Implement APS render fix and TSJS resilience

.cargo/config.toml

@@ -9,54 +9,60 @@
 # default-members = [fastly] — required so Viceroy can locate the binary via `cargo run --bin`.
 # The aliases below are grouped by adapter; each targets its adapter with the
 # correct toolchain (build / check / test / clippy).
+#
+# Aliases use string form, not array form: in a worktree nested inside the
+# repo (e.g. .claude/worktrees/*) Cargo discovers this file twice — the
+# worktree's copy and the parent checkout's — and merges array values by
+# concatenation, doubling every token ("check ... check ...").
+# String values are overridden by the deeper config instead of merged.
 
 [alias]
 # Generic: native test with an explicit host target.
-test_details = ["test", "--target", "aarch64-apple-darwin"]
+test_details = "test --target aarch64-apple-darwin"
 
 # --- Fastly adapter (wasm32-wasip1, run via Viceroy) ---
 # Whitelist the wasm-buildable crates (the Fastly adapter + the shared crates it
 # builds/tests on wasm) rather than blacklisting every native crate — so adding a
 # native crate needs no change here. Axum (native), Cloudflare
 # (wasm32-unknown-unknown), Spin, the CLI (native), and integration-tests
 # (native) are simply not listed.
-build-fastly = ["build", "-p", "trusted-server-core", "-p", "trusted-server-adapter-fastly", "-p", "trusted-server-js", "-p", "trusted-server-openrtb", "--target", "wasm32-wasip1"]
-check-fastly = ["check", "-p", "trusted-server-core", "-p", "trusted-server-adapter-fastly", "-p", "trusted-server-js", "-p", "trusted-server-openrtb", "--target", "wasm32-wasip1"]
-clippy-fastly = ["clippy", "-p", "trusted-server-core", "-p", "trusted-server-adapter-fastly", "-p", "trusted-server-js", "-p", "trusted-server-openrtb", "--all-targets", "--all-features", "--target", "wasm32-wasip1", "--", "-D", "warnings"]
-test-fastly = ["test", "-p", "trusted-server-core", "-p", "trusted-server-adapter-fastly", "-p", "trusted-server-js", "-p", "trusted-server-openrtb", "--target", "wasm32-wasip1"]
+build-fastly = "build -p trusted-server-core -p trusted-server-adapter-fastly -p trusted-server-js -p trusted-server-openrtb --target wasm32-wasip1"
+check-fastly = "check -p trusted-server-core -p trusted-server-adapter-fastly -p trusted-server-js -p trusted-server-openrtb --target wasm32-wasip1"
+clippy-fastly = "clippy -p trusted-server-core -p trusted-server-adapter-fastly -p trusted-server-js -p trusted-server-openrtb --all-targets --all-features --target wasm32-wasip1 -- -D warnings"
+test-fastly = "test -p trusted-server-core -p trusted-server-adapter-fastly -p trusted-server-js -p trusted-server-openrtb --target wasm32-wasip1"
 
 # --- Axum adapter (native dev server) ---
-build-axum = ["build", "-p", "trusted-server-adapter-axum"]
-check-axum = ["check", "-p", "trusted-server-adapter-axum"]
-clippy-axum = ["clippy", "-p", "trusted-server-adapter-axum", "--all-targets", "--all-features", "--", "-D", "warnings"]
-test-axum = ["test", "-p", "trusted-server-adapter-axum"]
+build-axum = "build -p trusted-server-adapter-axum"
+check-axum = "check -p trusted-server-adapter-axum"
+clippy-axum = "clippy -p trusted-server-adapter-axum --all-targets --all-features -- -D warnings"
+test-axum = "test -p trusted-server-adapter-axum"
 
 # --- Cloudflare adapter (native host + wasm32-unknown-unknown) ---
 # Build/check target the WASM runtime (requires the `cloudflare` feature);
 # tests run on the native host; clippy covers both native test code and the
 # production WASM feature.
-build-cloudflare = ["build", "-p", "trusted-server-adapter-cloudflare", "--target", "wasm32-unknown-unknown", "--features", "cloudflare"]
-check-cloudflare = ["check", "-p", "trusted-server-adapter-cloudflare", "--target", "wasm32-unknown-unknown", "--features", "cloudflare"]
+build-cloudflare = "build -p trusted-server-adapter-cloudflare --target wasm32-unknown-unknown --features cloudflare"
+check-cloudflare = "check -p trusted-server-adapter-cloudflare --target wasm32-unknown-unknown --features cloudflare"
 # No --all-features: the `cloudflare` feature has a compile_error! guard on
 # non-wasm32 targets.
-clippy-cloudflare = ["clippy", "-p", "trusted-server-adapter-cloudflare", "--all-targets", "--", "-D", "warnings"]
-clippy-cloudflare-wasm = ["clippy", "-p", "trusted-server-adapter-cloudflare", "--target", "wasm32-unknown-unknown", "--features", "cloudflare", "--lib", "--", "-D", "warnings"]
-test-cloudflare = ["test", "-p", "trusted-server-adapter-cloudflare"]
+clippy-cloudflare = "clippy -p trusted-server-adapter-cloudflare --all-targets -- -D warnings"
+clippy-cloudflare-wasm = "clippy -p trusted-server-adapter-cloudflare --target wasm32-unknown-unknown --features cloudflare --lib -- -D warnings"
+test-cloudflare = "test -p trusted-server-adapter-cloudflare"
 
 # --- Spin adapter (native host tests + wasm32-wasip1 target) ---
-check-spin = ["check", "-p", "trusted-server-adapter-spin", "--target", "wasm32-wasip1", "--features", "spin"]
-clippy-spin-native = ["clippy", "-p", "trusted-server-adapter-spin", "--all-targets", "--", "-D", "warnings"]
-clippy-spin-wasm = ["clippy", "-p", "trusted-server-adapter-spin", "--target", "wasm32-wasip1", "--features", "spin", "--lib", "--", "-D", "warnings"]
-test-spin = ["test", "-p", "trusted-server-adapter-spin"]
+check-spin = "check -p trusted-server-adapter-spin --target wasm32-wasip1 --features spin"
+clippy-spin-native = "clippy -p trusted-server-adapter-spin --all-targets -- -D warnings"
+clippy-spin-wasm = "clippy -p trusted-server-adapter-spin --target wasm32-wasip1 --features spin --lib -- -D warnings"
+test-spin = "test -p trusted-server-adapter-spin"
 
 # --- ts operator CLI (native host; install uses the current host platform) ---
-install-cli = ["install", "--path", "crates/trusted-server-cli", "--bin", "ts", "--locked", "--force"]
-build_cli_linux = ["build", "--package", "trusted-server-cli", "--target", "x86_64-unknown-linux-gnu"]
-build_cli_macos = ["build", "--package", "trusted-server-cli", "--target", "aarch64-apple-darwin"]
-run_cli_linux = ["run", "--package", "trusted-server-cli", "--target", "x86_64-unknown-linux-gnu", "--"]
-run_cli_macos = ["run", "--package", "trusted-server-cli", "--target", "aarch64-apple-darwin", "--"]
-test_cli_linux = ["test", "--package", "trusted-server-cli", "--target", "x86_64-unknown-linux-gnu"]
-test_cli_macos = ["test", "--package", "trusted-server-cli", "--target", "aarch64-apple-darwin"]
+install-cli = "install --path crates/trusted-server-cli --bin ts --locked --force"
+build_cli_linux = "build --package trusted-server-cli --target x86_64-unknown-linux-gnu"
+build_cli_macos = "build --package trusted-server-cli --target aarch64-apple-darwin"
+run_cli_linux = "run --package trusted-server-cli --target x86_64-unknown-linux-gnu --"
+run_cli_macos = "run --package trusted-server-cli --target aarch64-apple-darwin --"
+test_cli_linux = "test --package trusted-server-cli --target x86_64-unknown-linux-gnu"
+test_cli_macos = "test --package trusted-server-cli --target aarch64-apple-darwin"
 
 # When a wasm binary IS built, run it under Viceroy.
 [target.'cfg(all(target_arch = "wasm32"))']

.github/workflows/aps-real-gam.yml

@@ -0,0 +1,118 @@
+name: "APS real-GAM attestation"
+run-name: >-
+  APS real-GAM / ${{ inputs.evidence_id }} / ${{ inputs.release_id }}
+
+permissions:
+  contents: read
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_id:
+        description: Exact TSJS release id deployed to the protected test network
+        required: true
+        type: string
+      evidence_id:
+        description: Unique cutover evidence identifier
+        required: true
+        type: string
+      previous_artifact_id:
+        description: Immutable artifact identifier used for rollback
+        required: true
+        type: string
+
+jobs:
+  attest:
+    name: Chromium, Firefox, and WebKit attestation
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    environment: aps-real-gam
+    env:
+      TS_REAL_GAM_PAGE_URL: ${{ secrets.TS_REAL_GAM_PAGE_URL }}
+      TS_REAL_GAM_AUTH_HEADER: ${{ secrets.TS_REAL_GAM_AUTH_HEADER }}
+      TS_REAL_GAM_EXPECTED_RELEASE_ID: ${{ vars.TS_REAL_GAM_EXPECTED_RELEASE_ID }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Validate protected inputs and release binding
+        env:
+          DISPATCH_RELEASE_ID: ${{ inputs.release_id }}
+        run: |
+          test -n "$TS_REAL_GAM_PAGE_URL"
+          test -n "$TS_REAL_GAM_AUTH_HEADER"
+          test -n "$TS_REAL_GAM_EXPECTED_RELEASE_ID"
+          test -n "$DISPATCH_RELEASE_ID"
+          test "$DISPATCH_RELEASE_ID" = "$TS_REAL_GAM_EXPECTED_RELEASE_ID"
+          test -n "${{ inputs.evidence_id }}"
+          test -n "${{ inputs.previous_artifact_id }}"
+
+      - name: Read Node.js version
+        id: node-version
+        run: echo "version=$(awk '$1 == \"nodejs\" { print $2 }' .tool-versions)" >> "$GITHUB_OUTPUT"
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ steps.node-version.outputs.version }}
+          cache: npm
+          cache-dependency-path: crates/trusted-server-integration-tests/browser/package-lock.json
+
+      - name: Install isolated browser-test dependencies
+        working-directory: crates/trusted-server-integration-tests/browser
+        run: npm ci
+
+      - name: Install all required browsers
+        working-directory: crates/trusted-server-integration-tests/browser
+        run: npx playwright install --with-deps chromium firefox webkit
+
+      - name: Run protected real-GAM contract
+        id: real-gam
+        working-directory: crates/trusted-server-integration-tests/browser
+        run: >-
+          npm exec -- playwright test
+          --config=playwright.real-gam.config.ts
+          tests/shared/aps-real-gam.spec.ts
+          --project=chromium --project=firefox --project=webkit
+
+      - name: Write release attestation
+        if: always()
+        env:
+          ATTESTATION_EVIDENCE_ID: ${{ inputs.evidence_id }}
+          ATTESTATION_RELEASE_ID: ${{ inputs.release_id }}
+          ATTESTATION_PREVIOUS_ARTIFACT_ID: ${{ inputs.previous_artifact_id }}
+          ATTESTATION_TEST_OUTCOME: ${{ steps.real-gam.outcome }}
+        run: >-
+          node -e 'const fs=require("node:fs");
+          const path="crates/trusted-server-integration-tests/browser/real-gam-evidence/attestation-v1.json";
+          fs.mkdirSync(require("node:path").dirname(path),{recursive:true});
+          fs.writeFileSync(path,JSON.stringify({schemaVersion:1,evidenceId:process.env.ATTESTATION_EVIDENCE_ID,
+          releaseId:process.env.ATTESTATION_RELEASE_ID,previousArtifactId:process.env.ATTESTATION_PREVIOUS_ARTIFACT_ID,
+          commitSha:process.env.GITHUB_SHA,runId:process.env.GITHUB_RUN_ID,
+          conclusion:process.env.ATTESTATION_TEST_OUTCOME},null,2)+"\n",{mode:384});'
+
+      - name: Scrub browser evidence before upload
+        if: always()
+        env:
+          REAL_GAM_TEST_OUTCOME: ${{ steps.real-gam.outcome }}
+        working-directory: crates/trusted-server-integration-tests/browser
+        run: >-
+          node -e 'const fs=require("node:fs"),path=require("node:path");
+          const roots=["real-gam-evidence","playwright-report","test-results"];
+          const forbiddenExt=new Set([".har",".zip",".webm"]), secrets=[process.env.TS_REAL_GAM_PAGE_URL,process.env.TS_REAL_GAM_AUTH_HEADER].filter(Boolean);
+          const files=[]; const walk=p=>{if(!fs.existsSync(p))return; for(const e of fs.readdirSync(p,{withFileTypes:true})){const q=path.join(p,e.name); e.isDirectory()?walk(q):files.push(q)}}; roots.forEach(walk);
+          for(const file of files){if(forbiddenExt.has(path.extname(file)))throw Error("native capture forbidden: "+path.extname(file)); const body=fs.readFileSync(file); for(const secret of secrets){if(body.includes(Buffer.from(secret)))throw Error("protected value found in browser evidence")}}
+          const traces=files.filter(file=>file.endsWith("sanitized-trace-v1.json"));
+          for(const file of traces){const text=fs.readFileSync(file,"utf8"); if(/"(?:accountId|aaxResponse|adm|authorization|creativeBody|descriptor|lifecycleTicket|nonce|postData|requestHeaders|responseBody|responseHeaders)"\s*:/.test(text)||text.includes("<script")||text.includes("<!doctype"))throw Error("unsafe field or body found in sanitized evidence")}
+          if(process.env.REAL_GAM_TEST_OUTCOME==="success"&&traces.length!==60)throw Error("successful three-browser run must emit 60 sanitized case traces");'
+
+      - name: Upload real-GAM evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: aps-real-gam-${{ github.run_id }}
+          path: |
+            crates/trusted-server-integration-tests/browser/real-gam-evidence/
+            crates/trusted-server-integration-tests/browser/playwright-report/
+            crates/trusted-server-integration-tests/browser/test-results/
+          if-no-files-found: error
+          retention-days: 30

.github/workflows/integration-tests.yml

@@ -1,4 +1,6 @@
 name: "Integration Tests"
+run-name: >-
+  Integration Tests / ${{ inputs.evidence_id || format('PR {0}', github.event.pull_request.number) }}
 
 permissions:
   contents: read
@@ -9,6 +11,11 @@ on:
   pull_request:
     types: [opened, synchronize, reopened]
   workflow_dispatch:
+    inputs:
+      evidence_id:
+        description: Unique identifier used to bind this run to an evidence artifact
+        required: true
+        type: string
 
 env:
   ORIGIN_PORT: 8888
@@ -152,10 +159,58 @@ jobs:
           VICEROY_CONFIG_PATH: ${{ env.ARTIFACTS_DIR }}/configs/viceroy.toml
           RUST_LOG: info
 
+  aps-runner-proxy:
+    name: APS runner proxy (${{ matrix.runtime }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        runtime: [axum, fastly, cloudflare, spin]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up APS proxy test environment
+        id: shared-setup
+        uses: ./.github/actions/setup-integration-test-env
+        with:
+          origin-port: ${{ env.ORIGIN_PORT }}
+          install-viceroy: ${{ matrix.runtime == 'fastly' && 'true' || 'false' }}
+          build-wasm: "false"
+          build-axum: "false"
+          build-test-images: "false"
+          build-cloudflare: "false"
+
+      - name: Add Cloudflare wasm target
+        if: matrix.runtime == 'cloudflare'
+        run: rustup target add wasm32-unknown-unknown
+
+      - name: Set up Node.js for Wrangler
+        if: matrix.runtime == 'cloudflare'
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ steps.shared-setup.outputs.node-version }}
+
+      - name: Install Wrangler
+        if: matrix.runtime == 'cloudflare'
+        run: npm install -g wrangler@4.64.0
+
+      - name: Install Spin
+        if: matrix.runtime == 'spin'
+        uses: fermyon/actions/spin/setup@v1
+        with:
+          version: "4.0.2"
+
+      - name: Run actual-adapter APS runner-proxy corpus
+        run: ./scripts/integration-tests-aps-runner-proxy.sh --runtime ${{ matrix.runtime }}
+        env:
+          INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
+          RUST_LOG: info
+
   browser-tests:
     name: browser integration tests
     needs: prepare-artifacts
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
@@ -244,3 +299,79 @@ jobs:
           name: playwright-traces
           path: crates/trusted-server-integration-tests/browser/test-results/
           retention-days: 7
+
+      - name: Record TSJS pre-change performance evidence
+        if: github.event_name == 'workflow_dispatch'
+        working-directory: crates/trusted-server-integration-tests/browser
+        env:
+          WASM_BINARY_PATH: ${{ env.WASM_ARTIFACT_PATH }}
+          INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
+          VICEROY_CONFIG_PATH: ${{ env.ARTIFACTS_DIR }}/configs/viceroy.toml
+          TEST_FRAMEWORK: nextjs
+          TSJS_PERF_MODE: baseline
+          TSJS_PERF_OUTPUT: crates/trusted-server-js/lib/test/fixtures/performance/aps-tsjs-prechange.json
+          TSJS_PERF_MACHINE_CLASS: github-hosted:ubuntu-24.04
+          TSJS_EVIDENCE_ID: ${{ inputs.evidence_id }}
+        run: >-
+          npm exec -- playwright test
+          tests/shared/tsjs-performance.spec.ts
+          --project=chromium
+
+      - name: Upload TSJS pre-change performance evidence
+        if: github.event_name == 'workflow_dispatch' && always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: tsjs-performance-${{ inputs.evidence_id }}
+          path: crates/trusted-server-js/lib/test/fixtures/performance/aps-tsjs-prechange.json
+          if-no-files-found: error
+          retention-days: 30
+
+  browser-tests-aps-tsjs-conformance:
+    name: browser integration tests (APS/TSJS conformance)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up APS/TSJS browser test runtime
+        id: shared-setup
+        uses: ./.github/actions/setup-integration-test-env
+        with:
+          origin-port: ${{ env.ORIGIN_PORT }}
+          install-viceroy: "true"
+          build-wasm: "false"
+          build-axum: "false"
+          build-test-images: "false"
+          build-cloudflare: "false"
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ steps.shared-setup.outputs.node-version }}
+          cache: npm
+          cache-dependency-path: |
+            crates/trusted-server-integration-tests/browser/package-lock.json
+            crates/trusted-server-js/lib/package-lock.json
+
+      - name: Run focused APS/TSJS three-browser conformance matrix
+        env:
+          INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
+          TS_BROWSER_FRAMEWORKS: nextjs
+          TS_BROWSER_PROJECTS: chromium,firefox,webkit
+        run: >-
+          ./scripts/integration-tests-browser.sh
+          tests/shared/aps-renderer.spec.ts
+          tests/shared/aps-puc-lifecycle.spec.ts
+          tests/shared/tsjs-runtime.spec.ts
+          tests/shared/creative-sandbox.spec.ts
+          tests/nextjs/gpt-diagnostics.spec.ts
+          tests/nextjs/navigation.spec.ts
+          --project=chromium --project=firefox --project=webkit
+
+      - name: Upload APS/TSJS Playwright report
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: playwright-report-aps-tsjs-conformance
+          path: crates/trusted-server-integration-tests/browser/playwright-report/
+          retention-days: 7

.github/workflows/test.yml

@@ -247,5 +247,26 @@ jobs:
       - name: Build bundle
         run: npm run build
 
+      - name: Enforce bundle budgets
+        run: npm run check:bundle
+
+      - name: Typecheck full TSJS package
+        run: npm run typecheck
+
+      - name: Lint full TSJS package
+        run: npm run lint
+
+      - name: Verify generated APS renderer contract
+        run: npm run check:aps-contract
+
+      - name: Enforce hard-cutover architecture
+        run: npm run check:architecture
+
+      - name: Run embedded APS renderer contract
+        run: node --test test/contract/aps-renderer-es5.test.mjs
+
+      - name: Verify rc/july adoption manifest
+        run: node --test test/contract/rc-july-adoption.test.mjs
+
       - name: Run unit tests
         run: npm test -- --run

.tool-versions

@@ -1,5 +1,5 @@
 fastly 15.1.0
 rust 1.95.0
 nodejs 24.12.0
-viceroy 0.17.0
+viceroy 0.19.0
 wasmtime 44.0.1