Sync EdgeZero PR #257 updates (#761)

* Sync EdgeZero PR 257 updates

* Formatting

* Sync integration-tests lockfile to edgezero 170b74b and fastly 0.11

* Track edgezero main and align fastly to 0.12

Point the edgezero dependencies at the upstream main branch and bump
fastly/log-fastly to 0.12 to match edgezero's pinned version. Forward-port
the body and TLS APIs to the newer surface:

- Body::into_bytes() now returns Option<Bytes>; buffered-body call sites use
  unwrap_or_default() to preserve prior semantics.
- fastly 0.12 get_tls_protocol()/get_tls_cipher_openssl_name() return
  Result<Option<&str>>; adapter call sites use .ok().flatten().

Resync the excluded integration-tests lockfile to the same versions.

* Fix OpenRTB regeneration command in README

The wrapper script lives at crates/trusted-server-openrtb/generate.sh, not in
the codegen crate. Point the example at the actual script path.

* Address review feedback: doc entrypoint shape and crate-rename helper paths

Apply the approving review's inline doc suggestions and the crate-rename
cleanup:

- integration-guide: describe directory-based entrypoint discovery
  (src/integrations/<id>/index.ts) instead of arbitrary .ts files, and
  point the Testlight key file at testlight/index.ts.
- creative-processing: fix the generated bundle output directory to
  crates/trusted-server-js/dist (not lib/dist).
- .claude helper commands/agents: replace remaining crates/js references
  with crates/trusted-server-js so local/agent verification helpers keep
  working after the crate rename.

* Pin integration-tests log to 0.4.32 to match workspace lockfile

The Integration Tests CI job runs scripts/check-integration-dependency-versions.sh,
which requires the excluded trusted-server-integration-tests crate to resolve the
same shared direct-dependency versions as the workspace. Regenerating its lockfile
during the EdgeZero sync picked up log 0.4.33 while the workspace stays on 0.4.32.
Downgrade log in the integration lockfile so the parity check passes.

* Fix EdgeZero integration test paths after crate rename

The EdgeZero entry-point step in integration-tests.yml still pointed at the
pre-rename crates/integration-tests path for both --manifest-path and
VICEROY_CONFIG_PATH, so the job failed with 'manifest path does not exist'.
Point them at crates/trusted-server-integration-tests to match the rename
(the legacy integration-tests job already used the new path).

* Align toml dependency requirement with main (1.1)

The merge resolution kept this branch's looser toml = "1.0" requirement;
main uses "1.1". Both resolve to the same locked 1.1.x, so the lockfile is
unchanged, but match main to avoid widening the version range.

* Align integration-tests transitive deps with the workspace lockfile

The integration-tests lockfile was regenerated fresh during the EdgeZero
sync and picked up newer patch/minor versions of crates that also resolve
through trusted-server-core (http, bytes, uuid, lol_html, config, brotli,
chrono, regex, time, etc.), so the tests linked slightly different versions
than the production build ships.

Pin those shared transitive crates back to the workspace-resolved versions
(45 crates aligned). Six remain newer (js-sys, num-conv, wasm-bindgen
family) because the integration crate's own dependency tree constrains them
to a higher version; those cannot be downgraded without breaking
resolution. The CI direct-dependency parity check still passes and the
crate compiles --locked on the host target.

* Enforce transitive dependency parity for integration-tests lockfile

Extend check-integration-dependency-versions.sh with a lockfile-based
transitive parity check: every (name, version) the workspace lockfile
resolves must also be present in the integration lockfile for any shared
crate, so the integration tests exercise the same dependency versions the
production build ships. This catches accidental drift when the integration
lockfile is regenerated and silently bumps shared crates to newer versions
than production uses (the failure mode that produced the original log/http
drift during the EdgeZero sync).

A small documented allowlist exempts crates the integration crate's own
dependency tree forces to a different version (js-sys / wasm-bindgen family
and num-conv, pulled newer by reqwest's wasm tooling; itertools, whose
workspace 0.10.x line the integration tree never resolves).

Also align four more shared transitives that were previously skipped as
multi-version (bitflags, getrandom, hashbrown, syn) down to the workspace
versions, so the enforced allowlist stays minimal. The check is parsed
directly from the lockfiles (no cargo invocation), and a negative test
confirms it flags an injected http drift and passes after restore.

Author: aram356

.claude/agents/build-validator.md

@@ -34,7 +34,7 @@ Validate that the project builds correctly across all targets.
 
 5. **JS build**
    ```bash
-   cd crates/js/lib && node build-all.mjs
+   cd crates/trusted-server-js/lib && node build-all.mjs
    ```
 
 ## Output

.claude/agents/pr-creator.md

@@ -23,8 +23,8 @@ Before creating the PR, verify the branch is healthy:
 cargo fmt --all -- --check
 cargo clippy --workspace --all-targets --all-features -- -D warnings
 cargo test --workspace
-cd crates/js/lib && npx vitest run
-cd crates/js/lib && npm run format
+cd crates/trusted-server-js/lib && npx vitest run
+cd crates/trusted-server-js/lib && npm run format
 cd docs && npm run format
 ```
 

.claude/agents/pr-reviewer.md

@@ -109,7 +109,7 @@ For each changed file, evaluate:
 - Are edge cases covered (empty input, max values, error paths)?
 - If config-derived regex/pattern compilation changed: are invalid enabled-config startup failures and explicit `enabled = false` bypass cases both covered?
 - Rust tests: `cargo test --workspace`
-- JS tests: `npx vitest run` in `crates/js/lib/`
+- JS tests: `npx vitest run` in `crates/trusted-server-js/lib/`
 
 ### 5. Classify findings
 

.claude/agents/repo-explorer.md

@@ -13,7 +13,7 @@ This is a Rust workspace with three crates:
 
 - `crates/trusted-server-core/` — core library (integrations, HTML processing, Edge Cookies, GDPR)
 - `crates/trusted-server-adapter-fastly/` — Fastly Compute entry point
-- `crates/js/` — TypeScript/JS build pipeline (per-integration IIFE bundles)
+- `crates/trusted-server-js/` — TypeScript/JS build pipeline (per-integration IIFE bundles)
 
 Target: `wasm32-wasip1` (Fastly Compute)
 

.claude/agents/verify-app.md

@@ -31,13 +31,13 @@ cargo test --workspace
 ### 4. JS Tests
 
 ```bash
-cd crates/js/lib && npx vitest run
+cd crates/trusted-server-js/lib && npx vitest run
 ```
 
 ### 5. JS Format
 
 ```bash
-cd crates/js/lib && npm run format
+cd crates/trusted-server-js/lib && npm run format
 ```
 
 ### 6. Docs Format

.claude/commands/check-ci.md

@@ -3,8 +3,8 @@ Run all CI checks locally, in order. Stop and report if any step fails.
 1. `cargo fmt --all -- --check`
 2. `cargo clippy --workspace --all-targets --all-features -- -D warnings`
 3. `cargo test --workspace`
-4. `cd crates/js/lib && npx vitest run`
-5. `cd crates/js/lib && npm run format`
+4. `cd crates/trusted-server-js/lib && npx vitest run`
+5. `cd crates/trusted-server-js/lib && npm run format`
 6. `cd docs && npm run format`
 
 Report a summary of all results when done.

.claude/commands/test-all.md

@@ -7,7 +7,7 @@ cargo test --workspace
 Then run JS tests:
 
 ```bash
-cd crates/js/lib && npx vitest run
+cd crates/trusted-server-js/lib && npx vitest run
 ```
 
 Report results for both. If any test fails, investigate and suggest a fix.

.claude/commands/test-crate.md

@@ -11,7 +11,7 @@ cargo test -p $ARGUMENTS
 If $ARGUMENTS is "js" or "javascript", run:
 
 ```bash
-cd crates/js/lib && npx vitest run
+cd crates/trusted-server-js/lib && npx vitest run
 ```
 
 Report results and investigate any failures.

.claude/commands/verify.md

@@ -5,8 +5,8 @@ Full verification: build, test, and lint the entire project.
 3. `cargo fmt --all -- --check`
 4. `cargo clippy --workspace --all-targets --all-features -- -D warnings`
 5. `cargo test --workspace`
-6. `cd crates/js/lib && npx vitest run`
-7. `cd crates/js/lib && npm run format`
+6. `cd crates/trusted-server-js/lib && npx vitest run`
+7. `cd crates/trusted-server-js/lib && npm run format`
 8. `cd docs && npm run format`
 
 Report results for each step. Stop and investigate if any step fails.

.github/actions/setup-integration-test-env/action.yml

@@ -50,8 +50,6 @@ runs:
       if: ${{ inputs.install-viceroy == 'true' }}
       shell: bash
       # `.tool-versions` is the single source of truth for the Viceroy pin.
-      # The pin matters because upstream Viceroy > v0.16.4 has bumped MSRV
-      # beyond the rustc pin in `rust-toolchain.toml`.
       run: echo "viceroy-version=$(grep '^viceroy ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
 
     - name: Set up Rust toolchain
@@ -72,7 +70,7 @@ runs:
     - name: Install Viceroy
       if: ${{ inputs.install-viceroy == 'true' && steps.cache-viceroy.outputs.cache-hit != 'true' }}
       shell: bash
-      run: cargo install --git https://github.com/fastly/Viceroy --tag v${{ steps.viceroy-version.outputs.viceroy-version }} viceroy
+      run: cargo install viceroy --version "${{ steps.viceroy-version.outputs.viceroy-version }}" --locked --force
 
     - name: Build WASM binary
       if: ${{ inputs.build-wasm == 'true' }}
@@ -91,7 +89,7 @@ runs:
       shell: bash
       run: |
         docker build -t test-wordpress:latest \
-          crates/integration-tests/fixtures/frameworks/wordpress/
+          crates/trusted-server-integration-tests/fixtures/frameworks/wordpress/
 
     - name: Build Next.js test container
       if: ${{ inputs.build-test-images == 'true' }}
@@ -100,4 +98,4 @@ runs:
         docker build \
           --build-arg NODE_VERSION=${{ steps.node-version.outputs.node-version }} \
           -t test-nextjs:latest \
-          crates/integration-tests/fixtures/frameworks/nextjs/
+          crates/trusted-server-integration-tests/fixtures/frameworks/nextjs/