+function openedSeal(scope: RequestScope): Sealed | null {
+    if (scope.opened === undefined)
+        scope.opened = unseal(cookies().get(PRINCIPAL_COOKIE)) ?? null
+    return scope.opened
+}
+
+/** `claims` as a later request opens them from their seal: through JSON, and `exp` and `iat` aside. */
+function asSealed(claims: Record<string, unknown>): Record<string, unknown> {
+    const { exp: _, iat: __, ...sealed } = JSON.parse(JSON.stringify(claims))
+    return sealed
+}
+
+/** Who `opened` signs in, as one string: its claims as JSON, or `null`'s. 44.33. */
+function identityOf(opened: Sealed | null): string {
+    return JSON.stringify(opened === null ? null : opened.claims)
+}
+
+/**
+ * Who this request is signed in as, as one string.
+ *
+ * 44.33 — THE CLAIMS, NOT THE RESOLVED DOCUMENT: what `onPrincipal` reads off them can change
+ * between requests, and a seal sealed again for another life (26.15) holds the same claims. Read
+ * synchronously, off the cookie, so the pairing command stays a plain call.
+ */
+export function signedInAs(): string {
+    return identityOf(openedSeal(within('claudeCode')))
 }
 
 /**
@@ -233,6 +263,11 @@ async function set(claims: Record<string, unknown>): Promise<void> {
     scope.response.headers.set(PRINCIPAL_HEADER, 'set')
     const resolved = documentOf(claims, expires)
     scope.principal = resolved
+    scope.opened = { claims: asSealed(claims), expires }
+    // 44.34 — a status stream opened before this sign-in follows it.
+    const caller = callerOf()
+    if (caller !== undefined)
+        signedInAt(caller, caller, identityOf(scope.opened))
     principalMembers().document.set(await resolved)
     PRINCIPAL_LOG.debug('set')
 }
@@ -247,8 +282,12 @@ function clear(): void {
     const scope = within('principal.clear')
     cookies().delete(PRINCIPAL_COOKIE)
     scope.response.headers.set(PRINCIPAL_HEADER, 'clear')
+    const signedOut = callerOf()
     const minted = mintCaller(scope)
     scope.principal = Promise.resolve(ANONYMOUS)
+    scope.opened = null
+    // 44.34 — and one opened before this sign-out follows it to the caller it rotated to.
+    if (signedOut !== undefined) signedInAt(signedOut, minted, identityOf(null))
     principalMembers().document.set(ANONYMOUS)
     principalMembers().caller.set(minted)
     PRINCIPAL_LOG.debug('clear')

package/src/server/requestScope.ts

@@ -22,6 +22,9 @@ import { IDLE_TIMEOUT_SECONDS } from './IDLE_TIMEOUT_SECONDS.ts'
 /** The three framings a stream is answered in. 17.6. */
 export type Framing = Framed | 'bytes'
 
+/** A principal cookie's claims, `exp` and `iat` aside, and when it lapses. 26.11. */
+export type Sealed = { claims: Record<string, unknown>; expires: number }
+
 /** What one request, or one `App.run`, carries across every `await` its work makes. */
 export type RequestScope = Scope & {
     /**
@@ -38,6 +41,8 @@ export type RequestScope = Scope & {
     caller: string | undefined
     /** This request's one resolve of the principal. 26.14. */
     principal: Promise<Principal> | undefined
+    /** What the principal cookie opened to once read, or `null` where it held no seal. */
+    opened: Sealed | null | undefined
     /** 16.23 — whether the received request's idle timeout is off until the answer is sent. */
     unreaped: boolean
     /** This response's nonce, minted by the `csp` rung or on the first ask. 29.3. */
@@ -168,6 +173,7 @@ export function scopeFor(
         unreaped: false,
         caller: undefined,
         principal: undefined,
+        opened: undefined,
         applied: false,
         request: given,
         route: undefined,