Fix APS PUC rendering and collapsed GAM shells

[ChristianPavilonis]

Summary

• establish nonce-bound APS renderer communication over a private MessageChannel for PUC sibling-frame rendering while retaining the legacy direct renderer path
• resize only the authenticated, ordinary collapsed 1x1 GAM shell after APS rendering
• add PUC 1.17.2 browser coverage and focused transport/geometry regressions

Validation

• cargo test-fastly
• cargo clippy-fastly
• cargo fmt --all -- --check
• cd crates/trusted-server-js/lib && npx vitest run
• TEST_FRAMEWORK=nextjs npx playwright test tests/shared/aps-renderer.spec.ts
• git diff --check

[prk-Jr]

Summary

Moves APS PUC delivery onto a nonce-bound private MessageChannel while keeping the legacy direct-postMessage path in the renderer document, and adds a narrowly-guarded resize for collapsed 1x1 GAM shells. The transport rework is backward-compatible by construction and the new PUC 1.17.2 browser test is a genuine regression net. One blocking item: the JS format gate fails on a stray blank line. One question on renderer versioning.

Blocking

🔧 wrench

• JS format gate fails: stray double blank line left by the moved APS branch — prettier --check rejects src/integrations/gpt/index.ts, failing CI gate 6 (crates/trusted-server-js/lib/src/integrations/gpt/index.ts:1206, inline).

❓ question

• Renderer version not bumped despite a wire-protocol change (crates/trusted-server-js/lib/src/integrations/aps/render.ts:7): APS_UNIVERSAL_CREATIVE_RENDERER_VERSION stays 4 while APS_UNIVERSAL_CREATIVE_RENDERER switches from a direct postMessage({nonce, renderer}) to a transferred MessageChannel. PUC keys its cached dynamic renderer on rendererVersion. Is holding at 4 deliberate — i.e. the renderer document retains the legacy direct branch precisely so a PUC-cached v4 source keeps working against the new document? If so, a comment on that constant saying the version is intentionally pinned would make the coupling explicit; if not, it needs a bump. (Not inline: line 7 is outside the diff.)

Non-blocking

🤔 thinking

• Inline sizing is permanent across GPT refresh (.../gpt/index.ts:185, inline)
• Port branch drops the parent-source check the direct branch keeps (crates/trusted-server-core/src/integrations/aps.rs:120, inline)
• Capability consumed before the response is known to be delivered (.../gpt/index.ts:1158, inline)
• var b declared twice in the renderer source (.../aps/render.ts:421, inline)

⛏ nitpick

• Inconsistent try scope between the two response paths (.../gpt/index.ts:1238, inline)
• usesFixedPositioning also matches sticky (.../gpt/index.ts:145, inline)

📝 note

• Resize applies to more than the APS path: the description says "resize only the authenticated, ordinary collapsed 1x1 GAM shell after APS rendering", but resizeCollapsedCreativeFrame is also called on the inline-adm path and the cached-adm path. The behaviour change is wider than the summary states — worth reflecting in the PR description so the blast radius is clear to anyone bisecting a sizing regression later.
• New browser-test dependency: prebid-universal-creative@1.17.2 is pinned exactly and lands as "dev": true (93 packages in that lockfile, all dev). Reasonable price for real PUC coverage; noting the added CI install surface (gulp-cli, babel-runtime, core-js@2.6.12) for awareness.

👍 praise

• Conservative resize guard set (.../gpt/index.ts:151, inline)
• Real-PUC topology coverage (.../browser/tests/shared/aps-renderer.spec.ts:208, inline)

CI Status

GitHub checks on this head: 4/4 pass (browser integration tests, integration tests, integration tests (Fastly EC lifecycle), prepare integration artifacts). Because the base branch is fix/aps-renderer-spec-decoupled-shim rather than main, the fmt / clippy / unit-test workflows did not run on this PR — the results below are from running them locally at 5f29a74.

• cargo fmt --all -- --check: PASS
• cargo test-fastly aps: PASS (60 passed)
• npx vitest run: PASS (528 passed, 31 files)
• npm run lint (eslint): PASS
• npm run format (prettier --check): FAIL — src/integrations/gpt/index.ts
• clippy: not run locally

(npx tsc --noEmit reports errors in test/integrations/prebid/index.test.ts and test/shared/beacon_guard.test.ts; those are pre-existing and unrelated to this PR.)

[aram356]

Summary

The new work here is sound: the nonce-bound MessageChannel handshake correctly fixes PUC sibling-frame rendering (where the sender is the hidden dynamic-renderer frame, so the old event.source !== parent check could never pass), the collapsed 1x1 GAM shell resize is tightly guarded, and the real PUC 1.17.2 end-to-end spec is strong coverage. Two blocking items: a JS format failure and the branch/base divergence below.

Blocking

🔧 wrench

• PR does not merge into its base: git merge-tree against fix/aps-renderer-spec-decoupled-shim reports content conflicts in 15 files (aps.rs, orchestrator.rs, formats.rs, prebid.rs, publisher.rs, creative_opportunities.rs, render.ts, gpt/index.ts, types.ts, several tests/docs, plus add/add conflicts on the new files). This branch was rebuilt on a stale merge-base (bf61fa189) while the base chain advanced, so the two sides now hold divergent copies of the same logical commits: this branch carries the markWinner/markRendered split from the #963 feedback round while the base tip still has markUsed, and the base carries ~16k lines of unrelated newer work this branch lacks. As a result the PR is unmergeable as-is, and the 48-file diff attributes ~9.5k lines of already-reviewed stacked content (#918/#963/#988) to this PR. Fix: update the base branch to the rebased chain, or rebase this branch onto the current base tip, so the PR diff reduces to the actual new work (9 files, +1,628/−98).
• JS format gate fails on crates/trusted-server-js/lib/src/integrations/gpt/index.ts (see inline comment): CI gate 6 (npm run format) rejects the double blank line left where the old renderer branch was removed.

CI Status

• GitHub checks: integration tests (4 jobs) PASS
• Local vitest: 528/528 PASS
• Local cargo test (wasm32-wasip1, aps-filtered): 60/60 PASS
• JS format: FAIL (gpt/index.ts)
• fmt/clippy: not run locally

[aram356]

@ChristianPavilonis PR needs attention

[ChristianPavilonis]

Addressed the review feedback in commit dd58a809 and pushed the rebased branch.

• Fixed formatting and bumped the renderer protocol version to 5 while retaining v4 compatibility.
• Scoped and made APS sizing refresh-safe.
• Added rollback on APS response-delivery failure.
• Added fast failure replies for invalid renderer descriptors.
• Cleaned up naming, comments, and PBS Cache delivery error handling.

Validation passed: full Vitest (623 tests), browser integration suite, cargo fmt --all -- --check, and cargo test-fastly aps (62 tests). Re-requested review from prk-Jr and aram356.

[prk-Jr]

Summary

Reviewed the nonce-bound APS renderer handshake, v5 renderer contract, guarded collapsed-shell sizing, and real PUC regression coverage. No findings.

CI Status

• browser integration tests: PASS
• integration tests: PASS
• integration tests (Fastly EC lifecycle): PASS
• prepare integration artifacts: PASS
• cargo fmt --all -- --check: PASS (local)
• JS format: PASS (local)
• dependency audit: PASS (0 vulnerabilities)