[etiennelatendresse-optable]

Why

A new secureSignalsFromEids function would allow to filter cached EIDs and pass them to GPT secure signals

What Changed

• secureSignalsFromEids flattens EIDs into { provider, id } pairs for installGPTSecureSignals, filtered by sources/inserters/matchers
• Add tests
• Update README.md under GAM secure signals.

How to Test

• Tested
• Docs updated

Notes

• Breaking change
• Requires release
  Co-authored-by: Etienne Latendresse etienne.latendresse@optable.co

[jplaroche]

SecureSignalEid duplicates a type we already have. EID from iab-openrtb/v26 declares exactly these fields (inserter?, source, matcher?, uids), and it is already imported in lib/addons/uid2-refresh.ts and lib/core/resolvers/resolveMultiTargeting.ts. lib/core/prebid/rtd.ts also hand-rolls its own local EID, so this would be the third definition of the same shape — if ORTB adds or renames a field, the local copies silently drift.

The local type is looser on purpose (cached EIDs are parsed from localStorage, so uids can be missing and a uid can lack an id — the tests cover both), which the strict ORTB type does not allow. Deriving keeps the field names and the tolerance:

import type { EID, UID } from "iab-openrtb/v26";

// Cached EIDs are parsed from storage, so ORTB's required fields may be
// absent at runtime. Derived from EID so new/renamed ORTB fields flow through.
type SecureSignalEid = Partial<Omit<EID, "uids">> & Pick<EID, "source"> & { uids?: Array<Partial<UID>> };

No behaviour change, and the existing tests (including { id: "" } and {} uids) still typecheck.

Alternative, if you would rather not carry the runtime tolerance: use EID directly and adjust the two malformed-uid fixtures. That trades defensiveness against untrusted cache contents for a simpler type — your call which side to land on.

Sent using Claude

[jplaroche]

should we include this in gpt.ts instead of on it's own ?

[etiennelatendresse-optable]

should we include this in gpt.ts instead of on it's own ?

gpt.ts seems to be mostly for googletag stuff. Keeping it in core for now

[jplaroche]

LGTM