Merge remote-tracking branch 'origin/main' into fix-sourcepoint-publicpath-404

# Conflicts:
#	crates/trusted-server-core/src/integrations/datadome.rs
#	crates/trusted-server-core/src/integrations/gpt.rs
#	crates/trusted-server-core/src/integrations/lockr.rs
#	crates/trusted-server-core/src/integrations/permutive.rs
#	crates/trusted-server-core/src/integrations/sourcepoint.rs

Author: aram356

crates/trusted-server-core/src/integrations/datadome.rs

@@ -52,7 +52,7 @@
 //! automatically rewrite `DataDome` script URLs in HTML responses:
 //!
 //! - `<script src="https://js.datadome.co/tags.js">` becomes
-//!   `<script src="https://publisher.com/integrations/datadome/tags.js">`
+//!   `<script src="/integrations/datadome/tags.js">`
 //! - Handles both `src` and `href` attributes (for preload/prefetch links)
 
 use std::sync::{Arc, LazyLock};
@@ -815,6 +815,10 @@ impl IntegrationAttributeRewriter for DataDomeIntegration {
 
         let path = Self::extract_datadome_path(attr_value);
         // Root-relative so the browser resolves it against the page host.
+        // Note: a page-level `<base href>` participates in this resolution, so
+        // on pages that set an external base URL these resolve against that base
+        // rather than the address-bar origin — an accepted tradeoff, matching
+        // GTM/Didomi/Testlight which are also relative.
         let new_url = format!("/integrations/datadome{path}");
 
         log::info!(

crates/trusted-server-core/src/integrations/gpt.rs

@@ -443,6 +443,10 @@ impl IntegrationAttributeRewriter for GptIntegration {
 
         if Self::is_gpt_script_url(attr_value) {
             // Root-relative so the browser resolves it against the page host.
+            // Note: a page-level `<base href>` participates in this resolution,
+            // so on pages that set an external base URL these resolve against
+            // that base rather than the address-bar origin — an accepted
+            // tradeoff, matching GTM/Didomi/Testlight which are also relative.
             AttributeRewriteAction::replace("/integrations/gpt/script".to_string())
         } else {
             AttributeRewriteAction::keep()

crates/trusted-server-core/src/integrations/lockr.rs

@@ -420,6 +420,10 @@ impl IntegrationAttributeRewriter for LockrIntegration {
 
         if self.is_lockr_sdk_url(attr_value) {
             // Root-relative so the browser resolves it against the page host.
+            // Note: a page-level `<base href>` participates in this resolution,
+            // so on pages that set an external base URL these resolve against
+            // that base rather than the address-bar origin — an accepted
+            // tradeoff, matching GTM/Didomi/Testlight which are also relative.
             let replacement = "/integrations/lockr/sdk".to_string();
             log::debug!("Rewriting Lockr SDK URL to {}", replacement);
             AttributeRewriteAction::Replace(replacement)

crates/trusted-server-core/src/integrations/permutive.rs

@@ -434,6 +434,10 @@ impl IntegrationAttributeRewriter for PermutiveIntegration {
         if self.is_permutive_sdk_url(attr_value) {
             // Rewrite to first-party SDK endpoint.
             // Root-relative so the browser resolves it against the page host.
+            // Note: a page-level `<base href>` participates in this resolution,
+            // so on pages that set an external base URL these resolve against
+            // that base rather than the address-bar origin — an accepted
+            // tradeoff, matching GTM/Didomi/Testlight which are also relative.
             AttributeRewriteAction::replace("/integrations/permutive/sdk".to_string())
         } else {
             AttributeRewriteAction::keep()

crates/trusted-server-core/src/integrations/sourcepoint.rs

@@ -355,6 +355,10 @@ impl SourcepointIntegration {
             .unwrap_or_default();
 
         // Root-relative so the browser resolves it against the page host.
+        // Note: a page-level `<base href>` participates in this resolution, so
+        // on pages that set an external base URL these resolve against that base
+        // rather than the address-bar origin — an accepted tradeoff, matching
+        // GTM/Didomi/Testlight which are also relative.
         Some(format!("{SOURCEPOINT_CDN_PREFIX}{path}{query}"))
     }