Prebidexternal first-party bundle loading

[ChristianPavilonis]

Summary

• Hard cut Prebid to the external first-party bundle flow: no bundle_mode, no embedded/deferred tsjs-prebid loading, and external_bundle_url is required whenever Prebid is enabled.
• Always inject the same-origin /integrations/prebid/bundle.js script and keep publisher Prebid script interception/removal to prevent duplicate instances.
• Proxy the generated bundle with static-asset behavior: no EC forwarding, no copied request headers, streaming passthrough, HTTPS-only targets/redirects, and proxy.allowed_domains enforcement.
• Keep external_bundle_sha256 optional; when present it drives versioned first-party URLs, immutable cache headers, and sha256: ETags. SRI is validated if configured but is not required.
• Move Prebid out of the embedded Cargo TSJS build and document/generate publisher-specific external bundles with build-prebid-external.mjs.

Quick how-to: generate and configure a Prebid bundle

1. Generate a publisher-specific external Prebid bundle:

cd crates/js/lib
npm run build:prebid-external -- \
  --adapters=rubicon,appnexus,openx \
  --user-id-modules=sharedIdSystem,uid2IdSystem \
  --out=dist/prebid

2. Upload the generated trusted-prebid-<sha256>.js from dist/prebid/ to an HTTPS asset host that is allowed by proxy.allowed_domains.

3. Copy values from dist/prebid/manifest.json into config:

[integrations.prebid]
enabled = true
server_url = "https://prebid-server.example.com/openrtb2/auction"
external_bundle_url = "https://assets.example.com/prebid/trusted-prebid-<sha256>.js"

# Optional but recommended for versioned first-party URL + immutable cache headers.
external_bundle_sha256 = "<manifest sha256>"

# Optional browser SRI. Validated if present, but not required.
external_bundle_sri = "<manifest sri>"

# Include any client-side bidders whose adapters were included above.
client_side_bidders = ["rubicon"]

Trusted Server injects the same-origin /integrations/prebid/bundle.js route for browsers; publishers should not reference the external asset URL directly in page markup.

Testing

• cargo fmt --all -- --check
• TSJS_SKIP_BUILD=1 cargo check -p trusted-server-core
• TSJS_SKIP_BUILD=1 cargo test -p trusted-server-core prebid --lib
• TSJS_SKIP_BUILD=1 cargo test -p trusted-server-core publisher::tests --lib
• TSJS_SKIP_BUILD=1 cargo test -p trusted-server-core registry::tests --lib
• TSJS_SKIP_BUILD=1 cargo test --workspace
• TSJS_SKIP_BUILD=1 cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo check -p trusted-server-js
• cd crates/js/lib && npm run build
• cd crates/js/lib && npm run format
• cd crates/js/lib && npx vitest run
• cd crates/js/lib && npm run build:prebid-external -- --adapters=rubicon --user-id-modules=sharedIdSystem --out=/tmp/trusted-server-prebid-external-hard-cutover
• cd docs && npm ci && npm run format

[ChristianPavilonis]

The bundling should be moved to CLI when ready.