Split out of #206 (plugin-zero results comment): the third seam from the Tideholm mount — and the happiest finding, because no new code is needed, only a public blessing.

Finding

getWebIdFromRequestAsync(request) in src/auth/token.js already does everything an app plugin needs to answer "who is this?": Bearer (IDP-issued), Solid-OIDC DPoP, Nostr NIP-98, and LWS10-CID, uniformly, returning { webId, error }. The Tideholm adapter uses it directly and pod identities become game players with zero auth code of their own ("your WebID is your player").

The problem is only that reaching into src/auth/token.js is an internal import — the function's location, name, and shape are all unwarranted by anything public. Plugin zero works today and breaks the day auth is refactored.

Proposal

Bless it as the loader's identity seam:

api.auth.getAgent(request)   // -> Promise<string|null>  (WebID or null)

• Thin wrapper over getWebIdFromRequestAsync, returning just the WebID (plugins that want the error detail can get a second method or the raw result later — start minimal).
• Authentication only, deliberately not authorization: apps under an appPaths prefix (sibling issue) own their own permissioning; WAC stays out of their jurisdiction.
• Until the loader lands, exporting it from the package root (javascript-solid-server/auth) would give manually-composed apps a stable import path.

Acceptance

• Stable public accessor for request → WebID covering all four token types
• Contract test pinning the shape (so auth refactors keep the seam)
• Tideholm adapter migrated onto it (I'll do this the day it exists)
• Listed in the Plugin system for JSS #206 api surface next to api.fastify, registerMcpTool, registerPane