@astrale-os/adapter-cloudflare 0.5.0-beta.129 → 0.5.0-beta.130

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.5.0-beta.130](https://github.com/astrale-os/sdk/compare/adapter-cloudflare-v0.5.0-beta.129...adapter-cloudflare-v0.5.0-beta.130) (2026-09-07)
+
+
+### Bug Fixes
+
+* **adapter-cloudflare:** use public subrequest routing by default ([#459](https://github.com/astrale-os/sdk/issues/459)) ([9965fc8](https://github.com/astrale-os/sdk/commit/9965fc842c1c9f6d19490f7bb211d05f12ea82a8))
+
+
+### Dependencies
+
+* The following workspace dependencies were updated
+  * dependencies
+    * @astrale-os/sdk bumped to 0.5.0-beta.127
+
 ## [0.5.0-beta.129](https://github.com/astrale-os/sdk/compare/adapter-cloudflare-v0.5.0-beta.128...adapter-cloudflare-v0.5.0-beta.129) (2026-09-07)
 
 

package/dist/build/configuration/router.js

@@ -1,7 +1,7 @@
 export function resolveRouter(input) {
-    if (input === false)
+    if (input === false || input === undefined)
         return undefined;
-    const value = input ?? {};
+    const value = input;
     return Object.freeze({
         binding: value.binding ?? 'ROUTER',
         service: value.service ?? 'admin-router',

package/dist/params.d.ts

@@ -67,26 +67,20 @@ export interface CloudflareParams {
      */
     readonly wrangler?: Record<string, unknown>;
     /**
-     * Route subrequests to platform INSTANCE hostnames through a service binding
-     * instead of the public edge. A Cloudflare Worker can't fetch a same-zone
-     * hostname served by another Worker — Cloudflare 522s it — so without this the
-     * worker can't fetch an instance kernel's JWKS to verify an inbound credential
-     * from that instance, and every cross-instance call (install hooks, delegated
-     * GUI calls, and traffic initiated from a Shell-handshaken View) fails with
-     * `2002 Credential verification failed`. Point it at a router Worker that
-     * reaches those hosts internally (Astrale: `admin-router`).
+     * Optional private routing through a service binding. By default, subrequests use
+     * their public URLs; generated Workers enable `global_fetch_strictly_public` so
+     * same-zone Worker calls honor public routes too.
      *
      * Wires BOTH halves the SDK needs: the `<binding>` service binding in the
      * generated wrangler config, and a `routeSubrequest` predicate in the worker
      * entry that diverts matching hosts through it.
      *
-     * ON BY DEFAULT (targets `admin-router`) so every adapter-deployed worker can
-     * verify cross-instance credentials out of the box. Pass `false` to disable
-     * (a domain that never talks to another instance, or an account without a
-     * router), or an object to override the target / binding name / host match.
+     * Opt in only when the selected router owns every hostname matched by the
+     * suffix/label predicate. A shared DNS suffix is not proof of router ownership:
+     * standalone Domain deployments may share it with managed instances.
      *
-     *   router: false                      // opt out
-     *   router: { service: 'my-router' }   // override target
+     *   router: false                     // explicit public routing (the default)
+     *   router: { service: 'my-router' }   // opt into a private router
      */
     readonly router?: false | {
         /** Router Worker the binding targets. Default `'admin-router'`. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/adapter-cloudflare",
-  "version": "0.5.0-beta.129",
+  "version": "0.5.0-beta.130",
   "description": "Deploy an Astrale application through Cloudflare Workers",
   "keywords": [
     "adapter",
@@ -53,7 +53,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@astrale-os/sdk": "0.5.0-beta.126",
+    "@astrale-os/sdk": "0.5.0-beta.127",
     "@noble/hashes": "2.3.0",
     "hono": "^4.6.20",
     "jose": "^6.1.3",