Merge server-side-ad-templates-impl into feature/ts-cli-ad-templates

Reconcile the ad-template CLI + generate feature onto the commands/
module layout the base branch adopted from main (ts dev proxy, #798):

- audit/ -> commands/audit/ : mod.rs is the audit namespace; the #800
  draft-gen plus slot reconstruction move under commands/audit/generate/
  (base's duplicate commands/audit/{analyzer,browser_collector} dropped).
- config_ad_templates.rs -> commands/config/ad_templates.rs.
- app_config and ad_templates support modules stay at crate root.
- run.rs/lib.rs wiring merged with the new `ts dev` command.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: prk-Jr

.cargo/config.toml

@@ -7,44 +7,54 @@
 #
 # All adapters are workspace members so `-p` resolves each.
 # default-members = [fastly] — required so Viceroy can locate the binary via `cargo run --bin`.
-# Use the aliases below to target each adapter with the correct toolchain.
+# The aliases below are grouped by adapter; each targets its adapter with the
+# correct toolchain (build / check / test / clippy).
 
 [alias]
+# Generic: native test with an explicit host target.
 test_details = ["test", "--target", "aarch64-apple-darwin"]
-test_cli_macos = ["test", "--package", "trusted-server-cli", "--target", "aarch64-apple-darwin"]
-build_cli_macos = ["build", "--package", "trusted-server-cli", "--target", "aarch64-apple-darwin"]
-test_cli_linux = ["test", "--package", "trusted-server-cli", "--target", "x86_64-unknown-linux-gnu"]
-build_cli_linux = ["build", "--package", "trusted-server-cli", "--target", "x86_64-unknown-linux-gnu"]
-# Fastly adapter + shared crates (wasm32-wasip1 via Viceroy)
-# Excludes Axum (native-only), Cloudflare (wasm32-unknown-unknown), and Spin (separate wasm32-wasip1 job)
-test-fastly = ["test", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--exclude", "trusted-server-adapter-spin", "--target", "wasm32-wasip1"]
-# Axum dev server adapter (native)
-test-axum = ["test", "-p", "trusted-server-adapter-axum"]
-# Cloudflare adapter (native host; WASM target checked separately in CI)
-test-cloudflare = ["test", "-p", "trusted-server-adapter-cloudflare"]
-# Cloudflare adapter WASM target check (wasm32-unknown-unknown requires --features cloudflare)
-check-cloudflare = ["check", "-p", "trusted-server-adapter-cloudflare", "--target", "wasm32-unknown-unknown", "--features", "cloudflare"]
-# Spin adapter (native host tests; WASM target checked separately with --features spin)
-test-spin = ["test", "-p", "trusted-server-adapter-spin"]
-check-spin = ["check", "-p", "trusted-server-adapter-spin", "--target", "wasm32-wasip1", "--features", "spin"]
 
-# Clippy — target-matched to avoid cross-target compile failures
-clippy-fastly = ["clippy", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--exclude", "trusted-server-adapter-spin", "--all-targets", "--all-features", "--target", "wasm32-wasip1", "--", "-D", "warnings"]
+# --- Fastly adapter (wasm32-wasip1, run via Viceroy) ---
+# Whitelist the wasm-buildable crates (the Fastly adapter + the shared crates it
+# builds/tests on wasm) rather than blacklisting every native crate — so adding a
+# native crate needs no change here. Axum (native), Cloudflare
+# (wasm32-unknown-unknown), Spin, the CLI (native), and integration-tests
+# (native) are simply not listed.
+build-fastly = ["build", "-p", "trusted-server-core", "-p", "trusted-server-adapter-fastly", "-p", "trusted-server-js", "-p", "trusted-server-openrtb", "--target", "wasm32-wasip1"]
+check-fastly = ["check", "-p", "trusted-server-core", "-p", "trusted-server-adapter-fastly", "-p", "trusted-server-js", "-p", "trusted-server-openrtb", "--target", "wasm32-wasip1"]
+clippy-fastly = ["clippy", "-p", "trusted-server-core", "-p", "trusted-server-adapter-fastly", "-p", "trusted-server-js", "-p", "trusted-server-openrtb", "--all-targets", "--all-features", "--target", "wasm32-wasip1", "--", "-D", "warnings"]
+test-fastly = ["test", "-p", "trusted-server-core", "-p", "trusted-server-adapter-fastly", "-p", "trusted-server-js", "-p", "trusted-server-openrtb", "--target", "wasm32-wasip1"]
+
+# --- Axum adapter (native dev server) ---
+build-axum = ["build", "-p", "trusted-server-adapter-axum"]
+check-axum = ["check", "-p", "trusted-server-adapter-axum"]
 clippy-axum = ["clippy", "-p", "trusted-server-adapter-axum", "--all-targets", "--all-features", "--", "-D", "warnings"]
+test-axum = ["test", "-p", "trusted-server-adapter-axum"]
+
+# --- Cloudflare adapter (native host + wasm32-unknown-unknown) ---
+# Build/check target the WASM runtime (requires the `cloudflare` feature);
+# tests and clippy run on the native host.
+build-cloudflare = ["build", "-p", "trusted-server-adapter-cloudflare", "--target", "wasm32-unknown-unknown", "--features", "cloudflare"]
+check-cloudflare = ["check", "-p", "trusted-server-adapter-cloudflare", "--target", "wasm32-unknown-unknown", "--features", "cloudflare"]
 # No --all-features: the `cloudflare` feature has a compile_error! guard on
 # non-wasm32 targets. WASM-feature coverage comes from `cargo check-cloudflare`.
 clippy-cloudflare = ["clippy", "-p", "trusted-server-adapter-cloudflare", "--all-targets", "--", "-D", "warnings"]
+test-cloudflare = ["test", "-p", "trusted-server-adapter-cloudflare"]
+
+# --- Spin adapter (native host tests + wasm32-wasip1 target) ---
+check-spin = ["check", "-p", "trusted-server-adapter-spin", "--target", "wasm32-wasip1", "--features", "spin"]
 clippy-spin-native = ["clippy", "-p", "trusted-server-adapter-spin", "--all-targets", "--", "-D", "warnings"]
 clippy-spin-wasm = ["clippy", "-p", "trusted-server-adapter-spin", "--target", "wasm32-wasip1", "--features", "spin", "--lib", "--", "-D", "warnings"]
+test-spin = ["test", "-p", "trusted-server-adapter-spin"]
 
-# Build — target-matched, same split as test/clippy
-build-fastly = ["build", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--exclude", "trusted-server-adapter-spin", "--target", "wasm32-wasip1"]
-build-axum = ["build", "-p", "trusted-server-adapter-axum"]
-build-cloudflare = ["build", "-p", "trusted-server-adapter-cloudflare", "--target", "wasm32-unknown-unknown", "--features", "cloudflare"]
-
-# Check — fast compile validation, same split
-check-fastly = ["check", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--exclude", "trusted-server-adapter-spin", "--target", "wasm32-wasip1"]
-check-axum = ["check", "-p", "trusted-server-adapter-axum"]
+# --- ts operator CLI (native host; per-OS target overrides the wasm default) ---
+build_cli_linux = ["build", "--package", "trusted-server-cli", "--target", "x86_64-unknown-linux-gnu"]
+build_cli_macos = ["build", "--package", "trusted-server-cli", "--target", "aarch64-apple-darwin"]
+run_cli_linux = ["run", "--package", "trusted-server-cli", "--target", "x86_64-unknown-linux-gnu", "--"]
+run_cli_macos = ["run", "--package", "trusted-server-cli", "--target", "aarch64-apple-darwin", "--"]
+test_cli_linux = ["test", "--package", "trusted-server-cli", "--target", "x86_64-unknown-linux-gnu"]
+test_cli_macos = ["test", "--package", "trusted-server-cli", "--target", "aarch64-apple-darwin"]
 
+# When a wasm binary IS built, run it under Viceroy.
 [target.'cfg(all(target_arch = "wasm32"))']
 runner = "viceroy run -C ../../fastly.toml -- "

.github/actions/setup-integration-test-env/action.yml

@@ -5,10 +5,6 @@ inputs:
   origin-port:
     description: Fixed origin port baked into the WASM binary for integration tests.
     required: true
-  check-dependency-versions:
-    description: Run the integration dependency version consistency check.
-    required: false
-    default: "true"
   install-viceroy:
     description: Install the Viceroy binary used by integration tests.
     required: false
@@ -38,11 +34,6 @@ outputs:
 runs:
   using: composite
   steps:
-    - name: Check shared dependency versions
-      if: ${{ inputs.check-dependency-versions == 'true' }}
-      shell: bash
-      run: ./scripts/check-integration-dependency-versions.sh
-
     - name: Retrieve Rust version
       id: rust-version
       shell: bash

.github/workflows/integration-tests.yml

@@ -68,7 +68,6 @@ jobs:
         uses: ./.github/actions/setup-integration-test-env
         with:
           origin-port: ${{ env.ORIGIN_PORT }}
-          check-dependency-versions: "false"
           install-viceroy: "true"
           build-wasm: "false"
           build-axum: "false"
@@ -128,7 +127,6 @@ jobs:
         uses: ./.github/actions/setup-integration-test-env
         with:
           origin-port: ${{ env.ORIGIN_PORT }}
-          check-dependency-versions: "false"
           install-viceroy: "true"
           build-wasm: "false"
           build-test-images: "false"
@@ -172,7 +170,6 @@ jobs:
         uses: ./.github/actions/setup-integration-test-env
         with:
           origin-port: ${{ env.ORIGIN_PORT }}
-          check-dependency-versions: "false"
           install-viceroy: "true"
           build-wasm: "false"
           build-test-images: "false"

.github/workflows/test.yml

@@ -178,6 +178,41 @@ jobs:
       - name: Clippy (parity test crate)
         run: cargo clippy --manifest-path crates/trusted-server-integration-tests/Cargo.toml --all-targets -- -D warnings
 
+  test-cli:
+    # `trusted-server-cli` is a workspace member, but the workspace default target
+    # is wasm32-wasip1 (see .cargo/config.toml), where the crate is an empty shell
+    # — so the wasm workspace jobs do not exercise its real code. `ts dev proxy` is
+    # a macOS tool (Safari/keychain/networksetup), so validate the crate on macOS
+    # with an explicit native --target that overrides the wasm default.
+    name: cargo test (ts CLI, native)
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Retrieve Rust version
+        id: rust-version
+        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        shell: bash
+
+      - name: Set up Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: ${{ steps.rust-version.outputs.rust-version }}
+          components: "clippy, rustfmt"
+          cache-shared-key: cargo-cli-${{ runner.os }}
+
+      # No separate `cargo fmt` here: `trusted-server-cli` is a workspace member,
+      # so the main `cargo fmt --all` job already formats it. Clippy still needs a
+      # native run — the workspace clippy jobs are wasm/adapter-scoped and never
+      # lint the CLI's host-only code (macOS dev proxy vs Linux audit differ by cfg).
+      - name: cargo clippy
+        run: |
+          cargo clippy --manifest-path crates/trusted-server-cli/Cargo.toml --target "$(rustc -vV | sed -n 's/host: //p')" --all-targets -- -D warnings
+
+      - name: cargo test
+        run: |
+          cargo test --manifest-path crates/trusted-server-cli/Cargo.toml --target "$(rustc -vV | sed -n 's/host: //p')"
+
   test-typescript:
     name: vitest
     runs-on: ubuntu-latest