Merge branch 'main' into pr-reviewer-iterative-workflow

Author: aram356

.cargo/config.toml

@@ -1,8 +1,44 @@
+# No global [build] target — the workspace contains adapters for multiple targets:
+#   trusted-server-adapter-fastly    → wasm32-wasip1         (Fastly Compute)
+#   trusted-server-adapter-axum      → native                (dev server)
+#   trusted-server-adapter-cloudflare → wasm32-unknown-unknown (Cloudflare Workers)
+#   trusted-server-adapter-spin      → wasm32-wasip1         (Fermyon Spin)
+#
+# All adapters are workspace members so `-p` resolves each.
+# default-members = [fastly] — required so Viceroy can locate the binary via `cargo run --bin`.
+# Use the aliases below to target each adapter with the correct toolchain.
+
 [alias]
-test_details = ["test", "--target", "aarch64-apple-darwin"]
+# Fastly adapter + shared crates (wasm32-wasip1 via Viceroy)
+# Excludes Axum (native-only), Cloudflare (wasm32-unknown-unknown), and Spin (separate wasm32-wasip1 job)
+test-fastly = ["test", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--exclude", "trusted-server-adapter-spin", "--target", "wasm32-wasip1"]
+# Axum dev server adapter (native)
+test-axum = ["test", "-p", "trusted-server-adapter-axum"]
+# Cloudflare adapter (native host; WASM target checked separately in CI)
+test-cloudflare = ["test", "-p", "trusted-server-adapter-cloudflare"]
+# Cloudflare adapter WASM target check (wasm32-unknown-unknown requires --features cloudflare)
+check-cloudflare = ["check", "-p", "trusted-server-adapter-cloudflare", "--target", "wasm32-unknown-unknown", "--features", "cloudflare"]
+# Spin adapter (native host tests; WASM target checked separately with --features spin)
+test-spin = ["test", "-p", "trusted-server-adapter-spin"]
+check-spin = ["check", "-p", "trusted-server-adapter-spin", "--target", "wasm32-wasip1", "--features", "spin"]
+
+# Clippy — target-matched to avoid cross-target compile failures
+clippy-fastly = ["clippy", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--exclude", "trusted-server-adapter-spin", "--all-targets", "--all-features", "--target", "wasm32-wasip1", "--", "-D", "warnings"]
+clippy-axum = ["clippy", "-p", "trusted-server-adapter-axum", "--all-targets", "--all-features", "--", "-D", "warnings"]
+# No --all-features: the `cloudflare` feature has a compile_error! guard on
+# non-wasm32 targets. WASM-feature coverage comes from `cargo check-cloudflare`.
+clippy-cloudflare = ["clippy", "-p", "trusted-server-adapter-cloudflare", "--all-targets", "--", "-D", "warnings"]
+clippy-spin-native = ["clippy", "-p", "trusted-server-adapter-spin", "--all-targets", "--", "-D", "warnings"]
+clippy-spin-wasm = ["clippy", "-p", "trusted-server-adapter-spin", "--target", "wasm32-wasip1", "--features", "spin", "--lib", "--", "-D", "warnings"]
+
+# Build — target-matched, same split as test/clippy
+build-fastly = ["build", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--exclude", "trusted-server-adapter-spin", "--target", "wasm32-wasip1"]
+build-axum = ["build", "-p", "trusted-server-adapter-axum"]
+build-cloudflare = ["build", "-p", "trusted-server-adapter-cloudflare", "--target", "wasm32-unknown-unknown", "--features", "cloudflare"]
 
-[build]
-target = "wasm32-wasip1"
+# Check — fast compile validation, same split
+check-fastly = ["check", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--exclude", "trusted-server-adapter-spin", "--target", "wasm32-wasip1"]
+check-axum = ["check", "-p", "trusted-server-adapter-axum"]
 
 [target.'cfg(all(target_arch = "wasm32"))']
 runner = "viceroy run -C ../../fastly.toml -- "

.claude/agents/build-validator.md

@@ -8,10 +8,11 @@ Validate that the project builds correctly across all targets.
 
 ## Steps
 
-1. **Native build**
+1. **Per-target builds** (no global target — fastly is wasm32-wasip1, axum is
+   native, cloudflare is wasm32-unknown-unknown)
 
    ```bash
-   cargo build --workspace
+   cargo build-fastly && cargo build-axum && cargo build-cloudflare
    ```
 
 2. **WASM build** (production target)
@@ -23,7 +24,7 @@ Validate that the project builds correctly across all targets.
 3. **Clippy**
 
    ```bash
-   cargo clippy --workspace --all-targets --all-features -- -D warnings
+   cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare
    ```
 
 4. **Format check**

.claude/agents/pr-creator.md

@@ -21,8 +21,8 @@ Before creating the PR, verify the branch is healthy:
 
 ```
 cargo fmt --all -- --check
-cargo clippy --workspace --all-targets --all-features -- -D warnings
-cargo test --workspace
+cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare
+cargo test-fastly && cargo test-axum && cargo test-cloudflare
 cd crates/trusted-server-js/lib && npx vitest run
 cd crates/trusted-server-js/lib && npm run format
 cd docs && npm run format

.claude/agents/pr-reviewer.md

@@ -524,7 +524,7 @@ For each changed file, evaluate:
 - Are new code paths tested?
 - Are edge cases covered (empty input, max values, error paths)?
 - If config-derived regex/pattern compilation changed: are invalid enabled-config startup failures and explicit `enabled = false` bypass cases both covered?
-- Rust tests: `cargo test --workspace`
+- Rust tests: `cargo test-fastly && cargo test-axum && cargo test-cloudflare`
 - JS tests: `npx vitest run` in `crates/trusted-server-js/lib/`
 
 ### 5. Classify findings

.claude/agents/verify-app.md

@@ -19,13 +19,13 @@ cargo fmt --all -- --check
 ### 2. Clippy
 
 ```bash
-cargo clippy --workspace --all-targets --all-features -- -D warnings
+cargo clippy-fastly && cargo clippy-axum
 ```
 
 ### 3. Rust Tests
 
 ```bash
-cargo test --workspace
+cargo test-fastly && cargo test-axum
 ```
 
 ### 4. JS Tests

.claude/commands/check-ci.md

@@ -1,10 +1,11 @@
 Run all CI checks locally, in order. Stop and report if any step fails.
 
 1. `cargo fmt --all -- --check`
-2. `cargo clippy --workspace --all-targets --all-features -- -D warnings`
-3. `cargo test --workspace`
-4. `cd crates/trusted-server-js/lib && npx vitest run`
-5. `cd crates/trusted-server-js/lib && npm run format`
-6. `cd docs && npm run format`
+2. `cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare`
+3. `cargo test-fastly && cargo test-axum && cargo test-cloudflare`
+4. `cargo check-cloudflare` (wasm32-unknown-unknown target check, mirrors CI)
+5. `cd crates/trusted-server-js/lib && npx vitest run`
+6. `cd crates/trusted-server-js/lib && npm run format`
+7. `cd docs && npm run format`
 
 Report a summary of all results when done.

.claude/commands/test-all.md

@@ -1,7 +1,7 @@
 Run the full test suite for both Rust and JavaScript.
 
 ```bash
-cargo test --workspace
+cargo test-fastly && cargo test-axum && cargo test-cloudflare
 ```
 
 Then run JS tests:

.claude/commands/verify.md

@@ -1,10 +1,10 @@
 Full verification: build, test, and lint the entire project.
 
-1. `cargo build --workspace`
+1. `cargo build-fastly && cargo build-axum && cargo build-cloudflare`
 2. `cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1`
 3. `cargo fmt --all -- --check`
-4. `cargo clippy --workspace --all-targets --all-features -- -D warnings`
-5. `cargo test --workspace`
+4. `cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare`
+5. `cargo test-fastly && cargo test-axum && cargo test-cloudflare`
 6. `cd crates/trusted-server-js/lib && npx vitest run`
 7. `cd crates/trusted-server-js/lib && npm run format`
 8. `cd docs && npm run format`

.github/actions/setup-integration-test-env/action.yml

@@ -17,10 +17,18 @@ inputs:
     description: Build the trusted-server WASM binary for integration tests.
     required: false
     default: "true"
+  build-axum:
+    description: Build the trusted-server-axum native binary for integration tests.
+    required: false
+    default: "true"
   build-test-images:
     description: Build the framework Docker images used by integration tests.
     required: false
     default: "true"
+  build-cloudflare:
+    description: Build the Cloudflare Workers bundle (wasm32-unknown-unknown) for integration tests.
+    required: false
+    default: "false"
 
 outputs:
   node-version:
@@ -84,6 +92,16 @@ runs:
         TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
       run: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
 
+    - name: Build Axum native binary
+      if: ${{ inputs.build-axum == 'true' }}
+      shell: bash
+      env:
+        TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:${{ inputs.origin-port }}
+        TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
+        TRUSTED_SERVER__EC__PASSPHRASE: integration-test-ec-secret-padded-32
+        TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
+      run: cargo build -p trusted-server-adapter-axum
+
     - name: Build WordPress test container
       if: ${{ inputs.build-test-images == 'true' }}
       shell: bash
@@ -99,3 +117,18 @@ runs:
           --build-arg NODE_VERSION=${{ steps.node-version.outputs.node-version }} \
           -t test-nextjs:latest \
           crates/trusted-server-integration-tests/fixtures/frameworks/nextjs/
+
+    - name: Add wasm32-unknown-unknown target for Cloudflare build
+      if: ${{ inputs.build-cloudflare == 'true' }}
+      shell: bash
+      run: rustup target add wasm32-unknown-unknown
+
+    - name: Build Cloudflare Workers bundle
+      if: ${{ inputs.build-cloudflare == 'true' }}
+      shell: bash
+      env:
+        TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:${{ inputs.origin-port }}
+        TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
+        TRUSTED_SERVER__EC__PASSPHRASE: integration-test-ec-secret-padded-32
+        TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
+      run: bash crates/trusted-server-adapter-cloudflare/build.sh

.github/pull_request_template.md

@@ -23,8 +23,8 @@ Closes #
 
 <!-- How did you verify this works? Check all that apply -->
 
-- [ ] `cargo test --workspace`
-- [ ] `cargo clippy --workspace --all-targets --all-features -- -D warnings`
+- [ ] `cargo test-fastly && cargo test-axum`
+- [ ] `cargo clippy-fastly && cargo clippy-axum`
 - [ ] `cargo fmt --all -- --check`
 - [ ] JS tests: `cd crates/trusted-server-js/lib && npx vitest run`
 - [ ] JS format: `cd crates/trusted-server-js/lib && npm run format`