Add configuration-driven OpenRTB auction providers

[ChristianPavilonis]

Summary

• Replaces the hard-coded Prebid Server and Amazon Publisher Services auction wiring with map-shaped provider and bidder configuration compiled into one immutable auction plan.
• Adds a shared Open Real-Time Bidding (OpenRTB) 2.6 execution path with typed Standard, Prebid Server, and Amazon Publisher Services profiles, including bidder routing, request signing, notification policy, timeout handling, and response identity tracking.
• Uses the same validated plan across adapters, runtime routing, browser demand generation, examples, and operator documentation so these paths cannot disagree about enabled providers or bidders.

The old design tied provider identity, routing, transport, and response handling to singleton implementations. Adding another standards-compliant endpoint required more provider-specific code, and each adapter could derive backend behavior independently. This implementation moves those decisions into validated configuration while preserving existing Prebid Server and Amazon Publisher Services behavior.

Changes

Changed files

Root configuration and guidance

File	Change
Cargo.lock	Refreshes the lockfile after removing an obsolete adapter dependency.
README.md	Points operators to the new map-shaped auction provider configuration.
TESTING.md	Updates auction test setup and verification guidance for the config-first implementation.
trusted-server.example.toml	Replaces the legacy provider list with provider and bidder maps, typed profiles, routes, and notification settings.

Adapters and CLI

File	Change
crates/trusted-server-adapter-axum/src/app.rs	Compiles and reuses the validated auction plan in Axum request handling.
crates/trusted-server-adapter-axum/src/platform.rs	Adds Axum target capability and backend-name validation for configured providers.
crates/trusted-server-adapter-axum/tests/routes.rs	Covers startup and route behavior with config-defined auction providers.
crates/trusted-server-adapter-cloudflare/src/app.rs	Builds the auction runtime from the validated plan for Cloudflare Workers.
crates/trusted-server-adapter-cloudflare/src/platform.rs	Implements deterministic provider backend naming and target validation for Cloudflare Workers.
crates/trusted-server-adapter-fastly/Cargo.toml	Removes the Fastly-only dependency no longer needed by backend construction.
crates/trusted-server-adapter-fastly/src/app.rs	Compiles the auction plan at startup and passes it into Fastly request handling.
crates/trusted-server-adapter-fastly/src/backend.rs	Reworks dynamic backend construction around canonical provider backend specifications.
crates/trusted-server-adapter-fastly/src/platform.rs	Shares Fastly backend naming, timeout canonicalization, and target capability validation with the plan compiler.
crates/trusted-server-adapter-fastly/src/tinybird.rs	Reports the separated provider, returned seat, and delivery bidder identities in auction telemetry.
crates/trusted-server-adapter-spin/src/app.rs	Builds the auction runtime from the validated plan for Spin.
crates/trusted-server-adapter-spin/src/platform.rs	Implements deterministic provider backend naming and target validation for Spin.
crates/trusted-server-cli/src/prebid_bundle.rs	Removes the legacy provider-list conversion from generated Prebid configuration.
crates/trusted-server-cli/tests/config_env_overlay.rs	Covers environment overlays against the new provider and bidder maps.

Auction core

File	Change
crates/trusted-server-core/src/auction/README.md	Documents the plan-driven auction architecture and request flow.
crates/trusted-server-core/src/auction/endpoints.rs	Adds canonical endpoint validation used by provider-plan compilation.
crates/trusted-server-core/src/auction/formats.rs	Carries returned upstream seat identity separately from the browser delivery bidder.
crates/trusted-server-core/src/auction/mod.rs	Admits requests into the compiled-plan flow and handles disabled or empty auctions without provider I/O.
crates/trusted-server-core/src/auction/openrtb.rs	Implements the shared OpenRTB 2.6 request, signing, transport, response, and notification driver.
crates/trusted-server-core/src/auction/openrtb/test_executor.rs	Provides deterministic transport support for OpenRTB driver tests.
crates/trusted-server-core/src/auction/openrtb/tests.rs	Adds golden and error-path coverage for Standard, Prebid Server, and Amazon Publisher Services profiles.
crates/trusted-server-core/src/auction/orchestrator.rs	Replaces singleton dispatch with plan-driven fanout, routing, logical budgets, bid collection, and mediation.
crates/trusted-server-core/src/auction/plan.rs	Compiles raw configuration into a sorted, immutable plan and validates target capabilities and collisions.
crates/trusted-server-core/src/auction/profile.rs	Defines the typed profile registry and compiled Standard, Prebid Server, and Amazon Publisher Services profile variants.
crates/trusted-server-core/src/auction/provider.rs	Adds the generic planned provider that dispatches through the shared OpenRTB driver.
crates/trusted-server-core/src/auction/routing.rs	Validates bidder ownership and builds explicit and all-eligible provider routes.
crates/trusted-server-core/src/auction/telemetry.rs	Keeps provider ID, returned seat, and delivery bidder distinct in telemetry.
crates/trusted-server-core/src/auction/test_support.rs	Adds reusable plan, provider, and backend fixtures for auction tests.
crates/trusted-server-core/src/auction/types.rs	Adds plan-driven auction input types and the returned-seat field.

Configuration, platform, and request handling

File	Change
crates/trusted-server-core/src/auction_config_types.rs	Defines map-shaped provider and bidder configuration with typed profile, routing, and notification options.
crates/trusted-server-core/src/config.rs	Validates the new auction schema and rejects the retired list-shaped provider configuration.
crates/trusted-server-core/src/config_payload.rs	Updates configuration payload parsing and validation for provider and bidder maps.
crates/trusted-server-core/src/creative_opportunities.rs	Derives browser auction opportunities from authoritative configured bidder routes.
crates/trusted-server-core/src/html_processor.rs	Passes plan-derived bidder data into injected browser configuration.
crates/trusted-server-core/src/platform/backend_naming.rs	Adds the shared pure backend-name codec used by startup validation and adapters.
crates/trusted-server-core/src/platform/http.rs	Adds HTTP fields needed by canonical provider transport.
crates/trusted-server-core/src/platform/mod.rs	Exports the shared backend naming and target validation support.
crates/trusted-server-core/src/platform/test_support.rs	Extends platform fixtures for provider backend prediction and transport tests.
crates/trusted-server-core/src/platform/traits.rs	Updates platform contracts for canonical backend specifications and timeout handling.
crates/trusted-server-core/src/publisher.rs	Generates publisher JavaScript and auction responses from the compiled provider plan.
crates/trusted-server-core/src/settings.rs	Aligns runtime settings with compiled auction configuration ownership.
crates/trusted-server-core/src/test_support.rs	Makes shared test settings construct the new auction configuration.

Integrations

File	Change
crates/trusted-server-core/src/integrations/adserver_mock.rs	Keeps mock mediation separate from bidder-provider plans while preserving mediation behavior.
crates/trusted-server-core/src/integrations/aps.rs	Converts Amazon Publisher Services into a typed OpenRTB profile while preserving request, response, renderer, and diagnostics behavior.
crates/trusted-server-core/src/integrations/didomi.rs	Reads auction state through the plan-backed settings API.
crates/trusted-server-core/src/integrations/google_tag_manager.rs	Reads configured browser bidders from the compiled plan.
crates/trusted-server-core/src/integrations/gpt_diagnostics.rs	Updates diagnostics to use plan-backed auction state.
crates/trusted-server-core/src/integrations/mod.rs	Removes the former static Prebid Server and Amazon Publisher Services provider registration path.
crates/trusted-server-core/src/integrations/nextjs/mod.rs	Uses plan-derived bidder configuration when generating Next.js integration data.
crates/trusted-server-core/src/integrations/prebid.rs	Converts Prebid Server into a typed OpenRTB profile and derives browser demand from validated bidder routes.
crates/trusted-server-core/src/integrations/registry.rs	Stops treating auction providers as singleton integration registrations.
crates/trusted-server-core/src/integrations/sourcepoint.rs	Reads auction state through the plan-backed settings API.

Browser and integration tests

File	Change
crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml	Migrates the integration fixture to provider and bidder maps.
crates/trusted-server-js/lib/src/integrations/prebid/index.ts	Builds browser demand only for bidders authorized by the server plan.
crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts	Covers authoritative bidder filtering and mixed browser/server demand.
crates/trusted-server-js/lib/test/prebid-artifact-integration.test.mjs	Updates built-artifact expectations for plan-derived Prebid configuration.

Operator and architecture documentation

File	Change
docs/guide/api-reference.md	Documents the updated auction request and response behavior.
docs/guide/architecture.md	Describes the compiled auction plan in the system architecture.
docs/guide/auction-orchestration.md	Rewrites auction orchestration guidance around providers, profiles, bidder routes, and mediation.
docs/guide/configuration.md	Documents the map-shaped auction schema and validation rules.
docs/guide/ec-setup-guide.md	Updates examples that reference auction configuration.
docs/guide/error-reference.md	Adds startup and request errors for invalid provider plans and routes.
docs/guide/fastly.md	Explains Fastly backend handling for configured providers.
docs/guide/first-party-proxy.md	Updates configuration references to the new schema.
docs/guide/getting-started.md	Uses provider and bidder maps in setup instructions.
docs/guide/integration-guide.md	Explains how integrations consume plan-backed auction state.
docs/guide/integrations-overview.md	Updates the relationship between integrations and auction profiles.
docs/guide/integrations/aps.md	Documents the Amazon Publisher Services profile and bidder routing configuration.
docs/guide/integrations/prebid.md	Documents the Prebid Server profile and authoritative browser bidder behavior.
docs/guide/proxy-signing.md	Updates signing references for the shared OpenRTB driver.
docs/superpowers/plans/2026-08-11-config-first-auction-provider-architecture-implementation-plan.md	Records the implementation sequence, parity requirements, and verification gates.
docs/superpowers/specs/2026-08-10-config-first-auction-provider-architecture-design.md	Records the configuration-first provider architecture and its runtime contracts.

Scope

This is a large change because provider configuration is now the single source of truth for startup validation, adapter backend registration, runtime dispatch, browser bidder exposure, telemetry, and operator documentation. Shipping only part of that path would leave the old and new models active at the same time and allow them to disagree. The pull request keeps the work focused on auction-provider configuration and execution; it does not replace the existing static mock mediator or add runtime-loadable provider plugins.

Target-aware validation before ts config push remote I/O remains blocked on publishing and pinning the required EdgeZero callback dependency. The shared target-independent compiler and adapter startup validation are included here.

Closes

Closes #1026

Test plan

Full verification still needs to run on the rebased implementation head. The current remote head has completed only the JavaScript and TypeScript CodeQL check.

• cargo test-fastly && cargo test-axum && cargo test-cloudflare && cargo test-spin
• ./scripts/test-cli.sh
• cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity
• cargo fmt --all -- --check
• cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare && cargo clippy-cloudflare-wasm && cargo clippy-spin-native && cargo clippy-spin-wasm
• JS tests: cd crates/trusted-server-js/lib && npx vitest run
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM builds for Fastly, Cloudflare, and Spin
• CodeQL: JavaScript and TypeScript analysis

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code; use expect("should ...")
• Uses log macros, not println!
• New Rust and JavaScript behavior has test coverage in this pull request
• No secrets or credentials are intentionally included

[aram356]

@ChristianPavilonis to test in staging