Remove legacy entry point, canary routing, and flag plumbing

.cargo/config.toml

@@ -33,12 +33,14 @@ test-axum = ["test", "-p", "trusted-server-adapter-axum"]
 
 # --- Cloudflare adapter (native host + wasm32-unknown-unknown) ---
 # Build/check target the WASM runtime (requires the `cloudflare` feature);
-# tests and clippy run on the native host.
+# tests run on the native host; clippy covers both native test code and the
+# production WASM feature.
 build-cloudflare = ["build", "-p", "trusted-server-adapter-cloudflare", "--target", "wasm32-unknown-unknown", "--features", "cloudflare"]
 check-cloudflare = ["check", "-p", "trusted-server-adapter-cloudflare", "--target", "wasm32-unknown-unknown", "--features", "cloudflare"]
 # No --all-features: the `cloudflare` feature has a compile_error! guard on
-# non-wasm32 targets. WASM-feature coverage comes from `cargo check-cloudflare`.
+# non-wasm32 targets.
 clippy-cloudflare = ["clippy", "-p", "trusted-server-adapter-cloudflare", "--all-targets", "--", "-D", "warnings"]
+clippy-cloudflare-wasm = ["clippy", "-p", "trusted-server-adapter-cloudflare", "--target", "wasm32-unknown-unknown", "--features", "cloudflare", "--lib", "--", "-D", "warnings"]
 test-cloudflare = ["test", "-p", "trusted-server-adapter-cloudflare"]
 
 # --- Spin adapter (native host tests + wasm32-wasip1 target) ---

.github/workflows/format.yml

@@ -25,7 +25,7 @@ jobs:
         uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
           toolchain: ${{ steps.rust-version.outputs.rust-version }}
-          target: wasm32-wasip1
+          target: wasm32-wasip1,wasm32-unknown-unknown
           components: "clippy, rustfmt"
           cache-shared-key: cargo-${{ runner.os }}
 
@@ -41,6 +41,9 @@ jobs:
       - name: Run cargo clippy (Cloudflare — native)
         run: cargo clippy-cloudflare
 
+      - name: Run cargo clippy (Cloudflare — wasm32-unknown-unknown)
+        run: cargo clippy-cloudflare-wasm
+
       - name: Run cargo clippy (Spin — native)
         run: cargo clippy-spin-native
 

.github/workflows/integration-tests.yml

@@ -111,11 +111,11 @@ jobs:
           AXUM_BINARY_PATH: ${{ env.AXUM_ARTIFACT_PATH }}
           CLOUDFLARE_WRANGLER_DIR: ${{ github.workspace }}/crates/trusted-server-adapter-cloudflare
           INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
-          VICEROY_CONFIG_PATH: ${{ env.ARTIFACTS_DIR }}/configs/viceroy-legacy.toml
+          VICEROY_CONFIG_PATH: ${{ env.ARTIFACTS_DIR }}/configs/viceroy.toml
           RUST_LOG: info
 
-  integration-tests-edgezero:
-    name: integration tests (EdgeZero entry point)
+  integration-tests-fastly-ec:
+    name: integration tests (Fastly EC lifecycle)
     needs: prepare-artifacts
     runs-on: ubuntu-latest
     timeout-minutes: 15
@@ -137,14 +137,9 @@ jobs:
           name: integration-test-artifacts
           path: ${{ env.ARTIFACTS_DIR }}
 
-      # Exercises the EdgeZero entry point against the same WASM binary by
-      # pointing Viceroy at a config store with `edgezero_enabled = "true"`.
-      # Scoped to the container-free EC lifecycle suite (minimal TCP origin), a
-      # focused parity subset covering Fastly request conversion, config-store
-      # dispatch, publisher fallback proxying, and end-to-end EC/API wiring on
-      # the EdgeZero path. The legacy `integration-tests` job above still covers
-      # the full framework matrix.
-      - name: Run EdgeZero EC lifecycle tests
+      # Focused container-free EC lifecycle coverage using the same post-cutover
+      # Viceroy config as the full integration matrix.
+      - name: Run Fastly EC lifecycle tests
         run: >-
           cargo test
           --manifest-path crates/trusted-server-integration-tests/Cargo.toml
@@ -154,7 +149,7 @@ jobs:
         env:
           WASM_BINARY_PATH: ${{ env.WASM_ARTIFACT_PATH }}
           INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
-          VICEROY_CONFIG_PATH: ${{ env.ARTIFACTS_DIR }}/configs/viceroy-edgezero.toml
+          VICEROY_CONFIG_PATH: ${{ env.ARTIFACTS_DIR }}/configs/viceroy.toml
           RUST_LOG: info
 
   browser-tests:
@@ -201,7 +196,7 @@ jobs:
         env:
           WASM_BINARY_PATH: ${{ env.WASM_ARTIFACT_PATH }}
           INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
-          VICEROY_CONFIG_PATH: ${{ env.ARTIFACTS_DIR }}/configs/viceroy-legacy.toml
+          VICEROY_CONFIG_PATH: ${{ env.ARTIFACTS_DIR }}/configs/viceroy.toml
           TEST_FRAMEWORK: nextjs
           PLAYWRIGHT_HTML_REPORT: playwright-report-nextjs
         run: npx playwright test
@@ -220,7 +215,7 @@ jobs:
         env:
           WASM_BINARY_PATH: ${{ env.WASM_ARTIFACT_PATH }}
           INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
-          VICEROY_CONFIG_PATH: ${{ env.ARTIFACTS_DIR }}/configs/viceroy-legacy.toml
+          VICEROY_CONFIG_PATH: ${{ env.ARTIFACTS_DIR }}/configs/viceroy.toml
           TEST_FRAMEWORK: wordpress
           PLAYWRIGHT_HTML_REPORT: playwright-report-wordpress
         run: npx playwright test

CLAUDE.md

@@ -113,6 +113,7 @@ cargo fmt --all -- --check
 cargo clippy-fastly
 cargo clippy-axum
 cargo clippy-cloudflare
+cargo clippy-cloudflare-wasm
 cargo clippy-spin-native
 cargo clippy-spin-wasm
 
@@ -332,7 +333,7 @@ IntegrationRegistration::builder(ID)
 Every PR must pass:
 
 1. `cargo fmt --all -- --check`
-2. `cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare && cargo clippy-spin-native && cargo clippy-spin-wasm`
+2. `cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare && cargo clippy-cloudflare-wasm && cargo clippy-spin-native && cargo clippy-spin-wasm`
 3. `cargo test-fastly && cargo test-axum && cargo test-cloudflare && cargo test-spin`
 4. `cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity`
 5. JS build and test (`cd crates/trusted-server-js/lib && npx vitest run`)

crates/trusted-server-adapter-cloudflare/src/app.rs

@@ -5,7 +5,7 @@ use std::sync::Arc;
 use edgezero_core::app::Hooks;
 use edgezero_core::context::RequestContext;
 use edgezero_core::error::EdgeError;
-use edgezero_core::http::{HeaderValue, Method, Request, Response, header};
+use edgezero_core::http::{HeaderValue, Method, Request, Response, StatusCode, header};
 use edgezero_core::router::RouterService;
 use error_stack::Report;
 use trusted_server_core::auction::endpoints::handle_auction;
@@ -24,8 +24,7 @@ use trusted_server_core::publisher::{
     PublisherResponse, buffer_publisher_response, handle_publisher_request, handle_tsjs_dynamic,
 };
 use trusted_server_core::request_signing::{
-    handle_deactivate_key, handle_rotate_key, handle_trusted_server_discovery,
-    handle_verify_signature,
+    handle_trusted_server_discovery, handle_verify_signature,
 };
 use trusted_server_core::settings::Settings;
 
@@ -194,6 +193,20 @@ pub(crate) fn http_error(report: &Report<TrustedServerError>) -> Response {
     response
 }
 
+fn admin_key_management_not_supported() -> Response {
+    let body = edgezero_core::body::Body::from(
+        "Admin key management is not supported on Cloudflare Workers.\n\
+         Use the Fastly adapter (via Viceroy or deployed) to rotate or deactivate keys.\n",
+    );
+    let mut response = Response::new(body);
+    *response.status_mut() = StatusCode::NOT_IMPLEMENTED;
+    response.headers_mut().insert(
+        header::CONTENT_TYPE,
+        HeaderValue::from_static("text/plain; charset=utf-8"),
+    );
+    response
+}
+
 /// Builds the local `404 Not Found` returned for legacy `/admin/keys/*`
 /// aliases on the Cloudflare adapter.
 ///
@@ -383,18 +396,12 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
             // letting them fall through would forward the caller's
             // `Authorization` header and key-management payload to the origin,
             // leaking admin credentials.
-            .post(
-                "/_ts/admin/keys/rotate",
-                make_handler(Arc::clone(&state), |s, services, req| async move {
-                    handle_rotate_key(&s.settings, &services, req)
-                }),
-            )
-            .post(
-                "/_ts/admin/keys/deactivate",
-                make_handler(Arc::clone(&state), |s, services, req| async move {
-                    handle_deactivate_key(&s.settings, &services, req)
-                }),
-            )
+            .post("/_ts/admin/keys/rotate", |_ctx: RequestContext| async {
+                Ok::<Response, EdgeError>(admin_key_management_not_supported())
+            })
+            .post("/_ts/admin/keys/deactivate", |_ctx: RequestContext| async {
+                Ok::<Response, EdgeError>(admin_key_management_not_supported())
+            })
             .post(
                 "/auction",
                 make_handler(Arc::clone(&state), |s, services, req| async move {

crates/trusted-server-adapter-cloudflare/src/lib.rs

@@ -17,6 +17,12 @@ use worker::{Context, Env, Request, Response, Result, event};
 
 #[cfg(target_arch = "wasm32")]
 #[event(fetch)]
+/// Dispatches an incoming Cloudflare Worker fetch event.
+///
+/// # Errors
+///
+/// Returns a Workers runtime error when the fallback error response cannot be
+/// constructed.
 pub async fn main(req: Request, env: Env, ctx: Context) -> Result<Response> {
     if let Ok(config) = env.var("TRUSTED_SERVER_CONFIG") {
         app::set_cloudflare_config_json(config.to_string());

crates/trusted-server-adapter-cloudflare/src/platform.rs

@@ -243,8 +243,7 @@ fn is_hop_by_hop_response_header(name: &str, connection_tokens: &[String]) -> bo
         "upgrade",
     ];
     let lower = name.to_ascii_lowercase();
-    HOP_BY_HOP.iter().any(|header| *header == lower)
-        || connection_tokens.iter().any(|token| *token == lower)
+    HOP_BY_HOP.iter().any(|header| *header == lower) || connection_tokens.contains(&lower)
 }
 
 #[cfg(target_arch = "wasm32")]
@@ -339,13 +338,12 @@ impl CloudflareHttpClient {
             .ok()
             .flatten()
             .and_then(|v| v.trim().parse::<usize>().ok())
+            && claimed_len > MAX_PLATFORM_RESPONSE_BODY_BYTES
         {
-            if claimed_len > MAX_PLATFORM_RESPONSE_BODY_BYTES {
-                return Err(Report::new(PlatformError::HttpClient).attach(format!(
-                    "origin Content-Length {claimed_len} exceeds \
-                     {MAX_PLATFORM_RESPONSE_BODY_BYTES}-byte response body limit"
-                )));
-            }
+            return Err(Report::new(PlatformError::HttpClient).attach(format!(
+                "origin Content-Length {claimed_len} exceeds \
+                 {MAX_PLATFORM_RESPONSE_BODY_BYTES}-byte response body limit"
+            )));
         }
 
         let connection_tokens = response_connection_tokens(&resp);

crates/trusted-server-adapter-cloudflare/tests/routes.rs

@@ -238,6 +238,32 @@ fn all_explicit_routes_are_registered() {
 // Basic-auth parity tests
 // ---------------------------------------------------------------------------
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn authenticated_admin_routes_return_501() {
+    for (path, body) in [
+        ("/_ts/admin/keys/rotate", "{}"),
+        (
+            "/_ts/admin/keys/deactivate",
+            r#"{"kid":"test-key","delete":false}"#,
+        ),
+    ] {
+        let req = request_builder()
+            .method("POST")
+            .uri(path)
+            .header("authorization", "Basic YWRtaW46YWRtaW4tcGFzcw==")
+            .header("content-type", "application/json")
+            .body(edgezero_core::body::Body::from(body))
+            .expect("should build request");
+        let resp = route(test_router(), req).await;
+
+        assert_eq!(
+            resp.status().as_u16(),
+            501,
+            "{path} should report that Cloudflare key management is unsupported"
+        );
+    }
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn admin_route_without_credentials_returns_401() {
     let router = test_router();