@revenexx/app-sdk@0.9.0

Minor Changes

• 161c205: c.actor — who is acting, on every route context.

  An app was told which tenant a call was for and had no trustworthy way to learn which person was behind it. The brokered context identifies the calling system (in a theme site, the theme's service user), inbound identity headers are stripped because they are forgeable, and a body says only what the caller says about itself. Apps resolved a person out of the context's email claim and hoped.

  The gateway now states it (RAD-12), and this reads it: user, email, contact, organization, permissions/holds(), plus trust (authenticated | asserted | none) and plane (contact | operator | system).

  trust is the load-bearing field. A storefront call asserts its person — a tenant server's word, resolved through the role provider; a call carrying a person's own token was verified before a route was matched. Both arrive in the same headers, so the same contact is a signature on one plane and a label on the other. Call authenticated() before enforcing a per-person rule.

  Additive: c.actor answers plane: 'system', trust: 'none' for every call that carries no identity, which is every caller that predates this.