Emit absolute creative rewrite URLs

.env.dev

@@ -1,11 +1,14 @@
-# Non-secret development overlays used while generating the Axum config blob.
+# Non-secret development overlays used while generating local config blobs.
+# The public endpoint defaults to Viceroy; the Axum quickstart overrides it.
 # Sourcing this file alone does not configure the Axum server: also export the
 # blob and referenced secret-store values as shown in docs/guide/getting-started.md.
 
 # [publisher]
 TRUSTED_SERVER__PUBLISHER__DOMAIN=localhost
 TRUSTED_SERVER__PUBLISHER__COOKIE_DOMAIN=localhost
 TRUSTED_SERVER__PUBLISHER__ORIGIN_URL=http://localhost:9090
+# Browser-facing endpoint for rewritten creative URLs, not the upstream origin.
+TRUSTED_SERVER__PUBLISHER__PUBLIC_ORIGIN=http://localhost:7676
 
 # [synthetic]
 TRUSTED_SERVER__SYNTHETIC__COUNTER_STORE=counter_store

.github/workflows/integration-tests.yml

@@ -254,6 +254,8 @@ jobs:
     # once the pinned Playwright version supports the newer image.
     runs-on: ubuntu-24.04
     timeout-minutes: 15
+    env:
+      VICEROY_CONFIG_GENERATOR_PATH: ${{ github.workspace }}/target/debug/generate-viceroy-config
     steps:
       - uses: actions/checkout@v4
 
@@ -297,6 +299,12 @@ jobs:
           npm ci
           npx playwright install --with-deps chromium
 
+      # startViceroy retargets the config after choosing its listener port. Build
+      # on this runner rather than relying on an uncached binary or a native
+      # artifact from prepare-artifacts' potentially newer Ubuntu image.
+      - name: Build browser config generator
+        run: cargo build --package trusted-server-integration-tests --bin generate-viceroy-config
+
       - name: Test initial render fixture escaping
         working-directory: crates/trusted-server-integration-tests/browser
         run: node --test initial-render/pages.test.cjs

CHANGELOG.md

@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- **Breaking:** Creative rewrite proxy, click, CSS, `srcset`, sign-response, rebuild-response, and injected creative TSJS URLs are now absolute on `publisher.public_origin`. Review the [default authority, cookie scope, and coordinated upgrade/rollback warning for `public_origin`](docs/guide/configuration.md#publisher-configuration) before deployment. Existing root-relative signed proxy and click inputs remain accepted. TSJS bundle selection and hash calculation are unchanged.
 - The Lockr browser module no longer polls for private SDK state or mutates its API host, removing the "Lockr SDK not detected" timeout warning (#1247). Root-relative Lockr XHR API requests and rewritten SDK URLs now stay on the page origin even with an external `<base href>`. Custom or unreplaced legacy SDKs that relied on the removed host rewrite must route their own API calls through `/integrations/lockr/api`; `rewrite_sdk = false` leaves static SDK tags unchanged but does not disable dynamic interception. See the [Lockr migration guide](docs/guide/integrations/lockr.md#migration-from-the-sdk-host-shim).
 - Auction response collection now bounds network waiting by `[auction].timeout_ms`
   measured from dispatch, including delayed headers and trickling bodies on all

crates/trusted-server-adapter-fastly/src/app.rs

@@ -1965,6 +1965,20 @@ mod tests {
         );
     }
 
+    #[test]
+    fn proxy_rebuild_registers_get_and_post() {
+        let route = NAMED_ROUTES
+            .iter()
+            .find(|route| route.path == "/first-party/proxy-rebuild")
+            .expect("should register proxy rebuild route");
+        assert!(matches!(
+            route.handler,
+            NamedRouteHandler::FirstPartyProxyRebuild
+        ));
+        assert!(route.primary_methods.contains(&Method::GET));
+        assert!(route.primary_methods.contains(&Method::POST));
+    }
+
     #[test]
     fn legacy_admin_aliases_route_to_local_deny_not_key_handlers() {
         // Security guard for the legacy non-`/_ts` admin aliases. They must be

crates/trusted-server-adapter-spin/tests/routes.rs

@@ -805,21 +805,25 @@ async fn first_party_proxy_round_trip_through_spin_router() {
             .to_vec(),
     )
     .expect("sign response body should be UTF-8");
-    let href = json_string_field(&sign_body, "href")
-        .expect("sign response must include a signed href path");
+    let href =
+        json_string_field(&sign_body, "href").expect("sign response must include a signed href");
+    let (_, authority_and_path) = href
+        .split_once("://")
+        .expect("should return an absolute signed href");
+    let (_, path_and_query) = authority_and_path
+        .split_once('/')
+        .expect("should include a path in the signed href");
+    let href_path_and_query = format!("/{path_and_query}");
     assert!(
-        href.starts_with("/first-party/proxy?"),
-        "signed href must target the proxy path, got: {href}"
+        href_path_and_query.starts_with("/first-party/proxy?"),
+        "signed href must target the proxy path"
     );
 
     let router = test_router();
     let proxy_req = request_builder()
         .method("GET")
-        .uri(href.clone())
-        .header(
-            "spin-full-url",
-            format!("https://www.publisher.example{href}"),
-        )
+        .uri(href_path_and_query)
+        .header("spin-full-url", href)
         .body(edgezero_core::body::Body::empty())
         .expect("should build proxy request");
     let proxy_resp = route(router, proxy_req).await;

crates/trusted-server-cli/src/commands/audit/generate/mod.rs

@@ -415,6 +415,12 @@ fn build_draft_config_with_generator(
         "origin_url",
         &format!("origin_url = \"{origin}\""),
     )?;
+    draft = replace_key_in_section(
+        &draft,
+        "publisher",
+        "public_origin",
+        &format!("public_origin = \"{origin}\""),
+    )?;
 
     let detected = artifact
         .detected_integrations
@@ -2787,6 +2793,7 @@ mod tests {
         assert!(draft.contains("domain = \"www.publisher.example\""));
         assert!(draft.contains("cookie_domain = \".www.publisher.example\""));
         assert!(draft.contains("origin_url = \"https://www.publisher.example:8443\""));
+        assert!(draft.contains("public_origin = \"https://www.publisher.example:8443\""));
         assert!(draft.contains("[integrations.gpt]\nenabled = true"));
         assert!(draft.contains("[integrations.google_tag_manager]\nenabled = true"));
         assert!(draft.contains("container_id = \"GTM-ABC123\""));
@@ -4002,6 +4009,10 @@ mod tests {
                 "https://origin.example.com",
                 "https://origin.publisher.example.com",
             )
+            .replace(
+                "https://ads.example.com",
+                "https://ads.publisher.example.com",
+            )
     }
 
     /// A three-page site whose header ad unit tracks the section, so the crawl

crates/trusted-server-cli/src/commands/audit/generate/validate.rs

@@ -77,6 +77,10 @@ mod tests {
                 "https://origin.example.com",
                 "https://origin.publisher.example.com",
             )
+            .replace(
+                "https://ads.example.com",
+                "https://ads.publisher.example.com",
+            )
     }
 
     #[test]

crates/trusted-server-cli/tests/audit_config_diagnostics.rs

@@ -81,6 +81,10 @@ fn baseline() -> String {
             "https://origin.example.com",
             "https://origin.publisher.example.com",
         )
+        .replace(
+            "https://ads.example.com",
+            "https://ads.publisher.example.com",
+        )
 }
 
 const GPT_PAGE: &str = r#"<!doctype html><html><head><script>