Add trusted-server-adapter-cloudflare crate (PR 17)

.cargo/config.toml

@@ -1,23 +1,27 @@
 # No global [build] target — the workspace contains adapters for multiple targets:
-#   trusted-server-adapter-fastly → wasm32-wasip1 (Fastly Compute)
-#   trusted-server-adapter-axum   → native (dev server)
-# Future: trusted-server-adapter-cloudflare → wasm32-unknown-unknown
+#   trusted-server-adapter-fastly    → wasm32-wasip1         (Fastly Compute)
+#   trusted-server-adapter-axum      → native                (dev server)
+#   trusted-server-adapter-cloudflare → wasm32-unknown-unknown (Cloudflare Workers)
 #
-# Both adapters are workspace members so `-p` resolves both.
+# All adapters are workspace members so `-p` resolves each.
 # default-members = [fastly] — required so Viceroy can locate the binary via `cargo run --bin`.
 # Use the aliases below to target each adapter with the correct toolchain.
 
 [alias]
 # Fastly adapter + shared crates (wasm32-wasip1 via Viceroy)
-test-fastly = ["test", "--workspace", "--exclude", "trusted-server-adapter-axum", "--target", "wasm32-wasip1"]
+# Excludes Axum (native-only) and Cloudflare (wasm32-unknown-unknown, separate job)
+test-fastly = ["test", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--target", "wasm32-wasip1"]
 # Axum dev server adapter (native)
 test-axum = ["test", "-p", "trusted-server-adapter-axum"]
-# CI convenience — runs both in sequence (shell aliases can't chain; use a script or CI steps)
-# cargo test-fastly && cargo test-axum
+# Cloudflare adapter (native host; WASM target checked separately in CI)
+test-cloudflare = ["test", "-p", "trusted-server-adapter-cloudflare"]
+# Cloudflare adapter WASM target check (wasm32-unknown-unknown requires --features cloudflare)
+check-cloudflare = ["check", "-p", "trusted-server-adapter-cloudflare", "--target", "wasm32-unknown-unknown", "--features", "cloudflare"]
 
 # Clippy — target-matched to avoid cross-target compile failures
-clippy-fastly = ["clippy", "--workspace", "--exclude", "trusted-server-adapter-axum", "--all-targets", "--all-features", "--target", "wasm32-wasip1", "--", "-D", "warnings"]
+clippy-fastly = ["clippy", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--all-targets", "--all-features", "--target", "wasm32-wasip1", "--", "-D", "warnings"]
 clippy-axum = ["clippy", "-p", "trusted-server-adapter-axum", "--all-targets", "--all-features", "--", "-D", "warnings"]
+clippy-cloudflare = ["clippy", "-p", "trusted-server-adapter-cloudflare", "--all-targets", "--all-features", "--", "-D", "warnings"]
 
 [target.'cfg(all(target_arch = "wasm32"))']
 runner = "viceroy run -C ../../fastly.toml -- "

.github/actions/setup-integration-test-env/action.yml

@@ -25,6 +25,10 @@ inputs:
     description: Build the framework Docker images used by integration tests.
     required: false
     default: "true"
+  build-cloudflare:
+    description: Build the Cloudflare Workers bundle (wasm32-unknown-unknown) for integration tests.
+    required: false
+    default: "false"
 
 outputs:
   node-version:
@@ -113,3 +117,18 @@ runs:
           --build-arg NODE_VERSION=${{ steps.node-version.outputs.node-version }} \
           -t test-nextjs:latest \
           crates/integration-tests/fixtures/frameworks/nextjs/
+
+    - name: Add wasm32-unknown-unknown target for Cloudflare build
+      if: ${{ inputs.build-cloudflare == 'true' }}
+      shell: bash
+      run: rustup target add wasm32-unknown-unknown
+
+    - name: Build Cloudflare Workers bundle
+      if: ${{ inputs.build-cloudflare == 'true' }}
+      shell: bash
+      env:
+        TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:${{ inputs.origin-port }}
+        TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
+        TRUSTED_SERVER__SYNTHETIC__SECRET_KEY: integration-test-secret-key
+        TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
+      run: bash crates/trusted-server-adapter-cloudflare/build.sh

.github/workflows/format.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
+    branches: [main, "feature/**"]
 
 permissions:
   contents: read

.github/workflows/integration-tests.yml

@@ -16,6 +16,7 @@ env:
   WASM_ARTIFACT_PATH: /tmp/integration-test-artifacts/wasm/trusted-server-adapter-fastly.wasm
   AXUM_ARTIFACT_PATH: /tmp/integration-test-artifacts/axum/trusted-server-axum
   DOCKER_ARTIFACT_PATH: /tmp/integration-test-artifacts/docker/test-images.tar
+  CF_BUILD_ARTIFACT_PATH: /tmp/integration-test-artifacts/cloudflare/build
 
 jobs:
   prepare-artifacts:
@@ -30,12 +31,14 @@ jobs:
         with:
           origin-port: ${{ env.ORIGIN_PORT }}
           install-viceroy: "false"
+          build-cloudflare: "true"
 
       - name: Package integration test artifacts
         run: |
-          mkdir -p "$(dirname "$WASM_ARTIFACT_PATH")" "$(dirname "$AXUM_ARTIFACT_PATH")" "$(dirname "$DOCKER_ARTIFACT_PATH")"
+          mkdir -p "$(dirname "$WASM_ARTIFACT_PATH")" "$(dirname "$AXUM_ARTIFACT_PATH")" "$(dirname "$DOCKER_ARTIFACT_PATH")" "$CF_BUILD_ARTIFACT_PATH"
           cp target/wasm32-wasip1/release/trusted-server-adapter-fastly.wasm "$WASM_ARTIFACT_PATH"
           cp target/debug/trusted-server-axum "$AXUM_ARTIFACT_PATH"
+          cp -r crates/trusted-server-adapter-cloudflare/build/. "$CF_BUILD_ARTIFACT_PATH/"
           docker save \
             --output "$DOCKER_ARTIFACT_PATH" \
             test-wordpress:latest test-nextjs:latest
@@ -51,7 +54,7 @@ jobs:
     name: integration tests
     needs: prepare-artifacts
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
 
@@ -63,6 +66,7 @@ jobs:
           check-dependency-versions: "false"
           install-viceroy: "true"
           build-wasm: "false"
+          build-axum: "false"
           build-test-images: "false"
 
       - name: Download integration test artifacts
@@ -74,18 +78,34 @@ jobs:
       - name: Make binaries executable
         run: chmod +x "$AXUM_ARTIFACT_PATH"
 
+      - name: Restore Cloudflare Workers bundle
+        run: |
+          mkdir -p crates/trusted-server-adapter-cloudflare/build
+          cp -r "$CF_BUILD_ARTIFACT_PATH/." crates/trusted-server-adapter-cloudflare/build/
+
       - name: Load integration test Docker images
         run: docker load --input "$DOCKER_ARTIFACT_PATH"
 
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ steps.shared-setup.outputs.node-version }}
+
+      - name: Install wrangler
+        run: npm install -g wrangler
+
       - name: Run integration tests
         run: >-
           cargo test
           --manifest-path crates/integration-tests/Cargo.toml
           --target x86_64-unknown-linux-gnu
-          -- --include-ignored --skip test_wordpress_fastly --skip test_nextjs_fastly --test-threads=1
+          -- --include-ignored
+          --skip test_wordpress_fastly --skip test_nextjs_fastly
+          --test-threads=1
         env:
           WASM_BINARY_PATH: ${{ env.WASM_ARTIFACT_PATH }}
           AXUM_BINARY_PATH: ${{ env.AXUM_ARTIFACT_PATH }}
+          CLOUDFLARE_WRANGLER_DIR: ${{ github.workspace }}/crates/trusted-server-adapter-cloudflare
           INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
           RUST_LOG: info
 

.github/workflows/test.yml

@@ -7,7 +7,7 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
+    branches: [main, "feature/**"]
 
 jobs:
   test-rust:
@@ -74,6 +74,33 @@ jobs:
       - name: Run Axum adapter tests
         run: cargo test-axum
 
+  test-cloudflare:
+    name: cargo check (cloudflare native + wasm32-unknown-unknown)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Retrieve Rust version
+        id: rust-version
+        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        shell: bash
+
+      - name: Set up Rust toolchain (native + wasm32-unknown-unknown)
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: ${{ steps.rust-version.outputs.rust-version }}
+          target: wasm32-unknown-unknown
+          cache-shared-key: cargo-${{ runner.os }}
+
+      - name: Check Cloudflare adapter (native host)
+        run: cargo check -p trusted-server-adapter-cloudflare
+
+      - name: Check Cloudflare adapter (wasm32-unknown-unknown)
+        run: cargo check -p trusted-server-adapter-cloudflare --target wasm32-unknown-unknown --features cloudflare
+
+      - name: Run Cloudflare adapter tests (native host)
+        run: cargo test-cloudflare
+
   test-typescript:
     name: vitest
     runs-on: ubuntu-latest

CLAUDE.md

@@ -16,6 +16,7 @@ crates/
   trusted-server-core/                  # Core library — shared logic, integrations, HTML processing
   trusted-server-adapter-fastly/        # Fastly Compute entry point (wasm32-wasip1 binary)
   trusted-server-adapter-axum/          # Axum dev server entry point (native binary)
+  trusted-server-adapter-cloudflare/    # Cloudflare Workers entry point (wasm32-unknown-unknown binary)
   js/            # TypeScript/JS build — per-integration IIFE bundles
     lib/         # TS source, Vitest tests, esbuild pipeline
 ```
@@ -56,15 +57,25 @@ cargo run -p trusted-server-adapter-axum
 
 # Test Axum adapter only
 cargo test-axum
+
+# Check Cloudflare adapter (native)
+cargo check -p trusted-server-adapter-cloudflare
+
+# Check Cloudflare adapter (WASM target)
+cargo check -p trusted-server-adapter-cloudflare --target wasm32-unknown-unknown --features cloudflare
+
+# Test Cloudflare adapter (native host)
+cargo test-cloudflare
 ```
 
 ### Testing & Quality
 
 ```bash
 # Run all Rust tests — use workspace aliases (see .cargo/config.toml)
 # default-members = [fastly] so Viceroy can locate the binary via `cargo run --bin`.
-cargo test-fastly  # Fastly adapter + core (wasm32-wasip1 via Viceroy)
-cargo test-axum    # Axum dev server adapter (native)
+cargo test-fastly      # Fastly adapter + core (wasm32-wasip1 via Viceroy)
+cargo test-axum        # Axum dev server adapter (native)
+cargo test-cloudflare  # Cloudflare Workers adapter (native host)
 
 # Format
 cargo fmt --all -- --check