Prevent accidental Prebid Server stored requests

[ChristianPavilonis]

Summary

• Prevent generated browser auction slots from accidentally requesting Prebid Server (PBS) stored impressions. Previously, an empty bidder map could trigger a lookup using a dynamic slot code; a missing stored impression could reject the whole provider request, including valid sibling impressions.
• Add optional trustedServer.params.storedRequest intent: false disables stored fallback, true permits it, and omission preserves legacy behavior. Filter demandless PBS impressions after server-side parameter overrides without suppressing eligible Amazon Publisher Services (APS) or other providers.
• Preserve publisher intent across repeated and refresh auctions, with regression tests for the serialized browser payload and actual outbound provider request bytes.

Changes

Changed files

File	Change
crates/trusted-server-core/src/auction/routing.rs	Validates stored intent atomically, retains legacy admission facts, and carries intent into provider-local routing.
crates/trusted-server-core/src/auction/openrtb.rs	Honors intent after bidder overrides, filters paired impressions safely, and skips empty requests before signing or transport.
crates/trusted-server-core/src/auction/openrtb/tests.rs	Covers explicit, disabled, and legacy fallback, override-populated params, and retained impression identity.
crates/trusted-server-core/src/auction/orchestrator.rs	Adds transport tests for zero, one, and two active PBS providers alongside APS, including valid bid preservation.
crates/trusted-server-core/src/auction/formats.rs	Documents the wire field and tests conversion through strict intent admission.
crates/trusted-server-js/lib/src/integrations/prebid/index.ts	Defaults newly generated envelopes to false and preserves authored intent in live ad units and immutable refresh snapshots.
crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts	Tests initial, repeated, and refresh serialization, including omitted and malformed intent and container-ID lookup.
crates/trusted-server-js/lib/test/core/auction.test.ts	Confirms the shared serializer retains boolean values, omission, and invalid null for server validation.
crates/trusted-server-js/lib/test/prebid-artifact-integration.test.mjs	Verifies generated and publisher-authored intent through the built adapter.
docs/guide/api-reference.md	Defines the field, validation behavior, legacy compatibility, and request examples.
docs/guide/integrations/prebid.md	Explains refresh behavior, server-first deployment, and rollback constraints.
docs/guide/auction-orchestration.md	Describes provider routing and post-override impression filtering.
CHANGELOG.md	Records the fix and deployment requirement.
docs/superpowers/plans/2026-09-10-pbs-stored-request-intent.md	Records the approved plan, scope correction, regression evidence, and verification results.

Scope

This touches 14 files because the intent must survive browser generation, refresh reconstruction, server routing, and final request construction. Most additions are regression tests and documentation; changing only the router would leave a second stored-request fallback in the request builder.

No dependencies, adapter implementations, provider configuration, browser provider selectors, or explicit stored IDs are changed. Legacy inference and intentional stored-demand fanout remain supported. PBS all_eligible configuration remains rejected by the existing compiler, so its boundary test is retained rather than enabling a new configuration mode.

Deployment

Deploy server support everywhere before serving the new JavaScript. The old router rejects unknown envelope fields and can drop valid inline demand when it receives storedRequest.

Rust artifacts embed the JavaScript bundles. First prepare a server-support-only build retaining old JS emission, then distribute the full build. Keep compatible server admission during rollback while browsers may retain the new JS. Existing legacy callers and intentional stored requests can still reference missing slot-code IDs; this change does not eliminate unrelated PBS validation errors.

Closes

Closes #1086

Test plan

Meaningful failing-before assertions were captured for explicit intent admission, generated JS serialization, and the remaining post-override fallback. They pass after the fix. Independent correctness review found no issues.

• cargo test-fastly && cargo test-axum
• cargo test-cloudflare && cargo test-spin
• ./scripts/test-cli.sh
• cargo clippy-fastly && cargo clippy-axum
• cargo clippy-cloudflare && cargo clippy-cloudflare-wasm
• cargo clippy-spin-native && cargo clippy-spin-wasm
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run, 923 tests passed
• JS lint/format/build: npm run lint, npm run format, and node build-all.mjs
• Docs format/build: cd docs && npm run format && npm run build
• git diff --check
• Standalone release WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve

Fastly tests ran through Viceroy; Cloudflare and Spin production WASM paths passed Clippy. The full Rust suites passed with 10 pre-existing Fastly tests/doctests ignored. After a mechanical Clippy fix and a test-only example-domain correction, all six Clippy checks and focused routing/OpenRTB tests were rerun successfully; the full suites were not repeated after those two edits. No live PBS service was contacted.

Checklist

• Changes follow the project coding conventions
• No new unwrap() in production code; use expect("should ...")
• Existing log instrumentation conventions preserved; no println! added
• New behavior has regression tests
• No secrets or credentials committed