Add trusted-server-adapter-cloudflare crate (PR 17)

[prk-Jr]

Summary

• Add `trusted-server-adapter-cloudflare` crate — a Cloudflare Workers entry point using `#[event(fetch)]` and `edgezero_adapter_cloudflare::run_app`. Implements `Hooks` with full route parity to the Fastly and Axum adapters including admin key routes, auction, first-party proxy, and publisher fallback.
• Add `CloudflareHttpClient` (wasm32 only) backed by `worker::Fetch` so outbound proxy requests actually reach the origin on the Workers runtime. Strips `content-encoding`/`transfer-encoding` headers since the Workers runtime auto-decompresses responses, preventing a double-decompress error in the proxy layer.
• Wire real Cloudflare store implementations in `platform.rs` via edgezero handles injected by `run_app` — reducing `#[cfg(target_arch = "wasm32")]` blocks from 5 to 2:
  • Config: `ConfigStoreHandleAdapter` bridges `ctx.config_store()` to `PlatformConfigStore` — reuses the already-parsed `TRUSTED_SERVER_CONFIG` JSON handle.
  • KV: `KvHandleAdapter` bridges `ctx.kv_handle()` to `PlatformKvStore` — reuses the `env.kv()` handle opened by `run_app`.
  • Secrets: `CloudflareSecretStoreAdapter` calls `env.secret()` synchronously (still `#[cfg]` — `SecretHandle::get_bytes` is async while `PlatformSecretStore::get_bytes` is sync).
  • Geo: `CloudflareGeo` reads `cf-ipcountry`, `cf-ipcity`, `cf-ipcontinent`, `cf-iplatitude`, `cf-iplongitude` — no `#[cfg]` needed, degrades gracefully on native.
• Replace `std::time::Instant` with `web_time::Instant` in the auction orchestrator and audit remaining `std::time::SystemTime` usages in `proxy.rs` and `signing.rs` — `std::time` panics on `wasm32-unknown-unknown` (Cloudflare), while `web_time` works on all three targets.

Changes

File	Change
`crates/trusted-server-adapter-cloudflare/src/lib.rs`	New — `#[event(fetch)]` entry point, cfg-gated for wasm32
`crates/trusted-server-adapter-cloudflare/src/app.rs`	New — `TrustedServerApp` implementing `Hooks`, full route table
`crates/trusted-server-adapter-cloudflare/src/platform.rs`	New — real store adapters (`ConfigStoreHandleAdapter`, `KvHandleAdapter`, `CloudflareSecretStoreAdapter`, `CloudflareGeo`), `CloudflareHttpClient` (wasm32), `extract_client_ip` + 7 unit tests
`crates/trusted-server-adapter-cloudflare/build.sh`	New — NVM + `.env` sourcing, `cd SCRIPT_DIR` guard, worker-build 0.7
`crates/trusted-server-adapter-cloudflare/Cargo.toml`	New — crate manifest with wasm32 target deps
`crates/trusted-server-adapter-cloudflare/wrangler.toml`	New — wrangler config; uses `--cwd` DX so `wrangler dev` runs from workspace root
`crates/trusted-server-adapter-cloudflare/cloudflare.toml`	New — edgezero manifest declaring `TRUSTED_SERVER_CONFIG`, `TRUSTED_SERVER_KV`, secrets bindings
`crates/trusted-server-adapter-cloudflare/.gitignore`	Add `build/` and `.dev.vars` (wrangler convention for local secrets)
`crates/trusted-server-adapter-cloudflare/tests/routes.rs`	New — host-target smoke test: `routes()` builds without panic
`crates/trusted-server-core/src/auction/orchestrator.rs`	`std::time::Instant` → `web_time::Instant`
`crates/trusted-server-core/src/proxy.rs`	`std::time::SystemTime` → `web_time::SystemTime` (import + test)
`crates/trusted-server-core/src/request_signing/signing.rs`	`std::time::SystemTime` → `web_time::SystemTime` (production + test)
`crates/trusted-server-core/src/consent/mod.rs`	`std::time::SystemTime` → `web_time::SystemTime`
`crates/trusted-server-core/src/platform/http.rs`	Add `UnavailableHttpClient` (shared stub for platforms without outbound HTTP)
`Cargo.toml`	Add `web-time`, `js-sys`, `bytes` to workspace deps
`.github/workflows/test.yml`	Add CI jobs: native check + wasm32-unknown-unknown check for Cloudflare adapter
`crates/integration-tests/tests/environments/cloudflare.rs`	New — `CloudflareWorkers` integration test environment
`crates/integration-tests/tests/environments/mod.rs`	Export `cloudflare` environment module
`crates/integration-tests/tests/integration.rs`	Add Cloudflare integration test cases (ignored pending wrangler dev)
`.vscode/tasks.json`	Add "cloudflare dev server" task using `wrangler dev --cwd` from workspace root
`CLAUDE.md`	Document Cloudflare adapter build/check/test commands

Closes

Closes #498

Test plan

• `cargo test --workspace` (excluding Fastly adapter — Fastly WASM ABI not linkable on native host, pre-existing)
• `cargo clippy --workspace --all-targets --all-features -- -D warnings`
• `cargo fmt --all -- --check`
• JS tests: `cd crates/js/lib && npx vitest run`
• JS format: `cd crates/js/lib && npm run format`
• Docs format: `cd docs && npm run format`
• WASM build: `cargo check -p trusted-server-adapter-cloudflare --target wasm32-unknown-unknown`
• Manual testing via `wrangler dev` — proxy reaches origin, JS static routes serve correctly, no double-decompress errors
• Native host-target tests: `cargo test -p trusted-server-adapter-cloudflare` (7 unit + 1 smoke test pass)

Checklist

• Changes follow CLAUDE.md conventions
• No `unwrap()` in production code — use `expect("should ...")`
• Uses `log` macros (not `println!`)
• New code has tests
• No secrets or credentials committed

Known deferred items

• Secret store writes (`create`/`delete`) are not supported on Cloudflare Workers — `/admin/keys/rotate` and `/admin/keys/deactivate` read and write keys via `PlatformConfigStore`/`PlatformSecretStore`. Reads work via `CloudflareSecretStoreAdapter`; write-back would require a Cloudflare management API call outside the Workers runtime.

[ChristianPavilonis]

Summary

Adds the Cloudflare adapter, runtime wiring, and CI coverage. CI is green, but I found two correctness issues that should be addressed before merge, plus two smaller follow-ups.

[aram356]

Summary

Adds the Cloudflare Workers adapter, with web_time migration in core and a new CI job. The middleware-bypass and backend-naming concerns from the prior review are addressed and have regression tests, but the second prior 🔧 (sequential fan-out + missing per-request deadline) is mitigated only by documentation and a noisy log warning — the underlying behavior is unchanged. CI has three required gates failing.

Blocking

🔧 wrench

• CI is red on three required gates — cargo fmt --all -- --check, format-docs, and integration tests are failing on the latest run. The integration-tests failure is especially concerning because this PR is the one adding the CloudflareWorkers runtime to that matrix and the new env-var/wrangler wiring (integration-tests.yml:74-105). Either the new Cloudflare integration test broke, or it isn't actually running and another regression slipped in. Run cargo fmt --all, cd docs && npm run format, and reproduce the integration-tests failure locally with CLOUDFLARE_WRANGLER_DIR set; address whatever surfaces. Don't merge with red required checks.
• Per-provider auction timeout is silently dropped on Cloudflare (crates/trusted-server-adapter-cloudflare/src/platform.rs:289-315) — see inline.
• select() warning fires n-1 times per auction → log noise on every multi-provider request (crates/trusted-server-adapter-cloudflare/src/platform.rs:329-337) — see inline.

Non-blocking

🤔 thinking

• send_async always materializes the body, then re-serializes it for select (platform.rs:289-315) — see inline.
• Body::Stream silently dropped in outbound request body (platform.rs:228-235) — see inline.

♻️ refactor

• get_fallback / post_fallback near-duplicates (app.rs:307-363) — see inline.
• auth_middleware_rejects_with_401_when_credentials_required doesn't actually test 401 (tests/routes.rs:43-75) — see inline.

📌 out of scope

• wrangler.toml ships a placeholder KV id (wrangler.toml:11) — id = "REPLACE_WITH_YOUR_KV_NAMESPACE_ID" is fine for wrangler dev --local but will fail at deploy. Either call this out in getting-started.md next to the deploy instructions, or use a kv_namespaces[].preview_id so dev still works while the prod id stays empty/required. Follow-up issue is fine.

📝 note

• worker::Env::clone() per request (platform.rs:444-451) — see inline.

Prior-review status

• ✅ Cloudflare routes skip middleware → fixed (new src/middleware.rs + regression tests in tests/routes.rs:23-75).
• ⚠️ send_async serializes / no deadline → only documentation added; the underlying serialization and missing per-request timeout remain (see blocking findings above).
• ✅ Backend names too coarse → fixed (platform.rs:62-77 includes scheme, host, port, timeout_ms, cert flag).
• ✅ Stale ignore message → fixed (integration.rs:139,147).

CI Status

• cargo fmt: FAIL
• format-docs: FAIL
• integration tests: FAIL
• cargo check (cloudflare native + wasm32-unknown-unknown): PASS
• cargo test: PASS
• cargo test (axum native): PASS
• vitest: PASS
• format-typescript: PASS
• browser integration tests: PASS

[aram356]

Summary

Adds the trusted-server-adapter-cloudflare crate (edgezero handle adapters for Config/KV/secrets, CloudflareHttpClient, geo extraction from cf-* headers), an integration test environment, and a web_time migration in core. Crate scaffolding and middleware wiring are sound after the prior two review rounds, but CI is red on three jobs (one introduced by this PR) and several correctness/quality concerns from the earlier reviews remain open.

Note: the PR base is feature/edgezero-pr16-axum-dev-server, not main. Two of the four CI failures listed below are inherited from the base — but they still block merge to main.

Blocking

🔧 wrench

• cargo fmt fails on crates/integration-tests/tests/environments/cloudflare.rs — introduced by this PR. The integration-tests crate is in the workspace exclude list, so cargo fmt --all from the repo root passes; the CI rustfmt action checks every Rust file. See inline comment.
• use worker::*; violates CLAUDE.md — crates/trusted-server-adapter-cloudflare/src/lib.rs:7. See inline.
• Integration tests fail with orphaned workerd processes — crates/integration-tests/tests/environments/cloudflare.rs:104-109 only kills the wrangler parent; workerd grandchildren leak. Likely root cause of the test_all_combinations / test_nextjs_axum failures observed in CI. See inline.
• Per-provider auction timeout silently dropped on Cloudflare (still open from prior review) — platform.rs:277. See inline.
• select() warning logs n-1 times per multi-provider auction (still open from prior review) — platform.rs:337. See inline.
• CI: clippy::type_complexity failure — crates/trusted-server-adapter-axum/src/platform.rs:194. Inherited from PR-16 base; cannot merge to main until fixed in the base chain. Suggested: type ResponseTriplet = (u16, Vec<(String, Vec<u8>)>, Vec<u8>);.
• CI: format-docs failure — docs/guide/architecture.md and docs/guide/getting-started.md. Inherited from PR-15 (6d1184d6). Same merge-to-main concern.

Non-blocking

🤔 thinking

• send_async eagerly awaits → multi-provider auctions degrade to sum(latencies) — see inline at platform.rs:315.
• Body::Stream silently dropped on outbound — see inline at platform.rs:235.
• Top-level worker dispatch error: {e} may leak internals to clients — see inline at lib.rs:20.
• Eager full-response buffering with no cap — see inline at app.rs:96.
• Confirm worker::Error::Display does not leak the secret value — see inline at platform.rs:391.
• Hardcoded port 8787 conflicts with local wrangler dev — see inline at cloudflare.rs:23.

♻️ refactor

• get_fallback and post_fallback are near-duplicates — see inline at app.rs:363.
• auth_middleware_rejects_with_401_when_credentials_required doesn't actually test 401 — see inline at tests/routes.rs:75.

📝 note

• Stale #[ignore] reason on Cloudflare integration tests — see inline at integration.rs:139.
• The PR base also has red CI (format-docs, clippy::type_complexity). Recommend rebasing on the merged base before re-requesting review so CI status reflects only this PR's deltas.

⛏ nitpick

• Method::from(... .to_ascii_uppercase()) — see inline at platform.rs:216.
• wrangler.toml ships id = "REPLACE_WITH_YOUR_KV_NAMESPACE_ID" — wrangler dev refuses to start until edited. Worth a one-line note in CLAUDE.md or atop build.sh.
• The cloudflare feature in this crate's Cargo.toml is effectively redundant — [target.'cfg(target_arch = "wasm32")'.dependencies] already pulls worker and the adapter feature unconditionally on wasm32, so --features cloudflare only matters for cargo check on native. The doc comment names the use case but a one-line "why it isn't default" note would help future readers.

CI Status

• cargo fmt: FAIL (introduced by this PR — crates/integration-tests/tests/environments/cloudflare.rs)
• clippy: FAIL (inherited from base — axum type_complexity)
• rust tests (fastly, axum, cloudflare): PASS
• vitest: PASS
• format-docs: FAIL (inherited from base)
• format-typescript: PASS
• integration tests: FAIL (test_all_combinations, test_nextjs_axum — likely the workerd cleanup issue)
• browser integration tests: PASS
• cargo check (cloudflare native + wasm32-unknown-unknown): PASS

[aram356]

Summary

Round 4 review. The three round-3 🔧 blockers (workerd cleanup, cargo fmt, wildcard import) are resolved and CI is fully green on 15206b6a (10/10 jobs). The fail-loud multi-provider design replaces the silent degradation cleanly. Two new blocking items: the critical multi-provider rejection has no test coverage despite being #[cfg]-gateable into a testable helper, and the deferred Secret::to_string() audit needs either inline confirmation or a tracking issue before merge. Everything else is non-blocking — cleanup, defense-in-depth, and follow-ups.

Blocking

🔧 wrench

• Multi-provider select() rejection has zero test coverage — platform.rs:327. Extract the length check as a target-agnostic free function and add 3-4 unit tests. See inline.

❓ question

• Confirm worker::Secret::to_string() returns only the raw value — platform.rs:384. Either inline-confirm against worker 0.7 source or open a tracking issue and link it. See inline.

Non-blocking

🤔 thinking

• from_utf8_lossy corrupts non-ASCII outbound header values — platform.rs:215.
• worker::Env cloned per request for secret adapter — platform.rs:444.
• compatibility_date = "2024-09-23" is 18+ months old — cloudflare.toml:3.
• wrangler.toml placeholder KV ID needs a heads-up note — wrangler.toml:11.

♻️ refactor

• 13 near-identical per-route handler closures — app.rs:178-303. ~150 LOC reducible via a macro_rules! or generic helper. Same pattern in the Axum adapter — candidate for a shared core helper.
• apply_finalize_headers silently skips invalid operator-config headers — middleware.rs:117. CLAUDE.md says invalid enabled config should surface as startup/config errors. Same issue in Axum.

🌱 seedling

• CloudflareGeo missing region — platform.rs:500. CF Enterprise injects cf-region / cf-region-code.
• cloudflare feature is wasm32-only-effective but doesn't say so — Cargo.toml:18. Latent broken combo for cargo check --features cloudflare on native.

⛏ nitpick

• Method::from(...uppercase()) still deferred from prior review — platform.rs:210.
• to_ascii_lowercase() allocation per response header — platform.rs:251. Use eq_ignore_ascii_case.
• Set Content-Length but don't strip Transfer-Encoding — app.rs:90. Defense-in-depth.
• cargo install runs unconditionally in build.sh — build.sh:20. Gate with command -v.

CI Status

• cargo fmt: PASS
• cargo test (fastly): PASS
• cargo test (axum native): PASS
• cargo check (cloudflare native + wasm32-unknown-unknown): PASS
• vitest: PASS
• format-docs: PASS
• format-typescript: PASS
• integration tests: PASS
• browser integration tests: PASS
• prepare integration artifacts: PASS

Open from prior round (acknowledged)

• 🤔 Eager full-response buffering with no cap (app.rs:88) — deferred to follow-up issue.
• ❓ Secret::to_string() audit — now blocking (see above).

[aram356]

Summary

Round-5 re-review of the Cloudflare Workers adapter. Every blocker from the prior CHANGES_REQUESTED review is resolved and all CI gates are green, including the integration tests job this PR adds the Cloudflare runtime to. No correctness, security, WASM, or convention issues remain in the changed code. Approving; the findings below are non-blocking and left to the author's discretion.

Note: the base is feature/edgezero-pr16-axum-dev-server, not main — approving this greenlights merging into that feature branch; the full edgezero chain still has to land to reach production.

Non-blocking

🤔 thinking

• Multi-provider rejection fires after the budget is already spent — platform.rs:547-567 (see inline). The supported single-provider path is unaffected.
• Geo lat/long default to 0.0 (Null Island) when absent — platform.rs:520-529 (see inline).

♻️ refactor

• Duplicate outbound request headers silently collapsed (headers.set vs append) — platform.rs:213-223 (see inline).

📝 note

• unreachable! panic in send_async — platform.rs:303-305 (see inline).
• Stacked base / stale compatibility_date — base is a feature branch; compatibility_date = "2024-09-23" is ~20 months old (the comment already invites a bump).

⛏ nitpick

• Test code uses unwrap() instead of expect("should …") — platform.rs test module (see inline).

📌 out of scope

• wrangler.toml placeholder KV id — wrangler.toml:13 (see inline).

Prior-review status

• ✅ CI red (fmt / format-docs / integration) → all green
• ✅ Per-provider timeout silently dropped → now rejects loudly (with the timing caveat above)
• ✅ select() warning loop → removed
• ✅ use worker::* → explicit imports
• ✅ workerd process leak → killpg(pgid, SIGTERM) on Drop
• ✅ Auth test didn't assert behavior → renamed + honest doc
• ✅ get/post_fallback duplication → dispatch() helper
• ✅ Body::Stream silently dropped → now returns Err

The web_time migration is correctly scoped: a no-op std re-export on wasm32-wasip1, so Fastly's production path is unchanged.

CI Status

• cargo fmt: PASS
• clippy (cloudflare native + wasm32-unknown-unknown): PASS
• cargo test: PASS
• cargo test (axum native): PASS
• vitest: PASS
• format-typescript: PASS
• format-docs: PASS
• integration tests: PASS
• browser integration tests: PASS

[ChristianPavilonis]

Automated review by Yesman.

I found two blocking correctness issues in the new Cloudflare adapter: compressed origin responses can be returned with a stale Content-Length after decoding, and the unsupported multi-provider auction path is rejected only after all provider requests have already been sent and awaited. Please address these before merging.

[ChristianPavilonis]

Summary

Approving per request, with the findings below recorded for follow-up. CI is currently green on the latest head.

Findings folded into body

• P1 — EC timestamp helper still uses std::time::SystemTime — crates/trusted-server-core/src/ec/mod.rs:480: this core path can be exercised by Cloudflare EC generation/sync/tombstone flows, and std::time is not safe on wasm32-unknown-unknown. Suggested fix: migrate current_timestamp() to web_time::{SystemTime, UNIX_EPOCH} and update the stale wasm32-wasip1-only comment.
• P2 — Cloudflare clippy alias is documented but not run in CI — .github/workflows/format.yml:35: CI runs Fastly/Axum clippy but not cargo clippy-cloudflare, so Cloudflare adapter lint regressions can merge unnoticed. Suggested fix: add a Cloudflare clippy workflow step.
• P2 — clean-checkout Cloudflare build target is not installed by rust-toolchain.toml — rust-toolchain.toml:3: cargo build-cloudflare targets wasm32-unknown-unknown, but the pinned toolchain only installs wasm32-wasip1; CI installs the target explicitly, but local documented commands fail on a clean checkout. Suggested fix: add wasm32-unknown-unknown to the toolchain targets or document/run rustup target add wasm32-unknown-unknown.

CI

Latest gh pr checks 644 shows all current checks passing.

[ChristianPavilonis]

P1 — Cloudflare response conversion drops duplicate response headers

The adapter delegates final response conversion to the pinned edgezero-adapter-cloudflare. At the pinned rev in Cargo.toml, from_core_response iterates parts.headers and calls worker::Headers::set(...), which overwrites prior values for repeated header names. The Cloudflare outbound fetch bridge also uses resp.headers().entries(), which is not sufficient for preserving multi-value Set-Cookie.

Why it matters: Trusted Server publisher proxy responses may contain multiple Set-Cookie headers from the origin plus Trusted Server EC/consent cookies. Collapsing to the last value breaks publisher sessions and identity/privacy cookie behavior.

Suggested fix: Update/pin EdgeZero to use append for response headers, and explicitly preserve multi-value Set-Cookie from Workers fetch responses via the appropriate multi-value API. Add a Cloudflare integration/regression test with multiple Set-Cookie headers.

[ChristianPavilonis]

P1 — Cloudflare publisher fallback only supports GET/POST

The Cloudflare router registers only .get/.post for / and /{*rest}. Fastly/Axum route publisher fallback for GET, POST, HEAD, OPTIONS, PUT, PATCH, and DELETE.

Why it matters: Cloudflare will reject or miss normal publisher-origin traffic such as HEAD requests, CORS OPTIONS preflights, and non-GET/POST API calls instead of proxying them. That is a behavioral compatibility break for a transparent edge proxy.

Suggested fix: Mirror Axum/Fastly: add a shared publisher_fallback_methods() list and register both root and wildcard fallback routes for all supported methods. Also apply this to the startup-error router.

[ChristianPavilonis]

P2 — Sequential-fanout guard rejects based on configured provider count before filtering launchable providers

The new Cloudflare safety guard checks provider_names.len() > 1 before the existing skip logic for unknown, disabled, timed-out, or no-backend providers.

Why it matters: A Cloudflare deployment with two configured names but only one actually launchable provider now fails the entire auction, whereas the prior logic would safely skip the inactive provider and run the single valid one.

Suggested fix: Build/filter launch candidates first without sending requests, then reject only when more than one request would actually be launched on a non-concurrent platform.

[ChristianPavilonis]

P3 — Cloudflare-specific env overrides are sourced but not exported

.env.cloudflare.dev is sourced without set -a, unlike the root .env.

Why it matters: Local override variables may not be exported to worker-build, so the local Cloudflare bundle can ignore intended overrides.

Suggested fix: Source it with set -a && source ... && set +a.

[aram356]

Summary

Round 5 review. All round-4 blocking items resolved — including the two 🔧/❓ blockers I escalated. The author went beyond what was asked: extracted reject_multi_provider_fanout as a testable free function (4 unit tests), AND added a full-pipeline test at the orchestrator level (rejects_multi_provider_fanout_before_launch_on_sequential_platform) that asserts no provider requests launch under the rejection path. The Secret::to_string() audit was done inline with a citation of the worker-rs source. Bonus correctness fix on the response path strips stale Content-Length (which described the compressed payload) and re-emits an accurate value after bytes() decoding — caught a real bug I missed in round 4.

CI is fully green on fe9951dd (10/10 jobs). Approving with non-blocking notes only; the open items are forward-looking (KV-backed EC on Cloudflare prod, shared adapter helpers, missing geo region field) or documentation polish.

Non-blocking

🤔 thinking

• /auction runs with EcContext::default() on Cloudflare — auction partners never receive a TS EC ID. Matches Axum dev-mode. See inline at app.rs:280.
• handle_proxy passes kv: None even though Cloudflare has a KV store — integration proxies on Cloudflare run without KV identity-graph augmentation. See inline at app.rs:215.

🌱 seedling

• make_handler is a candidate to lift into core and share with Axum — both adapters reimplement the same boilerplate. See inline at app.rs:83.
• CloudflareGeo still missing region — carried from round 4 (asn: None was added for the new trait field, but region is still hardcoded). See inline at platform.rs:522.

📌 out of scope

• Round-4 deferrals carried forward: worker::Env cloned per request (acknowledged as cheap Rc<JsValue> clone), apply_finalize_headers silently logs invalid operator-config headers (cross-adapter — belongs in core Settings validation), and the PR's own "Known deferred items" (secret store writes).

📝 note

• Cloudflare integration tests run via --include-ignored in CI only — see inline at integration.rs:141.

CI Status

• cargo fmt: PASS
• cargo test (fastly): PASS
• cargo test (axum native): PASS
• cargo check (cloudflare native + wasm32-unknown-unknown): PASS
• vitest: PASS
• format-docs: PASS
• format-typescript: PASS
• integration tests: PASS
• browser integration tests: PASS
• prepare integration artifacts: PASS

[aram356]

🤔 thinking — /auction runs with EcContext::default() on Cloudflare.

This matches the Axum dev-mode pattern (axum/app.rs:276), but the practical effect on Cloudflare prod traffic is that auction partners never receive a TS EC ID — bidders see anonymous requests, EID resolution returns empty (kv = None, registry = None), and consent context is empty.

Likely a tracked follow-up before Cloudflare ships prod traffic. Worth either calling out in the PR description's "Known deferred items" or filing a follow-up issue and linking it from this line, so a future contributor doesn't deploy Cloudflare to production assuming feature parity with Fastly.

[aram356]

🤔 thinking — handle_proxy passes kv: None even though Cloudflare has a KV store.

services.kv_store() returns the KvHandleAdapter (real Cloudflare KV), but the KvIdentityGraph type that handle_proxy wants isn't constructed here. Same as Axum dev-mode (axum/app.rs:139) — so integration-proxy responses on Cloudflare won't be augmented with identity-graph data.

Not a regression vs. Axum, but Cloudflare prod will need the KV identity graph wired before it has parity with Fastly. Worth a follow-up issue link from this line.

[aram356]

🌱 seedling — make_handler is a candidate to lift into core and share with Axum.

The Axum adapter has an equivalent helper at axum/app.rs:159 (execute_handler). Both adapters need the same "build services, call handler, convert error to response" boilerplate. A core::handler_helpers::wrap would let both adapters share one definition and one test surface — and the eventual Fastly adapter would inherit it for free.

Not for this PR; flag for a future refactor.

[aram356]

🌱 seedling — CloudflareGeo still missing region.

Carried from round 4. Cloudflare Workers Enterprise plans inject cf-region (e.g. "California") and cf-region-code (e.g. "CA"). One header read away from completeness; the asn: None next to it handles the new trait field, but region is still always None. Follow-up issue is fine — not blocking.

[aram356]

📝 note — Cloudflare integration tests run via --include-ignored in CI only.

Local devs need wrangler + bash crates/trusted-server-adapter-cloudflare/build.sh per the updated #[ignore] reasons. The CI workflow (integration-tests.yml) installs wrangler, restores the pre-built CF bundle, and runs --include-ignored — that wiring looks correct end-to-end.

No action — just acknowledging the dev-loop story. A line in CONTRIBUTING.md (or the existing testing docs) pointing devs at bash build.sh before running the ignored tests would close the loop.