July release candidate (DO NOT MERGE)

.github/workflows/integration-tests.yml

@@ -183,7 +183,16 @@ jobs:
         with:
           node-version: ${{ steps.shared-setup.outputs.node-version }}
           cache: npm
-          cache-dependency-path: crates/trusted-server-integration-tests/browser/package-lock.json
+          cache-dependency-path: |
+            crates/trusted-server-integration-tests/browser/package-lock.json
+            crates/trusted-server-js/lib/package-lock.json
+
+      - name: Build TSJS browser fixtures
+        working-directory: crates/trusted-server-js/lib
+        run: |
+          npm ci
+          npm run build
+          npm run build:prebid-external
 
       - name: Install Playwright
         working-directory: crates/trusted-server-integration-tests/browser

CHANGELOG.md

@@ -9,15 +9,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- **Breaking** — Replaced the legacy APS contextual integration with APS OpenRTB at `/e/pb/bid`. APS configuration now uses canonical `account_id` (`pub_id` remains a compatibility alias), no longer requires APS-specific slot IDs, and defaults script creative eligibility off. Operators must update the endpoint, disable native APS demand for Trusted Server cohorts, and prepare GAM/Universal Creative targeting for `hb_bidder=aps` before rollout.
 - **Breaking** — `bid_param_zone_overrides` inner values must now be JSON objects; previously non-object or empty values (`"header" = "x"`, `"header" = {}`) were accepted and silently produced a dead rule at runtime. They now fail at startup with a configuration error. Operators upgrading should audit their `bid_param_zone_overrides` config for non-object zone entries.
 - **Breaking** — Sourcepoint browser module inclusion now requires explicit `[integrations.sourcepoint].enabled = true`; operators relying on the previous unconditional Sourcepoint module should enable the integration before upgrading.
+- Added optional APS `inventory_domain` and `inventory_page_origin` overrides for deployments whose edge hostname differs from the APS-authorized inventory identity.
+- Preserved APS renderer capabilities through the client-side `trustedServer` Prebid adapter, allowing its generated `hb_adid` to render through GAM and Prebid Universal Creative instead of producing an empty creative.
 
 ### Security
 
 - Validate synthetic ID format on inbound values from the `x-synthetic-id` header and `synthetic_id` cookie; values that do not match the expected format (`64-hex-hmac.6-alphanumeric-suffix`) are discarded and a fresh ID is generated rather than forwarded to response headers, cookies, or third-party APIs
 
 ### Added
 
+- Added opt-in APS HTTP debug metadata for controlled test sites, exposing the direct request and response under `/auction` provider metadata using the Prebid Server `debug.httpcalls` shape.
+- Added the default-true `[auction].rewrite_creatives` option. Setting it to `false` preserves mandatory `/auction` creative sanitization while skipping first-party resource/click URL rewriting and creative TSJS injection.
+- Added typed APS renderer transport for direct auctions and GAM/Prebid Universal Creative, using a minimized one-bid envelope, a fragment-bound nonce, and an opaque sandboxed renderer endpoint.
 - Added Osano consent mirror integration docs and public enablement guidance.
 - Implemented basic authentication for configurable endpoint paths (#73)
 - Added integrations guide with example `testlight` integration

Cargo.toml

@@ -37,6 +37,7 @@ version = "0.1.0"
 
 [workspace.dependencies]
 anyhow = "1"
+async-stream = "0.3"
 async-trait = "0.1"
 axum = "0.8"
 base64 = "0.22"

TESTING.md

@@ -131,8 +131,9 @@ INFO: Running 2 bidders in parallel
 INFO: Requesting bids from: prebid
 INFO: Prebid returned 2 bids (time: 120ms)
 INFO: Requesting bids from: aps
-INFO: APS (MOCK): returning 2 bids in 80ms
-INFO: GAM mediation: slot 'header-banner' won by 'amazon-aps' at $2.50 CPM
+INFO: APS requests bids for 2 impressions
+INFO: APS returns 2 accepted bids in 80ms
+INFO: GAM mediation: slot 'header-banner' won by 'aps' at $2.50 CPM
 ```
 
 ### Verify Provider Registration

crates/trusted-server-adapter-axum/src/platform.rs

@@ -158,11 +158,19 @@ impl PlatformBackend for AxumPlatformBackend {
         let port = spec
             .port
             .unwrap_or(if spec.scheme == "https" { 443 } else { 80 });
+        // Keep two providers that share an origin on distinct names so auction
+        // response correlation cannot cross providers.
+        let discriminator = spec
+            .discriminator
+            .as_deref()
+            .map(|d| format!("_p_{}", normalize_env_segment(d)))
+            .unwrap_or_default();
         Ok(format!(
-            "{}_{}_{}",
+            "{}_{}_{}{}",
             normalize_env_segment(&spec.scheme),
             normalize_env_segment(&spec.host),
             port,
+            discriminator,
         ))
     }
 
@@ -644,6 +652,7 @@ mod tests {
             first_byte_timeout: Duration::from_secs(15),
             between_bytes_timeout: Duration::from_secs(15),
             host_header_override: None,
+            discriminator: None,
         };
         let name1 = backend.predict_name(&spec).expect("should return a name");
         let name2 = backend
@@ -664,6 +673,7 @@ mod tests {
             first_byte_timeout: Duration::from_secs(15),
             between_bytes_timeout: Duration::from_secs(15),
             host_header_override: None,
+            discriminator: None,
         };
         assert_eq!(
             backend.predict_name(&spec).expect("should return name"),

crates/trusted-server-adapter-cloudflare/src/platform.rs

@@ -71,8 +71,15 @@ impl PlatformBackend for NoopBackend {
         } else {
             "_nocert"
         };
+        // Keep two providers that share an origin on distinct names so auction
+        // response correlation cannot cross providers.
+        let discriminator = spec
+            .discriminator
+            .as_deref()
+            .map(|d| format!("_p_{d}"))
+            .unwrap_or_default();
         Ok(format!(
-            "{}_{}_{}_{timeout_ms}ms{cert_suffix}",
+            "{}_{}_{}_{timeout_ms}ms{cert_suffix}{discriminator}",
             spec.scheme, spec.host, port
         ))
     }

crates/trusted-server-adapter-fastly/Cargo.toml

@@ -25,6 +25,7 @@ log = { workspace = true }
 log-fastly = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
+sha2 = { workspace = true }
 trusted-server-core = { workspace = true }
 url = { workspace = true }
 urlencoding = { workspace = true }

crates/trusted-server-adapter-fastly/src/app.rs

@@ -65,10 +65,10 @@
 //!   run on these responses. Legacy ran EC finalization on its own auth
 //!   challenges. Like the 401 geo-skip, this is privacy-conservative: no EC
 //!   cookies are issued to unauthenticated callers.
-//! - **Publisher responses** are buffered (bounded by
-//!   `publisher.max_buffered_body_bytes`) instead of streamed to the client.
-//!   Asset responses are streamed straight to the client (see
-//!   [`dispatch_asset_fallback`]), matching legacy.
+//! - **Publisher responses** keep Fastly origin bodies streaming through the
+//!   `EdgeZero` response body when the body is processable or pass-through.
+//!   Adapters without streaming-body support still use the bounded buffered
+//!   finalizer.
 //! - **Router-level 405s** (unregistered verbs) skip EC finalization along
 //!   with the middleware chain; the entry point still adds TS headers.
 //!
@@ -116,8 +116,8 @@ use trusted_server_core::proxy::{
     handle_first_party_proxy, handle_first_party_proxy_rebuild, handle_first_party_proxy_sign,
 };
 use trusted_server_core::publisher::{
-    AuctionDispatch, buffer_publisher_response_async, handle_page_bids, handle_publisher_request,
-    handle_tsjs_dynamic, page_bids_preflight_denied,
+    AuctionDispatch, handle_page_bids, handle_publisher_request, handle_tsjs_dynamic,
+    page_bids_preflight_denied, publisher_response_into_streaming_response,
 };
 use trusted_server_core::request_signing::{
     handle_deactivate_key, handle_rotate_key, handle_trusted_server_discovery,
@@ -721,10 +721,9 @@ async fn dispatch_fallback(
     let result = if uses_dynamic_tsjs_fallback(&method, &path) {
         handle_tsjs_dynamic(&req, &state.registry)
     } else if state.registry.has_route(&method, &path) {
-        // Integration-proxy responses are not bounded by publisher.max_buffered_body_bytes.
-        // Only the handle_publisher_request branch below routes through
-        // buffer_publisher_response_async. Integration responses are small in practice
-        // and the EdgeZero flag is off by default; extend the cap here if that changes.
+        // Integration-proxy responses are not bounded by
+        // publisher.max_buffered_body_bytes. Publisher fallback below uses the
+        // publisher-specific streaming finalizer instead.
         state
             .registry
             .handle_proxy(ProxyDispatchInput {
@@ -773,9 +772,8 @@ async fn dispatch_fallback(
         match runtime_services_for_consent_route(&state.settings, services) {
             Ok(publisher_services) => {
                 // Run the server-side auction with the configured creative-
-                // opportunity slots and collect the dispatched bids in the
-                // buffered finalize (`buffer_publisher_response_async`), matching
-                // the legacy streaming path. `handle_publisher_request` matches the
+                // opportunity slots and collect dispatched bids from the lazy
+                // publisher body stream. `handle_publisher_request` matches the
                 // slots against the request path. The partner registry plus the
                 // EC identity-graph KV (`ec.kv_graph`) enrich the bid request with
                 // server-side EIDs, same as the legacy auction.
@@ -798,13 +796,13 @@ async fn dispatch_fallback(
                         .await
                         {
                             Ok(pub_response) => {
-                                buffer_publisher_response_async(
+                                publisher_response_into_streaming_response(
                                     pub_response,
                                     &method,
-                                    &state.settings,
-                                    &state.registry,
-                                    &state.orchestrator,
-                                    &publisher_services,
+                                    Arc::clone(&state.settings),
+                                    state.registry.as_ref(),
+                                    Arc::clone(&state.orchestrator),
+                                    publisher_services.clone(),
                                 )
                                 .await
                             }
@@ -2158,6 +2156,10 @@ mod tests {
 
     #[async_trait::async_trait(?Send)]
     impl PlatformHttpClient for StreamingHttpClient {
+        fn supports_streaming_responses(&self) -> bool {
+            true
+        }
+
         async fn send(
             &self,
             request: PlatformHttpRequest,
@@ -2268,6 +2270,36 @@ mod tests {
         );
     }
 
+    #[test]
+    fn dispatch_fallback_streams_publisher_body_without_buffering() {
+        // Regression guard for the publisher streaming cutover (#849): a
+        // successful publisher origin fetch must hand `edgezero_main` a lazy
+        // streaming body (`Body::Stream`) so headers commit at origin first
+        // byte, rather than draining the processed page into a buffered
+        // `Body::Once`. Core tests cover the rewrite pipeline itself; this
+        // guards the adapter wiring that could silently re-buffer.
+        let settings = test_settings();
+        let state = build_state_from_settings(settings).expect("should build state");
+        let services = streaming_runtime_services();
+        let req = empty_request(Method::GET, "/article");
+
+        let response = block_on(super::dispatch_fallback(&state, &services, req));
+
+        assert_eq!(
+            response.status(),
+            StatusCode::OK,
+            "publisher proxy should succeed against the streaming origin stub"
+        );
+        assert!(
+            matches!(response.body(), Body::Stream(_)),
+            "EdgeZero publisher dispatch must attach the lazy streaming body, not buffer it"
+        );
+        assert!(
+            !response.headers().contains_key(header::CONTENT_LENGTH),
+            "processed streaming publisher responses must not carry a stale Content-Length"
+        );
+    }
+
     #[test]
     fn dispatch_runs_request_filter_and_threads_response_effects() {
         // Regression guard for the EdgeZero request-filter bypass: the publisher