Adapt Trusted Server to the EdgeZero AWS demo RC

.cargo/config.toml

@@ -2,7 +2,7 @@
 #   trusted-server-adapter-fastly    → wasm32-wasip1         (Fastly Compute)
 #   trusted-server-adapter-axum      → native                (dev server)
 #   trusted-server-adapter-cloudflare → wasm32-unknown-unknown (Cloudflare Workers)
-#   trusted-server-adapter-spin      → wasm32-wasip1         (Fermyon Spin)
+#   trusted-server-adapter-spin      → wasm32-wasip2         (Fermyon Spin)
 #   trusted-server-cli               → native                (operator CLI)
 #
 # All adapters are workspace members so `-p` resolves each.
@@ -54,9 +54,9 @@ clippy-cloudflare-wasm = "clippy -p trusted-server-adapter-cloudflare --target w
 test-cloudflare = "test -p trusted-server-adapter-cloudflare"
 
 # --- Spin adapter (native host tests + wasm32-wasip1 target) ---
-check-spin = "check -p trusted-server-adapter-spin --target wasm32-wasip1 --features spin"
+check-spin = "check -p trusted-server-adapter-spin --target wasm32-wasip2 --features spin"
 clippy-spin-native = "clippy -p trusted-server-adapter-spin --all-targets -- -D warnings"
-clippy-spin-wasm = "clippy -p trusted-server-adapter-spin --target wasm32-wasip1 --features spin --lib -- -D warnings"
+clippy-spin-wasm = "clippy -p trusted-server-adapter-spin --target wasm32-wasip2 --features spin --lib -- -D warnings"
 test-spin = "test -p trusted-server-adapter-spin"
 
 # --- ts operator CLI (native host; install uses the current host platform) ---

.dockerignore

@@ -0,0 +1,37 @@
+# Allow only build inputs, never the entire operator checkout.
+**
+!Cargo.toml
+!Cargo.lock
+!.tool-versions
+!rust-toolchain.toml
+!edgezero.toml
+!.cargo/
+!.cargo/config.toml
+!crates/
+!crates/**
+# Exclude operator TOMLs even if placed below a crate.
+**/*.toml
+!**/Cargo.toml
+!rust-toolchain.toml
+!edgezero.toml
+!.cargo/config.toml
+!trusted-server.example.toml
+**/.git
+**/target
+**/node_modules
+**/dist
+crates/trusted-server-adapter-cloudflare/build
+crates/trusted-server-adapter-cloudflare/pkg
+**/.env
+**/.env.*
+**/*.pem
+**/*.key
+**/*.p12
+**/*.pfx
+**/keys
+**/secrets
+**/.aws
+**/.npmrc
+**/.cargo/credentials*
+**/.ts-tmp
+**/.tsjs-npm-ci.lock

.github/workflows/format.yml

@@ -60,7 +60,7 @@ jobs:
       - name: Set up rust toolchain
         uses: ./.github/actions/setup-rust
         with:
-          target: wasm32-wasip1,wasm32-unknown-unknown
+          target: wasm32-wasip1,wasm32-wasip2,wasm32-unknown-unknown
           components: "clippy, rustfmt"
           cache-key: cargo-clippy
 
@@ -85,7 +85,7 @@ jobs:
       - name: Run cargo clippy (Spin — native)
         run: cargo clippy-spin-native
 
-      - name: Run cargo clippy (Spin — wasm32-wasip1)
+      - name: Run cargo clippy (Spin — wasm32-wasip2)
         run: cargo clippy-spin-wasm
 
       - name: Run host-target CLI clippy
@@ -196,3 +196,6 @@ jobs:
 
       - name: Test proposal scripts
         run: scripts/docs-proposal/test.sh
+
+      - name: Test native and local smoke helpers
+        run: node --test scripts/tests/*.test.mjs

.github/workflows/integration-tests.yml

@@ -96,7 +96,10 @@ jobs:
           node-version: ${{ steps.shared-setup.outputs.node-version }}
 
       - name: Install wrangler
-        run: npm install -g wrangler
+        run: |
+          version=$(awk '$1 == "wrangler" { print $2 }' .tool-versions)
+          test -n "$version"
+          npm install -g "wrangler@$version"
 
       - name: Run integration tests
         run: >-

.github/workflows/native-container.yml

@@ -0,0 +1,45 @@
+name: Native RC container
+
+on:
+  pull_request:
+    paths:
+      - Dockerfile
+      - .dockerignore
+      - .tool-versions
+      - rust-toolchain.toml
+      - Cargo.toml
+      - Cargo.lock
+      - edgezero.toml
+      - .cargo/**
+      - crates/trusted-server-adapter-axum/**
+      - crates/trusted-server-core/**
+      - crates/trusted-server-js/**
+      - crates/trusted-server-openrtb*/**
+      - scripts/test-native-container.mjs
+      - .github/workflows/native-container.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  local-provider-image:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Read pinned Node version
+        id: node
+        run: |
+          version=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)
+          test -n "$version"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ steps.node.outputs.version }}
+      - name: Build local-provider image
+        run: docker build --build-arg TRUSTED_SERVER__GIT_VERSION="${{ github.sha }}" -t ts-rc-local:test .
+      - name: Check real TS routes, startup rejection and drain
+        run: node scripts/test-native-container.mjs ts-rc-local:test

.github/workflows/test.yml

@@ -135,21 +135,21 @@ jobs:
         run: cargo test-cloudflare
 
   test-spin:
-    name: cargo check/build/test (spin native + wasm32-wasip1)
+    name: cargo check/build/test (spin native + wasm32-wasip2)
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
 
-      - name: Set up Rust toolchain (native + wasm32-wasip1)
+      - name: Set up Rust toolchain (native + wasm32-wasip2)
         uses: ./.github/actions/setup-rust
         with:
-          target: wasm32-wasip1
+          target: wasm32-wasip2
           cache-key: cargo-spin
 
       - name: Check Spin adapter (native host)
         run: cargo check -p trusted-server-adapter-spin
 
-      - name: Check Spin adapter (wasm32-wasip1)
+      - name: Check Spin adapter (wasm32-wasip2)
         run: cargo check-spin
 
       - name: Build Spin adapter release WASM
@@ -162,7 +162,7 @@ jobs:
           TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
           TRUSTED_SERVER__EC__PASSPHRASE: integration-test-ec-secret-padded-32
           TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
-        run: cargo build --package trusted-server-adapter-spin --target wasm32-wasip1 --features spin --release
+        run: cargo build --package trusted-server-adapter-spin --target wasm32-wasip2 --features spin --release
 
       - name: Run Spin adapter tests (native host)
         run: cargo test-spin

.tool-versions

@@ -1,7 +1,9 @@
-fastly    15.1.0
-rust      1.95.0
+fastly    16.0.0
+rust      1.98.1
 nodejs    24.12.0
-viceroy   0.17.0
-wasmtime  44.0.1
+viceroy   0.21.0
+wasmtime  48.0.2
+spin-framework 4.1.0
+wrangler  4.151.3
 awscli    2.36.45
 terraform 1.16.2

AGENTS.md

@@ -31,16 +31,18 @@ Supporting files: `edgezero.toml`, `fastly.toml`,
 
 ## Toolchain
 
-| Tool        | Version / Target                         |
-| ----------- | ---------------------------------------- |
-| Rust        | 1.95.0 (pinned in `rust-toolchain.toml`) |
-| WASM target | `wasm32-wasip1`                          |
-| Node        | 24.12.0 (from `.tool-versions`)          |
-| Fastly CLI  | 15.1.0 (from `.tool-versions`)           |
-| Viceroy     | 0.17.0 (from `.tool-versions`)           |
-| Wasmtime    | 44.0.1 (from `.tool-versions`)           |
-| AWS CLI     | 2.36.45 (from `.tool-versions`)          |
-| Terraform   | 1.16.2 (from `.tool-versions`)           |
+| Tool        | Version / Target                             |
+| ----------- | -------------------------------------------- |
+| Rust        | 1.98.1 (pinned in `rust-toolchain.toml`)     |
+| WASM target | Fastly `wasm32-wasip1`; Spin `wasm32-wasip2` |
+| Node        | 24.12.0 (from `.tool-versions`)              |
+| Fastly CLI  | 16.0.0 (from `.tool-versions`)               |
+| Viceroy     | 0.21.0 (from `.tool-versions`)               |
+| Wasmtime    | 48.0.2 (from `.tool-versions`)               |
+| Spin        | 4.1.0 (from `.tool-versions`)                |
+| Wrangler    | 4.151.3 (from `.tool-versions`)              |
+| AWS CLI     | 2.36.45 (from `.tool-versions`)              |
+| Terraform   | 1.16.2 (from `.tool-versions`)               |
 
 ---
 
@@ -62,7 +64,8 @@ fastly compute serve
 EDGEZERO_MANIFEST="<release-root>/edgezero.toml" \
   ts deploy --adapter fastly --service-id <service-id> --application-release "<release-root>"
 
-# Run Axum dev server (native — no Viceroy)
+# Run native TS with prepared config/secrets, not legacy TRUSTED_SERVER_* inputs.
+# See docs/guide/native-rc-demo.md for local files, secret variables and providers.
 cargo run -p trusted-server-adapter-axum
 
 # Test Axum adapter only
@@ -87,7 +90,7 @@ cargo check-spin
 cargo test-spin
 
 # Production-style Spin WASM artifact used by crates/trusted-server-adapter-spin/spin.toml
-cargo build --package trusted-server-adapter-spin --target wasm32-wasip1 --features spin --release
+cargo build --package trusted-server-adapter-spin --target wasm32-wasip2 --features spin --release
 
 # Optional local Spin runtime smoke, if the Spin CLI is installed
 spin up --from crates/trusted-server-adapter-spin
@@ -158,7 +161,7 @@ cd crates/trusted-server-js/lib && node build-all.mjs
 ### Install prerequisites
 
 ```bash
-cargo install viceroy --version 0.17.0 --locked --force
+cargo install viceroy --version 0.21.0 --locked --force
 ```
 
 ---
@@ -352,7 +355,7 @@ IntegrationRegistration::builder(ID)
 | `fastly.toml`                 | Fastly service configuration and build settings                                                   |
 | `trusted-server.example.toml` | Source-controlled Trusted Server app-config template                                              |
 | `trusted-server.toml`         | Operator-owned app config; gitignored; `ts config push` publishes it as an EdgeZero blob envelope |
-| `rust-toolchain.toml`         | Pins Rust version to 1.95.0                                                                       |
+| `rust-toolchain.toml`         | Pins Rust version to 1.98.1                                                                       |
 | `.env.dev`                    | Local development environment variables                                                           |
 
 ---