Let a module name the browser's cookies and the shared store keys

.cargo/config.toml

@@ -26,20 +26,22 @@ test_details = "test --target aarch64-apple-darwin"
 # native crate needs no change here. Axum (native), Cloudflare
 # (wasm32-unknown-unknown), Spin, the CLI (native), and integration-tests
 # (native) are simply not listed.
-build-fastly = "build -p trusted-server-core -p trusted-server-adapter-fastly -p trusted-server-js -p trusted-server-openrtb --target wasm32-wasip1"
-check-fastly = "check -p trusted-server-core -p trusted-server-adapter-fastly -p trusted-server-js -p trusted-server-openrtb --target wasm32-wasip1"
-clippy-fastly = "clippy -p trusted-server-core -p trusted-server-adapter-fastly -p trusted-server-js -p trusted-server-openrtb --all-targets --all-features --target wasm32-wasip1 -- -D warnings"
-test-fastly = "test -p trusted-server-core -p trusted-server-adapter-fastly -p trusted-server-js -p trusted-server-openrtb --target wasm32-wasip1"
+build-fastly = "build -p trusted-server-core -p trusted-server-adapter-fastly -p trusted-server-device-fastly -p trusted-server-geo-fastly -p trusted-server-cmp-osano -p trusted-server-modules -p trusted-server-identity-lockr -p trusted-server-audience-permutive -p trusted-server-cmp-sourcepoint -p trusted-server-cmp-didomi -p trusted-server-cmp-inmobi -p trusted-server-ads-txt-sellers -p trusted-server-tag-google-tag-manager -p trusted-server-testing-testlight -p trusted-server-framework-nextjs -p trusted-server-ad-tag-google -p trusted-server-bot-protection-datadome -p trusted-server-ad-server-mock -p trusted-server-auction-aps -p trusted-server-auction-prebid -p trusted-server-auction-prebid-server -p trusted-server-auction-protocol-openrtb -p trusted-server-js -p trusted-server-openrtb --target wasm32-wasip1"
+check-fastly = "check -p trusted-server-core -p trusted-server-adapter-fastly -p trusted-server-device-fastly -p trusted-server-geo-fastly -p trusted-server-cmp-osano -p trusted-server-modules -p trusted-server-identity-lockr -p trusted-server-audience-permutive -p trusted-server-cmp-sourcepoint -p trusted-server-cmp-didomi -p trusted-server-cmp-inmobi -p trusted-server-ads-txt-sellers -p trusted-server-tag-google-tag-manager -p trusted-server-testing-testlight -p trusted-server-framework-nextjs -p trusted-server-ad-tag-google -p trusted-server-bot-protection-datadome -p trusted-server-ad-server-mock -p trusted-server-auction-aps -p trusted-server-auction-prebid -p trusted-server-auction-prebid-server -p trusted-server-auction-protocol-openrtb -p trusted-server-js -p trusted-server-openrtb --target wasm32-wasip1"
+clippy-fastly = "clippy -p trusted-server-core -p trusted-server-adapter-fastly -p trusted-server-device-fastly -p trusted-server-geo-fastly -p trusted-server-cmp-osano -p trusted-server-modules -p trusted-server-identity-lockr -p trusted-server-audience-permutive -p trusted-server-cmp-sourcepoint -p trusted-server-cmp-didomi -p trusted-server-cmp-inmobi -p trusted-server-ads-txt-sellers -p trusted-server-tag-google-tag-manager -p trusted-server-testing-testlight -p trusted-server-framework-nextjs -p trusted-server-ad-tag-google -p trusted-server-bot-protection-datadome -p trusted-server-ad-server-mock -p trusted-server-auction-aps -p trusted-server-auction-prebid -p trusted-server-auction-prebid-server -p trusted-server-auction-protocol-openrtb -p trusted-server-js -p trusted-server-openrtb --all-targets --all-features --target wasm32-wasip1 -- -D warnings"
+test-fastly = "test -p trusted-server-core -p trusted-server-adapter-fastly -p trusted-server-device-fastly -p trusted-server-geo-fastly -p trusted-server-cmp-osano -p trusted-server-modules -p trusted-server-identity-lockr -p trusted-server-audience-permutive -p trusted-server-cmp-sourcepoint -p trusted-server-cmp-didomi -p trusted-server-cmp-inmobi -p trusted-server-ads-txt-sellers -p trusted-server-tag-google-tag-manager -p trusted-server-testing-testlight -p trusted-server-framework-nextjs -p trusted-server-ad-tag-google -p trusted-server-bot-protection-datadome -p trusted-server-ad-server-mock -p trusted-server-auction-aps -p trusted-server-auction-prebid -p trusted-server-auction-prebid-server -p trusted-server-auction-protocol-openrtb -p trusted-server-js -p trusted-server-openrtb --target wasm32-wasip1"
 # Feature-on counterpart of `test-fastly`. `test-fastly` does NOT pass
 # --all-features, so without this the reusable-sandbox code is linted by
 # `clippy-fastly` but its tests never execute.
 test-fastly-reuse = "test -p trusted-server-adapter-fastly --target wasm32-wasip1 --features reusable-sandbox"
 
 # --- Axum adapter (native dev server) ---
+# Test and clippy also cover the permission signal crates, whose own tests
+# run with the Axum adapter in CI.
 build-axum = "build -p trusted-server-adapter-axum"
 check-axum = "check -p trusted-server-adapter-axum"
-clippy-axum = "clippy -p trusted-server-adapter-axum --all-targets --all-features -- -D warnings"
-test-axum = "test -p trusted-server-adapter-axum"
+clippy-axum = "clippy -p trusted-server-adapter-axum -p trusted-server-permission-signal-gpc -p trusted-server-permission-signal-gpp -p trusted-server-permission-signal-mtm -p trusted-server-permission-signal-tcf -p trusted-server-permission-signal-us-privacy -p trusted-server-cmp-osano -p trusted-server-modules -p trusted-server-identity-lockr -p trusted-server-audience-permutive -p trusted-server-cmp-sourcepoint -p trusted-server-cmp-didomi -p trusted-server-cmp-inmobi -p trusted-server-ads-txt-sellers -p trusted-server-loading-cache-51degrees -p trusted-server-tag-google-tag-manager -p trusted-server-testing-testlight -p trusted-server-framework-nextjs -p trusted-server-ad-tag-google -p trusted-server-bot-protection-datadome -p trusted-server-ad-server-mock -p trusted-server-auction-aps -p trusted-server-auction-prebid -p trusted-server-auction-prebid-server -p trusted-server-auction-protocol-openrtb --all-targets --all-features -- -D warnings"
+test-axum = "test -p trusted-server-adapter-axum -p trusted-server-permission-signal-gpc -p trusted-server-permission-signal-gpp -p trusted-server-permission-signal-mtm -p trusted-server-permission-signal-tcf -p trusted-server-permission-signal-us-privacy -p trusted-server-cmp-osano -p trusted-server-modules -p trusted-server-identity-lockr -p trusted-server-audience-permutive -p trusted-server-cmp-sourcepoint -p trusted-server-cmp-didomi -p trusted-server-cmp-inmobi -p trusted-server-ads-txt-sellers -p trusted-server-loading-cache-51degrees -p trusted-server-tag-google-tag-manager -p trusted-server-testing-testlight -p trusted-server-framework-nextjs -p trusted-server-ad-tag-google -p trusted-server-bot-protection-datadome -p trusted-server-ad-server-mock -p trusted-server-auction-aps -p trusted-server-auction-prebid -p trusted-server-auction-prebid-server -p trusted-server-auction-protocol-openrtb"
 
 # --- Cloudflare adapter (native host + wasm32-unknown-unknown) ---
 # Build/check target the WASM runtime (requires the `cloudflare` feature);

.claude/skills/planning-prebid-aws/references/configuration-and-secrets.md

@@ -12,17 +12,17 @@ Before asking questions the repository can answer:
 4. Add observations to the existing deployment decision record with source path/key, candidate requirement, confidence/status, and the remaining question. Report credential identifiers or presence only; keep raw TOML, credential values, and commercially sensitive publisher values out of reports and generated examples.
 5. Verify candidate adapters against the selected PBS Go release and confirm partner authorization. Record each host-secret requirement as required, not needed, or unresolved. A bidder name alone proves neither a secret requirement nor permission to use the bidder.
 
-| Trusted Server input                                               | Discovery use                                                                               |
-| ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------- |
-| `auction.enabled`                                                  | Determine active versus disabled server-auction intent without expanding defaults           |
-| `auction.providers.<id>` with `profile = "prebid-server"`          | Identify each configured PBS provider; withhold endpoint values                             |
-| Provider `timeout_ms` and `profile_config.test_mode` or `debug`    | Record explicit timeout and diagnostic intent, not permission to contact bidders            |
-| Provider `profile_config.bid_param_override_rules`                 | Count conditional publisher or placement inputs without reporting their values              |
-| `auction.bidders.<bidder>.provider`                                | Group candidate server-side adapters under the referenced PBS provider                      |
-| `integrations.prebid.enabled`, `account_id`, `timeout_ms`, `debug` | Record browser integration intent and compatibility questions separately from server demand |
-| `integrations.prebid.client_side_bidders`                          | Browser-side participation; do not automatically enable these adapters in PBS               |
-| `integrations.prebid.bundle`                                       | Browser bundle and identity capabilities, not proof of server-side use                      |
-| Relevant privacy, format, and stored-request settings              | Identify dependencies that need confirmation from the caller or request path                |
+| Trusted Server input                                                                    | Discovery use                                                                                                |
+| --------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
+| `auction.enabled`                                                                       | Determine active versus disabled server-auction intent without expanding defaults                            |
+| `demand.<name>` with `implementation = "auction.prebid-server"`                         | Identify each configured PBS demand source and whether `demand.modules` selects it; withhold endpoint values |
+| Demand source `timeout_ms`, `test_mode` and `debug`                                     | Record explicit timeout and diagnostic intent, not permission to contact bidders                             |
+| Demand source `bid_param_override_rules`                                                | Count conditional publisher or placement inputs without reporting their values                               |
+| `auction.bidders.<bidder>.module`                                                       | Group candidate server-side adapters under the referenced PBS demand source                                  |
+| `prebid` in `auction.modules`, and `auction.prebid` `account_id`, `timeout_ms`, `debug` | Record browser integration intent and compatibility questions separately from server demand                  |
+| `auction.prebid.client_side_bidders`                                                    | Browser-side participation; do not automatically enable these adapters in PBS                                |
+| `auction.prebid.bundle`                                                                 | Browser bundle and identity capabilities, not proof of server-side use                                       |
+| Relevant privacy, format, and stored-request settings                                   | Identify dependencies that need confirmation from the caller or request path                                 |
 
 Use `ts prebid server inspect --config <selected-path>` for redacted local discovery. It reports explicit values without expanding defaults or proving host-secret requirements. Resolve schema defaults and adapter metadata separately, recording unsupported details as unresolved rather than fetching credentials or inventing mappings. Read config without invoking commands that publish or rewrite it. Leave `trusted-server.toml` unchanged. Propose caller endpoint/account changes separately after integration approval; discovery must not activate bidders, publish configuration, or change traffic.
 

.env.example

@@ -40,41 +40,36 @@ TRUSTED_SERVER__REQUEST_SIGNING__ENABLED=false
 # =============================================================================
 # Integrations
 # =============================================================================
+# Which integrations run is set in the TOML file, in the section of each
+# one's type, as `[auction] modules = ["prebid"]` and
+# `[framework] module = "nextjs"`. There is no per-integration enabled flag.
+# An overlay below changes a setting the file already carries, and it cannot
+# add one the file leaves out or replace a list. An overlay names its section
+# as the file writes it, so a section with a hyphen in its name, such as
+# `[ad-tag]`, is set with `env 'NAME=value' command`, because a shell's
+# `export` refuses the name.
 
-# Prebid
-TRUSTED_SERVER__INTEGRATIONS__PREBID__ENABLED=false
-# TRUSTED_SERVER__INTEGRATIONS__PREBID__SERVER_URL=https://prebid-server.example.com/openrtb2/auction
-# TRUSTED_SERVER__INTEGRATIONS__PREBID__TIMEOUT_MS=1000
-# TRUSTED_SERVER__INTEGRATIONS__PREBID__BIDDERS=kargo,rubicon,appnexus
-# TRUSTED_SERVER__INTEGRATIONS__PREBID__BID_PARAM_OVERRIDES='{"bidder-name":{"param1":12345,"param2":"value"}}'
-# Compatibility env shape for bidder -> zone -> params overrides
-# TRUSTED_SERVER__INTEGRATIONS__PREBID__BID_PARAM_ZONE_OVERRIDES='{"kargo":{"header":{"placementId":"_abc"}}}'
-# Preferred canonical env shape for future generic rules
-# TRUSTED_SERVER__INTEGRATIONS__PREBID__BID_PARAM_OVERRIDE_RULES='[{"when":{"bidder":"kargo","zone":"header"},"set":{"placementId":"_abc"}}]'
-# TRUSTED_SERVER__INTEGRATIONS__PREBID__SUPPRESS_NURL_BIDDERS=exampleBidder,anotherBidder
-# TRUSTED_SERVER__INTEGRATIONS__PREBID__AUTO_CONFIGURE=false
-# TRUSTED_SERVER__INTEGRATIONS__PREBID__DEBUG=false
-# TRUSTED_SERVER__INTEGRATIONS__PREBID__TEST_MODE=false
+# Prebid, the browser side. The Prebid Server endpoint belongs to a demand
+# source, so its overlay is TRUSTED_SERVER__DEMAND__<NAME>__ENDPOINT.
+# TRUSTED_SERVER__AUCTION__PREBID__ACCOUNT_ID=
+# TRUSTED_SERVER__AUCTION__PREBID__TIMEOUT_MS=1000
+# TRUSTED_SERVER__AUCTION__PREBID__DEBUG=false
 
 # Next.js
-TRUSTED_SERVER__INTEGRATIONS__NEXTJS__ENABLED=false
-# TRUSTED_SERVER__INTEGRATIONS__NEXTJS__REWRITE_ATTRIBUTES=href,link,url
+# TRUSTED_SERVER__FRAMEWORK__NEXTJS__MAX_COMBINED_PAYLOAD_BYTES=10485760
 
 # Didomi
-TRUSTED_SERVER__INTEGRATIONS__DIDOMI__ENABLED=false
-# TRUSTED_SERVER__INTEGRATIONS__DIDOMI__SDK_ORIGIN=https://sdk.privacy-center.org
-# TRUSTED_SERVER__INTEGRATIONS__DIDOMI__API_ORIGIN=https://api.privacy-center.org
+# TRUSTED_SERVER__CMP__DIDOMI__SDK_ORIGIN=https://sdk.privacy-center.org
+# TRUSTED_SERVER__CMP__DIDOMI__API_ORIGIN=https://api.privacy-center.org
 
 # Permutive
-TRUSTED_SERVER__INTEGRATIONS__PERMUTIVE__ENABLED=false
-# TRUSTED_SERVER__INTEGRATIONS__PERMUTIVE__ORGANIZATION_ID=
-# TRUSTED_SERVER__INTEGRATIONS__PERMUTIVE__WORKSPACE_ID=
-# TRUSTED_SERVER__INTEGRATIONS__PERMUTIVE__PROJECT_ID=
+# TRUSTED_SERVER__AUDIENCE__PERMUTIVE__ORGANIZATION_ID=
+# TRUSTED_SERVER__AUDIENCE__PERMUTIVE__WORKSPACE_ID=
+# TRUSTED_SERVER__AUDIENCE__PERMUTIVE__PROJECT_ID=
 
 # Lockr
-TRUSTED_SERVER__INTEGRATIONS__LOCKR__ENABLED=false
-# TRUSTED_SERVER__INTEGRATIONS__LOCKR__APP_ID=
-# TRUSTED_SERVER__INTEGRATIONS__LOCKR__CACHE_TTL_SECONDS=3600
+# TRUSTED_SERVER__IDENTITY__LOCKR__APP_ID=
+# TRUSTED_SERVER__IDENTITY__LOCKR__CACHE_TTL_SECONDS=3600
 
 # =============================================================================
 # Rewrite Configuration (optional)

.github/workflows/inspector.yml

@@ -0,0 +1,26 @@
+name: "Permissions Inspector"
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  build-inspector-wasm:
+    name: build inspector wasm
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Retrieve Rust version
+        id: rust-version
+        run: echo "rust-version=$(grep -oP 'channel = "\K[^"]+' rust-toolchain.toml)" >> "$GITHUB_OUTPUT"
+      - name: Set up Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: ${{ steps.rust-version.outputs.rust-version }}
+          target: wasm32-unknown-unknown
+      - name: Build the inspector engine
+        run: ./scripts/build-inspector-wasm.sh

.github/workflows/test.yml

@@ -68,12 +68,23 @@ jobs:
       - name: Run inline control harness
         run: BID_DELAY=3 ./scripts/template-cache-local-test.sh inline
 
-      - name: Run cache purge harness
-        run: BID_DELAY=3 ./scripts/template-cache-local-test.sh purge
+      - name: Run config by host harness
+        run: ./scripts/config-by-host-local-test.sh
+
+      - name: Run config by host harness (reusable-sandbox feature)
+        run: ./scripts/config-by-host-local-test.sh reuse
+
+      # Last, because it builds core with a key schedule compiled in.
+      - name: Run attestation harness
+        run: ./scripts/attestation-local-test.sh
 
   test-axum:
-    name: cargo test (axum native)
-    runs-on: ubuntu-latest
+    name: cargo test (axum native, ${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
     steps:
       - uses: actions/checkout@v4
 
@@ -122,12 +133,33 @@ jobs:
         run: |
           cargo test --package trusted-server-openrtb-codegen --target "$(rustc -vV | sed -n 's/host: //p')"
 
+      # The core library's unit tests otherwise run only on the WebAssembly
+      # targets, which build with panic=abort, so their harness stops at the
+      # first failing test and reports every later one as never run. A run that
+      # looks like a single failure can hide many more. This native run reports
+      # them all at once, which is what makes a red build readable.
+      - name: Run host-target core library tests
+        run: |
+          cargo test --package trusted-server-core --target "$(rustc -vV | sed -n 's/host: //p')"
+
+      # The seam-probe fixture crate's own unit tests only run when invoked on
+      # the host target, because no adapter alias compiles its test target. Run
+      # them here so a fault in the seam fixture cannot sit unseen behind a
+      # green gate set.
+      - name: Run host-target seam-probe integration tests
+        run: |
+          cargo test --package trusted-server-integration-seam-probe --target "$(rustc -vV | sed -n 's/host: //p')"
+
       - name: Verify Fastly WASM release build
         run: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
 
   test-cloudflare:
-    name: cargo check (cloudflare native + wasm32-unknown-unknown)
-    runs-on: ubuntu-latest
+    name: cargo check (cloudflare native + wasm32-unknown-unknown, ${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
     steps:
       - uses: actions/checkout@v4
 
@@ -322,3 +354,9 @@ jobs:
 
       - name: Run unit tests
         run: npm test -- --run
+
+      # A module that writes a script into pages tests it in its own folder,
+      # with Node's test runner and no packages.
+      - name: Run module page script tests
+        working-directory: .
+        run: node --test "crates/*/*/tests/*.test.mjs"

.gitignore

@@ -16,6 +16,9 @@
 /spin
 /spin.sig
 
+# logs
+*.log
+
 # EdgeZero local KV store (created by edgezero-adapter-axum framework)
 .edgezero/
 /dist/prebid/