Bind credentials to approved contexts and add secure provisioning

.env.example

@@ -1,21 +1,21 @@
 # Trusted Server development environment variables
 # Copy this file to .env.dev, .env.staging, or .env.production and fill in
-# non-secret values. App-config secrets are key names in the pushed blob and
-# their values belong in the platform secret store; see the configuration guide.
+# non-secret values. App config contains no credential values or key names.
+# Provision generated native bindings separately; see docs/guide/secrets.md.
 # For Axum runtime loading, export the config blob as:
 # TRUSTED_SERVER_CONFIG_TRUSTED_SERVER_CONFIG_TRUSTED_SERVER_CONFIG=<blob-envelope-json>
-# and export one secret per key name as:
-# TRUSTED_SERVER_SECRET_TRUSTED_SERVER_SECRETS_<KEY_NAME>=<secret-value>
+# Use `ts secrets plan --adapter axum` for exact generated environment names.
+# Inject their raw values through the launcher, not a tracked environment file.
 # The commented examples below are CLI overlays for ordinary fields only.
 # Fastly example: map logical app-config secrets to physical `ts_secrets`.
 # EDGEZERO__STORES__SECRETS__TRUSTED_SERVER_SECRETS__NAME=ts_secrets
 
 # =============================================================================
 # Publisher Settings
 # =============================================================================
-TRUSTED_SERVER__PUBLISHER__DOMAIN=publisher.com
-TRUSTED_SERVER__PUBLISHER__COOKIE_DOMAIN=.publisher.com
-TRUSTED_SERVER__PUBLISHER__ORIGIN_URL=https://origin.publisher.com
+TRUSTED_SERVER__PUBLISHER__DOMAIN=example.com
+TRUSTED_SERVER__PUBLISHER__COOKIE_DOMAIN=.example.com
+TRUSTED_SERVER__PUBLISHER__ORIGIN_URL=https://origin.example.com
 
 # =============================================================================
 # Synthetic ID Settings

.tool-versions

@@ -1,6 +1,7 @@
 fastly    16.0.0
 rust      1.98.1
 nodejs    24.20.0
+wrangler  4.83.0
 viceroy   0.21.0
 wasmtime  48.0.1
 spin      4.1.0

CHANGELOG.md

@@ -9,6 +9,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- **Breaking:** App credentials use context-derived native bindings, not operator-selected secret references. Remove all twelve credential properties, including on disabled features, and provision raw values through reviewed `ts secrets plan` output. Partner inbound auth uses boolean `api_token_enabled`; optional S3 session credentials use boolean `session_token_enabled`, both default false. Enabled credentials and compiled destinations load as one snapshot. First-release direct `ts secrets set` supports Fastly only; all four adapters have native rendering. Cloudflare/Spin presence checks remain unsupported. See the provisioning, protected CI, and migration guides. New keys do not revoke retired contexts, warm states need recreation, and an old-binary rollback restores the original attack. Native/provider/IAM and migration rehearsals remain release gates; this entry is not a completed security-release claim.
+
 - **Breaking:** `x-ts-version` now reports the deployed git version — the release tag, else the branch, else the first 6 characters of the commit — compiled in from the build-time `TRUSTED_SERVER__GIT_VERSION` (set by the deploy pipeline) or local git, and is sent by every adapter, including on the Fastly `GET /health` probe. The Fastly service version it previously carried is now `x-ts-fastly-version`; update dashboards, monitors, and scripts that read `x-ts-version` as the Fastly version number. Builds with neither the override nor git omit the header.
 - **Breaking:** `ts prebid bundle` is now `ts prebid client`, alongside the new `ts prebid server` namespace. Update scripts and runbooks to use `ts prebid client` with the same arguments. The old `bundle` spelling is no longer accepted and has no compatibility alias.
 - The S2S `/_ts/api/v1/batch-sync` endpoint now validates the full batch and calls the CAS-protected update path once per distinct normalized EC ID. The last valid UID wins within a group, and infrastructure failures reject the failing and each unprocessed group, so accepted and `kv_unavailable` input indexes may interleave.