Embed kitchen sink fixture in Trusted Server

.cargo/config.toml

@@ -1,5 +1,9 @@
 [alias]
 test_details = ["test", "--target", "aarch64-apple-darwin"]
+test_cli_macos = ["test", "--package", "trusted-server-cli", "--target", "aarch64-apple-darwin"]
+build_cli_macos = ["build", "--package", "trusted-server-cli", "--target", "aarch64-apple-darwin"]
+test_cli_linux = ["test", "--package", "trusted-server-cli", "--target", "x86_64-unknown-linux-gnu"]
+build_cli_linux = ["build", "--package", "trusted-server-cli", "--target", "x86_64-unknown-linux-gnu"]
 
 [build]
 target = "wasm32-wasip1"

.github/workflows/format.yml

@@ -35,6 +35,9 @@ jobs:
       - name: Run cargo clippy
         run: cargo clippy --workspace --all-targets --all-features -- -D warnings
 
+      - name: Run host-target CLI clippy
+        run: cargo clippy --package trusted-server-cli --target x86_64-unknown-linux-gnu --all-targets --all-features -- -D warnings
+
   format-typescript:
     runs-on: ubuntu-latest
     defaults:

.github/workflows/integration-tests.yml

@@ -30,6 +30,11 @@ jobs:
           origin-port: ${{ env.ORIGIN_PORT }}
           install-viceroy: "false"
 
+      - name: Generate integration Viceroy configs
+        run: ./scripts/generate-integration-viceroy-configs.sh
+        env:
+          INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
+
       - name: Package integration test artifacts
         run: |
           mkdir -p "$(dirname "$WASM_ARTIFACT_PATH")" "$(dirname "$DOCKER_ARTIFACT_PATH")"
@@ -81,6 +86,7 @@ jobs:
         env:
           WASM_BINARY_PATH: ${{ env.WASM_ARTIFACT_PATH }}
           INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
+          VICEROY_CONFIG_PATH: ${{ env.ARTIFACTS_DIR }}/configs/viceroy-legacy.toml
           RUST_LOG: info
 
   integration-tests-edgezero:
@@ -124,10 +130,10 @@ jobs:
         env:
           WASM_BINARY_PATH: ${{ env.WASM_ARTIFACT_PATH }}
           INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
-          VICEROY_CONFIG_PATH: ${{ github.workspace }}/crates/trusted-server-integration-tests/fixtures/configs/viceroy-template-edgezero.toml
-          # Opt into the EdgeZero entry-point canary in test_ec_lifecycle_fastly.
+          VICEROY_CONFIG_PATH: ${{ env.ARTIFACTS_DIR }}/configs/viceroy-edgezero.toml
+          # Opt into the EdgeZero entry-point probe in test_ec_lifecycle_fastly.
           # Only set here, so the legacy integration-tests job runs the same
-          # scenarios through legacy_main without asserting the EdgeZero-only 405.
+          # scenarios through legacy_main without the EdgeZero diagnostic probe.
           EXPECT_EDGEZERO_ENTRY_POINT: "true"
           RUST_LOG: info
 
@@ -176,7 +182,7 @@ jobs:
         env:
           WASM_BINARY_PATH: ${{ env.WASM_ARTIFACT_PATH }}
           INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
-          VICEROY_CONFIG_PATH: ${{ github.workspace }}/crates/trusted-server-integration-tests/fixtures/configs/viceroy-template.toml
+          VICEROY_CONFIG_PATH: ${{ env.ARTIFACTS_DIR }}/configs/viceroy-legacy.toml
           TEST_FRAMEWORK: nextjs
           PLAYWRIGHT_HTML_REPORT: playwright-report-nextjs
         run: npx playwright test
@@ -195,7 +201,7 @@ jobs:
         env:
           WASM_BINARY_PATH: ${{ env.WASM_ARTIFACT_PATH }}
           INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
-          VICEROY_CONFIG_PATH: ${{ github.workspace }}/crates/trusted-server-integration-tests/fixtures/configs/viceroy-template.toml
+          VICEROY_CONFIG_PATH: ${{ env.ARTIFACTS_DIR }}/configs/viceroy-legacy.toml
           TEST_FRAMEWORK: wordpress
           PLAYWRIGHT_HTML_REPORT: playwright-report-wordpress
         run: npx playwright test

.github/workflows/test.yml

@@ -49,6 +49,9 @@ jobs:
       - name: Run tests
         run: cargo test --workspace
 
+      - name: Run host-target CLI tests
+        run: cargo test --package trusted-server-cli --target x86_64-unknown-linux-gnu
+
       - name: Verify Fastly WASM release build
         env:
           TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:8080

.gitignore

@@ -6,6 +6,7 @@
 
 # env
 .env*
+trusted-server.toml
 
 # backup
 **/*.rs.bk

CLAUDE.md

@@ -15,12 +15,14 @@ real-time bidding integration, and publisher-side JavaScript injection.
 crates/
   trusted-server-core/                  # Core library — shared logic, integrations, HTML processing
   trusted-server-adapter-fastly/        # Fastly Compute entry point (wasm32-wasip1 binary)
+  trusted-server-cli/                   # Host-target `ts` operator CLI
   trusted-server-js/                    # TypeScript/JS build — per-integration IIFE bundles
     lib/         # TS source, Vitest tests, esbuild pipeline
 ```
 
-Supporting files: `fastly.toml`, `trusted-server.toml`, `.env.dev`,
-`rust-toolchain.toml`, `CONTRIBUTING.md`.
+Supporting files: `edgezero.toml`, `fastly.toml`,
+`trusted-server.example.toml`, `.env.dev`, `rust-toolchain.toml`,
+`CONTRIBUTING.md`. Operator-owned `trusted-server.toml` files are gitignored.
 
 ## Toolchain
 
@@ -59,6 +61,11 @@ fastly compute publish
 # Run all Rust tests (uses viceroy)
 cargo test --workspace
 
+# Run host-target CLI tests (workspace default target is wasm32-wasip1)
+# Use your host triple, for example x86_64-unknown-linux-gnu on CI/Linux
+# or aarch64-apple-darwin on Apple Silicon macOS.
+cargo test --package trusted-server-cli --target <host-triple>
+
 # Format
 cargo fmt --all -- --check
 
@@ -266,10 +273,12 @@ IntegrationRegistration::builder(ID)
 
 | File                  | Purpose                                                    |
 | --------------------- | ---------------------------------------------------------- |
-| `fastly.toml`         | Fastly service configuration and build settings            |
-| `trusted-server.toml` | Application settings (ad servers, KV stores, ID templates) |
-| `rust-toolchain.toml` | Pins Rust version to 1.95.0                                |
-| `.env.dev`            | Local development environment variables                    |
+| `edgezero.toml`                 | EdgeZero app/platform manifest and logical stores               |
+| `fastly.toml`                   | Fastly service configuration and build settings                 |
+| `trusted-server.example.toml`   | Source-controlled Trusted Server app-config template            |
+| `trusted-server.toml`           | Operator-owned app config; gitignored; `ts config push` publishes it as an EdgeZero blob envelope |
+| `rust-toolchain.toml`           | Pins Rust version to 1.95.0                                     |
+| `.env.dev`                      | Local development environment variables                         |
 
 ---