Implement APS render fix and TSJS resilience - #1002
Draft
aram356 wants to merge 647 commits into
Draft
Conversation
The winning-bid `hb_auction_id` carried `AuctionRequest.id`, which is
`ts-{ec_id}` whenever an Edge Cookie ID exists. That value reached
`window.tsjs.bids` and the page-bids JSON for every visitor, handing any
script on the page the identifier the `ts-ec` cookie keeps HttpOnly, and
it could not distinguish one auction from the next because it is stable
per visitor.
Mint an unrelated `ts-auc-{uuid}` per auction instead, and emit it only
when the GPT diagnostics integration is enabled, since nothing else
consumes it. `AuctionRequest.id` is unchanged for SSPs.
Keep the operator API read-only: `window.tsjs.gptDiagnostics` now exposes only snapshot, export, subscribe, show, and hide. The evidence writers Trusted Server's own modules use move to a separate internal channel, `window.tsjs.gptDiagnosticsRecorder`, so the documented contract matches what the object actually offers. Bound the store's deferred work by retained state rather than refresh rate. Request-intent evidence now expires lazily when the slot is next recorded or requested instead of owning a timer per source, which also removes the WeakRef-absent fallback that strongly retained every marked slot until expiry. Delivery-boundary notifications share one timer that re-arms from retained cycles. Stop reporting a source-agnostic GPT identifier as a reservation. Those IDs are populated for reservation and backfill alike, so they classify as `reservation` only alongside an explicit non-backfill fact. Evict a creative attempt whose cycle rendered empty, so a late markup response cannot claim a Trusted Server delivery against an empty render, and label badges from the derived delivery state instead of re-deriving the precedence rules from raw timestamps. Also: attribute `refresh(null)`, make the presentation switches exhaustive, hoist the snapshot out of the subscriber loop so every subscriber sees one capture, and make the export's attribution fields required. Type-check the export contract: the `expectTypeOf` assertions were never evaluated, and one of them was a genuine error. Scope `test.typecheck` to the type tests, since a package-wide `tsc --noEmit` still fails on pre-existing errors elsewhere. Fix the replacement-after-eviction test, which passed vacuously because ten open cycles made the final render ambiguous, and cover the paths the review identified: publisher-refresh malformed input, the association LRU trim, the out-of-order callback arms, a declined creative attempt, the Prebid dispatch-context restore arm, and wrapper install ordering. Correct the operator guide where it contradicted the implementation, and record the auction-token revision in the design spec.
Conflict in the Prebid refresh handler: main (#965) documented that the delegated refresh preserves the publisher's original bare form, while this branch replaced that call with the diagnostics recording plus the scoped dispatch context. Both hold — `dispatchPrebidRefresh` passes `slots` and `opts` through unchanged — so the resolution keeps the diagnostics calls and main's comment, extended to say the wrapper only scopes the shared context. Also add `bid_id` to the auction-ID test provider's `Bid` literal, a field main added in #996 after this branch introduced the provider.
Brings in the PR #997 review fixes: the read-only diagnostics facade split from the internal recorder channel, lazily expiring request-intent evidence with one shared delivery-boundary timer, source-agnostic IDs no longer reported as reservations, the empty-render attempt eviction, and the scoped type-check gate for the export contract. The branch also carries a merge of main, whose #965 and #996 arrive here as squashes of work rc/july already implements more fully. Where the two sides describe the same feature, rc/july's implementation is kept: - APS, adserver_mock, auction/types.rs, auction/formats.rs — rc/july's OpenRTB provider, renderer-aware bid_id precedence, and typed renderer envelope supersede main's versions, which drop fields rc/july needs. - prebid.rs — rc/july canonicalizes the excluded-suffix list at both the startup and build paths already, so main's `load_config` helper adds nothing. Main's test is taken instead of rc/july's: it builds from raw settings rather than reusing the config `validate_config_for_startup` already canonicalized, so it actually exercises the build path. - prebid/index.ts — a bare refresh that filtered slots must deliver the resolved target list, not stay bare, so rc/july's `deliveredSlots` behavior and its test expectation both stand. Three fixes are ported into rc/july's shapes rather than resolved away: - The EC-derived auction ID reached page JavaScript here too, through different plumbing: both collect paths inlined `request.id.as_str()` into `write_bids_to_state`, and page-bids passed it to `build_bid_map_with_auction_id`. All three now mint a per-auction token via `diagnostics_auction_id()`, gated on the diagnostics integration being enabled. - A blank Prebid Cache UUID no longer ships cache coordinates. It loses the hb_adid precedence to `adid` or the bid id, so the Universal Creative would fetch `?uuid=<non-cache-id>` and miss instead of using the inline adm. The gate moves from `is_some()` to `non_empty()`, and main's regression test comes along with rc/july's `Bid` fields added. - The browser-side excluded-suffix list is validated before use. The server only de-duplicates it, so an empty suffix matched every ad unit path and pulled every slot out of the refresh auction, and a non-array value threw inside the publisher's own `refresh()`. Also collapses a duplicated `hb_auction_id` write in `build_bid_map` down to one guarded insert, and points the Prebid refresh recorder at `gptDiagnosticsRecorder` to match the new channel.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| function isPermutiveSdkUrl(url: string): boolean { | ||
| const lower = url.toLowerCase(); | ||
| return ( | ||
| (lower.includes('.edge.permutive.app') || lower.includes('cdn.permutive.com')) && |
|
|
||
| function exactControllerInline(document: string): string { | ||
| const inline = [ | ||
| ...document.matchAll(/<script([^>]*)>([\s\S]*?)<\/script>/giu), |
| const MAX_ALIASES = 32; | ||
| const MAX_FACTS = 512; | ||
| const HASH = /^[0-9a-f]{64}$/; | ||
| const CAPABILITY = /^[a-z][a-z0-9_]*(?:[._][a-z0-9_]+)*$/; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements the APS render fix and TSJS resilience design as a coordinated hard cutover based on current
main, with no backward-compatibility runtime or legacy API aliases.Scope boundaries
mainis the implementation and behavior authority; retiredrc/julyis an immutable concept checklist only and is never merged, rebased, cherry-picked, built, or performance-testedCache-Control; runner access remains a validated live proxy concernFinal implementation checkpoint
212040ba9d5f26bde87238191844f09646bff31ca0ec892d39dcc22b13d5d17e7bd55857633f97fcf65e41825729882c4e45d8b7mainatf6a2fb85ce623bf8a574e3941e1ee349acc3412dmainis the exact merge base; branch is 0 commits behindLoad-time architecture
The former parser-blocking full persistent release is no longer the first-display path. The generated bootstrap selects one content-addressed artifact:
The current admission gate reports:
All absolute ceilings pass. The production-shaped semantic transfer comparison against the exact freshly built current
mainalso passes for raw, gzip, and brotli bytes. The PR-triggered browser performance workflow remains the authority for paired timing evidence; its threshold was not weakened or reset.Verification
Local verification at the final checkpoint:
Protected cutover prerequisites
The PR-triggered performance workflow and repository-required GitHub checks must pass on this head. The real-GAM suite remains a protected/manual attestation because it requires deployment credentials and live infrastructure. No production deployment or protected real-GAM run was performed from this worktree.