Add Fermyon Spin adapter (wasm32-wasip1)

.cargo/config.toml

@@ -2,28 +2,34 @@
 #   trusted-server-adapter-fastly    → wasm32-wasip1         (Fastly Compute)
 #   trusted-server-adapter-axum      → native                (dev server)
 #   trusted-server-adapter-cloudflare → wasm32-unknown-unknown (Cloudflare Workers)
+#   trusted-server-adapter-spin      → wasm32-wasip1         (Fermyon Spin)
 #
 # All adapters are workspace members so `-p` resolves each.
 # default-members = [fastly] — required so Viceroy can locate the binary via `cargo run --bin`.
 # Use the aliases below to target each adapter with the correct toolchain.
 
 [alias]
 # Fastly adapter + shared crates (wasm32-wasip1 via Viceroy)
-# Excludes Axum (native-only) and Cloudflare (wasm32-unknown-unknown, separate job)
-test-fastly = ["test", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--target", "wasm32-wasip1"]
+# Excludes Axum (native-only), Cloudflare (wasm32-unknown-unknown), and Spin (separate wasm32-wasip1 job)
+test-fastly = ["test", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--exclude", "trusted-server-adapter-spin", "--target", "wasm32-wasip1"]
 # Axum dev server adapter (native)
 test-axum = ["test", "-p", "trusted-server-adapter-axum"]
 # Cloudflare adapter (native host; WASM target checked separately in CI)
 test-cloudflare = ["test", "-p", "trusted-server-adapter-cloudflare"]
 # Cloudflare adapter WASM target check (wasm32-unknown-unknown requires --features cloudflare)
 check-cloudflare = ["check", "-p", "trusted-server-adapter-cloudflare", "--target", "wasm32-unknown-unknown", "--features", "cloudflare"]
+# Spin adapter (native host tests; WASM target checked separately with --features spin)
+test-spin = ["test", "-p", "trusted-server-adapter-spin"]
+check-spin = ["check", "-p", "trusted-server-adapter-spin", "--target", "wasm32-wasip1", "--features", "spin"]
 
 # Clippy — target-matched to avoid cross-target compile failures
-clippy-fastly = ["clippy", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--all-targets", "--all-features", "--target", "wasm32-wasip1", "--", "-D", "warnings"]
+clippy-fastly = ["clippy", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--exclude", "trusted-server-adapter-spin", "--all-targets", "--all-features", "--target", "wasm32-wasip1", "--", "-D", "warnings"]
 clippy-axum = ["clippy", "-p", "trusted-server-adapter-axum", "--all-targets", "--all-features", "--", "-D", "warnings"]
 # No --all-features: the `cloudflare` feature has a compile_error! guard on
 # non-wasm32 targets. WASM-feature coverage comes from `cargo check-cloudflare`.
 clippy-cloudflare = ["clippy", "-p", "trusted-server-adapter-cloudflare", "--all-targets", "--", "-D", "warnings"]
+clippy-spin-native = ["clippy", "-p", "trusted-server-adapter-spin", "--all-targets", "--no-default-features", "--", "-D", "warnings"]
+clippy-spin-wasm = ["clippy", "-p", "trusted-server-adapter-spin", "--target", "wasm32-wasip1", "--features", "spin", "--lib", "--", "-D", "warnings"]
 
 # Build — target-matched, same split as test/clippy
 build-fastly = ["build", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--target", "wasm32-wasip1"]

.github/actions/setup-integration-test-env/action.yml

@@ -58,7 +58,7 @@ runs:
       if: ${{ inputs.install-viceroy == 'true' }}
       shell: bash
       # `.tool-versions` is the single source of truth for the Viceroy pin.
-      # The pin matters because upstream Viceroy > v0.16.4 has bumped MSRV
+      # The pin matters because upstream Viceroy v0.17+ has bumped MSRV
       # beyond the rustc pin in `rust-toolchain.toml`.
       run: echo "viceroy-version=$(grep '^viceroy ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
 
@@ -131,6 +131,6 @@ runs:
       env:
         TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:${{ inputs.origin-port }}
         TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
-        TRUSTED_SERVER__SYNTHETIC__SECRET_KEY: integration-test-secret-key
+        TRUSTED_SERVER__EDGE_COOKIE__SECRET_KEY: integration-test-secret-key
         TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
       run: bash crates/trusted-server-adapter-cloudflare/build.sh

.github/workflows/format.yml

@@ -38,6 +38,15 @@ jobs:
       - name: Run cargo clippy (Axum — native)
         run: cargo clippy-axum
 
+      - name: Run cargo clippy (Cloudflare — native)
+        run: cargo clippy-cloudflare
+
+      - name: Run cargo clippy (Spin — native)
+        run: cargo clippy-spin-native
+
+      - name: Run cargo clippy (Spin — wasm32-wasip1)
+        run: cargo clippy-spin-wasm
+
   format-typescript:
     runs-on: ubuntu-latest
     defaults:

.github/workflows/test.yml

@@ -25,7 +25,7 @@ jobs:
         id: viceroy-version
         # `.tool-versions` is the single source of truth so this workflow and
         # `.github/actions/setup-integration-test-env/action.yml` can't drift.
-        # The pin matters because upstream Viceroy > v0.16.4 has bumped MSRV
+        # The pin matters because upstream Viceroy v0.17+ has bumped MSRV
         # beyond the rustc pin in `rust-toolchain.toml`.
         run: echo "viceroy-version=$(grep '^viceroy ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
         shell: bash
@@ -116,6 +116,36 @@ jobs:
       - name: Run Cloudflare adapter tests (native host)
         run: cargo test-cloudflare
 
+  test-spin:
+    name: cargo check/build (spin native + wasm32-wasip1)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Retrieve Rust version
+        id: rust-version
+        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        shell: bash
+
+      - name: Set up Rust toolchain (native + wasm32-wasip1)
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: ${{ steps.rust-version.outputs.rust-version }}
+          target: wasm32-wasip1
+          cache-shared-key: cargo-${{ runner.os }}
+
+      - name: Check Spin adapter (native host)
+        run: cargo check -p trusted-server-adapter-spin
+
+      - name: Check Spin adapter (wasm32-wasip1)
+        run: cargo check-spin
+
+      - name: Build Spin adapter release WASM
+        run: cargo build --package trusted-server-adapter-spin --target wasm32-wasip1 --features spin --release
+
+      - name: Run Spin adapter tests (native host)
+        run: cargo test-spin
+
   test-parity:
     name: cargo test (cross-adapter parity)
     runs-on: ubuntu-latest

.gitignore

@@ -3,6 +3,10 @@
 /pkg
 /target
 
+# local Spin CLI downloads
+/spin
+/spin.sig
+
 # EdgeZero local KV store (created by edgezero-adapter-axum framework)
 .edgezero/
 /crates/integration-tests/target

.tool-versions

@@ -1,4 +1,4 @@
 fastly 13.3.0
 rust 1.91.1
 nodejs 24.12.0
-viceroy 0.16.4
+viceroy 0.16.5

CLAUDE.md

@@ -17,6 +17,7 @@ crates/
   trusted-server-adapter-fastly/        # Fastly Compute entry point (wasm32-wasip1 binary)
   trusted-server-adapter-axum/          # Axum dev server entry point (native binary)
   trusted-server-adapter-cloudflare/    # Cloudflare Workers entry point (wasm32-unknown-unknown binary)
+  trusted-server-adapter-spin/          # Fermyon Spin entry point (wasm32-wasip1 component)
   js/            # TypeScript/JS build — per-integration IIFE bundles
     lib/         # TS source, Vitest tests, esbuild pipeline
 ```
@@ -31,7 +32,7 @@ Supporting files: `fastly.toml`, `trusted-server.toml`, `.env.dev`,
 | Rust        | 1.91.1 (pinned in `rust-toolchain.toml`) |
 | WASM target | `wasm32-wasip1`                          |
 | Node        | LTS (for JS build)                       |
-| Viceroy     | Latest (Fastly local simulator)          |
+| Viceroy     | 0.16.5 (pinned in `.tool-versions`)      |
 
 ---
 
@@ -66,6 +67,21 @@ cargo check-cloudflare
 
 # Test Cloudflare adapter (native host)
 cargo test-cloudflare
+
+# Check Spin adapter (native)
+cargo check -p trusted-server-adapter-spin
+
+# Check Spin adapter (WASM target)
+cargo check-spin
+
+# Test Spin adapter (native host)
+cargo test-spin
+
+# Production-style Spin WASM artifact used by crates/trusted-server-adapter-spin/spin.toml
+cargo build --package trusted-server-adapter-spin --target wasm32-wasip1 --features spin --release
+
+# Optional local Spin runtime smoke, if the Spin CLI is installed
+spin up --from crates/trusted-server-adapter-spin
 ```
 
 ### Testing & Quality
@@ -76,12 +92,20 @@ cargo test-cloudflare
 cargo test-fastly      # Fastly adapter + core (wasm32-wasip1 via Viceroy)
 cargo test-axum        # Axum dev server adapter (native)
 cargo test-cloudflare  # Cloudflare Workers adapter (native host)
+cargo test-spin        # Spin adapter route tests (native host)
 
 # Format
 cargo fmt --all -- --check
 
-# Lint
-cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare
+# Lint by adapter target — target-matched clippy is the blocking gate because
+# the workspace has multiple wasm runtimes and runtime-specific SDKs. A plain
+# `cargo clippy --workspace --all-features` would trip the cloudflare
+# feature's non-wasm32 compile_error! guard.
+cargo clippy-fastly
+cargo clippy-axum
+cargo clippy-cloudflare
+cargo clippy-spin-native
+cargo clippy-spin-wasm
 
 # Check compilation (per-target aliases — bare `cargo check` fails at the workspace root)
 cargo check-fastly && cargo check-axum && cargo check-cloudflare
@@ -102,7 +126,7 @@ cd crates/js/lib && node build-all.mjs
 ### Install prerequisites
 
 ```bash
-cargo install viceroy          # Fastly local test runtime
+cargo install --git https://github.com/fastly/Viceroy --tag v0.16.5 viceroy
 ```
 
 ---
@@ -173,6 +197,7 @@ pub struct UserId(Uuid);
 ## Error Handling
 
 - Use `error-stack` (`Report<MyError>`) — not anyhow or eyre.
+  - **Exception**: `crates/trusted-server-adapter-spin/src/lib.rs` entry point returns `anyhow::Result` because `edgezero_adapter_spin::run_app` forces this type at the WASM FFI boundary. Do not use `anyhow` anywhere else.
 - Use `Box<dyn Error>` only in tests or prototyping.
 - Use concrete error types with `Report<E>`.
 - Use `ensure!()` / `bail!()` macros for early returns.
@@ -296,11 +321,12 @@ IntegrationRegistration::builder(ID)
 Every PR must pass:
 
 1. `cargo fmt --all -- --check`
-2. `cargo clippy-fastly && cargo clippy-axum`
-3. `cargo test-fastly && cargo test-axum`
-4. JS build and test (`cd crates/js/lib && npx vitest run`)
-5. JS format (`cd crates/js/lib && npm run format`)
-6. Docs format (`cd docs && npm run format`)
+2. `cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare && cargo clippy-spin-native && cargo clippy-spin-wasm`
+3. `cargo test-fastly && cargo test-axum && cargo test-cloudflare && cargo test-spin`
+4. `cargo test --manifest-path crates/integration-tests/Cargo.toml --test parity`
+5. JS build and test (`cd crates/js/lib && npx vitest run`)
+6. JS format (`cd crates/js/lib && npm run format`)
+7. Docs format (`cd docs && npm run format`)
 
 ---
 
@@ -310,7 +336,8 @@ Every PR must pass:
 2. **Get approval** — for non-trivial changes, present a plan first.
 3. **Implement incrementally** — small, testable changes. Every change should
    impact as little code as possible.
-4. **Test after every change** — `cargo test-fastly && cargo test-axum`.
+4. **Test after every change** — run the target-matched adapter test for the
+   code you changed; before PR handoff, run the full CI gate list above.
 5. **Explain as you go** — describe what you changed and why.
 6. **If blocked** — explain what's blocking and why.