Unify edgezero.toml into one multi-adapter manifest

Rewrite the root edgezero.toml as a single EdgeZero manifest covering all four
adapters (fastly, axum, cloudflare, spin), aligned with edgezero's canonical
format: `[app]` with entry = crates/trusted-server-core, one `[adapters.<name>]`
block each with real crate/manifest paths, build target/profile/features, and
commands (Fastly's preserved verbatim).

The locked edgezero schema has no per-adapter store overrides and rejects
unknown fields, so stores declare the union of logical ids with `default` set to
the primary id. This is safe: nothing in src/ or build.rs reads edgezero.toml —
Fastly binds its real stores in fastly.toml, and core resolves store names from
trusted-server.toml at runtime. The manifest ids are portable metadata consumed
only by `ts config validate` and edgezero deploy tooling.

The Spin adapter's regression test now loads this root manifest
(include_str!("../../../edgezero.toml")), so the duplicate
adapter-spin/edgezero.toml is deleted and spin.toml's watch glob repointed.
Validated with `ts config validate` (strict); spin (29) and cli (8) tests pass.

Author: aram356

crates/trusted-server-adapter-spin/edgezero.toml

@@ -46,4 +46,4 @@ v_active_x2dkids = "{{ v_active_x2dkids }}"
 
 [component.trusted-server.build]
 command = "cargo build --target wasm32-wasip1 --release -p trusted-server-adapter-spin --features spin"
-watch = ["src/**/*.rs", "Cargo.toml", "edgezero.toml", "spin.toml"]
+watch = ["src/**/*.rs", "Cargo.toml", "../../edgezero.toml", "spin.toml"]

crates/trusted-server-adapter-spin/spin.toml

@@ -57,8 +57,9 @@ fn routes_build_without_panic() {
 
 #[test]
 fn edgezero_manifest_loads_and_resolves_spin_stores() {
-    let loader =
-        edgezero_core::manifest::ManifestLoader::load_from_str(include_str!("../edgezero.toml"));
+    let loader = edgezero_core::manifest::ManifestLoader::load_from_str(include_str!(
+        "../../../edgezero.toml"
+    ));
     let manifest = loader.manifest();
 
     assert!(

crates/trusted-server-adapter-spin/tests/routes.rs

@@ -1,9 +1,48 @@
+# Unified EdgeZero manifest for Trusted Server.
+#
+# One portable app definition plus one `[adapters.<name>]` block per runtime
+# target (fastly, axum, cloudflare, spin). Store declarations are portable:
+# they list the logical store ids the app uses. Platform store names / bindings
+# are supplied out of band (fastly.toml service resources, the Spin runtime,
+# Cloudflare bindings, axum local files), so the ids here are the union across
+# adapters with `default` set to the primary (production Fastly) id.
+
 [app]
 name = "trusted-server"
+entry = "crates/trusted-server-core"
+kind = "http"
+version = "0.1.0"
+
+# -- Stores ------------------------------------------------------------------
+# Logical store ids only. The union covers every adapter's binding; `default`
+# names the primary id (Fastly production for kv/config/secrets). Runtime store
+# names resolve per platform outside this manifest.
+
+[stores.kv]
+ids = ["trusted_server_kv", "ec_identity_store"]
+default = "trusted_server_kv"
+
+[stores.config]
+ids = ["trusted_server_config"]
+default = "trusted_server_config"
+
+# Secrets: axum/cloudflare/spin are Single-capable for secrets stores, so this
+# declares exactly one logical id. Runtime binds the platform secret store out
+# of band (fastly.toml secret stores, Spin runtime, Cloudflare bindings).
+[stores.secrets]
+ids = ["trusted_server_secrets"]
+default = "trusted_server_secrets"
+
+# -- Fastly Compute (production) --------------------------------------------
 
 [adapters.fastly.adapter]
+crate = "crates/trusted-server-adapter-fastly"
 manifest = "fastly.toml"
 
+[adapters.fastly.build]
+target = "wasm32-wasip1"
+profile = "release"
+
 [adapters.fastly.commands]
 auth-login = "fastly profile create"
 auth-logout = "fastly profile delete"
@@ -12,14 +51,49 @@ build = "cargo build --bin trusted-server-adapter-fastly --release --target wasm
 serve = "fastly compute serve"
 deploy = "fastly compute publish"
 
-[stores.config]
-ids = ["app_config"]
-default = "app_config"
+# -- Axum (native dev server) -----------------------------------------------
 
-[stores.secrets]
-ids = ["secrets"]
-default = "secrets"
+[adapters.axum.adapter]
+crate = "crates/trusted-server-adapter-axum"
+manifest = "crates/trusted-server-adapter-axum/axum.toml"
 
-[stores.kv]
-ids = ["ec_identity_store"]
-default = "ec_identity_store"
+[adapters.axum.build]
+target = "native"
+profile = "dev"
+
+[adapters.axum.commands]
+build = "cargo build -p trusted-server-adapter-axum"
+serve = "cargo run -p trusted-server-adapter-axum"
+
+# -- Cloudflare Workers ------------------------------------------------------
+
+[adapters.cloudflare.adapter]
+crate = "crates/trusted-server-adapter-cloudflare"
+manifest = "crates/trusted-server-adapter-cloudflare/wrangler.toml"
+
+[adapters.cloudflare.build]
+target = "wasm32-unknown-unknown"
+profile = "release"
+features = ["cloudflare"]
+
+[adapters.cloudflare.commands]
+build = "cargo build -p trusted-server-adapter-cloudflare --target wasm32-unknown-unknown --features cloudflare"
+serve = "wrangler dev --cwd crates/trusted-server-adapter-cloudflare"
+deploy = "wrangler deploy --cwd crates/trusted-server-adapter-cloudflare"
+
+# -- Fermyon Spin ------------------------------------------------------------
+
+[adapters.spin.adapter]
+crate = "crates/trusted-server-adapter-spin"
+manifest = "crates/trusted-server-adapter-spin/spin.toml"
+component = "trusted-server"
+
+[adapters.spin.build]
+target = "wasm32-wasip1"
+profile = "release"
+features = ["spin"]
+
+[adapters.spin.commands]
+build = "cargo build --package trusted-server-adapter-spin --target wasm32-wasip1 --features spin --release"
+serve = "spin up --from crates/trusted-server-adapter-spin"
+deploy = "spin deploy --from crates/trusted-server-adapter-spin"