State<T> + nested/array #[secret] + Fastly dispatch fidelity + app! app-state injection

[aram356]

Four independent upstream primitives for the trusted-server -> EdgeZero migration. Builds on #300 (introspection routes), now merged; this PR targets main (merged up to date).

Closes #304.

Note on #283 (JA4): the Fastly raw-request hook below is something a JA4 interface could build on, but this PR does not deliver #283 (a standard cross-adapter JA4 API). There is no neutral JA4 type, no get_tls_ja4() wiring, and it's Fastly-only. #283 remains open as follow-up.

Specs: docs/superpowers/specs/2026-07-02-edgezero-state-and-nested-secrets-design.md (State<T> + nested secrets), docs/superpowers/specs/2026-07-03-edgezero-fastly-dispatch-and-appstate-design.md (Fastly dispatch + app-state). Task-by-task plans under docs/superpowers/plans/ (all boxes checked).

State<T> extractor

• State<T> extractor (FromRequest by type from request extensions; Deref/DerefMut/into_inner; 500 when unregistered).
• RouterBuilder::with_state<T> stores app state in a single Extensions bag; dispatch does request.extensions_mut().extend(state.clone()) after the introspection injects (last-write-wins by TypeId). Zero macro change -- #[action] composes State<T> via the generic FromRequest path.
• Docs: docs/guide/handlers.md "Sharing app state".

Nested / array #[secret]

• Owned, path-qualified SecretField { kind, path: Vec<SecretPathSegment>, optional }; AppConfigMeta::secret_fields() -> Vec<SecretField> (was const SECRET_FIELDS); dotted_path().
• Derive: #[app_config(nested)] opt-in recurses into sub-struct / Vec<_> fields; accepts Option<String>; rejects Option<String> on #[secret(store_ref)]; empty/bare #[app_config] hard-errors; AppConfigRoot bound assertion; serde rename/rename_all guards extended along the path.
• Runtime secret_walk is a path navigator (nested objects, arrays per-element, optional absent/null skip, KeyInNamedStore sibling resolved in the innermost parent, dotted [n] errors).
• Push: nested/list-aware validate_excluding_secrets pruning.
• CLI: path-aware TOML collector powers config validate/push/diff; TypedSecretEntry carries a dotted label.
• CI: the nested-AppConfig audit guard is inverted -- nesting allowed iff the field opts in via #[app_config(nested)].
• Docs: docs/guide/configuration.md "Nested and array secrets".

Fastly run_app dispatch fidelity

• Multi-value response headers: set_header->append_header in from_core_response and the proxy response/request conversion (origin Set-Cookie no longer collapses).
• Hooks::owns_logging() -- platform-neutral opt-out gated in all four adapters' run_app; app!(owns_logging = <bool>) macro argument.
• run_app_with_request_extensions -- a generic pre-dispatch hook: an app closure reads raw-fastly::Request signals (e.g. JA4 / H2 / client IP -- the app supplies the closure and its own type) into a scratch Extensions before conversion, merged into the core request; visible to middleware and the State/extractor layer.

app! app-state injection

• app!(state = <expr>) makes the macro-generated build_router() call .with_state(<expr>), reusing the State<T> dispatch injection. Macro-only -- no adapter or Hooks change.
• app-demo gains a state = crate::app_state() + State<Arc<DemoState>> handler with an end-to-end test.

Tests / CI gates

cargo fmt, cargo clippy --workspace --all-targets --all-features -D warnings, cargo test --workspace --all-targets, feature check (fastly cloudflare spin), spin wasm32-wasip2, the nested-AppConfig audit, app-demo (own workspace) tests + clippy, and the Fastly adapter's wasm32-wasip1 + Viceroy tests (headers + request-extension hook). Green locally and on CI after merging main up to date.

Notes

• The Fastly adapter is wasm-only -- its tests run via wasm32-wasip1 + Viceroy from the crate dir, not host cargo test.
• No workspace-wide lint allows added; the only new #[expect] are documented dead_code on #[derive(AppConfig)] test fixtures.

[prk-Jr]

PR Review

Summary

Four well-separated upstream primitives (State<T>, nested/array #[secret], Fastly dispatch fidelity, app! app-state) with no blocking findings — implementation is solid and the test coverage is exceptional. All findings below are non-blocking suggestions.

😃 Praise

• Test discipline is exceptional: trybuild UI tests with exact stderr, a true end-to-end nested-secret test through AppConfig<C>::from_request with live in-memory stores, an interleaved-poll no-bleed test for State, and Set-Cookie multi-value regression tests in both conversion directions.
• The app-demo app_state() doc comment warning about per-request build_router() on Fastly (the OnceLock pattern) is exactly the operational note downstream users need.

Findings

Non-blocking (body-level)

• ♻️ Three parallel path-walkers: path navigation is implemented three times — the JSON walk (crates/edgezero-core/src/extractor.rs, resolve_secret_field), the TOML walk (crates/edgezero-cli/src/config.rs, collect_secret_leaves), and the prune walk (crates/edgezero-core/src/app_config.rs, prune_secret_leaf). They are already slightly divergent on optional/array handling (see inline comment on the optional-flag conflation). Full unification across three value types would be over-engineering, but a shared conformance test table (the same path/shape fixtures run against all three walkers) would pin them together cheaply.
• 🌱 No CLI test for an optional (Option<String>) secret leaf: collect_secret_leaves' optional arm has no direct test — the runtime walk covers both null and absent leaves, the CLI covers neither. One config validate test with an absent optional leaf closes the gap.
• 🌱 Per-request Vec allocation in secret_fields(): this was a const; it now allocates per call, and secret_walk calls it per request. Negligible next to secret-store I/O today; if it ever shows up in profiles, a std::sync::OnceLock<Vec<SecretField>> in the emitted impl fixes it without an API change.
• 📝 TypedSecretEntry.field_name &str → String is a public API break (crates/edgezero-adapter/src/registry.rs): fine pre-1.0, and #[non_exhaustive] + the generic new() keep call sites compiling. Noting for changelog awareness.

CI Status

• fmt: PASS
• clippy (--workspace --all-targets --all-features -D warnings): PASS
• tests (--workspace --all-targets): PASS

[ChristianPavilonis]

Summary

Requesting changes for one secret-redaction issue in runtime AppConfig validation. I also left one medium Fastly proxy fidelity comment. CI is green, and the earlier nested-secret review feedback appears addressed, but the secret-value exposure path should be fixed before merge.

[ChristianPavilonis]

Summary

Approving per request. CI is green and the previously requested redaction and Host-port fixes are present. I left inline suggestions for the remaining follow-up issues I found.

[ChristianPavilonis]

Fastly proxy Host header can include URI userinfo

authority() includes userinfo, so a target like http://user:pass@example.com:8080/path would send Host: user:pass@example.com:8080. That is not valid Host semantics and can leak credentials to the origin. Build the value from host() plus the optional port instead.

Suggested change

	let host_header = match uri.authority() {
	Some(authority) => Some(authority.as_str()),
	None => uri.host(),
	};
	if let Some(value) = host_header {
	fastly_request.set_header("Host", value);
	}
	if let Some(host) = uri.host() {
	let value = match uri.port() {
	Some(port) => format!("{host}:{}", port.as_str()),
	None => host.to_owned(),
	};
	fastly_request.set_header("Host", value.as_str());
	}

[aram356]

Fixed in 04f9e77. build_fastly_request now composes Host from uri.host() plus uri.port() (when present), never uri.authority() — so a http://user:pass@example.com:8080/... target sends Host: example.com:8080 with no userinfo leaked. Backend + TLS SNI still key off uri.host().

[ChristianPavilonis]

Qualified direct self-cycles still bypass the guard

This catches Vec<Config>, but Vec<crate::Config> still compiles and then Config::secret_fields() recursively calls itself until stack overflow. That can abort CLI validation/push/diff or trap a worker on first runtime config extraction. Please either expand the obvious self-cycle detection (Self, qualified crate::Config/module paths where resolvable) or add a runtime depth/seen-set guard around generated secret-field collection.

[aram356]

Fixed in 04f9e77 with the runtime guard option. Every derived nested secret_fields() body now enters a SecretFieldsRecursionGuard (thread-local depth cap = 64) that panics with a clear message before the stack overflows. This covers exactly the cases the compile-time check cannot resolve — mutual A↔B and path-qualified Vec<crate::Config> self-references. I did not broaden the compile-time check to terminal-ident matching because that false-positives on legitimately-distinct same-named types (some_mod::Config nested in a Config); the bare single-segment self-cycle stays a compile error for fast feedback. should_panic test in tests/app_config_cycle_guard.rs.

[ChristianPavilonis]

Generic nested AppConfig children fail outside generic scope

For a generic config wrapper such as struct Wrapper<T> { #[app_config(nested)] child: T }, even with T: AppConfigRoot + AppConfigMeta, this module-scope const cannot see T and the derive fails with cannot find type T in this scope. Move the assertion into the generated impl/secret_fields() scope, or add the necessary generated where-clause bounds instead of emitting the check at module scope.

[aram356]

Fixed in 04f9e77. The AppConfigRoot bound check moved from the module-scope const _ into the secret_fields() method body, where the impl generics are in scope — so struct Wrapper<T: AppConfigRoot + AppConfigMeta> { #[app_config(nested)] child: T } compiles instead of failing with "cannot find type T". The no-op __assert::<T>() call is compiled out but still enforces the bound. Added a trybuild .pass fixture (app_config_generic_nested_child.rs) that instantiates and calls Wrapper::<Child>::secret_fields().

[ChristianPavilonis]

Clarify which validators run in typed CLI paths

The implementation uses validate_excluding_secrets for typed validate/push/diff, so validators on secret leaves are deferred until runtime after the actual secret value is resolved. The docs should not imply CLI preflight runs every validator rule on #[secret] fields.

Suggested change

	The default `edgezero` binary exposes the same commands but has no typed app-config
	struct in scope, so it runs the **raw** `config validate` path and **cannot** run
	`config push` at all (the bundled `config push` errors, pointing you at the downstream
	CLI — the blob model needs the typed `AppConfig<C>`). Downstream CLIs upgrade to the
	typed paths so `validator` rules, `#[secret]` / `#[secret(store_ref)]` checks, and
	Spin's flat-namespace collision check all run.
	The default `edgezero` binary exposes the same commands but has no typed app-config
	struct in scope, so it runs the **raw** `config validate` path and **cannot** run
	`config push` at all (the bundled `config push` errors, pointing you at the downstream
	CLI — the blob model needs the typed `AppConfig<C>`). Downstream CLIs upgrade to the
	typed paths so non-secret `validator` rules, `#[secret]` / `#[secret(store_ref)]`
	checks, and Spin's flat-namespace collision check all run. Validators on secret
	leaves run at runtime after `AppConfig<C>` resolves the actual secret values.

[aram356]

Fixed in 04f9e77 — applied your suggestion. The walkthrough now says the typed CLI runs non-secret validator rules, the #[secret]/#[secret(store_ref)] checks, and the Spin collision check, and that validators on secret leaves run at runtime after AppConfig<C> resolves the actual values (the typed paths use validate_excluding_secrets).