Always emit hb_adid so server-side ad template creatives render

[prk-Jr]

Summary

• Bidders that return neither a Prebid Cache UUID nor an adid produced no hb_adid in window.tsjs.bids. adInit only sets targeting keys that exist on the bid, so GAM never received an hb_adid key, the Universal Creative's %%PATTERN:hb_adid%% expanded to empty, and the render bridge rejected the resulting Prebid Request for want of an ad ID. The line item won and served its wrapper, but the creative never rendered — a silent, per-bidder loss of every SSAT impression.
• Adds Bid::bid_id, populated from the OpenRTB bid object's own id, and uses it as the last-resort hb_adid source. id is mandatory per the OpenRTB spec, so this closes the gap for every bidder.
• cache_id and ad_id keep priority, in that order. This is not cosmetic: when hb_cache_host/hb_cache_path are present the Universal Creative uses hb_adid as the Prebid Cache lookup key (https://<host><path>?uuid=<hb_adid>), so an arbitrary value there would break cache retrieval. Both priorities are locked in by test.

Why a separate field rather than folding into ad_id

ad_id is the creative/ad identifier and is exposed raw in the debug bid. The OpenRTB id is unique per bid instance, not per creative — surfacing it as ad_id would mislead any consumer treating that field as a creative identifier. The existing comment in parse_bid says as much, so the bid ID is carried as its own field instead.

Changes

File	Change
crates/trusted-server-core/src/auction/types.rs	Add Bid::bid_id: Option<String> with #[serde(default, skip_serializing_if = "Option::is_none")], so the serialized wire shape is unchanged when absent
crates/trusted-server-core/src/integrations/prebid.rs	Populate bid_id from the OpenRTB bid id in parse_bid; two tests covering it alongside and without adid/cache
crates/trusted-server-core/src/publisher.rs	build_bid_map hb_adid chain becomes cache_id → ad_id → bid_id; test for the new fallback, renamed omit-case test, and bid_id added to the cache/ad-id tests to prove precedence
crates/trusted-server-core/src/auction/orchestrator.rs	bid_id: None at Bid literals (tests)
crates/trusted-server-core/src/auction/formats.rs	bid_id: None at Bid literal
crates/trusted-server-core/src/auction/telemetry.rs	bid_id: None at Bid literal (test)
crates/trusted-server-core/src/integrations/adserver_mock.rs	bid_id: None at Bid literals
crates/trusted-server-core/src/integrations/aps.rs	bid_id: None at Bid literal
CHANGELOG.md	Entry under Unreleased → Fixed

Test plan

• cargo test-fastly && cargo test-axum
• cargo clippy-fastly && cargo clippy-axum
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: cargo test-cloudflare, cargo test-spin, cargo clippy-cloudflare, cargo clippy-cloudflare-wasm, cargo clippy-spin-native, cargo clippy-spin-wasm, and the parity suite (cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity)

The new bid_map_falls_back_to_bid_id_when_cache_id_and_ad_id_absent test was confirmed to fail with the fallback removed (left: None), so it genuinely gates the fix rather than passing vacuously.

Not covered by automated tests: the browser-side half of the loop — that GAM echoes the new hb_adid back and the bridge serves the creative. That path is the subject of #926.

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses tracing macros (not println!)
• New code has tests
• No secrets or credentials committed

[ChristianPavilonis]

Review Summary

Reviewed PR #996 against main. The direct Prebid fallback is correctly wired, but the inline findings cover an incomplete mediated path and a defensive fallback edge case.

[aram356]

Summary

Well-executed, tightly scoped fix: the cache_id → ad_id → bid_id precedence is locked in by tests from both directions, the new fallback test was verified to fail without the fix, and the render loop stays symmetric end-to-end (build_bid_map → GPT targeting → %%PATTERN:hb_adid%% → bridge equality check). One blocking gap on the mediated path, plus a few non-blocking observations.

Blocking

🔧 wrench

• Mediation passthrough drops bid_id — see inline comment (crates/trusted-server-core/src/integrations/adserver_mock.rs:321).

Non-blocking

🤔 thinking

• GAM 40-char targeting-value limit — see inline comment (crates/trusted-server-core/src/publisher.rs:3293).
• hb_cache_host/hb_cache_path are emitted independently of cache_id: if PBS ever returns ext.prebid.cache.bids.url without cacheId, the map now carries hb_adid = bid_id alongside cache coordinates, and (absent inline adm) the Universal Creative would fetch https://<host><path>?uuid=<bid_id> — a guaranteed miss. Pre-existing with the ad_id fallback, but bid_id extends it to every bidder. A cheap guard is to gate the hb_cache_host/hb_cache_path inserts on cache_id.is_some() (crates/trusted-server-core/src/publisher.rs:3300-3315).

🌱 seedling

• /auction responses could now echo the real OpenRTB bid id: crates/trusted-server-core/src/auction/formats.rs:281 synthesizes id: Some(format!("{}-{}", bid.bidder, slot_id)). Now that Bid carries the upstream bid's own id, echoing bid.bid_id (with the synthetic as fallback) would preserve win-notification correlation and debugging traceability for /auction consumers. Follow-up scope, not this PR.

⛏ nitpick

• Empty-string id flows into the map — see inline comment (crates/trusted-server-core/src/integrations/prebid.rs:2228).
• Stale comment in the JS bridge: crates/trusted-server-js/lib/src/integrations/gpt/index.ts:1162-1164 explains hb_adid non-uniqueness solely via the creative-id fallback; there is now a third tier (bid_id, unique per bid instance). The slot-scoped lookup rationale still holds, but the comment is incomplete. File isn't in this diff, hence body-level.

CI Status

All checks pass on GitHub: fmt, clippy (all six target-matched variants), Rust tests (fastly/axum/cloudflare/spin/CLI), cross-adapter parity, vitest, browser and Fastly EC integration tests, docs/TS format, CodeQL.