@astrale-os/adapter-cloudflare 0.5.0-beta.88 → 0.5.0-beta.89

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.5.0-beta.89](https://github.com/astrale-os/sdk/compare/adapter-cloudflare-v0.5.0-beta.88...adapter-cloudflare-v0.5.0-beta.89) (2026-08-30)
+
+
+### Features
+
+* support trusted Domain token-exchange authority ([#352](https://github.com/astrale-os/sdk/issues/352)) ([8bec391](https://github.com/astrale-os/sdk/commit/8bec3915afad8aef6fab66d6e8906ea89ca8ad39))
+
+
+### Dependencies
+
+* The following workspace dependencies were updated
+  * dependencies
+    * @astrale-os/sdk bumped to 0.5.0-beta.86
+
 ## [0.5.0-beta.88](https://github.com/astrale-os/sdk/compare/adapter-cloudflare-v0.5.0-beta.87...adapter-cloudflare-v0.5.0-beta.88) (2026-08-30)
 
 

package/dist/build/worker/codegen/service.d.ts

@@ -1,4 +1,5 @@
 import type { Build } from '@astrale-os/sdk/deployment/build';
+import type { ExchangeOptions } from '@astrale-os/sdk/execution';
 export interface ExecutionCodegenOptions {
     readonly origin: string;
     readonly runtimeSpecifier: string;
@@ -7,6 +8,7 @@ export interface ExecutionCodegenOptions {
     readonly maximumRequestBytes?: number;
     readonly invocationTimeoutMs?: number;
     readonly providerAssignedWorker?: string;
+    readonly tokenExchange?: ExchangeOptions | false;
     readonly router?: {
         readonly binding: string;
         readonly hostSuffix: string;

package/dist/build/worker/codegen/service.js

@@ -46,6 +46,7 @@ ${frontend}  load: async () => ({
   ${options.maximumRequestBytes === undefined ? '' : `maximumRequestBytes: ${options.maximumRequestBytes},`}
   ${options.invocationTimeoutMs === undefined ? '' : `invocationTimeoutMs: ${options.invocationTimeoutMs},`}
   ${options.providerAssignedWorker === undefined ? '' : `providerAssignedWorker: ${JSON.stringify(options.providerAssignedWorker)},`}
+  ${options.tokenExchange === undefined ? '' : `tokenExchange: ${JSON.stringify(options.tokenExchange)} as const,`}
   selfBinding: (env) => env.SELF,${routeSubrequest}
 })
 `;

package/dist/build/worker/execution.prepare.js

@@ -23,6 +23,9 @@ export async function prepareExecution(input) {
         build: input.context.build,
         ...(maximumRequestBytes === undefined ? {} : { maximumRequestBytes }),
         ...(invocationTimeoutMs === undefined ? {} : { invocationTimeoutMs }),
+        ...(input.params.tokenExchange === undefined
+            ? {}
+            : { tokenExchange: input.params.tokenExchange }),
         ...(input.configuredIssuer === undefined && input.direct
             ? { providerAssignedWorker: input.name }
             : {}),

package/dist/params.d.ts

@@ -1,3 +1,4 @@
+import type { ExchangeOptions } from '@astrale-os/sdk/execution';
 /**
  * `CloudflareParams` — the provider-typed config for the Cloudflare adapter.
  *
@@ -62,6 +63,12 @@ export interface CloudflareParams {
      * long provider orchestration while retaining a finite application budget.
      */
     readonly invocationTimeoutMs?: number;
+    /**
+     * Configure the Domain issuer's token exchange. Ordinary Domains retain the
+     * authenticated caller by default. Trusted platform Domains may deliberately
+     * select `grantMode: 'union'` to add their installed-Domain principal.
+     */
+    readonly tokenExchange?: ExchangeOptions | false;
     /**
      * Escape hatch: raw wrangler config deep-merged over the generated base. Use
      * it to declare extra bindings the adapter has no typed field for — KV, R2,

package/dist/worker/entry.d.ts

@@ -1,6 +1,6 @@
 import type { JsonWebKey } from '@astrale-os/sdk/auth';
 import type { BuildMaterial, GeneratedBuildMaterial } from '@astrale-os/sdk/deployment/build/material';
-import type { ExecutionContext } from '@astrale-os/sdk/execution';
+import type { ExchangeOptions, ExecutionContext } from '@astrale-os/sdk/execution';
 import type { Runtime } from '@astrale-os/sdk/runtime';
 export interface Fetcher {
     fetch(request: Request): Response | Promise<Response>;
@@ -29,6 +29,7 @@ export interface CloudflareWorkerConfig<RuntimeValue extends Runtime, Bindings e
     readonly routeSubrequest?: (url: URL, bindings: Bindings) => Fetcher | null | undefined;
     readonly invocationTimeoutMs?: number;
     readonly maximumRequestBytes?: number;
+    readonly tokenExchange?: ExchangeOptions | false;
 }
 export interface CloudflareWorkerSource<RuntimeValue extends Runtime, Material = BuildMaterial> {
     readonly runtime: RuntimeValue;

package/dist/worker/entry.js

@@ -44,6 +44,9 @@ function createCloudflareWorkerEntry(restore) {
                             ...(new URL(environment.issuer).protocol === 'http:'
                                 ? { allowInsecureHttp: true }
                                 : {}),
+                            ...(config.tokenExchange === undefined
+                                ? {}
+                                : { tokenExchange: config.tokenExchange }),
                         });
                     },
                     server: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/adapter-cloudflare",
-  "version": "0.5.0-beta.88",
+  "version": "0.5.0-beta.89",
   "description": "Deploy an Astrale application through Cloudflare Workers",
   "keywords": [
     "adapter",
@@ -53,7 +53,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@astrale-os/sdk": "0.5.0-beta.85",
+    "@astrale-os/sdk": "0.5.0-beta.86",
     "@noble/hashes": "2.3.0",
     "hono": "^4.6.20",
     "jose": "^6.1.3",