@astrale-os/sdk 0.5.0-beta.85 → 0.5.0-beta.87

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.5.0-beta.87](https://github.com/astrale-os/sdk/compare/sdk-v0.5.0-beta.86...sdk-v0.5.0-beta.87) (2026-08-30)
+
+
+### Bug Fixes
+
+* expose managed Domain token exchange ([#354](https://github.com/astrale-os/sdk/issues/354)) ([f7d97bc](https://github.com/astrale-os/sdk/commit/f7d97bc4016d263ccb7f966509775c26368a350f))
+
+## [0.5.0-beta.86](https://github.com/astrale-os/sdk/compare/sdk-v0.5.0-beta.85...sdk-v0.5.0-beta.86) (2026-08-30)
+
+
+### Features
+
+* support trusted Domain token-exchange authority ([#352](https://github.com/astrale-os/sdk/issues/352)) ([8bec391](https://github.com/astrale-os/sdk/commit/8bec3915afad8aef6fab66d6e8906ea89ca8ad39))
+
 ## [0.5.0-beta.85](https://github.com/astrale-os/sdk/compare/sdk-v0.5.0-beta.84...sdk-v0.5.0-beta.85) (2026-08-30)
 
 

package/dist/execution/identity/exchange.d.ts

@@ -4,6 +4,15 @@ import type { IdentityNetworkPolicy, VerificationBasisResolver } from './jwks.js
 import type { SigningMaterial } from './signing.js';
 export interface ExchangeOptions {
     readonly maximumTtlSeconds?: number;
+    /** Authority carried by the exchanged Domain credential. Defaults to the authenticated caller. */
+    readonly grantMode?: ExchangeGrantMode;
+}
+export type ExchangeGrantMode = 'caller' | 'union';
+interface AcceptedExchangeOptions {
+    readonly maximumTtlSeconds: number;
+    readonly grantMode: ExchangeGrantMode;
 }
 export declare function maximumExchangeTtl(input: ExchangeOptions | undefined): number;
-export declare function tokenExchange(issuer: IssuerId, subject: string, signing: SigningMaterial, policy: IdentityNetworkPolicy, verification: VerificationBasisResolver, maximumTtlSeconds: number): exchange.Provider;
+export declare function tokenExchange(issuer: IssuerId, subject: string, signing: SigningMaterial, policy: IdentityNetworkPolicy, verification: VerificationBasisResolver, maximumTtlSeconds: number, grantMode?: ExchangeGrantMode): exchange.Provider;
+export declare function exchangeOptions(input: ExchangeOptions | undefined): AcceptedExchangeOptions;
+export {};

package/dist/execution/identity/exchange.js

@@ -8,21 +8,27 @@ import { CredentialRejected, IssuerUnavailable } from './errors.js';
 import { verifyCredential, verifyCredentialAgainst } from './jwks.js';
 const DEFAULT_MAXIMUM_TTL_SECONDS = 300;
 export function maximumExchangeTtl(input) {
-    if (input === undefined)
-        return DEFAULT_MAXIMUM_TTL_SECONDS;
+    return acceptExchangeOptions(input).maximumTtlSeconds;
+}
+function acceptExchangeOptions(input) {
+    if (input === undefined) {
+        return Object.freeze({ maximumTtlSeconds: DEFAULT_MAXIMUM_TTL_SECONDS, grantMode: 'caller' });
+    }
     if (input === null ||
         typeof input !== 'object' ||
         Array.isArray(input) ||
-        Reflect.ownKeys(input).some((key) => key !== 'maximumTtlSeconds')) {
+        Reflect.ownKeys(input).some((key) => key !== 'maximumTtlSeconds' && key !== 'grantMode')) {
         throw new TypeError('Execution identity tokenExchange options are invalid.');
     }
     const value = input.maximumTtlSeconds ?? DEFAULT_MAXIMUM_TTL_SECONDS;
     if (!Number.isSafeInteger(value) || value < 1) {
         throw new TypeError('tokenExchange.maximumTtlSeconds must be a positive safe integer.');
     }
-    return value;
+    const grantMode = input.grantMode ?? 'caller';
+    return Object.freeze({ maximumTtlSeconds: value, grantMode: acceptExchangeGrantMode(grantMode) });
 }
-export function tokenExchange(issuer, subject, signing, policy, verification, maximumTtlSeconds) {
+export function tokenExchange(issuer, subject, signing, policy, verification, maximumTtlSeconds, grantMode = 'caller') {
+    const acceptedGrantMode = acceptExchangeGrantMode(grantMode);
     return Object.freeze({
         async exchange(request, context) {
             try {
@@ -45,7 +51,7 @@ export function tokenExchange(issuer, subject, signing, policy, verification, ma
                 const token = await new SignJWT({
                     grant: {
                         v: 1,
-                        expr: { kind: 'identity', credential: carried.credential },
+                        expr: exchangeGrant(acceptedGrantMode, carried.credential),
                     },
                 })
                     .setProtectedHeader({
@@ -81,6 +87,27 @@ export function tokenExchange(issuer, subject, signing, policy, verification, ma
         },
     });
 }
+export function exchangeOptions(input) {
+    return acceptExchangeOptions(input);
+}
+function exchangeGrant(mode, credential) {
+    const caller = Object.freeze({ kind: 'identity', credential });
+    if (mode === 'caller')
+        return caller;
+    return Object.freeze({
+        kind: 'union',
+        operands: Object.freeze([
+            Object.freeze({ kind: 'identity', self: true }),
+            caller,
+        ]),
+    });
+}
+function acceptExchangeGrantMode(input) {
+    if (input !== 'caller' && input !== 'union') {
+        throw new TypeError('tokenExchange.grantMode must be caller or union.');
+    }
+    return input;
+}
 function requireProfile(input, profile) {
     const expected = ['aud', 'delegation', 'exp', 'iat', 'iss', 'sub'];
     const actual = Object.keys(input.claims).sort();

package/dist/execution/identity/identity.js

@@ -1,7 +1,7 @@
 import { admit, authenticate } from './authentication.js';
 import { publicationDelivery } from './delivery.js';
 import { httpIssuer } from './errors.js';
-import { maximumExchangeTtl, tokenExchange } from './exchange.js';
+import { exchangeOptions, tokenExchange } from './exchange.js';
 import { createVerificationBasisResolver } from './jwks.js';
 import { signing } from './signing.js';
 /** Create one stateless execution identity backed by an asymmetric private JWK. */
@@ -37,7 +37,10 @@ export function createIdentity(input) {
     });
     const exchangeProvider = input.tokenExchange === false
         ? undefined
-        : tokenExchange(issuer, input.subject, material, policy, verification, maximumExchangeTtl(input.tokenExchange));
+        : (() => {
+            const options = exchangeOptions(input.tokenExchange);
+            return tokenExchange(issuer, input.subject, material, policy, verification, options.maximumTtlSeconds, options.grantMode);
+        })();
     return identity({
         issuer,
         subject: input.subject,

package/dist/execution/identity/index.d.ts

@@ -1,2 +1,2 @@
 export { createIdentity, identity, type Identity, type IdentityInput } from './identity.js';
-export { maximumExchangeTtl, tokenExchange, type ExchangeOptions } from './exchange.js';
+export { maximumExchangeTtl, tokenExchange, type ExchangeGrantMode, type ExchangeOptions, } from './exchange.js';

package/dist/execution/identity/index.js

@@ -1,2 +1,2 @@
 export { createIdentity, identity } from './identity.js';
-export { maximumExchangeTtl, tokenExchange } from './exchange.js';
+export { maximumExchangeTtl, tokenExchange, } from './exchange.js';

package/dist/execution/index.d.ts

@@ -1,5 +1,5 @@
 export { serve } from './serve.js';
 export type { ExecutionContext, ServedApplication, ServeInput } from './serve.js';
-export { createIdentity, type Identity, type IdentityInput } from './identity/index.js';
+export { createIdentity, type ExchangeGrantMode, type ExchangeOptions, type Identity, type IdentityInput, } from './identity/index.js';
 export { InvocationError } from './invocation/index.js';
 export type { InvocationErrorCode } from './invocation/index.js';

package/dist/execution/index.js

@@ -1,3 +1,3 @@
 export { serve } from './serve.js';
-export { createIdentity } from './identity/index.js';
+export { createIdentity, } from './identity/index.js';
 export { InvocationError } from './invocation/index.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/sdk",
-  "version": "0.5.0-beta.85",
+  "version": "0.5.0-beta.87",
   "description": "Schema-first SDK for defining, composing, and deploying Astrale domains",
   "keywords": [
     "astrale",