Add trusted-server-adapter-axum native dev server (PR 16)

.cargo/config.toml

@@ -1,8 +1,38 @@
+# No global [build] target — the workspace contains adapters for multiple targets:
+#   trusted-server-adapter-fastly    → wasm32-wasip1         (Fastly Compute)
+#   trusted-server-adapter-axum      → native                (dev server)
+#   trusted-server-adapter-cloudflare → wasm32-unknown-unknown (Cloudflare Workers)
+#
+# All adapters are workspace members so `-p` resolves each.
+# default-members = [fastly] — required so Viceroy can locate the binary via `cargo run --bin`.
+# Use the aliases below to target each adapter with the correct toolchain.
+
 [alias]
-test_details = ["test", "--target", "aarch64-apple-darwin"]
+# Fastly adapter + shared crates (wasm32-wasip1 via Viceroy)
+# Excludes Axum (native-only) and Cloudflare (wasm32-unknown-unknown, separate job)
+test-fastly = ["test", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--target", "wasm32-wasip1"]
+# Axum dev server adapter (native)
+test-axum = ["test", "-p", "trusted-server-adapter-axum"]
+# Cloudflare adapter (native host; WASM target checked separately in CI)
+test-cloudflare = ["test", "-p", "trusted-server-adapter-cloudflare"]
+# Cloudflare adapter WASM target check (wasm32-unknown-unknown requires --features cloudflare)
+check-cloudflare = ["check", "-p", "trusted-server-adapter-cloudflare", "--target", "wasm32-unknown-unknown", "--features", "cloudflare"]
+
+# Clippy — target-matched to avoid cross-target compile failures
+clippy-fastly = ["clippy", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--all-targets", "--all-features", "--target", "wasm32-wasip1", "--", "-D", "warnings"]
+clippy-axum = ["clippy", "-p", "trusted-server-adapter-axum", "--all-targets", "--all-features", "--", "-D", "warnings"]
+# No --all-features: the `cloudflare` feature has a compile_error! guard on
+# non-wasm32 targets. WASM-feature coverage comes from `cargo check-cloudflare`.
+clippy-cloudflare = ["clippy", "-p", "trusted-server-adapter-cloudflare", "--all-targets", "--", "-D", "warnings"]
+
+# Build — target-matched, same split as test/clippy
+build-fastly = ["build", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--target", "wasm32-wasip1"]
+build-axum = ["build", "-p", "trusted-server-adapter-axum"]
+build-cloudflare = ["build", "-p", "trusted-server-adapter-cloudflare", "--target", "wasm32-unknown-unknown", "--features", "cloudflare"]
 
-[build]
-target = "wasm32-wasip1"
+# Check — fast compile validation, same split
+check-fastly = ["check", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--target", "wasm32-wasip1"]
+check-axum = ["check", "-p", "trusted-server-adapter-axum"]
 
 [target.'cfg(all(target_arch = "wasm32"))']
 runner = "viceroy run -C ../../fastly.toml -- "

.claude/agents/build-validator.md

@@ -8,10 +8,11 @@ Validate that the project builds correctly across all targets.
 
 ## Steps
 
-1. **Native build**
+1. **Per-target builds** (no global target — fastly is wasm32-wasip1, axum is
+   native, cloudflare is wasm32-unknown-unknown)
 
    ```bash
-   cargo build --workspace
+   cargo build-fastly && cargo build-axum && cargo build-cloudflare
    ```
 
 2. **WASM build** (production target)
@@ -23,7 +24,7 @@ Validate that the project builds correctly across all targets.
 3. **Clippy**
 
    ```bash
-   cargo clippy --workspace --all-targets --all-features -- -D warnings
+   cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare
    ```
 
 4. **Format check**

.claude/agents/pr-creator.md

@@ -21,8 +21,8 @@ Before creating the PR, verify the branch is healthy:
 
 ```
 cargo fmt --all -- --check
-cargo clippy --workspace --all-targets --all-features -- -D warnings
-cargo test --workspace
+cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare
+cargo test-fastly && cargo test-axum && cargo test-cloudflare
 cd crates/trusted-server-js/lib && npx vitest run
 cd crates/trusted-server-js/lib && npm run format
 cd docs && npm run format

.claude/agents/pr-reviewer.md

@@ -108,7 +108,7 @@ For each changed file, evaluate:
 - Are new code paths tested?
 - Are edge cases covered (empty input, max values, error paths)?
 - If config-derived regex/pattern compilation changed: are invalid enabled-config startup failures and explicit `enabled = false` bypass cases both covered?
-- Rust tests: `cargo test --workspace`
+- Rust tests: `cargo test-fastly && cargo test-axum && cargo test-cloudflare`
 - JS tests: `npx vitest run` in `crates/trusted-server-js/lib/`
 
 ### 5. Classify findings

.claude/agents/verify-app.md

@@ -19,13 +19,13 @@ cargo fmt --all -- --check
 ### 2. Clippy
 
 ```bash
-cargo clippy --workspace --all-targets --all-features -- -D warnings
+cargo clippy-fastly && cargo clippy-axum
 ```
 
 ### 3. Rust Tests
 
 ```bash
-cargo test --workspace
+cargo test-fastly && cargo test-axum
 ```
 
 ### 4. JS Tests

.claude/commands/check-ci.md

@@ -1,10 +1,11 @@
 Run all CI checks locally, in order. Stop and report if any step fails.
 
 1. `cargo fmt --all -- --check`
-2. `cargo clippy --workspace --all-targets --all-features -- -D warnings`
-3. `cargo test --workspace`
-4. `cd crates/trusted-server-js/lib && npx vitest run`
-5. `cd crates/trusted-server-js/lib && npm run format`
-6. `cd docs && npm run format`
+2. `cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare`
+3. `cargo test-fastly && cargo test-axum && cargo test-cloudflare`
+4. `cargo check-cloudflare` (wasm32-unknown-unknown target check, mirrors CI)
+5. `cd crates/trusted-server-js/lib && npx vitest run`
+6. `cd crates/trusted-server-js/lib && npm run format`
+7. `cd docs && npm run format`
 
 Report a summary of all results when done.

.claude/commands/test-all.md

@@ -1,7 +1,7 @@
 Run the full test suite for both Rust and JavaScript.
 
 ```bash
-cargo test --workspace
+cargo test-fastly && cargo test-axum && cargo test-cloudflare
 ```
 
 Then run JS tests:

.claude/commands/verify.md

@@ -1,10 +1,10 @@
 Full verification: build, test, and lint the entire project.
 
-1. `cargo build --workspace`
+1. `cargo build-fastly && cargo build-axum && cargo build-cloudflare`
 2. `cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1`
 3. `cargo fmt --all -- --check`
-4. `cargo clippy --workspace --all-targets --all-features -- -D warnings`
-5. `cargo test --workspace`
+4. `cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare`
+5. `cargo test-fastly && cargo test-axum && cargo test-cloudflare`
 6. `cd crates/trusted-server-js/lib && npx vitest run`
 7. `cd crates/trusted-server-js/lib && npm run format`
 8. `cd docs && npm run format`

.github/actions/setup-integration-test-env/action.yml

@@ -17,10 +17,18 @@ inputs:
     description: Build the trusted-server WASM binary for integration tests.
     required: false
     default: "true"
+  build-axum:
+    description: Build the trusted-server-axum native binary for integration tests.
+    required: false
+    default: "true"
   build-test-images:
     description: Build the framework Docker images used by integration tests.
     required: false
     default: "true"
+  build-cloudflare:
+    description: Build the Cloudflare Workers bundle (wasm32-unknown-unknown) for integration tests.
+    required: false
+    default: "false"
 
 outputs:
   node-version:
@@ -84,6 +92,16 @@ runs:
         TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
       run: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
 
+    - name: Build Axum native binary
+      if: ${{ inputs.build-axum == 'true' }}
+      shell: bash
+      env:
+        TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:${{ inputs.origin-port }}
+        TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
+        TRUSTED_SERVER__EDGE_COOKIE__SECRET_KEY: integration-test-secret-key
+        TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
+      run: cargo build -p trusted-server-adapter-axum
+
     - name: Build WordPress test container
       if: ${{ inputs.build-test-images == 'true' }}
       shell: bash
@@ -99,3 +117,18 @@ runs:
           --build-arg NODE_VERSION=${{ steps.node-version.outputs.node-version }} \
           -t test-nextjs:latest \
           crates/trusted-server-integration-tests/fixtures/frameworks/nextjs/
+
+    - name: Add wasm32-unknown-unknown target for Cloudflare build
+      if: ${{ inputs.build-cloudflare == 'true' }}
+      shell: bash
+      run: rustup target add wasm32-unknown-unknown
+
+    - name: Build Cloudflare Workers bundle
+      if: ${{ inputs.build-cloudflare == 'true' }}
+      shell: bash
+      env:
+        TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:${{ inputs.origin-port }}
+        TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
+        TRUSTED_SERVER__SYNTHETIC__SECRET_KEY: integration-test-secret-key
+        TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
+      run: bash crates/trusted-server-adapter-cloudflare/build.sh

.github/pull_request_template.md

@@ -23,8 +23,8 @@ Closes #
 
 <!-- How did you verify this works? Check all that apply -->
 
-- [ ] `cargo test --workspace`
-- [ ] `cargo clippy --workspace --all-targets --all-features -- -D warnings`
+- [ ] `cargo test-fastly && cargo test-axum`
+- [ ] `cargo clippy-fastly && cargo clippy-axum`
 - [ ] `cargo fmt --all -- --check`
 - [ ] JS tests: `cd crates/trusted-server-js/lib && npx vitest run`
 - [ ] JS format: `cd crates/trusted-server-js/lib && npm run format`

.github/workflows/format.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
+    branches: [main, "feature/**"]
 
 permissions:
   contents: read
@@ -32,8 +32,14 @@ jobs:
       - name: Run cargo fmt
         uses: actions-rust-lang/rustfmt@v1
 
-      - name: Run cargo clippy
-        run: cargo clippy --workspace --all-targets --all-features -- -D warnings
+      - name: Run cargo clippy (Fastly — wasm32-wasip1)
+        run: cargo clippy-fastly
+
+      - name: Run cargo clippy (Axum — native)
+        run: cargo clippy-axum
+
+      - name: Run cargo clippy (Cloudflare — native)
+        run: cargo clippy-cloudflare
 
   format-typescript:
     runs-on: ubuntu-latest

.github/workflows/integration-tests.yml

@@ -14,7 +14,9 @@ env:
   ORIGIN_PORT: 8888
   ARTIFACTS_DIR: /tmp/integration-test-artifacts
   WASM_ARTIFACT_PATH: /tmp/integration-test-artifacts/wasm/trusted-server-adapter-fastly.wasm
+  AXUM_ARTIFACT_PATH: /tmp/integration-test-artifacts/axum/trusted-server-axum
   DOCKER_ARTIFACT_PATH: /tmp/integration-test-artifacts/docker/test-images.tar
+  CF_BUILD_ARTIFACT_PATH: /tmp/integration-test-artifacts/cloudflare/build
 
 jobs:
   prepare-artifacts:
@@ -29,11 +31,14 @@ jobs:
         with:
           origin-port: ${{ env.ORIGIN_PORT }}
           install-viceroy: "false"
+          build-cloudflare: "true"
 
       - name: Package integration test artifacts
         run: |
-          mkdir -p "$(dirname "$WASM_ARTIFACT_PATH")" "$(dirname "$DOCKER_ARTIFACT_PATH")"
+          mkdir -p "$(dirname "$WASM_ARTIFACT_PATH")" "$(dirname "$AXUM_ARTIFACT_PATH")" "$(dirname "$DOCKER_ARTIFACT_PATH")" "$CF_BUILD_ARTIFACT_PATH"
           cp target/wasm32-wasip1/release/trusted-server-adapter-fastly.wasm "$WASM_ARTIFACT_PATH"
+          cp target/debug/trusted-server-axum "$AXUM_ARTIFACT_PATH"
+          cp -r crates/trusted-server-adapter-cloudflare/build/. "$CF_BUILD_ARTIFACT_PATH/"
           docker save \
             --output "$DOCKER_ARTIFACT_PATH" \
             test-wordpress:latest test-nextjs:latest
@@ -49,7 +54,7 @@ jobs:
     name: integration tests
     needs: prepare-artifacts
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
 
@@ -61,6 +66,7 @@ jobs:
           check-dependency-versions: "false"
           install-viceroy: "true"
           build-wasm: "false"
+          build-axum: "false"
           build-test-images: "false"
 
       - name: Download integration test artifacts
@@ -69,17 +75,37 @@ jobs:
           name: integration-test-artifacts
           path: ${{ env.ARTIFACTS_DIR }}
 
+      - name: Make binaries executable
+        run: chmod +x "$AXUM_ARTIFACT_PATH"
+
+      - name: Restore Cloudflare Workers bundle
+        run: |
+          mkdir -p crates/trusted-server-adapter-cloudflare/build
+          cp -r "$CF_BUILD_ARTIFACT_PATH/." crates/trusted-server-adapter-cloudflare/build/
+
       - name: Load integration test Docker images
         run: docker load --input "$DOCKER_ARTIFACT_PATH"
 
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ steps.shared-setup.outputs.node-version }}
+
+      - name: Install wrangler
+        run: npm install -g wrangler
+
       - name: Run integration tests
         run: >-
           cargo test
           --manifest-path crates/trusted-server-integration-tests/Cargo.toml
           --target x86_64-unknown-linux-gnu
-          -- --include-ignored --skip test_wordpress_fastly --skip test_nextjs_fastly --test-threads=1
+          -- --include-ignored
+          --skip test_wordpress_fastly --skip test_nextjs_fastly
+          --test-threads=1
         env:
           WASM_BINARY_PATH: ${{ env.WASM_ARTIFACT_PATH }}
+          AXUM_BINARY_PATH: ${{ env.AXUM_ARTIFACT_PATH }}
+          CLOUDFLARE_WRANGLER_DIR: ${{ github.workspace }}/crates/trusted-server-adapter-cloudflare
           INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
           RUST_LOG: info
 

.github/workflows/test.yml

@@ -7,7 +7,7 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
+    branches: [main, "feature/**"]
 
 jobs:
   test-rust:
@@ -47,7 +47,33 @@ jobs:
         run: cargo install viceroy --version "${{ steps.viceroy-version.outputs.viceroy-version }}" --locked --force
 
       - name: Run tests
-        run: cargo test --workspace
+        run: cargo test-fastly
+
+  test-axum:
+    name: cargo test (axum native)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Retrieve Rust version
+        id: rust-version
+        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        shell: bash
+
+      - name: Set up Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: ${{ steps.rust-version.outputs.rust-version }}
+          # wasm32-wasip1 is required by the "Verify Fastly WASM release
+          # build" step below; the axum build and tests are native.
+          target: wasm32-wasip1
+          cache-shared-key: cargo-${{ runner.os }}
+
+      - name: Build Axum adapter
+        run: cargo build -p trusted-server-adapter-axum
+
+      - name: Run Axum adapter tests
+        run: cargo test-axum
 
       - name: Verify Fastly WASM release build
         env:
@@ -57,6 +83,33 @@ jobs:
           TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
         run: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
 
+  test-cloudflare:
+    name: cargo check (cloudflare native + wasm32-unknown-unknown)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Retrieve Rust version
+        id: rust-version
+        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        shell: bash
+
+      - name: Set up Rust toolchain (native + wasm32-unknown-unknown)
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: ${{ steps.rust-version.outputs.rust-version }}
+          target: wasm32-unknown-unknown
+          cache-shared-key: cargo-${{ runner.os }}
+
+      - name: Check Cloudflare adapter (native host)
+        run: cargo check -p trusted-server-adapter-cloudflare
+
+      - name: Check Cloudflare adapter (wasm32-unknown-unknown)
+        run: cargo check -p trusted-server-adapter-cloudflare --target wasm32-unknown-unknown --features cloudflare
+
+      - name: Run Cloudflare adapter tests (native host)
+        run: cargo test-cloudflare
+
   test-typescript:
     name: vitest
     runs-on: ubuntu-latest