pi-roundtable-web 0.8.0 → 0.9.0

package/dist/index.html

@@ -5,7 +5,7 @@
 		<meta name="viewport" content="width=device-width, initial-scale=1" />
 		<title>Console</title>
 		
-	<link rel="stylesheet" crossorigin href="./chunk-e8z9q554.css"><script type="module" crossorigin src="./chunk-2cm6wak5.js"></script></head>
+	<link rel="stylesheet" crossorigin href="./chunk-e8z9q554.css"><script type="module" crossorigin src="./chunk-0vqnvf92.js"></script></head>
 	<body>
 		<div id="root"></div>
 		

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "pi-roundtable-web",
-	"version": "0.8.0",
-	"description": "An owner-only web console for pi-roundtable: conversations, transcripts, and memory notes, with live updates",
+	"version": "0.9.0",
+	"description": "A web console for the owners of a pi-roundtable host: conversations, transcripts, and memory notes, with live updates",
 	"type": "module",
 	"license": "MIT",
 	"engines": {
@@ -40,14 +40,14 @@
 		"jose": "6.2.12"
 	},
 	"peerDependencies": {
-		"pi-roundtable": ">=0.8.0 <0.9.0"
+		"pi-roundtable": ">=0.9.0 <0.10.0"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "2.5.15",
 		"@types/bun": "1.4.2",
 		"@types/react": "19.3.0",
 		"@types/react-dom": "19.3.0",
-		"pi-roundtable": "0.8.0",
+		"pi-roundtable": "0.9.0",
 		"react": "19.3.0",
 		"react-dom": "19.3.0",
 		"react-markdown": "10.1.0",

package/src/api-types.ts

@@ -81,8 +81,10 @@ export interface DashboardView {
 }
 
 /**
- * Who a stored conversation belongs to; `plugin` is one a plugin runs through `context.turns`,
- * such as a web chat, as the host's registry records it.
+ * Where a stored conversation came from, for the page to group it by; it grants nothing. `owner`
+ * is a Discord channel no agent or group owns, where an owner talks to the assistant; `plugin` is
+ * one a plugin runs through `context.turns`, such as a web chat, as the host's registry records
+ * it. Whose a conversation is, the registry says: `ConversationView.principal`.
  */
 export type ConversationKind =
 	| "agent"
@@ -110,10 +112,21 @@ export interface ConversationView {
 	startedAt?: string;
 	/** Plugin conversations only: the name the registry gives it. */
 	title?: string;
+	/** Conversations the host's registry records: `private` to one principal, or `shared`. */
+	visibility?: "private" | "shared";
+	/** Conversations the registry records as someone's: whose, by their principal's name. */
+	principal?: PrincipalName;
 	/** Turns running or waiting in the channel. */
 	busy: number;
 }
 
+/** A principal as the console names them. */
+export interface PrincipalName {
+	id: string;
+	/** Their display name, or their id when the host no longer knows them. */
+	name: string;
+}
+
 export interface ConversationsView {
 	conversations: ConversationView[];
 }
@@ -151,6 +164,13 @@ export interface NoteView {
 	eventDate: string | null;
 }
 
+/** The people whose notes the notes pane can show: the visitor first, then the others, oldest first. */
+export interface PrincipalsView {
+	/** The visitor's own principal, whose notes the pane shows unless asked for another's. */
+	self: string;
+	principals: (PrincipalName & { disabled?: true })[];
+}
+
 export interface NoteInput {
 	fact: string;
 	kind: NoteKind;

package/src/cloudflare-access.ts

@@ -1,12 +1,15 @@
 import { createRemoteJWKSet, type JWTVerifyGetKey, jwtVerify } from "jose";
-import { admit, type RequestVerifier, refuse } from "./verifier.ts";
+import { admitAs, type RequestVerifier, refuse } from "./verifier.ts";
 
 export interface CloudflareAccessOptions {
 	/** The Access team domain, such as `example.cloudflareaccess.com`. */
 	teamDomain: string;
 	/** The AUD tag of the Access application in front of the console. */
 	audience: string;
-	/** The email, or emails, Access may vouch for; compared without regard to case. */
+	/**
+	 * The email, or emails, Access may vouch for; compared without regard to case. The console
+	 * then admits only those whose identity is linked to an owner: see `cloudflareAccessIdentity`.
+	 */
 	email: string | readonly string[];
 	/** Replaceable in tests; the team's published signing keys otherwise. */
 	keys?: JWTVerifyGetKey;
@@ -14,11 +17,29 @@ export interface CloudflareAccessOptions {
 
 const HEADER = "cf-access-jwt-assertion";
 
+/** The identity provider of an Access team's users: `oidc:<base64url(https://<teamDomain>)>`. */
+const providerOf = (issuer: string) =>
+	`oidc:${Buffer.from(issuer).toString("base64url")}`;
+
+/**
+ * The identity, as `access.owners[].identities` and `roundtable principal link` write it, of the
+ * Access user `sub` (the user id in the token) of a team: `oidc:<base64url(issuer)>:<sub>`, the
+ * form any OpenID issuer's users take.
+ */
+export function cloudflareAccessIdentity(
+	teamDomain: string,
+	sub: string,
+): string {
+	return `${providerOf(`https://${teamDomain.trim()}`)}:${sub}`;
+}
+
 /**
  * Admits a request only when Cloudflare Access vouches for an allowed email: its
  * `Cf-Access-Jwt-Assertion` header holds a token signed by the team's keys, issued by the team,
- * for this application, naming that email. The token is checked on every request, so the
- * console stays closed to a client that reaches it without passing through Access.
+ * for this application, naming that email and a user. The token is checked on every request, so
+ * the console stays closed to a client that reaches it without passing through Access. It reports
+ * the user as an OpenID identity of the team's issuer, their `sub` as the subject and their email
+ * as the name.
  */
 export function cloudflareAccess(
 	options: CloudflareAccessOptions,
@@ -38,22 +59,27 @@ export function cloudflareAccess(
 	const keys =
 		options.keys ??
 		createRemoteJWKSet(new URL(`https://${teamDomain}/cdn-cgi/access/certs`));
+	const issuer = `https://${teamDomain}`;
+	const provider = providerOf(issuer);
 	return async (request) => {
 		const token = request.headers.get(HEADER);
 		if (!token) return refuse("no Access token");
+		let email: string;
+		let subject: string;
 		try {
-			const { payload } = await jwtVerify(token, keys, {
-				issuer: `https://${teamDomain}`,
-				audience,
-			});
+			const { payload } = await jwtVerify(token, keys, { issuer, audience });
 			if (
 				typeof payload.email !== "string" ||
 				!emails.includes(payload.email.toLowerCase())
 			)
 				return refuse("email not allowed");
+			if (typeof payload.sub !== "string" || !payload.sub)
+				return refuse("Access token names no user");
+			email = payload.email.toLowerCase();
+			subject = payload.sub;
 		} catch {
 			return refuse("invalid Access token");
 		}
-		return admit();
+		return admitAs({ provider, subject, name: email });
 	};
 }

package/src/console-api.ts

@@ -2,13 +2,15 @@ import { join } from "node:path";
 import type {
 	AgentTeam,
 	ChannelKey,
+	ConversationRecord,
 	ConversationRegistry,
+	IdentityService,
 	Logger,
 	MemoryKind,
 	QueuePort,
 	SpeakerMemory,
 } from "pi-roundtable";
-import { MemoryError, parseChannelKey } from "pi-roundtable";
+import { MemoryError, parseChannelKey, SYSTEM_PRINCIPAL } from "pi-roundtable";
 import { thinkingLabel } from "pi-roundtable/kit";
 import type {
 	ApiError,
@@ -22,6 +24,8 @@ import type {
 	NoteView,
 	OverviewView,
 	PaneName,
+	PrincipalName,
+	PrincipalsView,
 	TranscriptView,
 } from "./api-types.ts";
 import {
@@ -41,6 +45,7 @@ import {
 	message,
 	safeAdminUrl,
 } from "./features.ts";
+import type { Visitor } from "./visitors.ts";
 
 const NOTE_SEARCH_LIMIT = 500;
 /** The largest note body the console reads. */
@@ -57,11 +62,12 @@ export interface ConsolePorts {
 	queue: Pick<QueuePort, "size">;
 	/** Undefined when Discord no longer knows the channel; throws when it cannot be asked. */
 	channelName?: (channelId: string) => Promise<ChannelName | undefined>;
-	/** The owner's memory; present when the notes pane is served. */
-	memory?: Pick<
-		SpeakerMemory,
-		"list" | "search" | "add" | "update" | "removeById"
-	>;
+	/** A principal's memory; present when the notes pane is served. */
+	memoryOf?: (
+		principalId: string,
+	) => Pick<SpeakerMemory, "list" | "search" | "add" | "update" | "removeById">;
+	/** The host's principals, read only: whose notes the pane may show, and the names of conversations' principals. */
+	people?: Pick<IdentityService, "principal" | "list">;
 	/** Conversations the console must not list or read. */
 	exclude?: (key: ChannelKey) => boolean;
 	/** The host's conversation registry; without it only the conversations found by name are listed. */
@@ -105,10 +111,14 @@ export class ConsoleApi {
 		this.#ports = ports;
 	}
 
-	/** `path` is what follows `<mount>/api/`. */
-	async handle(request: Request, path: string): Promise<Response> {
+	/** `path` is what follows `<mount>/api/`; `visitor` is the owner the request comes from. */
+	async handle(
+		request: Request,
+		path: string,
+		visitor: Visitor,
+	): Promise<Response> {
 		try {
-			return await this.#route(request, path);
+			return await this.#route(request, path, visitor);
 		} catch (error) {
 			if (error instanceof HttpError)
 				return json(
@@ -143,7 +153,11 @@ export class ConsoleApi {
 			throw new HttpError(404, "This pane is not served.");
 	}
 
-	async #route(request: Request, path: string): Promise<Response> {
+	async #route(
+		request: Request,
+		path: string,
+		visitor: Visitor,
+	): Promise<Response> {
 		const method = request.method;
 		let parts: string[];
 		try {
@@ -205,7 +219,11 @@ export class ConsoleApi {
 		}
 		if (head === "notes" && parts.length <= 2) {
 			this.#pane("notes");
-			return this.#notes(request, id);
+			return this.#notes(request, id, visitor);
+		}
+		if (method === "GET" && head === "principals" && !id) {
+			this.#pane("notes");
+			return json(await this.principals(visitor));
 		}
 		throw new HttpError(404, "There is no such API.");
 	}
@@ -282,16 +300,19 @@ export class ConsoleApi {
 			excluded: (key: ChannelKey) => this.#hidden(key),
 			relayNotes,
 		};
+		const records = registry ? await registry.list() : [];
 		// The registry first; the directory scan reads the conversations from before it, by name.
-		const recorded = registry
-			? registeredConversations(sessionsDir, await registry.list(), filter)
-			: [];
+		const recorded = registeredConversations(sessionsDir, records, filter);
 		const stored = [
 			...recorded,
 			...storedConversations(sessionsDir, filter),
 		].sort((a, b) => (b.lastActive ?? "").localeCompare(a.lastActive ?? ""));
+		const byKey = new Map(records.map((record) => [record.key, record]));
+		const names = new Map<string, Promise<PrincipalName>>();
 		return {
-			conversations: await Promise.all(stored.map((c) => this.#view(c))),
+			conversations: await Promise.all(
+				stored.map((c) => this.#view(c, byKey.get(c.key), names)),
+			),
 		};
 	}
 
@@ -337,13 +358,16 @@ export class ConsoleApi {
 			throw new HttpError(404, "There is no such archive.");
 		const { entries, truncated } = readTranscript(dir, archive, relayNotes);
 		return {
-			conversation: await this.#view({
-				key: key as ChannelKey,
-				kind: parsed.kind,
-				id: parsed.id,
-				...(parsed.member ? { member: parsed.member } : {}),
-				...files,
-			}),
+			conversation: await this.#view(
+				{
+					key: key as ChannelKey,
+					kind: parsed.kind,
+					id: parsed.id,
+					...(parsed.member ? { member: parsed.member } : {}),
+					...files,
+				},
+				await this.#ports.registry?.get(key as ChannelKey),
+			),
 			archives,
 			...(archive !== undefined ? { archive } : {}),
 			entries,
@@ -351,8 +375,22 @@ export class ConsoleApi {
 		};
 	}
 
-	async #view(stored: StoredConversation): Promise<ConversationView> {
+	/**
+	 * How the page shows a conversation. `record` is what the registry holds of it, which says whose
+	 * it is; `names` gathers the principals' names one listing reads, so each is read once.
+	 */
+	async #view(
+		stored: StoredConversation,
+		record: ConversationRecord | undefined,
+		names = new Map<string, Promise<PrincipalName>>(),
+	): Promise<ConversationView> {
 		const { team, queue } = this.#ports;
+		const owner = record?.principalId;
+		let principal: Promise<PrincipalName> | undefined;
+		if (owner !== undefined) {
+			principal = names.get(owner) ?? this.#principalName(owner);
+			names.set(owner, principal);
+		}
 		const kind: ConversationKind =
 			stored.kind === "mcp"
 				? "outside"
@@ -375,6 +413,8 @@ export class ConsoleApi {
 			...(stored.lastActive ? { lastActive: stored.lastActive } : {}),
 			...(stored.firstMessage ? { firstMessage: stored.firstMessage } : {}),
 			...(stored.startedAt ? { startedAt: stored.startedAt } : {}),
+			...(record ? { visibility: record.visibility } : {}),
+			...(principal ? { principal: await principal } : {}),
 			// A group's turns queue under the group channel, not under each member's conversation.
 			busy: queue.size(
 				stored.kind === "group" ? `discord:${stored.id}` : stored.key,
@@ -382,6 +422,11 @@ export class ConsoleApi {
 		};
 	}
 
+	async #principalName(id: string): Promise<PrincipalName> {
+		const known = await this.#ports.people?.principal(id);
+		return { id, name: known?.displayName ?? id };
+	}
+
 	async #name(channelId: string): Promise<ChannelName> {
 		const lookup = this.#ports.channelName;
 		if (!lookup) return { kind: "unknown" };
@@ -395,9 +440,43 @@ export class ConsoleApi {
 
 	// ── Notes ──────────────────────────────────────────────────────────────
 
-	async #notes(request: Request, id: string | undefined): Promise<Response> {
-		const { memory } = this.#ports;
-		if (!memory) throw new HttpError(404, "This pane is not served.");
+	/** The people whose notes the pane can show: every principal but the host's own, the visitor first. */
+	async principals(visitor: Visitor): Promise<PrincipalsView> {
+		const self = visitor.principal.id;
+		const everyone = (await this.#ports.people?.list()) ?? [visitor.principal];
+		const listed = [
+			...everyone.filter((p) => p.id === self),
+			...everyone.filter((p) => p.id !== self && p.id !== SYSTEM_PRINCIPAL),
+		];
+		return {
+			self,
+			principals: listed.map((p) => ({
+				id: p.id,
+				name: p.displayName,
+				...(p.disabled ? { disabled: true as const } : {}),
+			})),
+		};
+	}
+
+	/** The memory of the principal the request names, default the visitor's own. */
+	async #memoryFor(request: Request, visitor: Visitor) {
+		const { memoryOf, people } = this.#ports;
+		if (!memoryOf) throw new HttpError(404, "This pane is not served.");
+		const named = new URL(request.url).searchParams.get("principal");
+		if (named === null || named === visitor.principal.id)
+			return memoryOf(visitor.principal.id);
+		// The host's own principal keeps no notes; anyone else must be a principal the host knows.
+		if (named === SYSTEM_PRINCIPAL || !(await people?.principal(named)))
+			throw new HttpError(404, "There is no such person.");
+		return memoryOf(named);
+	}
+
+	async #notes(
+		request: Request,
+		id: string | undefined,
+		visitor: Visitor,
+	): Promise<Response> {
+		const memory = await this.#memoryFor(request, visitor);
 		const method = request.method;
 		if (!id) {
 			if (method === "GET") {

package/src/console-server.ts

@@ -1,9 +1,10 @@
-import type { HttpRoute, Logger } from "pi-roundtable";
+import type { ActorFacts, HttpRoute, Logger } from "pi-roundtable";
 import type { AssetBundle } from "./assets.ts";
 import type { ConsoleApi } from "./console-api.ts";
 import type { ConsolePresentation } from "./features.ts";
 import { presentPage } from "./page-presentation.ts";
 import type { RequestVerifier } from "./verifier.ts";
+import type { Identified, Visitor } from "./visitors.ts";
 
 const encoder = new TextEncoder();
 /** Changes closer together than this reach the page as one event. */
@@ -33,6 +34,8 @@ export interface ConsoleServerOptions {
 	mount: string;
 	assets: AssetBundle;
 	verifier: RequestVerifier;
+	/** Who a request the verifier admitted comes from, by the actor it reported; only an owner is a visitor. */
+	identify(actor: ActorFacts | undefined): Promise<Identified>;
 	/** The console's own origin; requests that change data must come from it. */
 	origin: string;
 	api: Pick<ConsoleApi, "handle">;
@@ -48,8 +51,8 @@ export interface ConsoleServerOptions {
 
 /**
  * The console on the host's listener: `<mount>` redirects to `<mount>/`, and everything under
- * it needs the verifier to vouch for the owner. A request that changes data must also carry the
- * console's own `Origin`.
+ * it needs the verifier to vouch for the person and that person to be an owner. A request that
+ * changes data must also carry the console's own `Origin`.
  */
 export class ConsoleServer {
 	readonly #options: ConsoleServerOptions;
@@ -113,9 +116,12 @@ export class ConsoleServer {
 		const path = new URL(request.url).pathname;
 		if (path !== this.#options.mount && !path.startsWith(this.#base))
 			return new Response("Not found", { status: 404 });
-		const refusal = await this.#refusal(request);
-		if (refusal !== undefined) {
-			this.#options.logger.warn({ refusal }, "console request refused");
+		const admission = await this.#admission(request);
+		if ("refusal" in admission) {
+			this.#options.logger.warn(
+				{ refusal: admission.refusal },
+				"console request refused",
+			);
 			return new Response("Forbidden", {
 				status: 403,
 				headers: { "cache-control": "no-store" },
@@ -130,7 +136,11 @@ export class ConsoleServer {
 		if (rest === "api/events" && request.method === "GET")
 			return this.#events();
 		if (rest.startsWith("api/"))
-			return this.#options.api.handle(request, rest.slice("api/".length));
+			return this.#options.api.handle(
+				request,
+				rest.slice("api/".length),
+				admission.visitor,
+			);
 		if (!READ_METHODS.has(request.method))
 			return new Response("Method not allowed", { status: 405 });
 		const asset = this.#options.assets.get(rest);
@@ -167,21 +177,33 @@ export class ConsoleServer {
 		return new Response("Not found", { status: 404 });
 	}
 
-	/** Undefined when the request may pass, otherwise why not; never throws. */
-	async #refusal(request: Request): Promise<string | undefined> {
+	/** The owner the request comes from when it may pass, otherwise why not; never throws. */
+	async #admission(
+		request: Request,
+	): Promise<{ visitor: Visitor } | { refusal: string }> {
+		let actor: ActorFacts | undefined;
 		try {
 			const verdict = await this.#options.verifier(request);
-			if (!verdict.admitted) return String(verdict.reason);
+			if (!verdict.admitted) return { refusal: String(verdict.reason) };
+			actor = verdict.actor;
 		} catch {
 			// A verifier that fails admits no one.
-			return "verifier failed";
+			return { refusal: "verifier failed" };
 		}
+		let identified: Identified;
+		try {
+			identified = await this.#options.identify(actor);
+		} catch {
+			// Nor does a lookup of who they are that fails.
+			return { refusal: "identity failed" };
+		}
+		if ("refusal" in identified) return { refusal: String(identified.refusal) };
 		if (
 			!READ_METHODS.has(request.method) &&
 			request.headers.get("origin") !== this.#options.origin
 		)
-			return "foreign origin";
-		return undefined;
+			return { refusal: "foreign origin" };
+		return identified;
 	}
 
 	/** A server-sent event stream that says `changed` whenever the console may differ. */

package/src/index.ts

@@ -18,6 +18,8 @@ export type {
 	OverviewView,
 	PaneName,
 	PartyView,
+	PrincipalName,
+	PrincipalsView,
 	SkillDetailView,
 	SkillView,
 	TranscriptEntry,
@@ -26,12 +28,15 @@ export type {
 } from "./api-types.ts";
 export { PANES } from "./api-types.ts";
 export type { CloudflareAccessOptions } from "./cloudflare-access.ts";
-export { cloudflareAccess } from "./cloudflare-access.ts";
+export {
+	cloudflareAccess,
+	cloudflareAccessIdentity,
+} from "./cloudflare-access.ts";
 /** Summary for a trusted host's separately stored party sessions. */
 export { conversationFiles as sessionSummary } from "./conversations.ts";
 export type { ConsoleFeatures, ConsolePresentation } from "./features.ts";
 export type { WebConsoleOptions } from "./options.ts";
 export { DEFAULT_RELAY_NOTE } from "./options.ts";
 export type { RequestVerifier, Verdict } from "./verifier.ts";
-export { admit, refuse } from "./verifier.ts";
+export { admit, admitAs, refuse } from "./verifier.ts";
 export { webConsole } from "./web-plugin.ts";

package/src/options.ts

@@ -14,8 +14,10 @@ export const DEFAULT_RELAY_NOTE =
 
 export interface WebConsoleOptions {
 	/**
-	 * Decides whether a request comes from the owner; required. `cloudflareAccess(...)` is the
-	 * built-in one. Without it the plugin refuses to start rather than serve without authentication.
+	 * Decides whether a request comes from someone the operator's proxy authenticated, and reports
+	 * who; required. `cloudflareAccess(...)` is the built-in one. Without it the plugin refuses to
+	 * start rather than serve without authentication. Only a person whose principal holds the owner
+	 * role gets in.
 	 */
 	verifier: RequestVerifier;
 	/** Host-specific data and actions, resolved against public plugin setup context. */
@@ -31,7 +33,11 @@ export interface WebConsoleOptions {
 	 * must carry it as their `Origin`, and the dashboard line links to it.
 	 */
 	origin: string;
-	/** The id memory notes are kept under: the owner's. Required when the `notes` pane is served. */
+	/**
+	 * Deprecated: the owner's principal that a verifier reporting no actor speaks for; default the
+	 * primary owner (the first of `access.owners`). The notes pane shows each visitor their own
+	 * notes, and any principal's on request.
+	 */
 	ownerId?: string;
 	/** The host's data directory, whose `sessions/` holds the conversations; default `./data`. */
 	dataDir?: string;
@@ -145,9 +151,9 @@ export function resolveOptions(options: WebConsoleOptions): ResolvedOptions {
 	}
 	const panes = checkPanes(options.panes);
 	const ownerId = options.ownerId?.trim();
-	if (panes.includes("notes") && !ownerId)
+	if (options.ownerId !== undefined && !ownerId)
 		fail(
-			"ownerId is required for the notes pane: it is the id the owner's memory is kept under. Set it, or leave `notes` out of panes",
+			"ownerId is empty. Leave it out: the console finds each visitor's principal, and a verifier that reports no actor speaks for the primary owner",
 		);
 	const title = options.title?.trim() ?? "Roundtable";
 	if (!title) fail("title is empty");

package/src/verifier.ts

@@ -1,6 +1,16 @@
+import type { ActorFacts } from "pi-roundtable";
+
 /** The verdict on one request: admitted, or refused with a reason for the log. */
 export type Verdict =
-	| { admitted: true }
+	| {
+			admitted: true;
+			/**
+			 * Who signed in, as the proxy vouched for them; the console finds their principal through
+			 * `IDENTITY` and admits only an owner. Without it, the request is taken as the primary
+			 * owner's, as before 0.9, and the console warns once.
+			 */
+			actor?: ActorFacts;
+	  }
 	| {
 			admitted: false;
 			/** Why, for the operator's log. It is never sent to the client, and it must not hold a secret. */
@@ -8,14 +18,22 @@ export type Verdict =
 	  };
 
 /**
- * Decides whether a request comes from the owner. The console asks it for every request under
- * its path, before anything else, and refuses with 403 when it says no, throws, or rejects.
- * A verifier reads the request's headers, which the operator's proxy set after authenticating the
- * owner, and must never trust a header a client can forge: see "Threat model" in the README.
+ * Decides whether a request comes from someone the operator's proxy authenticated, and who. The
+ * console asks it for every request under its path, before anything else, and refuses with 403
+ * when it says no, throws, or rejects; then it admits only a person whose principal holds the
+ * owner role. A verifier reads the request's headers, which the operator's proxy set after
+ * authenticating the person, and must never trust a header a client can forge: see "Threat model"
+ * in the README.
  */
 export type RequestVerifier = (request: Request) => Verdict | Promise<Verdict>;
 
+/** Admits the request without saying who it is from, as a verifier before 0.9 did. */
 export const admit = (): Verdict => ({ admitted: true });
+/** Admits the request as coming from the person these facts describe. */
+export const admitAs = (actor: ActorFacts): Verdict => ({
+	admitted: true,
+	actor,
+});
 export const refuse = (reason: string): Verdict => ({
 	admitted: false,
 	reason,