Fix missing Permutive segments and ignored integration log settings

[ChristianPavilonis]

Summary

• Separate browser bundles kept private copies of core state, so Permutive segments never reached /auction and integrations ignored publisher logging settings. Share the provider registry and log level across bundles.
• Stop creative from raising the default log level to info, while preserving explicit tsdebug behavior.
• Add tests that build and run the separate production bundles together, covering behavior ordinary unit tests missed.

Changes

Paths below are relative to crates/trusted-server-js/lib/, except CHANGELOG.md at the repository root.

File	Change
src/core/context.ts	Resolve the provider map from a shared global key on every registration and collection.
src/core/log.ts	Store the log level under a shared global key and read it for every logging call.
src/integrations/creative/click.ts	Remove the unconditional warn to info bump when installing the click guard.
build-module-options.mjs	Define the per-module production build options once for builds and artifact tests.
build-all.mjs	Use the shared options without changing bundle naming or output behavior.
test/iife-state-artifact-integration.test.mjs	Build core, creative and Permutive separately, then test auction context and logging in a simulated browser.
test/core/context.test.ts	Reset shared state between tests and verify that separate module instances share providers.
test/core/log.test.ts	Verify shared log-level changes, the default level and all logging thresholds.
test/core/config.test.ts	Reset the shared log level between tests.
test/prebid-artifact-integration.test.mjs	Build the Prebid shim using the same options as production.
CHANGELOG.md	Document restored segment transmission, logging changes, the server allowlist and the consent caveat.

Scope

This is the small repair for the two observable failures in #1196. It retains separate browser bundles and the existing publisher API. It does not change Rust, share APS renderer state, or implement the browser-runtime redesign in #1194. That redesign can replace the shared storage later without losing these behavior tests.

Restoring context starts sending config.permutive_segments when Permutive is enabled and cohorts are available. The server retains it only when auction.allowed_context_keys includes "permutive_segments". The allowlist is not a consent gate; this PR does not add consent enforcement, so publisher consent handling still needs review before relying on this data flow.

Closes

Closes #1196

Test plan

• cargo test-fastly && cargo test-axum
• cargo clippy-fastly && cargo clippy-axum
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: npm run lint, node build-all.mjs, explicit Prettier checks for the new .mjs files, focused TypeScript checking, and git diff --check.

All JS commands run from crates/trusted-server-js/lib/. Rust, docs-site and deployment checks were not run because those areas are unchanged.

The artifact suite reproduced nine failures before the runtime fix, including missing segments and ignored logging settings. All 11 artifact tests pass afterward. The two separate-module unit regressions also failed before the fix and pass afterward. The full suite passes 1,174 tests across 49 test files, including the existing Prebid artifact tests. The production build emits all 13 expected bundles.

Focused TypeScript check:

npx tsc --noEmit --target ES2022 --module ESNext --moduleResolution Bundler \
  --lib ES2022,DOM --skipLibCheck \
  src/core/context.ts src/core/log.ts \
  test/core/context.test.ts test/core/log.test.ts test/core/config.test.ts

Checklist

• Changes follow AGENTS.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses tracing macros, not println!. Not applicable: no Rust logging changes.
• New code has tests
• No secrets or credentials committed

[dhruv8sh]

Summary

Shares the context-provider registry and log level across independently built TSJS bundles via Symbol.for globals, which restores Permutive segments in /auction requests and makes integration logging follow tsjs.setConfig / tsjs.log.setLevel. The fix is small and well tested; no blocking issues, just one behavior question about tsdebug scope and a forward-looking note on shared-state robustness.

Non-blocking

🤔 thinking / 🌱 seedling / ⛏ nitpick

• tsdebug now raises logging for every bundle and can override the publisher's level — see inline at crates/trusted-server-js/lib/src/integrations/creative/click.ts:492
• Document the wider tsdebug scope in the CHANGELOG (contingent on the above) — see inline at CHANGELOG.md:35
• Shared provider map is never checked for shape or version — see inline at crates/trusted-server-js/lib/src/core/context.ts:20

👍 praise

• Tests run the real production bundles together — see inline at crates/trusted-server-js/lib/test/iife-state-artifact-integration.test.mjs:1

CI Status

• browser integration tests: PASS
• integration tests: PASS
• integration tests (Fastly EC lifecycle): PASS
• CodeQL: PASS
• cargo test (ts CLI, native): PASS
• cargo test: PASS (required)
• Analyze (rust): PASS
• Analyze (javascript-typescript): PASS
• cargo fmt: PASS (required)
• cargo test (axum native): PASS
• format-typescript: PASS (required)
• cargo check (cloudflare native + wasm32-unknown-unknown): PASS
• CLAUDE.md symlink guard: PASS
• format-docs: PASS (required)
• cargo check/build/test (spin native + wasm32-wasip1): PASS
• cargo test (cross-adapter parity): PASS
• prepare integration artifacts: PASS
• vitest: PASS
• Analyze (actions): PASS
• Analyze (javascript-typescript): PASS

[prk-Jr]

Summary

The shared global provider registry and log level fix the independent-IIFE state duplication described in #1196. The extracted build options preserve production behavior, and the artifact tests exercise context propagation, publisher log settings, load order, and explicit tsdebug overrides. No blocking or non-blocking findings.

Local verification with the pinned Node 24.12.0: 31 tests pass across the context, logger, config, and production-IIFE state suites.

CI Status

• integration tests: PASS
• browser integration tests: PASS
• integration tests (Fastly EC lifecycle): PASS
• CodeQL: PASS
• cargo test (ts CLI, native): PASS
• Analyze (rust): PASS
• CLAUDE.md symlink guard: PASS
• Analyze (javascript-typescript): PASS (both reported runs)
• cargo fmt: PASS (required)
• cargo test (axum native): PASS
• format-typescript: PASS (required)
• cargo check (cloudflare native + wasm32-unknown-unknown): PASS
• cargo test: PASS (required)
• format-docs: PASS (required)
• cargo check/build/test (spin native + wasm32-wasip1): PASS
• cargo test (cross-adapter parity): PASS
• Analyze (actions): PASS
• prepare integration artifacts: PASS
• vitest: PASS