Add Fermyon Spin adapter (wasm32-wasip1)

.cargo/config.toml

@@ -2,36 +2,42 @@
 #   trusted-server-adapter-fastly    → wasm32-wasip1         (Fastly Compute)
 #   trusted-server-adapter-axum      → native                (dev server)
 #   trusted-server-adapter-cloudflare → wasm32-unknown-unknown (Cloudflare Workers)
+#   trusted-server-adapter-spin      → wasm32-wasip1         (Fermyon Spin)
 #
 # All adapters are workspace members so `-p` resolves each.
 # default-members = [fastly] — required so Viceroy can locate the binary via `cargo run --bin`.
 # Use the aliases below to target each adapter with the correct toolchain.
 
 [alias]
 # Fastly adapter + shared crates (wasm32-wasip1 via Viceroy)
-# Excludes Axum (native-only) and Cloudflare (wasm32-unknown-unknown, separate job)
-test-fastly = ["test", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--target", "wasm32-wasip1"]
+# Excludes Axum (native-only), Cloudflare (wasm32-unknown-unknown), and Spin (separate wasm32-wasip1 job)
+test-fastly = ["test", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--exclude", "trusted-server-adapter-spin", "--target", "wasm32-wasip1"]
 # Axum dev server adapter (native)
 test-axum = ["test", "-p", "trusted-server-adapter-axum"]
 # Cloudflare adapter (native host; WASM target checked separately in CI)
 test-cloudflare = ["test", "-p", "trusted-server-adapter-cloudflare"]
 # Cloudflare adapter WASM target check (wasm32-unknown-unknown requires --features cloudflare)
 check-cloudflare = ["check", "-p", "trusted-server-adapter-cloudflare", "--target", "wasm32-unknown-unknown", "--features", "cloudflare"]
+# Spin adapter (native host tests; WASM target checked separately with --features spin)
+test-spin = ["test", "-p", "trusted-server-adapter-spin"]
+check-spin = ["check", "-p", "trusted-server-adapter-spin", "--target", "wasm32-wasip1", "--features", "spin"]
 
 # Clippy — target-matched to avoid cross-target compile failures
-clippy-fastly = ["clippy", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--all-targets", "--all-features", "--target", "wasm32-wasip1", "--", "-D", "warnings"]
+clippy-fastly = ["clippy", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--exclude", "trusted-server-adapter-spin", "--all-targets", "--all-features", "--target", "wasm32-wasip1", "--", "-D", "warnings"]
 clippy-axum = ["clippy", "-p", "trusted-server-adapter-axum", "--all-targets", "--all-features", "--", "-D", "warnings"]
 # No --all-features: the `cloudflare` feature has a compile_error! guard on
 # non-wasm32 targets. WASM-feature coverage comes from `cargo check-cloudflare`.
 clippy-cloudflare = ["clippy", "-p", "trusted-server-adapter-cloudflare", "--all-targets", "--", "-D", "warnings"]
+clippy-spin-native = ["clippy", "-p", "trusted-server-adapter-spin", "--all-targets", "--", "-D", "warnings"]
+clippy-spin-wasm = ["clippy", "-p", "trusted-server-adapter-spin", "--target", "wasm32-wasip1", "--features", "spin", "--lib", "--", "-D", "warnings"]
 
 # Build — target-matched, same split as test/clippy
-build-fastly = ["build", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--target", "wasm32-wasip1"]
+build-fastly = ["build", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--exclude", "trusted-server-adapter-spin", "--target", "wasm32-wasip1"]
 build-axum = ["build", "-p", "trusted-server-adapter-axum"]
 build-cloudflare = ["build", "-p", "trusted-server-adapter-cloudflare", "--target", "wasm32-unknown-unknown", "--features", "cloudflare"]
 
 # Check — fast compile validation, same split
-check-fastly = ["check", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--target", "wasm32-wasip1"]
+check-fastly = ["check", "--workspace", "--exclude", "trusted-server-adapter-axum", "--exclude", "trusted-server-adapter-cloudflare", "--exclude", "trusted-server-adapter-spin", "--target", "wasm32-wasip1"]
 check-axum = ["check", "-p", "trusted-server-adapter-axum"]
 
 [target.'cfg(all(target_arch = "wasm32"))']

.github/actions/setup-integration-test-env/action.yml

@@ -98,7 +98,7 @@ runs:
       env:
         TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:${{ inputs.origin-port }}
         TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
-        TRUSTED_SERVER__EDGE_COOKIE__SECRET_KEY: integration-test-secret-key
+        TRUSTED_SERVER__EC__PASSPHRASE: integration-test-ec-secret-padded-32
         TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
       run: cargo build -p trusted-server-adapter-axum
 
@@ -129,6 +129,6 @@ runs:
       env:
         TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:${{ inputs.origin-port }}
         TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
-        TRUSTED_SERVER__SYNTHETIC__SECRET_KEY: integration-test-secret-key
+        TRUSTED_SERVER__EC__PASSPHRASE: integration-test-ec-secret-padded-32
         TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
       run: bash crates/trusted-server-adapter-cloudflare/build.sh

.github/workflows/format.yml

@@ -41,6 +41,12 @@ jobs:
       - name: Run cargo clippy (Cloudflare — native)
         run: cargo clippy-cloudflare
 
+      - name: Run cargo clippy (Spin — native)
+        run: cargo clippy-spin-native
+
+      - name: Run cargo clippy (Spin — wasm32-wasip1)
+        run: cargo clippy-spin-wasm
+
   format-typescript:
     runs-on: ubuntu-latest
     defaults:

.github/workflows/test.yml

@@ -114,6 +114,45 @@ jobs:
       - name: Run Cloudflare adapter tests (native host)
         run: cargo test-cloudflare
 
+  test-spin:
+    name: cargo check/build/test (spin native + wasm32-wasip1)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Retrieve Rust version
+        id: rust-version
+        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        shell: bash
+
+      - name: Set up Rust toolchain (native + wasm32-wasip1)
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: ${{ steps.rust-version.outputs.rust-version }}
+          target: wasm32-wasip1
+          cache-shared-key: cargo-${{ runner.os }}
+
+      - name: Check Spin adapter (native host)
+        run: cargo check -p trusted-server-adapter-spin
+
+      - name: Check Spin adapter (wasm32-wasip1)
+        run: cargo check-spin
+
+      - name: Build Spin adapter release WASM
+        # Mirror the Fastly release-build overrides so the artifact embeds usable
+        # settings instead of the trusted-server.toml placeholders, which startup
+        # rejects (falling back to the generic 503 router). This proves the
+        # documented Spin artifact can boot, not just compile.
+        env:
+          TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:8080
+          TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
+          TRUSTED_SERVER__EC__PASSPHRASE: integration-test-ec-secret-padded-32
+          TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
+        run: cargo build --package trusted-server-adapter-spin --target wasm32-wasip1 --features spin --release
+
+      - name: Run Spin adapter tests (native host)
+        run: cargo test-spin
+
   test-parity:
     name: cargo test (cross-adapter parity)
     runs-on: ubuntu-latest

.gitignore

@@ -12,6 +12,10 @@
 # Auto-generated JS module index
 **/src/generated-modules.ts
 
+# local Spin CLI downloads
+/spin
+/spin.sig
+
 # EdgeZero local KV store (created by edgezero-adapter-axum framework)
 .edgezero/
 

CLAUDE.md

@@ -17,6 +17,7 @@ crates/
   trusted-server-adapter-fastly/        # Fastly Compute entry point (wasm32-wasip1 binary)
   trusted-server-adapter-axum/          # Axum dev server entry point (native binary)
   trusted-server-adapter-cloudflare/    # Cloudflare Workers entry point (wasm32-unknown-unknown binary)
+  trusted-server-adapter-spin/          # Fermyon Spin entry point (wasm32-wasip1 component)
   trusted-server-js/                    # TypeScript/JS build — per-integration IIFE bundles
     lib/         # TS source, Vitest tests, esbuild pipeline
 ```
@@ -68,6 +69,21 @@ cargo check-cloudflare
 
 # Test Cloudflare adapter (native host)
 cargo test-cloudflare
+
+# Check Spin adapter (native)
+cargo check -p trusted-server-adapter-spin
+
+# Check Spin adapter (WASM target)
+cargo check-spin
+
+# Test Spin adapter (native host)
+cargo test-spin
+
+# Production-style Spin WASM artifact used by crates/trusted-server-adapter-spin/spin.toml
+cargo build --package trusted-server-adapter-spin --target wasm32-wasip1 --features spin --release
+
+# Optional local Spin runtime smoke, if the Spin CLI is installed
+spin up --from crates/trusted-server-adapter-spin
 ```
 
 ### Testing & Quality
@@ -78,12 +94,20 @@ cargo test-cloudflare
 cargo test-fastly      # Fastly adapter + core (wasm32-wasip1 via Viceroy)
 cargo test-axum        # Axum dev server adapter (native)
 cargo test-cloudflare  # Cloudflare Workers adapter (native host)
+cargo test-spin        # Spin adapter route tests (native host)
 
 # Format
 cargo fmt --all -- --check
 
-# Lint
-cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare
+# Lint by adapter target — target-matched clippy is the blocking gate because
+# the workspace has multiple wasm runtimes and runtime-specific SDKs. A plain
+# `cargo clippy --workspace --all-features` would trip the cloudflare
+# feature's non-wasm32 compile_error! guard.
+cargo clippy-fastly
+cargo clippy-axum
+cargo clippy-cloudflare
+cargo clippy-spin-native
+cargo clippy-spin-wasm
 
 # Check compilation (per-target aliases — bare `cargo check` fails at the workspace root)
 cargo check-fastly && cargo check-axum && cargo check-cloudflare
@@ -175,6 +199,7 @@ pub struct UserId(Uuid);
 ## Error Handling
 
 - Use `error-stack` (`Report<MyError>`) — not anyhow or eyre.
+  - **Exception**: `crates/trusted-server-adapter-spin/src/lib.rs` entry point returns `anyhow::Result` because `edgezero_adapter_spin::run_app` forces this type at the WASM FFI boundary. Do not use `anyhow` anywhere else.
 - Use `Box<dyn Error>` only in tests or prototyping.
 - Use concrete error types with `Report<E>`.
 - Use `ensure!()` / `bail!()` macros for early returns.
@@ -298,11 +323,12 @@ IntegrationRegistration::builder(ID)
 Every PR must pass:
 
 1. `cargo fmt --all -- --check`
-2. `cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare`
-3. `cargo test-fastly && cargo test-axum && cargo test-cloudflare`
-4. JS build and test (`cd crates/trusted-server-js/lib && npx vitest run`)
-5. JS format (`cd crates/trusted-server-js/lib && npm run format`)
-6. Docs format (`cd docs && npm run format`)
+2. `cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare && cargo clippy-spin-native && cargo clippy-spin-wasm`
+3. `cargo test-fastly && cargo test-axum && cargo test-cloudflare && cargo test-spin`
+4. `cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity`
+5. JS build and test (`cd crates/trusted-server-js/lib && npx vitest run`)
+6. JS format (`cd crates/trusted-server-js/lib && npm run format`)
+7. Docs format (`cd docs && npm run format`)
 
 ---
 
@@ -312,7 +338,8 @@ Every PR must pass:
 2. **Get approval** — for non-trivial changes, present a plan first.
 3. **Implement incrementally** — small, testable changes. Every change should
    impact as little code as possible.
-4. **Test after every change** — `cargo test-fastly && cargo test-axum`.
+4. **Test after every change** — run the target-matched adapter test for the
+   code you changed; before PR handoff, run the full CI gate list above.
 5. **Explain as you go** — describe what you changed and why.
 6. **If blocked** — explain what's blocking and why.