July release candidate (DO NOT MERGE)

.github/actions/setup-integration-test-env/action.yml

@@ -93,6 +93,26 @@ runs:
         TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
       run: cargo build -p trusted-server-adapter-axum
 
+    - name: Set up Node.js for browser fixtures
+      if: ${{ inputs.build-test-images == 'true' }}
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ steps.node-version.outputs.node-version }}
+        cache: npm
+        cache-dependency-path: crates/trusted-server-js/lib/package-lock.json
+
+    - name: Build external Prebid fixture bundle
+      if: ${{ inputs.build-test-images == 'true' }}
+      shell: bash
+      run: |
+        rm -rf "$GITHUB_WORKSPACE/target/integration-test-artifacts/prebid"
+        mkdir -p "$GITHUB_WORKSPACE/target/integration-test-artifacts/prebid"
+        npm ci --prefix crates/trusted-server-js/lib
+        npm run --prefix crates/trusted-server-js/lib build:prebid-external -- \
+          --adapters=rubicon \
+          --user-id-modules=sharedIdSystem \
+          --out "$GITHUB_WORKSPACE/target/integration-test-artifacts/prebid"
+
     - name: Build WordPress test container
       if: ${{ inputs.build-test-images == 'true' }}
       shell: bash
@@ -109,6 +129,15 @@ runs:
           -t test-nextjs:latest \
           crates/trusted-server-integration-tests/fixtures/frameworks/nextjs/
 
+    - name: Build ad-trace test container
+      if: ${{ inputs.build-test-images == 'true' }}
+      shell: bash
+      run: |
+        docker build \
+          -f crates/trusted-server-integration-tests/fixtures/frameworks/ad-trace/Dockerfile \
+          -t test-ad-trace:latest \
+          .
+
     - name: Add wasm32-unknown-unknown target for Cloudflare build
       if: ${{ inputs.build-cloudflare == 'true' }}
       shell: bash

.github/workflows/integration-tests.yml

@@ -46,7 +46,7 @@ jobs:
           cp -r crates/trusted-server-adapter-cloudflare/build/. "$CF_BUILD_ARTIFACT_PATH/"
           docker save \
             --output "$DOCKER_ARTIFACT_PATH" \
-            test-wordpress:latest test-nextjs:latest
+            test-ad-trace:latest test-wordpress:latest test-nextjs:latest
 
       - name: Upload integration test artifacts
         uses: actions/upload-artifact@v4
@@ -183,7 +183,16 @@ jobs:
         with:
           node-version: ${{ steps.shared-setup.outputs.node-version }}
           cache: npm
-          cache-dependency-path: crates/trusted-server-integration-tests/browser/package-lock.json
+          cache-dependency-path: |
+            crates/trusted-server-integration-tests/browser/package-lock.json
+            crates/trusted-server-js/lib/package-lock.json
+
+      - name: Build TSJS browser fixtures
+        working-directory: crates/trusted-server-js/lib
+        run: |
+          npm ci
+          npm run build
+          npm run build:prebid-external
 
       - name: Install Playwright
         working-directory: crates/trusted-server-integration-tests/browser
@@ -228,10 +237,29 @@ jobs:
           path: crates/trusted-server-integration-tests/browser/playwright-report-wordpress/
           retention-days: 7
 
+      - name: Run browser tests (ad trace contract)
+        if: always()
+        working-directory: crates/trusted-server-integration-tests/browser
+        env:
+          WASM_BINARY_PATH: ${{ env.WASM_ARTIFACT_PATH }}
+          INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
+          VICEROY_CONFIG_PATH: ${{ env.ARTIFACTS_DIR }}/configs/viceroy-ad-trace.toml
+          TEST_FRAMEWORK: ad-trace
+          PLAYWRIGHT_HTML_REPORT: playwright-report-ad-trace
+        run: npx playwright test tests/ad-trace/auction-trace.spec.ts
+
+      - name: Upload Playwright report (ad trace contract)
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: playwright-report-ad-trace
+          path: crates/trusted-server-integration-tests/browser/playwright-report-ad-trace/
+          retention-days: 7
+
       - name: Upload Playwright traces and screenshots
         uses: actions/upload-artifact@v4
         if: failure()
         with:
           name: playwright-traces
-          path: crates/trusted-server-integration-tests/browser/test-results/
+          path: crates/trusted-server-integration-tests/browser/test-results-*/
           retention-days: 7

CHANGELOG.md

@@ -9,15 +9,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- **Breaking** — Replaced the legacy APS contextual integration with APS OpenRTB at `/e/pb/bid`. APS configuration now uses canonical `account_id` (`pub_id` remains a compatibility alias), no longer requires APS-specific slot IDs, and defaults script creative eligibility off. Operators must update the endpoint, disable native APS demand for Trusted Server cohorts, and prepare GAM/Universal Creative targeting for `hb_bidder=aps` before rollout.
 - **Breaking** — `bid_param_zone_overrides` inner values must now be JSON objects; previously non-object or empty values (`"header" = "x"`, `"header" = {}`) were accepted and silently produced a dead rule at runtime. They now fail at startup with a configuration error. Operators upgrading should audit their `bid_param_zone_overrides` config for non-object zone entries.
 - **Breaking** — Sourcepoint browser module inclusion now requires explicit `[integrations.sourcepoint].enabled = true`; operators relying on the previous unconditional Sourcepoint module should enable the integration before upgrading.
+- Added optional APS `inventory_domain` and `inventory_page_origin` overrides for deployments whose edge hostname differs from the APS-authorized inventory identity.
+- Preserved APS renderer capabilities through the client-side `trustedServer` Prebid adapter, allowing its generated `hb_adid` to render through GAM and Prebid Universal Creative instead of producing an empty creative.
 
 ### Security
 
 - Validate synthetic ID format on inbound values from the `x-synthetic-id` header and `synthetic_id` cookie; values that do not match the expected format (`64-hex-hmac.6-alphanumeric-suffix`) are discarded and a fresh ID is generated rather than forwarded to response headers, cookies, or third-party APIs
 
 ### Added
 
+- Added opt-in APS HTTP debug metadata for controlled test sites, exposing the direct request and response under `/auction` provider metadata using the Prebid Server `debug.httpcalls` shape.
+- Added the default-true `[auction].rewrite_creatives` option. Setting it to `false` preserves mandatory `/auction` creative sanitization while skipping first-party resource/click URL rewriting and creative TSJS injection.
+- Added typed APS renderer transport for direct auctions and GAM/Prebid Universal Creative, using a minimized one-bid envelope, a fragment-bound nonce, and an opaque sandboxed renderer endpoint.
 - Added Osano consent mirror integration docs and public enablement guidance.
 - Implemented basic authentication for configurable endpoint paths (#73)
 - Added integrations guide with example `testlight` integration

Cargo.toml

@@ -37,6 +37,7 @@ version = "0.1.0"
 
 [workspace.dependencies]
 anyhow = "1"
+async-stream = "0.3"
 async-trait = "0.1"
 axum = "0.8"
 base64 = "0.22"

TESTING.md

@@ -131,8 +131,9 @@ INFO: Running 2 bidders in parallel
 INFO: Requesting bids from: prebid
 INFO: Prebid returned 2 bids (time: 120ms)
 INFO: Requesting bids from: aps
-INFO: APS (MOCK): returning 2 bids in 80ms
-INFO: GAM mediation: slot 'header-banner' won by 'amazon-aps' at $2.50 CPM
+INFO: APS requests bids for 2 impressions
+INFO: APS returns 2 accepted bids in 80ms
+INFO: GAM mediation: slot 'header-banner' won by 'aps' at $2.50 CPM
 ```
 
 ### Verify Provider Registration

crates/trusted-server-adapter-axum/src/app.rs

@@ -32,7 +32,7 @@ use trusted_server_core::settings_data::{
 
 use trusted_server_core::platform::RuntimeServices;
 
-use crate::middleware::{AuthMiddleware, FinalizeResponseMiddleware};
+use crate::middleware::{AdTracePrepareMiddleware, AuthMiddleware, FinalizeResponseMiddleware};
 use crate::platform::{AxumPlatformConfigStore, build_runtime_services};
 
 // ---------------------------------------------------------------------------
@@ -540,6 +540,7 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
 
     let mut router = RouterService::builder()
         .middleware(FinalizeResponseMiddleware::new(Arc::clone(&state.settings)))
+        .middleware(AdTracePrepareMiddleware::new(Arc::clone(&state.settings)))
         .middleware(AuthMiddleware::new(Arc::clone(&state.settings)));
 
     router = router.route("/health", Method::GET, |_ctx: RequestContext| async {

crates/trusted-server-adapter-axum/src/middleware.rs

@@ -5,6 +5,7 @@ use edgezero_core::context::RequestContext;
 use edgezero_core::error::EdgeError;
 use edgezero_core::http::{HeaderValue, Response};
 use edgezero_core::middleware::{Middleware, Next};
+use edgezero_core::response::IntoResponse;
 use trusted_server_core::auth::enforce_basic_auth;
 use trusted_server_core::constants::HEADER_X_GEO_INFO_AVAILABLE;
 use trusted_server_core::settings::Settings;
@@ -38,6 +39,51 @@ impl Middleware for FinalizeResponseMiddleware {
     async fn handle(&self, ctx: RequestContext, next: Next<'_>) -> Result<Response, EdgeError> {
         let mut response = next.run(ctx).await?;
         apply_finalize_headers(&self.settings, &mut response);
+        trusted_server_core::integrations::ad_trace::finalize_response(&mut response);
+        Ok(response)
+    }
+}
+
+// ---------------------------------------------------------------------------
+// AdTracePrepareMiddleware
+// ---------------------------------------------------------------------------
+
+/// Prepares and sanitizes the request before auth, routing, or downstream use.
+pub struct AdTracePrepareMiddleware {
+    settings: Arc<Settings>,
+}
+
+impl AdTracePrepareMiddleware {
+    #[must_use]
+    pub fn new(settings: Arc<Settings>) -> Self {
+        Self { settings }
+    }
+}
+
+#[async_trait(?Send)]
+impl Middleware for AdTracePrepareMiddleware {
+    async fn handle(&self, mut ctx: RequestContext, next: Next<'_>) -> Result<Response, EdgeError> {
+        let decision = match trusted_server_core::integrations::ad_trace::prepare_request(
+            &self.settings,
+            ctx.request_mut(),
+        ) {
+            Ok(decision) => decision,
+            Err(report) => {
+                log::error!("ad trace request preparation failed: {report:?}");
+                return Ok(crate::app::http_error(&report));
+            }
+        };
+        let mut response = match next.run(ctx).await {
+            Ok(response) => response,
+            Err(error) => {
+                log::error!("request handler failed after ad trace preparation: {error:?}");
+                error.into_response()?
+            }
+        };
+        trusted_server_core::integrations::ad_trace::attach_response_decision(
+            &decision,
+            &mut response,
+        );
         Ok(response)
     }
 }

crates/trusted-server-adapter-cloudflare/src/app.rs

@@ -29,7 +29,7 @@ use trusted_server_core::request_signing::{
 };
 use trusted_server_core::settings::Settings;
 
-use crate::middleware::{AuthMiddleware, FinalizeResponseMiddleware};
+use crate::middleware::{AdTracePrepareMiddleware, AuthMiddleware, FinalizeResponseMiddleware};
 use crate::platform::build_runtime_services;
 
 // ---------------------------------------------------------------------------
@@ -432,6 +432,7 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
 
         let mut router = RouterService::builder()
             .middleware(FinalizeResponseMiddleware::new(Arc::clone(&state.settings)))
+            .middleware(AdTracePrepareMiddleware::new(Arc::clone(&state.settings)))
             .middleware(AuthMiddleware::new(Arc::clone(&state.settings)))
             .get(
                 "/.well-known/trusted-server.json",

crates/trusted-server-adapter-cloudflare/src/middleware.rs

@@ -5,6 +5,7 @@ use edgezero_core::context::RequestContext;
 use edgezero_core::error::EdgeError;
 use edgezero_core::http::{HeaderValue, Response};
 use edgezero_core::middleware::{Middleware, Next};
+use edgezero_core::response::IntoResponse;
 use trusted_server_core::auth::enforce_basic_auth;
 use trusted_server_core::constants::HEADER_X_GEO_INFO_AVAILABLE;
 use trusted_server_core::settings::Settings;
@@ -46,6 +47,50 @@ impl Middleware for FinalizeResponseMiddleware {
 
         let mut response = next.run(ctx).await?;
         apply_finalize_headers(&self.settings, geo_available, &mut response);
+        trusted_server_core::integrations::ad_trace::finalize_response(&mut response);
+        Ok(response)
+    }
+}
+
+// ---------------------------------------------------------------------------
+// AdTracePrepareMiddleware
+// ---------------------------------------------------------------------------
+
+pub struct AdTracePrepareMiddleware {
+    settings: Arc<Settings>,
+}
+
+impl AdTracePrepareMiddleware {
+    #[must_use]
+    pub fn new(settings: Arc<Settings>) -> Self {
+        Self { settings }
+    }
+}
+
+#[async_trait(?Send)]
+impl Middleware for AdTracePrepareMiddleware {
+    async fn handle(&self, mut ctx: RequestContext, next: Next<'_>) -> Result<Response, EdgeError> {
+        let decision = match trusted_server_core::integrations::ad_trace::prepare_request(
+            &self.settings,
+            ctx.request_mut(),
+        ) {
+            Ok(decision) => decision,
+            Err(report) => {
+                log::error!("ad trace request preparation failed: {report:?}");
+                return Ok(crate::app::http_error(&report));
+            }
+        };
+        let mut response = match next.run(ctx).await {
+            Ok(response) => response,
+            Err(error) => {
+                log::error!("request handler failed after ad trace preparation: {error:?}");
+                error.into_response()?
+            }
+        };
+        trusted_server_core::integrations::ad_trace::attach_response_decision(
+            &decision,
+            &mut response,
+        );
         Ok(response)
     }
 }