Protected Audience (formerly FLEDGE)

[SecureContext]
partial interface Navigator {
  Promise<undefined> joinAdInterestGroup(AuctionAdInterestGroup group);
};

dictionary AuctionAd {
  required USVString renderURL;
  USVString sizeGroup;
  any metadata;

  USVString buyerReportingId;
  USVString buyerAndSellerReportingId;
  sequence<USVString> selectableBuyerAndSellerReportingIds;
  sequence<USVString> allowedReportingOrigins;
  DOMString adRenderId;
  USVString creativeScanningMetadata;
};

dictionary AuctionAdInterestGroupSize {
  required USVString width;
  required USVString height;
};

dictionary GenerateBidInterestGroup {
  required USVString owner;
  required USVString name;

  boolean enableBiddingSignalsPrioritization = false;
  record<DOMString, double> priorityVector;

  record<USVString, sequence<DOMString>> sellerCapabilities;
  DOMString executionMode = "compatibility";
  USVString biddingLogicURL;
  USVString biddingWasmHelperURL;
  USVString updateURL;
  USVString trustedBiddingSignalsURL;
  sequence<USVString> trustedBiddingSignalsKeys;
  DOMString trustedBiddingSignalsSlotSizeMode = "none";
  long maxTrustedBiddingSignalsURLLength;
  USVString trustedBiddingSignalsCoordinator;
  any userBiddingSignals;
  sequence<AuctionAd> ads;
  sequence<AuctionAd> adComponents;
  record<DOMString, AuctionAdInterestGroupSize> adSizes;
  record<DOMString, sequence<DOMString>> sizeGroups;
};

dictionary ProtectedAudiencePrivateAggregationConfig {
  USVString aggregationCoordinatorOrigin;
};

dictionary AuctionAdInterestGroup : GenerateBidInterestGroup {
  double priority = 0.0;
  record<DOMString, double> prioritySignalsOverrides;
  required double lifetimeMs;
  DOMString additionalBidKey;
  ProtectedAudiencePrivateAggregationConfig privateAggregationConfig;
};

The joinAdInterestGroup(group) method steps are:

1. Let global be this’s relevant global object.

2. If global’s associated Document is not allowed to use the "join-ad-interest-group" policy-controlled feature, then throw a "NotAllowedError" DOMException.

3. Let settings be this’s relevant settings object.

4. Assert that settings’s origin is not an opaque origin and its scheme is "https".

5. Let interestGroup be a new interest group.

6. Validate the given group and set interestGroup’s fields accordingly.

   1. Set interestGroup’s expiry to the current coarsened wall time plus group["lifetimeMs"] milliseconds.

   2. Set interestGroup’s next update after to the current coarsened wall time plus 24 hours.

   3. Set interestGroup’s last updated to the current coarsened wall time.

   4. Set interestGroup’s owner to the result of parsing an https origin on group["owner"].

   5. If interestGroup’s owner is failure, then throw a TypeError.

   6. Optionally, throw a "NotAllowedError" DOMException.

      Note: This implementation-defined condition is intended to allow user agents to decline for a number of reasons, for example the owner’s site not being enrolled.

   7. Set interestGroup’s name to group["name"].

   8. Set interestGroup’s priority to group["priority"].

   9. Set interestGroup’s enable bidding signals prioritization to group["enableBiddingSignalsPrioritization"].

   10. If group["priorityVector"] exists, then set interestGroup’s priority vector to group["priorityVector"].

   11. If group["prioritySignalsOverrides"] exists, then set interestGroup’s priority signals overrides to group["prioritySignalsOverrides"].

   12. If group["privateAggregationConfig"] exists:

       1. Let aggregationCoordinator be the result of obtaining the coordinator from a Private Aggregation config given group["privateAggregationConfig"].

       2. If aggregationCoordinator is a DOMException, then throw aggregationCoordinator.

       3. Set interestGroup’s Private Aggregation coordinator to aggregationCoordinator.

   13. If group["sellerCapabilities"] exists, for each sellerString → capabilities of group["sellerCapabilities"]:

       1. Let sellerCapabilities be a new set of seller capabilities.

       2. For each capabilityString of capabilities:

          1. If capabilityString is "interest-group-counts" or "latency-stats", then append capabilityString to sellerCapabilities.

             Note: For forward compatibility with new values, don’t throw.

       3. If sellerString is "*", then set interestGroup’s all sellers capabilities to sellerCapabilities.

       4. Otherwise:

          1. If interestGroup’s seller capabilities is null, then set interestGroup’s seller capabilities to a new ordered map whose keys are origins and whose values are sets of seller capabilities.

          2. Let sellerUrl be the result of running the URL parser on sellerString.

          3. If sellerUrl is not failure:

             1. Let seller be sellerUrl’s origin.

             2. If interestGroup’s seller capabilities does not contain seller, then set interestGroup’s seller capabilities[seller] to sellerCapabilities.

   14. If group["executionMode"] is "compatibility", "frozen-context", or "group-by-origin", then set interestGroup’s execution mode to it.

   15. For each groupMember and interestGroupField in the following table

       Group member	Interest group field
       "biddingLogicURL"	bidding url
       "biddingWasmHelperURL"	bidding wasm helper url
       "updateURL"	update url

       1. If group contains groupMember:

          1. Let parsedUrl be the result of running parse and verify a bidding code or update URL on group[groupMember] and interestGroup’s owner.

          2. If parsedUrl is failure, then throw a TypeError.

          3. Set interestGroup’s interestGroupField to parsedUrl.

   16. If group["trustedBiddingSignalsURL"] exists:

       1. Let parsedUrl be the result of running parse and verify a trusted signals URL on group[trustedBiddingSignalsURL].

       2. If parsedUrl is failure, then throw a TypeError.

       3. Set interestGroup’s trusted bidding signals url to parsedUrl.

   17. If group["trustedBiddingSignalsKeys"] exists, then set interestGroup’s trusted bidding signals keys to group["trustedBiddingSignalsKeys"].

   18. If group["maxTrustedBiddingSignalsURLLength"] exists:

       1. If group["maxTrustedBiddingSignalsURLLength"] ≥ 0, set interestGroup’s max trusted bidding signals url length to group["maxTrustedBiddingSignalsURLLength"], otherwise throw a TypeError.

   19. If group["trustedBiddingSignalsCoordinator"] exists:

       1. Let parsedCoordinator be the result of parsing an https origin on group["trustedBiddingSignalsCoordinator"].

       2. If parsedCoordinator is failure, then throw a TypeError.

       3. Set interestGroup’s trusted bidding signals coordinator to parsedCoordinator.

   20. If group["userBiddingSignals"] exists:

       1. Set interestGroup’s user bidding signals to the result of serializing a JavaScript value to a JSON string, given group["userBiddingSignals"]. This can throw a TypeError.

   21. If group["trustedBiddingSignalsSlotSizeMode"] is one of "none", "slot-size", or "all-slots-requested-sizes", set interestGroup’s trusted bidding signals slot size mode to group["trustedBiddingSignalsSlotSizeMode"].

   22. Let adSizes be a new map whose keys are strings and values are ad sizes.

   23. If group["adSizes"] exists:

       1. For each sizeName → size of group["adSizes"]:

          1. If sizeName is "", throw a TypeError.

          2. Let parsedSize be the result from running parse an AdRender ad size with size.

          3. If parsedSize is null, throw a TypeError.

          4. Set adSizes[sizeName] to parsedSize.

       2. Set interestGroup’s ad sizes to adSizes.

   24. Let sizeGroups be a new map whose keys are strings and values are lists of strings

   25. If group["sizeGroups"] exists:

       1. For each sizeGroupName → sizeList of group["sizeGroups"]:

          1. If sizeGroupName is "", throw a TypeError.

          2. For each sizeName of sizeList:

             1. If sizeName is "" or adSizes[sizeName] does not exist, throw a TypeError.

          3. Set sizeGroups[sizeGroupName] to sizeList.

       2. Set interestGroup’s size groups to sizeGroups.

   26. For each groupMember and interestGroupField in the following table

       Group member	Interest group field
       "ads"	ads
       "adComponents"	ad components

       1. If group contains groupMember, for each ad of group[groupMember]:

          1. Let igAd be a new interest group ad.

          2. Let renderURL be the result of running the URL parser on ad["renderURL"].

          3. Throw a TypeError if any of the following conditions hold:

             • renderURL is failure;

             • renderURL scheme is not "https";

             • renderURL includes credentials.

          4. Set igAd’s render url to renderURL.

          5. If ad["sizeGroup"] exists:

             1. Let sizeGroup be ad["sizeGroup}].

             2. Throw a TypeError if none of the following conditions hold:

                • adSizes[sizeGroup] exists.

                • sizeGroups[sizeGroup] exists.

             3. Set igAd’s size group to sizeGroup.

          6. If ad["metadata"] exists, then let igAd’s metadata be the result of serializing a JavaScript value to a JSON string, given ad["metadata"]. This can throw a TypeError.

          7. If ad["adRenderId"] exists:

             1. If ad["adRenderId"]'s length > 12, throw a TypeError.

             2. If any code point in ad["adRenderId"] is not an ASCII code point, throw a TypeError.

             3. Set igAd’s ad render id to ad["adRenderId"].

          8. If ad["creativeScanningMetadata"] exists, then set igAd’s creative scanning metadata to it.

          9. If groupMember is "ads":

             1. If ad["buyerReportingId"] exists, then set igAd’s buyer reporting ID to it.

             2. If ad["buyerAndSellerReportingId"] exists, then set igAd’s buyer and seller reporting ID to it.

             3. If ad["selectableBuyerAndSellerReportingIds"] exists, then set igAd’s selectable buyer and seller reporting IDs to it.

             4. If ad["allowedReportingOrigins"] exists:

                1. Let allowedReportingOrigins be a new list of origins.

                2. For each originStr in ad["allowedReportingOrigins"]:

                   1. Let origin be the result of parsing an https origin on originStr.

                   2. If origin is failure, then throw a TypeError.

                   3. Append origin to allowedReportingOrigins.

                   4. If allowedReportingOrigins’s size > 10, throw a TypeError.

                3. Set igAd’s allowed reporting origins to allowedReportingOrigins.

          10. Append igAd to interestGroup’s interestGroupField.

   27. If group["additionalBidKey"] exists:

       1. Let decodedKey be the result of running forgiving-base64 decode with group["additionalBidKey"].

       2. Throw a TypeError if any of the following conditions hold:

          • decodedKey is a failure;

          • decodedKey’s length is not 32;

          • group["ads"] exists;

          • group["updateURL"] exists.

       3. Set interestGroup’s additional bid key to decodedKey.

7. If interestGroup’s estimated size > 1048576 bytes, then throw a TypeError.

8. Let p be a new promise.

9. Let queue be the result of starting a new parallel queue.

10. Enqueue the following steps to queue:

    1. Let permission be the result of checking interest group permissions with interestGroup’s owner, settings, and "join".

    2. If permission is false, then queue a global task on DOM manipulation task source, given global, to reject p with a "NotAllowedError" DOMException and abort these steps.

    3. Queue a global task on DOM manipulation task source, given global, to resolve p with undefined.

    4. If the browser is currently storing an interest group with owner and name that matches interestGroup, then set the bid counts, join counts, and previous wins of interestGroup to the values of the currently stored one and remove the currently stored one from the browser.

    5. Set interestGroup’s joining origin to this’s relevant settings object’s top-level origin.

    6. Set interestGroup’s join time to the current coarsened wall time.

    7. If the most recent entry in interestGroup’s join counts corresponds to the current day in UTC, increment its count. If not, insert a new tuple the time set to the current UTC day and a count of 1.

    8. Store interestGroup in the user agent’s interest group set.

    9. Run update k-anonymity cache for interest group for interestGroup.

11. Return p.

To perform storage maintenance:

1. Let ownersAndExpiry be a new ordered map whose keys are origins and values are moments.

   Note: The key is from owner, and value is from expiry. It’s used to determine a set of owners whose interest groups will be removed from the user agent’s interest group set because the number of distinct owners exceeds the Interest group set max owners limit. It’s sorted based on their values (expiry) in descending order, in order to remove interest groups of owners expiring soonest first.

2. Let now be the current coarsened wall time.

3. For each ig of the user agent’s interest group set:

   1. Let owner be ig’s owner.

   2. If ig’s expiry is before now, then remove ig from the user agent’s interest group set and continue.

   3. If ownersAndExpiry[owner] exists, then set ownersAndExpiry[owner] to ig’s expiry if it comes after ownersAndExpiry[owner].

   4. Otherwise, set ownersAndExpiry[owner] to ig’s expiry.

4. If ownersAndExpiry’s size > interest group set max owners, then set ownersAndExpiry to ownersAndExpiry sorted in descending order with a being less than b if a’s value comes before b’s value, where values are expiry.

5. Let owners be the keys of ownersAndExpiry.

6. For each i in the range from 0 to owners’s size, exclusive:

   1. If i ≥ interest group set max owners, then remove interest groups from the user agent’s interest group set whose owner is owners[i], and continue.

   2. Let regularIgs be a list of regular interest groups in the user agent’s interest group set whose owner is owners[i].

   3. If regularIgs’s size > max regular interest groups per owner, then clear excess interest groups with regularIgs and max regular interest groups per owner.

   4. Let negativeIgs be a list of negative interest groups in the user agent’s interest group set whose owner is owners[i].

   5. If negativeIgs’s size > max negative interest groups per owner, then clear excess interest groups with negativeIgs and max negative interest groups per owner.

7. For each owner of owners:

   1. Let igs be a list of interest groups in the user agent’s interest group set whose owner is owner, sorted in descending order with a being less than b if a’s expiry comes before b’s expiry.

   2. Let cumulativeSize be 0.

   3. For each ig of igs:

      1. If the sum of cumulativeSize and ig’s estimated size > max interest groups total size per owner, then remove ig from the user agent’s interest group set.

      2. Otherwise, increment cumulativeSize by ig’s estimated size.

To clear excess interest groups with a list of interest groups igs, and an integer maxIgs:

1. Let sortedIgs be igs sorted in descending order with a being less than b if a’s expiry comes before b’s expiry.

   Note: In order to remove interest groups expiring soonest first, sort interest groups based on their expiry in descending order.

2. For each i in the range from maxIgs to igs’s size, exclusive:

   1. Remove sortedIgs[i] from the user agent’s interest group set.

[SecureContext]
partial interface Navigator {
  Promise<undefined> leaveAdInterestGroup(optional AuctionAdInterestGroupKey group = {});
};

dictionary AuctionAdInterestGroupKey {
  required USVString owner;
  required USVString name;
};

The leaveAdInterestGroup(group) method steps are:

1. Let global be this’s relevant global object.

2. Let settings be this’s relevant settings object.

3. Let frameOrigin be settings’s origin.

4. Assert that frameOrigin is not an opaque origin and its scheme is "https".

5. Let p be a new promise.

6. If group is empty:

   1. Let instance be global’s browsing context’s fenced frame config instance.

   2. If instance is null, then return.

   3. Let interestGroup be instance’s interest group descriptor.

   4. Run these steps in parallel:

      1. Queue a global task on DOM manipulation task source, given global, to resolve p with undefined.

      2. If interestGroup is not null:

         1. Let owner be interestGroup’s owner.

         2. If owner is same origin with frameOrigin, then remove interest groups from the user agent’s interest group set whose owner is owner and name is interestGroup’s name.

7. Otherwise:

   1. If global’s associated Document is not allowed to use the "join-ad-interest-group" policy-controlled feature, then throw a "NotAllowedError" DOMException.

      Note: Both joining and leaving interest groups use the "join-ad-interest-group" feature.

   2. Let owner be the result of parsing an https origin with group["owner"].

   3. If owner is failure, throw a TypeError.

   4. Run these steps in parallel:

      1. Let permission be the result of checking interest group permissions with owner, settings, and "leave".

      2. If permission is false, then queue a global task on DOM manipulation task source, given global, to reject p with a "NotAllowedError" DOMException and abort these steps.

      3. Queue a global task on DOM manipulation task source, given global, to resolve p with undefined.

      4. Remove interest groups from the user agent’s interest group set whose owner is owner and name is group["name"].

8. Return p.

[SecureContext]
partial interface Navigator {
  Promise<undefined> clearOriginJoinedAdInterestGroups(
      USVString owner, optional sequence<USVString> interestGroupsToKeep = []);
};

The clearOriginJoinedAdInterestGroups(owner, interestGroupsToKeep) method steps are:

1. Let settings be this’s relevant settings object.

2. Let frameOrigin be settings’s origin.

3. Assert that frameOrigin is not an opaque origin and its scheme is "https".

4. Let p be a new promise.

5. Let global be this’s relevant global object.

6. If global’s associated Document is not allowed to use the "join-ad-interest-group" policy-controlled feature, then throw a "NotAllowedError" DOMException.

   Note: Both joining and leaving interest groups use the "join-ad-interest-group" feature.

7. Let ownerOrigin be the result of parsing an https origin with owner.

8. If ownerOrigin is failure, throw a TypeError.

9. Run these steps in parallel:

   1. Let permission be the result of checking interest group permissions with ownerOrigin, settings, and "leave".

   2. If permission is false, then queue a global task on the DOM manipulation task source given global, reject p with a "NotAllowedError" DOMException and abort these steps.

   3. Queue a global task on the DOM manipulation task source given global, to resolve p with undefined.

   4. Remove interest groups from the user agent’s interest group set whose owner is ownerOrigin, whose joining origin is frameOrigin, and whose name is not in interestGroupsToKeep.

10. Return p.

[SecureContext]
partial interface Navigator {
  Promise<(USVString or FencedFrameConfig)?> runAdAuction(AuctionAdConfig config);
  readonly attribute boolean deprecatedRunAdAuctionEnforcesKAnonymity;
};

dictionary AuctionReportBuyersConfig {
  required bigint bucket;
  required double scale;
};

dictionary AuctionReportBuyerDebugModeConfig {
  boolean enabled = false;

  // Must only be provided if `enabled` is true.
  bigint? debugKey;
};

dictionary AuctionRealTimeReportingConfig {
  required DOMString type;
};

dictionary AuctionAdConfig {
  required USVString seller;
  required USVString decisionLogicURL;

  USVString trustedScoringSignalsURL;
  long maxTrustedScoringSignalsURLLength;
  USVString trustedScoringSignalsCoordinator;
  boolean sendCreativeScanningMetadata;
  sequence<USVString> interestGroupBuyers;
  Promise<any> auctionSignals;
  Promise<any> sellerSignals;
  Promise<DOMString?> directFromSellerSignalsHeaderAdSlot;
  Promise<record<USVString, USVString>?> deprecatedRenderURLReplacements;
  unsigned long long sellerTimeout;
  unsigned short sellerExperimentGroupId;
  Promise<record<USVString, any>?> perBuyerSignals;
  Promise<record<USVString, unsigned long long>?> perBuyerTimeouts;
  Promise<record<USVString, unsigned long long>?> perBuyerCumulativeTimeouts;
  unsigned long long reportingTimeout;
  USVString sellerCurrency;
  Promise<record<USVString, USVString>?> perBuyerCurrencies;
  record<USVString, unsigned short> perBuyerMultiBidLimits;
  record<USVString, unsigned short> perBuyerGroupLimits;
  record<USVString, unsigned short> perBuyerExperimentGroupIds;
  record<USVString, record<USVString, double>> perBuyerPrioritySignals;

  sequence<bigint> auctionReportBuyerKeys;
  record<DOMString, AuctionReportBuyersConfig> auctionReportBuyers;
  AuctionReportBuyerDebugModeConfig auctionReportBuyerDebugModeConfig;
  sequence<DOMString> requiredSellerCapabilities;
  ProtectedAudiencePrivateAggregationConfig privateAggregationConfig;

  record<DOMString, DOMString> requestedSize;
  sequence<record<DOMString, DOMString>> allSlotsRequestedSizes;
  Promise<undefined> additionalBids;
  DOMString auctionNonce;
  AuctionRealTimeReportingConfig sellerRealTimeReportingConfig;
  record<USVString, AuctionRealTimeReportingConfig> perBuyerRealTimeReportingConfig;
  sequence<AuctionAdConfig> componentAuctions = [];
  AbortSignal? signal;
  Promise<boolean> resolveToConfig;

  Promise<Uint8Array> serverResponse;
  USVString requestId;
};

The runAdAuction(config) method steps are:

1. Let global be this’s relevant global object.

2. Let settings be this’s relevant settings object.

3. If global’s associated Document is not allowed to use the "run-ad-auction" policy-controlled feature, then throw a "NotAllowedError" DOMException.

4. Let privateAggregationAllowed be the result of determining whether global’s associated Document is allowed to use the "private-aggregation" policy-controlled feature.

5. Let auctionConfig be the result of running validate and convert auction ad config with config and true.

6. If auctionConfig is failure, then throw a TypeError.

7. Optionally, throw a "NotAllowedError" DOMException.

   Note: This implementation-defined condition is intended to allow user agents to decline for a number of reasons, for example the seller’s site not being enrolled.

8. Let p be a new promise.

9. Let configMapping be global’s associated Document’s node navigable’s traversable navigable’s fenced frame config mapping.

10. Let pendingConfig be the result of constructing a pending fenced frame config with auctionConfig.

11. Let urn be the result of running store a pending config on configMapping with pendingConfig.

12. If urn is failure, then resolve p with null and return p.

13. Let bidIgs be a new list of interest groups.

14. If config["signal"] exists, then:

    1. Let signal be config["signal"].

    2. If signal is aborted, then reject p with signal’s abort reason and return p.

    3. Otherwise add the following abort steps to signal:

       1. Set auctionConfig’s aborted to true.

       2. Set auctionConfig’s abort reason to signal’s abort reason.

       3. For each auction in auctionConfig’s component auctions:

          1. Set auction’s aborted to true.

15. Assert that settings’s origin is not an opaque origin and its scheme is "https".

16. Let queue be the result of starting a new parallel queue.

17. Enqueue the following steps to queue:

    1. Let reportingContextMap be the result of creating a reporting context map given auctionConfig and privateAggregationAllowed.

    2. If auctionConfig’s server response is not null:

       1. Let winnerInfo be the result of running parse and validate server response with auctionConfig, null, global, bidIgs, and reportingContextMap.

    3. Otherwise:

       1. Let realTimeContributionsMap be a new real time reporting contributions map.

       2. Let winnerInfo be the result of running generate and score bids with auctionConfig, null, global, bidIgs, reportingContextMap, and realTimeContributionsMap.

    4. Let auctionReportInfo be a new auction report info.

    5. If winnerInfo is not failure, then:

       1. Set auctionReportInfo to the result of running collect forDebuggingOnly reports with reportingContextMap, auctionConfig’s seller, and winnerInfo.

       2. Set auctionReportInfo’s real time reporting contributions map to realTimeContributionsMap.

    6. If auctionConfig’s aborted is true:

       1. Queue a global task on the DOM manipulation task source, given global, to reject p with auctionConfig’s abort reason.

    7. Otherwise if winnerInfo is failure, then queue a global task on DOM manipulation task source, given global, to reject p with a "TypeError".

    8. Otherwise if winnerInfo is null or winnerInfo’s leading bid is null:

       1. Queue a global task on DOM manipulation task source, given global, to resolve p with null.

       2. For each reportUrl of auctionReportInfo’s debug loss report urls:

          1. Send report with reportUrl and settings.

       3. Send real time reports with auctionReportInfo’s real time reporting contributions map and settings.

       4. Process the Private Aggregation contributions given auctionConfig, reportingContextMap.

    9. Otherwise:

       1. Let winner be winnerInfo’s leading bid.

       2. Let fencedFrameConfig be the result of filling in a pending fenced frame config with pendingConfig, auctionConfig, reportingContextMap, winnerInfo, auctionReportInfo, and settings.

       3. Finalize a pending config on configMapping with urn and fencedFrameConfig.

       4. Wait until auctionConfig’s resolve to config is a boolean.

       5. Let result be fencedFrameConfig.

       6. If auctionConfig’s resolve to config is false, then set result to urn.

       7. Queue a global task on the DOM manipulation task source, given global, to resolve p with result.

       8. Run update previous wins with winner.

    10. Run interest group update with auctionConfig’s interest group buyers and settings’s policy container.

    11. Run update bid counts with bidIgs.

18. Return p.

To construct a pending fenced frame config given an auction config config:

1. Return a fenced frame config with the following items:

   mapped url

   a struct with the following items:

   value

   "about:blank"

   visibility

   "opaque"

   container size

   the result of

   converting config’s requested size to pixel values (WICG/turtledove#986)

   content size

   null

   interest group descriptor

   a struct with the following items:

   value

   a struct with the following items:

   owner

   ""

   name

   ""

   visibility

   "opaque"

   on navigate callback

   null

   effective sandboxing flags

   a struct with the following items:

   value

   TODO: fill this in once fenced frame sandbox flags are more fully specified

   visibility

   "opaque"

   effective enabled permissions

   a struct with the following items:

   value

   «"attribution-reporting", "private-aggregation", "shared-storage", "shared-storage-select-url"»

   visibility

   "opaque"

   fenced frame reporting metadata

   null

   exfiltration budget metadata

   null

   nested configs

   a struct with the following items:

   value

   an empty list «»

   visibility

   "opaque"

   embedder shared storage context

   null

To fill in a pending fenced frame config given a fenced frame config pendingConfig, auction config auctionConfig, reporting context map reportingContextMap, leading bid info winningBidInfo, auction report info auctionReportInfo, and an environment settings object settings:

1. Let winningBid be winningBidInfo’s leading bid.

2. Let replacements be an ordered map whose keys are strings and whose values are strings.

3. For each replacement in auctionConfig’s deprecated render url replacements:

   1. Let k be replacement’s match.

   2. Let v be replacement’s replacement.

   3. Set replacements[k] to v.

4. Let replacedAdURL be the result of running substitute macros with replacements and winningBid’s ad descriptor’s url.

5. Set pendingConfig’s mapped url’s value to replacedAdURL.

6. Let adSize be winningBid’s ad descriptor’s size.

7. Let concreteAdSize be the result of

   resolving screen-relative sizes to pixel values for adSize. (WICG/turtledove#986)

8. Let adWidthString and adHeightString be the result of

   converting concreteAdSize to strings. (WICG/turtledove#986)

9. Let sizeMacroMap be the ordered map «[ "{%AD_WIDTH%}" → adWidthString, "{%AD_HEIGHT%}" → adHeightString, "${AD_WIDTH}" → adWidthString, "${AD_HEIGHT}" → adHeightString]»

10. Set pendingConfig’s mapped url’s value to the result of substituting macros with sizeMacroMap into winningBid’s ad descriptor’s url.

11. If adSize is not null:

    1. Set pendingConfig’s content size to a struct with the following items:

       value

       concreteAdSize.

       Cast concreteAdSize into the format that is eventually chosen for value. (WICG/turtledove#986)

       visibility

       "opaque"

12. Set pendingConfig’s interest group descriptor’s value to a struct with the following items:

    owner

    winningBid’s interest group’s owner

    name

    winningBid’s interest group’s name

13. Let fencedFrameReportingMap be the map «[ "buyer" → «», "seller" → «» ]».

14. If auctionConfig’s component auctions is empty, then set fencedFrameReportingMap["component-seller"] to an empty list «».

15. Set pendingConfig’s fenced frame reporting metadata to a struct with the following items:

    value

    A struct with the following items:

    fenced frame reporting map

    fencedFrameReportingMap

    direct seller is seller

    true if auctionConfig’s component auctions is empty, false otherwise

    allowed reporting origins

    winningBid’s bid ad’s allowed reporting origins

    visibility

    "opaque"

16. Set pendingConfig’s on navigate callback to an algorithm with these steps:

    1. Asynchronously finish reporting with pendingConfig’s fenced frame reporting metadata’s value’s fenced frame reporting map, auctionConfig, reportingContextMap, winningBidInfo, auctionReportInfo and settings.

17. Let adComponentDescriptorsWithReplacements be a new list of ad descriptors.

18. If winningBid’s ad component descriptors is not null:

    1. For each adComponentDescriptor of winningBid’s ad component descriptors:

       1. Let descriptorWithReplacement be a new ad descriptor.

       2. Set descriptorWithReplacement’s size to adComponentDescriptor’s size.

       3. Set descriptorWithReplacement’s url to the result of running substitute macros with replacements and adComponentDescriptor’s url.

       4. Append descriptorWithReplacement to adComponentDescriptorsWithReplacements.

19. Set pendingConfig’s nested configs’s value to the result of running create nested configs with adComponentDescriptorsWithReplacements.

20. Return pendingConfig.

To asynchronously finish reporting given a fenced frame reporting map reportingMap, auction config auctionConfig, reporting context map reportingContextMap, leading bid info leadingBidInfo, auction report info auctionReportInfo, and an environment settings object settings:

1. Increment a winning bid’s k-anonymity count given leadingBidInfo’s leading bid.

2. If leadingBidInfo’s leading non-k-anon-enforced bid is not null, and leadingBidInfo’s leading non-k-anon-enforced bid’s reporting id ≠ leadingBidInfo’s leading bid’s reporting id, increment a winning bid’s k-anonymity count given leadingBidInfo’s leading non-k-anon-enforced bid.

3. Let buyerDone, sellerDone, and componentSellerDone be booleans, initially false.

4. If leadingBidInfo’s component seller is null, set componentSellerDone to true.

5. While:

   1. If buyerDone, sellerDone, and componentSellerDone are all true, then break.

   2. Wait until one of the following fields of leadingBidInfo being not null:

      • buyer reporting result;

      • seller reporting result;

      • component seller reporting result.

   3. If buyerDone is false and leadingBidInfo’s buyer reporting result is not null:

      1. Let buyerMap be leadingBidInfo’s buyer reporting result’s reporting beacon map.

      2. If buyerMap is null, set buyerMap to an empty map «[]».

      3. Let macroMap be leadingBidInfo’s buyer reporting result’s reporting macro map.

      4. Finalize a reporting destination with reportingMap, buyer, buyerMap, and macroMap.

      5. Send report with leadingBidInfo’s buyer reporting result’s report url and settings.

      6. Set buyerDone to true.

   4. If sellerDone is false and leadingBidInfo’s seller reporting result is not null:

      1. Let sellerMap be leadingBidInfo’s seller reporting result’s reporting beacon map.

      2. If sellerMap is null, set sellerMap to an empty map «[]».

      3. Finalize a reporting destination with reportingMap, seller, and sellerMap.

      4. Send report with leadingBidInfo’s seller reporting result’s report url and settings.

      5. Set sellerDone to true.

   5. If componentSellerDone is false and leadingBidInfo’s component seller reporting result is not null:

      1. Let componentSellerMap be leadingBidInfo’s component seller reporting result’s reporting beacon map.

      2. If componentSellerMap is null, set componentSellerMap to an empty map «[]».

      3. Finalize a reporting destination with reportingMap, component-seller, and componentSellerMap.

      4. Send report with leadingBidInfo’s component seller reporting result’s report url and settings.

      5. Set componentSellerDone to true.

6. For each reportUrl of auctionReportInfo’s debug win report urls:

   1. Send report with report and settings.

7. For each reportUrl of auctionReportInfo’s debug loss report urls:

   1. Send report with report and settings.

8. Send real time reports with auctionReportInfo’s real time reporting contributions map and settings.

9. Process the Private Aggregation contributions given auctionConfig, reportingContextMap.

To create nested configs given ad component descriptors adComponentDescriptors:

1. Let nestedConfigs be an empty list «».

2. If adComponentDescriptors is null:

   1. Return nestedConfigs.

3. For each adComponentDescriptor of adComponentDescriptors:

   1. Let fencedFrameConfig be a fenced frame config with the following items:

      mapped url

      a struct with the following items:

      value

      adComponentDescriptor’s url

      visibility

      "opaque"

      container size

      null

      content size

      If adComponentDescriptor’s size is null, then null. Otherwise, a struct with the following items:

      value

      adComponentDescriptor’s size TODO: Resolve screen-relative sizes and macros and cast this properly.

      visibility

      "opaque"

      interest group descriptor

      null

      on navigate callback

      null

      effective sandboxing flags

      a struct with the following items:

      value

      TODO: fill this in once fenced frame sandbox flags are more fully specified

      visibility

      "opaque"

      effective enabled permissions

      a struct with the following items:

      value

      «"attribution-reporting", "private-aggregation", "shared-storage", "shared-storage-select-url"»

      visibility

      "opaque"

      fenced frame reporting metadata

      null

      exfiltration budget metadata

      null

      nested configs

      a struct with the following items:

      value

      an empty list «»

      visibility

      "opaque"

      embedder shared storage context

      null

   2. Append fencedFrameConfig to nestedConfigs.

4. Return nestedConfigs.

To validate and convert auction ad config given an AuctionAdConfig config and a boolean isTopLevel:

1. Assert that these steps are not running in parallel.

2. Let auctionConfig be a new auction config.

3. Let seller be the result of parsing an https origin with config["seller"].

4. If seller is failure, then return failure.

5. Set auctionConfig’s seller to seller.

6. If config["serverResponse"] exists:

   1. If config["requestId"] does not exist, then throw a TypeError.

   2. Let resolvedAndTypeChecked be the promise representing performing the following steps upon fulfillment of config["serverResponse"] with result:

      1. Set auctionConfig’s server response to the transferred result.

      2. Set auctionConfig’s server response id to config["requestId"].

   3. Upon rejection of resolvedAndTypeChecked:

      1. Set auctionConfig’s server response to failure.

   Note: The JavaScript code calling runAdAuction() is responsible for not resolving config["serverResponse"] until server responses have been retrieved from one or more `Ad-Auction-Result` and `Ad-Auction-Result-Nonce` headers, as resolving this Promise early would cause a race condition in which the script runners might run without the server responses that it needs. There are two ways that server responses can be retrieved.
   (1) The JavaScript code issues a request whose initiator type is "fetch" and whose adAuctionHeaders option is set to true. The JavaScript code has to resolve config["serverResponse"] after the corresponding call to fetch() has resolved to a response. The JavaScript code can also choose to wait to call runAdAuction() until after the corresponding call to fetch() has resolved to a response, and can then immediately resolve config["serverResponse"];
   (2) issue an iframe navigation request with the adauctionheaders content attribute set to true. In this case, the JavaScript code is retrieved as part of the iframe navigation response, at which point the JavaScript code in the iframe makes the call to runAdAuction(), and config["serverResponse"] can be specified directly without a Promise.

7. Otherwise:

   1. If config["requestId"] exists, then throw a TypeError.

   2. If config["decisionLogicURL"] does not exist, then throw a TypeError.

8. If config["decisionLogicURL"] exists:

   1. Let decisionLogicURL be the result of running the URL parser on config["decisionLogicURL"].

   2. If decisionLogicURL is failure, or it is not same origin with auctionConfig’s seller, then return failure.

   3. Set auctionConfig’s decision logic url to decisionLogicURL.

9. If config["trustedScoringSignalsURL"] exists:

   1. Let trustedScoringSignalsURL be the result of parse and verify a trusted signals URL on config["trustedScoringSignalsURL"].

   2. If trustedScoringSignalsURL is failure, return failure.

   3. Set auctionConfig’s trusted scoring signals url to trustedScoringSignalsURL.

10. If config["maxTrustedScoringSignalsURLLength"] exists:

    1. If config["maxTrustedScoringSignalsURLLength"] ≥ 0, set auctionConfig’s max trusted scoring signals url length to config["maxTrustedScoringSignalsURLLength"], otherwise throw a TypeError.

11. If config["trustedScoringSignalsCoordinator"] exists:

    1. Let parsedCoordinator be the result of parsing an https origin on config["trustedScoringSignalsCoordinator"].

    2. If parsedCoordinator is failure, then throw a TypeError.

    3. Set auctionConfig’s trusted scoring signals coordinator to parsedCoordinator.

12. If config["sendCreativeScanningMetadata"] exists:

    1. Set auctionConfig’s send creative scanning metadata to config["sendCreativeScanningMetadata"].

13. If config["interestGroupBuyers"] exists:

    1. Let buyers be a new empty list.

    2. For each buyerString in config["interestGroupBuyers"]:

       1. Let buyer be the result of parsing an https origin with buyerString.

       2. If buyer is failure, then return failure.

       3. Append buyer to buyers.

    3. Set auctionConfig’s interest group buyers to buyers.

14. If config["auctionSignals"] exists:

    1. Set auctionConfig’s auction signals to config["auctionSignals"].

    2. Handle an input promise in configuration given auctionConfig and auctionConfig’s auction signals:

       • To parse the value result:

         1. If result is undefined or null, set auctionConfig’s auction signals to null.

         2. Otherwise, set auctionConfig’s auction signals to the result of serializing a JavaScript value to a JSON string given result.

       • To handle an error, set auctionConfig’s auction signals to failure.

15. If config["requestedSize"] exists:

    1. Let adSize be the result from running parse an AdRender ad size with config["requestedSize"]

    2. If adSize is null, throw a TypeError.

    3. Set auctionConfig’s requested size to adSize.

16. If config["allSlotsRequestedSizes"] exists:

    1. If config["allSlotsRequestedSizes"] is empty, throw a TypeError.

    2. Set auctionConfig’s all slots requested sizes to a new set.

    3. For each adSizeValue in config["allSlotsRequestedSizes"]:

       1. Let adSize be the result of running parse an AdRender ad size with adSizeValue.

       2. If adSize is null, throw a TypeError.

       3. If auctionConfig’s all slots requested sizes contains adSize, throw a TypeError.

       4. Append adSize to auctionConfig’s all slots requested sizes.

    4. If auctionConfig’s requested size is not null, and auctionConfig’s all slots requested sizes does not contain auctionConfig’s requested size, throw a TypeError.

17. If config["sellerSignals"] exists:

    1. Set auctionConfig’s seller signals to config["sellerSignals"].

    2. Handle an input promise in configuration given auctionConfig and auctionConfig’s seller signals:

       • To parse the value result:

         1. If result is undefined or null, set auctionConfig’s seller signals to null.

         2. Otherwise, set auctionConfig’s seller signals to the result of serializing a JavaScript value to a JSON string, given result.

       • To handle an error, set auctionConfig’s seller signals to failure.

18. If config["auctionNonce"] exists, then set auctionConfig’s auction nonce to the result of running get uuid from string with config["auctionNonce"].

19. If config["additionalBids"] exists:

    1. Throw a TypeError if any of the following conditions hold:

       • config["auctionNonce"] does not exist;

       • config["interestGroupBuyers"] does not exist, or is empty;

       • config["componentAuctions"] is not empty.

    2. Set auctionConfig’s expects additional bids to true.

    3. Handle an input promise in configuration given auctionConfig and config["additionalBids"]:

       Note: The JavaScript code calling runAdAuction() is responsible for not resolving config["additionalBids"] until additional bids have been retrieved from one or more `Ad-Auction-Additional-Bid` headers, as resolving this Promise early would cause a race condition in which additional bids might not be included in the auction. There are two ways that additional bids can be retrieved.
       (1) The JavaScript code issues a request whose initiator type is "fetch" and whose adAuctionHeaders option is set to true. The JavaScript code has to resolve config["additionalBids"] after the corresponding call to fetch() has resolved to a response. The JavaScript code can also choose to wait to call runAdAuction() until after the corresponding call to fetch() has resolved to a response, and can then immediately resolve config["additionalBids"];
       (2) issue an iframe navigation request with the adauctionheaders content attribute set to true. In this case, the JavaScript code is retrieved as part of the iframe navigation response, at which point the JavaScript code in the iframe makes the call to runAdAuction(), and config["additionalBids"] can be immediately resolved.

       • To parse the value result:

         1. Set auctionConfig’s expects additional bids to false.

       • To handle an error:

         1. Set auctionConfig’s expects additional bids to failure.

20. If config["directFromSellerSignalsHeaderAdSlot"] exists:

    1. Handle an input promise in configuration given auctionConfig and config["directFromSellerSignalsHeaderAdSlot"]:

       Note: The JavaScript code calling runAdAuction() is responsible for not resolving config["directFromSellerSignalsHeaderAdSlot"] until direct from seller signals have been retrieved from one or more `Ad-Auction-Signals` headers, as resolving this Promise early would cause a race condition in which the script runners might run without the direct from seller signals that it needs. There are two ways that direct from seller signals can be retrieved.
       (1) The JavaScript code issues a request whose initiator type is "fetch" and whose adAuctionHeaders option is set to true. The JavaScript code has to resolve config["directFromSellerSignalsHeaderAdSlot"] after the corresponding call to fetch() has resolved to a response. The JavaScript code can also choose to wait to call runAdAuction() until after the corresponding call to fetch() has resolved to a response, and can then immediately resolve config["directFromSellerSignalsHeaderAdSlot"];
       (2) issue an iframe navigation request with the adauctionheaders content attribute set to true. In this case, the JavaScript code is retrieved as part of the iframe navigation response, at which point the JavaScript code in the iframe makes the call to runAdAuction(), and config["directFromSellerSignalsHeaderAdSlot"] can be specified directly without a Promise.

       • To parse the value result:

         1. Set auctionConfig’s direct from seller signals header ad slot to result.

       • To handle an error:

         1. Set auctionConfig’s direct from seller signals header ad slot to failure.

21. If config["deprecatedRenderURLReplacements"] exists:

    1. Set auctionConfig’s deprecated render url replacements to config["deprecatedRenderURLReplacements"].

    2. Handle an input promise in configuration given auctionConfig and auctionConfig’s deprecated render url replacements:

       • To parse the value result:

         1. Let renderUrlReplacements be a new empty list of ad keyword replacements.

         2. If result is not null:

            1. For each replacement in result:

               1. If validate a url macro with replacement’s match returns false, then throw a TypeError.

               2. Otherwise, append replacement to renderUrlReplacements.

         3. Set auctionConfig’s deprecated render url replacements to renderUrlReplacements.

       • To handle an error, set auctionConfig’s deprecated render url replacements to failure.

22. If config["sellerTimeout"] exists, set auctionConfig’s seller timeout to config["sellerTimeout"] in milliseconds or 500, whichever is smaller.

23. Let reportingTimeout be config["reportingTimeout"] if it exists, 50 otherwise.

24. Set config["reportingTimeout"] to reportingTimeout in milliseconds or 5000, whichever is smaller.

25. If config["sellerExperimentGroupId"] exists, then set auctionConfig’s seller experiment group id to config["sellerExperimentGroupId"].

26. If config["sellerCurrency"] exists:

    1. If the result of checking whether a string is a valid currency tag on config["sellerCurrency"] is false, then return failure.

    2. Set auctionConfig’s seller currency to config["sellerCurrency"].

27. If config["perBuyerSignals"] exists:

    1. Set auctionConfig’s per buyer signals to config["perBuyerSignals"].

    2. Handle an input promise in configuration given auctionConfig and auctionConfig’s per buyer signals:

       • To parse the value result:

         1. If result is null:

            1. Set auctionConfig’s per buyer signals to null.

         2. Otherwise:

            1. Set auctionConfig’s per buyer signals to a new ordered map whose keys are origins and whose values are strings.

            2. For each key → value of result:

               1. Let buyer be the result of parsing an https origin with key. If buyer is failure, throw a TypeError.

               2. Let signalsString be the result of serializing a JavaScript value to a JSON string, given value.

               3. Set auctionConfig’s per buyer signals[buyer] to signalsString.

       • To handle an error, set auctionConfig’s per buyer signals to failure.

28. For each idlTimeoutMember, perBuyerTimeoutField, allBuyersTimeoutField in the following table

    IDL timeout member	Per buyer timeout field	All buyers timeout field
    "perBuyerTimeouts"	per buyer timeouts	all buyers timeout
    "perBuyerCumulativeTimeouts"	per buyer cumulative timeouts	all buyers cumulative timeout

    1. If config contains idlTimeoutMember:

       1. Set auctionConfig’s perBuyerTimeoutField to config[idlTimeoutMember].

       2. Handle an input promise in configuration given auctionConfig and auctionConfig’s perBuyerTimeoutField:

          • To parse the value result:

            1. If result is null:

               1. Set auctionConfig’s perBuyerTimeoutField to null.

            2. Otherwise:

               1. Set auctionConfig’s perBuyerTimeoutField to a new ordered map whose keys are origins and whose values are durations in milliseconds.

               2. For each key → value of result:

                  1. If perBuyerTimeoutField is "perBuyerTimeouts", and value > 500, then set value to 500.

                  2. If key is "*", then set auctionConfig’s allBuyersTimeoutField to value in milliseconds, and continue.

                  3. Let buyer be the result of parsing an https origin with key. If buyer is failure, throw a TypeError.

                  4. Set auctionConfig’s perBuyerTimeoutField[buyer] to value in milliseconds.

          • To handle an error, set auctionConfig’s perBuyerTimeoutField to failure.

29. If config["perBuyerGroupLimits"] exists, for each key → value of config["perBuyerGroupLimits"]:

    1. If value is 0, then return failure.

    2. If key is "*", then set auctionConfig’s all buyers group limit to value, and continue.

    3. Let buyer be the result of parsing an https origin with key.

    4. If buyer is failure, then return failure.

    5. Set auctionConfig’s per buyer group limits[buyer] to value.

30. If config["perBuyerExperimentGroupIds"] exists, for each key → value of config["perBuyerExperimentGroupIds"]:

    1. If key is "*", then set auctionConfig’s all buyer experiment group id to value, and continue.

    2. Let buyer the result of parsing an https origin with key.

    3. If buyer is failure, then return failure.

    4. Set auctionConfig’s per buyer experiment group ids[buyer] to value.

31. If config["perBuyerMultiBidLimits"] exists, for each key → value of config["perBuyerMultiBidLimits"]:

    1. If key is "*", then set auctionConfig’s all buyers multi-bid limit to value, and continue.

    2. Let buyer the result of parsing an https origin with key.

    3. If buyer is failure, then return failure.

    4. Set auctionConfig’s per buyer multi-bid limits[buyer] to value.

32. If config["perBuyerPrioritySignals"] exists, for each key → value of config["perBuyerPrioritySignals"]:

    1. Let signals be an ordered map whose keys are strings and whose values are double.

    2. for each k → v of value:

       1. If k starts with "browserSignals.", throw a TypeError.

       2. Set signals[k] to v.

    3. If key is "*", then set auctionConfig’s all buyers priority signals to value, and continue.

    4. Let buyer be the result of parsing an https origin with key.

    5. If buyer is failure, then return failure.

    6. Set auctionConfig’s per buyer priority signals[buyer] to signals.

33. If config["auctionReportBuyerKeys"] exists:

    1. Let interestGroupBuyers be auctionConfig’s interest group buyers.

    2. If interestGroupBuyers is null, set interestGroupBuyers to a new list.

    3. For each index of the range 0 to config[ "auctionReportBuyerKeys"]'s size, exclusive:

       1. Let key be config["auctionReportBuyerKeys"][index].

       2. If key is not contained in the range 0 to 2¹²⁸, exclusive, throw a TypeError.

       3. If index ≥ interestGroupBuyers’ size, continue.

          Note: Continue is used (instead of break) to validate all given buyer keys.

       4. Let origin be interestGroupBuyers[index].

       5. Set auctionConfig’s auction report buyer keys[origin] to key.

       Check behavior when an origin is repeated in interestGroupBuyers.

34. If config["auctionReportBuyers"] exists:

    1. For each reportType → reportBuyerConfig of config[ "auctionReportBuyers"]:

       1. If « "interestGroupCount", "bidCount", "totalGenerateBidLatency", "totalSignalsFetchLatency" » does not contain reportType, continue.

          Note: No error is thrown to allow forward compatibility if additional report types are added later.

          Should these strings be dash delimited?

       2. If reportBuyerConfig["bucket"] is not contained in the range 0 to 2¹²⁸, exclusive, throw a TypeError.

          Consider validating the case where the bucket used (after summing) is too large. Currently, the implementation appears to overflow. (WICG/turtledove#1040)

       3. Set auctionConfig’s auction report buyers[reportType] to reportBuyerConfig.

35. If config["auctionReportBuyerDebugModeConfig"] exists:

    1. Let debugModeConfig be config["auctionReportBuyerDebugModeConfig"].

    2. Let enabled be debugModeConfig["enabled"].

    3. Let debugKey be debugModeConfig["debugKey"].

    4. If debugKey is not null:

       1. If debugKey is not contained in the range 0 to 2⁶⁴, exclusive, throw a TypeError.

       2. If enabled is false, throw a TypeError.

    5. Set auctionConfig’s auction report buyer debug details to a new debug details with the items:

       enabled

       enabled

       key

       debugKey

36. If config["requiredSellerCapabilities"] exists:

    1. Let sellerCapabilities be a new set of seller capabilities.

    2. For each capabilityString of config["requiredSellerCapabilities"]:

       1. If capabilityString is "interest-group-counts" or "latency-stats", then append capabilityString to sellerCapabilities.

          Note: For forward compatibility with new values, don’t throw.

    3. Set auctionConfig’s required seller capabilities to sellerCapabilities.

37. If config["privateAggregationConfig"] exists:

    1. Let aggregationCoordinator be the result of obtaining the coordinator from a Private Aggregation config given config["privateAggregationConfig"].

    2. If aggregationCoordinator is a DOMException, return failure.

    3. Set auctionConfig’s seller Private Aggregation coordinator to aggregationCoordinator.

38. If config["perBuyerCurrencies"] exists:

    1. Set auctionConfig’s per buyer currencies to config["perBuyerCurrencies"]

    2. Handle an input promise in configuration given auctionConfig and auctionConfig’s per buyer currencies:

       • To parse the value result:

         1. If result is null:

            1. Set auctionConfig’s per buyer currencies to null.

         2. Otherwise:

            1. Set auctionConfig’s per buyer currencies to a new ordered map whose keys are origins and whose values are currency tags.

            2. for each key → value of result:

               1. If the result of checking whether a string is a valid currency tag given value is false, throw a TypeError.

               2. If key is "*", then set auctionConfig’s all buyers currency to value, and continue.

               3. Let buyer be the result of parsing an https origin with key. If buyer is failure, throw a TypeError.

               4. Set auctionConfig’s per buyer currencies[buyer] to value.

       • To handle an error, set auctionConfig’s per buyer currencies to failure.

39. If config["sellerRealTimeReportingConfig"] exists:

    1. If config["sellerRealTimeReportingConfig"]["type"] is "default-local-reporting", then set auctionConfig’s seller real time reporting config to "default-local-reporting".

40. If config["perBuyerRealTimeReportingConfig"] exists, For each key → value of config["perBuyerRealTimeReportingConfig"]:

    1. Let buyer the result of parsing an https origin with key.

    2. If buyer is failure, then return failure.

    3. If value["type"] is "default-local-reporting", then set auctionConfig’s per buyer real time reporting config[buyer] to "default-local-reporting".

41. If config["componentAuctions"] is not empty:

    1. If config["interestGroupBuyers"] exists and is not empty, then return failure.

    2. If config["deprecatedRenderURLReplacements"] exists, then throw a TypeError.

42. For each component in config["componentAuctions"]:

    1. If isTopLevel is false, then return failure.

    2. Let componentAuction be the result of running validate and convert auction ad config with component and false.

    3. If componentAuction is failure, then return failure.

    4. Append componentAuction to auctionConfig’s component auctions.

43. Set auctionConfig’s config idl to config.

44. If config["resolveToConfig"] exists:

    1. Let auctionConfig’s resolve to config be config["resolveToConfig"].

    2. TODO: What should happen if this rejects?

    3. Upon fulfillment of auctionConfig’s resolve to config with resolveToConfig, set auctionConfig’s resolve to config to resolveToConfig.

45. Return auctionConfig.

To validate a url macro given a string macro:

1. Return true if any of the following conditions hold:

   • macro starts with "'${'" and ends with "'}'";

   • macro starts with "'%%'" and ends with "'%%'".

2. Otherwise, return false.

To update bid count given a list of interest groups igs:

1. For each ig in igs:

   1. Let loadedIg be the interest group from the user agent’s interest group set whose owner is ig’s owner and whose name is ig’s name, continue if none found.

   2. If the most recent entry in loadedIg’s bid counts corresponds to the current day in UTC, increment its count. If not, insert a new tuple of the time set to the current UTC day and a count of 1.

   3. Replace the interest group that has loadedIg’s owner and name in the user agent’s interest group set with loadedIg.

To update previous wins given a generated bid bid:

1. Let ig be bid’s interest group.

2. Let loadedIg be the interest group from the user agent’s interest group set whose owner is ig’s owner and whose name is ig’s name, return if none found.

3. Let win be a new previous win.

4. Set win’s time to the current coarsened wall time.

5. Let ad be a new interest group ad with the following items:

   render url

   bid’s bid ad’s render url

   metadata

   bid’s bid ad’s metadata

   ad render ID

   bid’s bid ad’s ad render ID

6. Set win’s ad to ad.

7. Append win to loadedIg’s previous wins.

8. Replace the interest group that has loadedIg’s owner and name in the user agent’s interest group set with loadedIg.

To build bid generators map given an auction config auctionConfig:

1. Let bidGenerators be a new ordered map whose keys are origins and whose values are per buyer bid generators.

2. Let negativeTargetInfo be a new negative target info.

3. For each buyer in auctionConfig’s interest group buyers:

   1. For each ig of the user agent’s interest group set whose owner is buyer:

      1. Let igName be ig’s name.

      2. If ig’s additional bid key is not null:

         1. Set negativeTargetInfo[(buyer, igName)] to (ig’s joining origin, ig’s additional bid key).

      3. Continue if any of the following conditions hold:

         • ig’s bidding url is null;

         • ig’s ads is null, or is empty;

         • the result of running check if required seller capabilities are permitted with auctionConfig and ig is false.

      4. Let signalsUrl be ig’s trusted bidding signals url.

      5. Let slotSizeQueryParam be the result of calculating the ad slot size query param given ig and auctionConfig.

      6. Let joiningOrigin be ig’s joining origin.

      7. If bidGenerators does not contain buyer:

         1. Let perBuyerGenerator be a new per buyer bid generator.

         2. Let perSignalsUrlGenerator be a new per signals url bid generator.

         3. Set perSignalsUrlGenerator[joiningOrigin] to « ig ».

         4. Set perSlotSizeQueryParam[slotSizeQueryParam] to perSignalsUrlGenerator.

         5. Set perBuyerGenerator[signalsUrl] to perSlotSizeQueryParam.

         6. Set bidGenerators[buyer] to perBuyerGenerator.

         7. TODO: add a perBiddingScriptUrlGenerator layer that replaces the list of IGs with a map from biddingScriptUrl to a list of IGs.

      8. Otherwise:

         1. Let perBuyerGenerator be bidGenerators[buyer].

         2. If perBuyerGenerator does not contain signalsUrl:

            1. Let perSignalsUrlGenerator be a new per signals url bid generator.

            2. Set perSignalsUrlGenerator[joiningOrigin] to « ig ».

            3. Set perSlotSizeQueryParam[slotSizeQueryParam] to perSignalsUrlGenerator.

            4. Set perBuyerGenerator[signalsUrl] to perSlotSizeQueryParam.

         3. Otherwise:

            1. Let perSlotSizeQueryParam be perBuyerGenerator[signalsUrl].

            2. If perSlotSizeQueryParam does not contain slotSizeQueryParam:

               1. Let perSignalsUrlGenerator be a new per signals url bid generator.

               2. Set perSignalsUrlGenerator[joiningOrigin] to « ig ».

               3. Set perSlotSizeQueryParam[slotSizeQueryParam] to perSignalsUrlGenerator.

            3. Otherwise:

               1. Let perSignalsUrlGenerator be perSlotSizeQueryParam[slotSizeQueryParam].

               2. If perSignalsUrlGenerator does not contain joiningOrigin, then set perSignalsUrlGenerator[joiningOrigin] to « ig ».

               3. Otherwise, append ig to perSignalsUrlGenerator[joiningOrigin].

4. Return « bidGenerators, negativeTargetInfo ».

To check if required seller capabilities are permitted given an auction config auctionConfig and an interest group ig:

1. Let seller be auctionConfig’s seller.

2. Let requiredSellerCapabilities be auctionConfig’s required seller capabilities.

3. Return true if all of the following conditions hold:

   • ig’s seller capabilities is not null;

   • ig’s seller capabilities[seller] exists;

   • requiredSellerCapabilities is a subset of ig’s seller capabilities[seller].

4. Return false.

To obtain the coordinator from a Private Aggregation config given a ProtectedAudiencePrivateAggregationConfig config, perform the following steps. They return an aggregation coordinator, null or a DOMException.

1. If config["aggregationCoordinatorOrigin"] does not exist, return null.

2. Return the result of obtaining the Private Aggregation coordinator given config["aggregationCoordinatorOrigin"].

To generate potentially multiple bids given an ordered map-or-null allTrustedBiddingSignals, and an origin-or-null crossOriginTrustedBiddingSignalsOrigin, a string auctionSignals, a BiddingBrowserSignals browserSignals, a string-or-null perBuyerSignals, a DirectFromSellerSignalsForBuyer directFromSellerSignalsForBuyer, a duration perBuyerTimeout in milliseconds, a currency tag expectedCurrency, an unsigned short multiBidLimit, an interest group ig, a reporting context reportingContext, a moment auctionStartTime, and an environment settings object settings, perform the following steps. They return a failure if failing to fetch the script or wasm, otherwise a tuple of (list of generated bids, bid debug reporting info, list of real time reporting contributions, Private Aggregation contributions, execution metrics).

1. Let igGenerateBid be the result of building an interest group passed to generateBid with ig.

2. Set browserSignals["joinCount"] to the sum of ig’s join counts for all days within the last 30 days.

3. Set browserSignals["recency"] to the current coarsened wall time minus ig’s join time, in milliseconds.

4. Set browserSignals["bidCount"] to the sum of ig’s bid counts for all days within the last 30 days.

5. Set browserSignals["adComponentsLimit"] to 40.

6. Set browserSignals["multiBidLimit"] to multiBidLimit.

7. Let prevWins be a new sequence<PreviousWin>.

8. For each prevWin of ig’s previous wins for all days within the the last 30 days:

   1. Let timeDelta be auctionStartTime minus prevWin’s time.

   2. Set timeDelta to 0 if timeDelta is negative, timeDelta’s nearest second (rounding down) otherwise.

   3. Let prevWinAdIDL be a new AuctionAd with the following items:

      renderURL

      the serialization of prevWin’s render url

      metadata

      prevWin’s metadata

      adRenderId

      prevWin’s ad render ID

   4. Let prevWinElement be the sequence<PreviousWinElement> «timeDelta, prevWinAdIDL».

   5. Append prevWinElement to prevWins.

9. Set browserSignals["prevWinsMs"] to prevWins.

10. Let metrics be a new execution metrics.

11. Let biddingScriptFetcher be the result of creating a new script fetcher with ig’s bidding url, and settings.

12. Let biddingScript be the result of waiting for script body from a fetcher given biddingScriptFetcher.

13. Add a sample to an averager given metrics’s code fetch time averager and biddingScriptFetcher’s fetch duration.

14. If biddingScript is failure, return failure.

15. If ig’s bidding wasm helper url is not null:

    1. Let wasmFetchStart be settings’s current monotonic time.

    2. Let wasmModuleObject be the result of fetching WebAssembly with ig’s bidding wasm helper url and settings.

    3. Let wasmFetchDuration be the duration from wasmFetchStart to settings’s current monotonic time, in milliseconds.

    4. Add a sample to an averager given metrics’s code fetch time averager and wasmFetchDuration.

    5. If wasmModuleObject is not failure, then set browserSignals["wasmHelper"] to wasmModuleObject.

    6. Otherwise, return failure.

16. Let trustedBiddingSignals be null.

17. If allTrustedBiddingSignals is not null:

    1. Assert that ig’s trusted bidding signals keys is not null.

    2. Set trustedBiddingSignals to an ordered map whose keys are strings and whose values are any.

    3. For each key of ig’s trusted bidding signals keys:

       1. If allTrustedBiddingSignals[key] exists, then set trustedBiddingSignals[key] to allTrustedBiddingSignals[key].

18. Let sameOriginTrustedBiddingSignals be null.

19. Let crossOriginTrustedBiddingSignals be null.

20. If trustedBiddingSignals is not null:

    1. If crossOriginTrustedBiddingSignalsOrigin is null, then set sameOriginTrustedBiddingSignals to trustedBiddingSignals.

    2. Otherwise:

       1. Set crossOriginTrustedBiddingSignals to a new ordered map whose keys are strings and whose values are any.

       2. Let originKey be the serialization of crossOriginTrustedBiddingSignalsOrigin.

       3. Set crossOriginTrustedBiddingSignalsOrigin[originKey] to trustedBiddingSignals.

21. Return the result of evaluating a bidding script with biddingScript, multiBidLimit, ig, reportingContext, metrics, expectedCurrency, igGenerateBid, auctionSignals, perBuyerSignals, sameOriginTrustedBiddingSignals, crossOriginTrustedBiddingSignals, browserSignals, directFromSellerSignalsForBuyer and perBuyerTimeout.

To generate and score bids given an auction config auctionConfig, an auction config-or-null topLevelAuctionConfig, a global object global, a list of interest groups bidIgs, a reporting context map reportingContextMap, and a real time reporting contributions map realTimeContributionsMap:

1. Assert that these steps are running in parallel.

2. Let settings be global’s relevant settings object.

3. Let policyContainer be settings’s policy container.

4. Let topLevelOrigin be settings’s top-level origin.

5. Let seller be auctionConfig’s seller.

6. Let auctionStartTime be the current coarsened wall time.

7. Let decisionLogicFetcher be the result of creating a new script fetcher with auctionConfig’s decision logic url and settings.

8. Let trustedScoringSignalsBatcher be the result of creating a trusted scoring signals batcher with auctionConfig’s max trusted scoring signals url length.

9. Let « bidGenerators, negativeTargetInfo » be the result of running build bid generators map with auctionConfig.

10. If auctionConfig’s aborted is true, return failure.

11. Let leadingBidInfo be a new leading bid info.

12. Let queue be the result of starting a new parallel queue.

13. Let capturedAuctionSignalsHeaders be global’s associated Document’s node navigable’s traversable navigable’s captured ad auction signals headers.

14. If auctionConfig’s component auctions are not empty:

    1. Assert topLevelAuctionConfig is null.

    2. Let pendingComponentAuctions be auctionConfig’s component auctions’s size.

    3. Let topLevelDirectFromSellerSignalsForSeller be null.

    4. Let topLevelDirectFromSellerSignalsRetrieved be false.

    5. For each component in auctionConfig’s component auctions, enqueue the following steps to queue:

       1. If component’s server response is not null:

          1. Let compWinnerInfo be the result of running parse and validate server response with component, auctionConfig, global, bidIgs, and reportingContextMap.

       2. Otherwise:

          1. Let compWinnerInfo be the result of running generate and score bids with component, auctionConfig, global, bidIgs, reportingContextMap, and realTimeContributionsMap.

       3. If recursively wait until configuration input promises resolve given auctionConfig does not return failure, and compWinnerInfo is not failure, then:

          1. If topLevelDirectFromSellerSignalsRetrieved is false:

             1. Let topLevelDirectFromSellerSignals be the result of running get direct from seller signals given seller, auctionConfig’s direct from seller signals header ad slot, and capturedAuctionSignalsHeaders.

             2. Set topLevelDirectFromSellerSignalsForSeller to the result of running get direct from seller signals for a seller given topLevelDirectFromSellerSignals.

             3. Set topLevelDirectFromSellerSignalsRetrieved to true.

          2. If compWinnerInfo’s leading bid is not null, then run score and rank a bid with auctionConfig, reportingContextMap[auctionConfig], compWinnerInfo’s leading bid, leadingBidInfo, decisionLogicFetcher, trustedScoringSignalsBatcher, null, "top-level-auction", null, topLevelOrigin, realTimeContributionsMap, and policyContainer.

          3. If compWinnerInfo’s leading non-k-anon-enforced bid is not null, then run score and rank a bid with auctionConfig, reportingContextMap[ auctionConfig], compWinnerInfo’s leading non-k-anon-enforced bid, leadingBidInfo, decisionLogicFetcher, trustedScoringSignalsBatcher, topLevelDirectFromSellerSignalsForSeller, null, "top-level-auction", null, topLevelOrigin, realTimeContributionsMap, and policyContainer.

       4. Decrement pendingComponentAuctions by 1.

    6. Wait until pendingComponentAuctions is 0.

    7. If auctionConfig’s aborted is true, return failure.

    8. Set reportingContextMap[auctionConfig]'s local leader info to a copy of leadingBidInfo.

    9. If leadingBidInfo’s leading bid is null, return null.

    10. Let winningComponentConfig be leadingBidInfo’s auction config.

    11. Set leadingBidInfo’s auction config to auctionConfig.

    12. Set leadingBidInfo’s component seller to winningComponentConfig’s seller.

    13. Let « topLevelSellerSignals, unusedTopLevelReportResultBrowserSignals » be the result of running report result with leadingBidInfo, reportingContextMap[auctionConfig], topLevelDirectFromSellerSignalsForSeller, winningComponentConfig, and global.

    14. Set leadingBidInfo’s auction config to winningComponentConfig.

    15. Set leadingBidInfo’s component seller to null.

    16. Set leadingBidInfo’s top level seller to seller.

    17. Set leadingBidInfo’s top level seller signals to topLevelSellerSignals.

    18. Let directFromSellerSignals be the result of running get direct from seller signals given winningComponentConfig’s seller, winningComponentConfig’s direct from seller signals header ad slot, and capturedAuctionSignalsHeaders.

    19. Let directFromSellerSignalsForSeller be the result of running get direct from seller signals for a seller given directFromSellerSignals.

    20. Let directFromSellerSignalsForBuyer be the result of running get direct from seller signals for a buyer with directFromSellerSignals, and leadingBidInfo’s leading bid’s interest group’s owner.

    21. Let « sellerSignals, reportResultBrowserSignals » be the result of running report result with leadingBidInfo, reportingContextMap[winningComponentConfig], directFromSellerSignalsForSeller, null, and global.

    22. Run report win with leadingBidInfo, reportingContextMap[winningComponentConfig], sellerSignals, reportResultBrowserSignals, directFromSellerSignalsForBuyer, and settings.

    23. Set reportingContextMap[auctionConfig]'s winner reporting id to leadingBidInfo’s leading bid’s reporting id.

    24. Set reportingContextMap[winningComponentConfig]'s winner reporting id to leadingBidInfo’s leading bid’s reporting id.

    25. Return leadingBidInfo.

15. If waiting until configuration input promises resolve given auctionConfig returns failure, then return failure.

16. Let allBuyersExperimentGroupId be auctionConfig’s all buyer experiment group id.

17. Let allBuyersGroupLimit be auctionConfig’s all buyers group limit.

18. Let auctionSignals be auctionConfig’s auction signals.

19. Let directFromSellerSignals be the result of running get direct from seller signals given seller, auctionConfig’s direct from seller signals header ad slot, and capturedAuctionSignalsHeaders.

20. Let directFromSellerSignalsForSeller be the result of running get direct from seller signals for a seller given directFromSellerSignals.

21. Let browserSignals be a BiddingBrowserSignals.

22. Let topLevelHost be the result of running the host serializer on topLevelOrigin’s host.

23. Set browserSignals["topWindowHostname"] to topLevelHost.

24. Set browserSignals["seller"] to the serialization of seller.

25. If auctionConfig’s requested size is not null, set browserSignals["requestedSize"] to the result of running convert an ad size to a map with auctionConfig’s requested size.

26. Let auctionLevel be "single-level-auction".

27. Let reportingContext be reportingContextMap[auctionConfig].

28. Let componentAuctionExpectedCurrency be null.

29. If topLevelAuctionConfig is not null:

    1. Set browserSignals["topLevelSeller"]] to the serialization of topLevelAuctionConfig’s seller.

    2. Set auctionLevel to "component-auction".

    3. Set componentAuctionExpectedCurrency to the result of looking up per-buyer currency with topLevelAuctionConfig and seller.

30. Let pendingBuyers be bidGenerators’s size.

31. Let additionalBids be the result of running validate and convert additional bids with auctionConfig, topLevelAuctionConfig, negativeTargetInfo, reportingContextMap and global.

32. Let pendingAdditionalBids be the size of additionalBids.

33. For each additionalBid of additionalBids, run the following steps in parallel:

    1. Score and rank a bid with auctionConfig, reportingContext additionalBid’s bid, leadingBidInfo, decisionLogicFetcher, trustedScoringSignalsBatcher, directFromSellerSignalsForSeller, null, auctionLevel, componentAuctionExpectedCurrency, topLevelOrigin, realTimeContributionsMap, and policyContainer.

    2. Decrement pendingAdditionalBids by 1.

34. For each buyer → perBuyerGenerator of bidGenerators, enqueue the following steps to queue:

    1. Let cumulativeTimeoutTracker be the result of creating a cumulative timeout tracker given auctionConfig and buyer.

    2. Let buyerExperimentGroupId be allBuyersExperimentGroupId.

    3. Let perBuyerExperimentGroupIds be auctionConfig’s per buyer experiment group ids.

    4. If perBuyerExperimentGroupIds is not null and perBuyerExperimentGroupIds[buyer] exists, then set buyerExperimentGroupId to perBuyerExperimentGroupIds[buyer].

    5. Let metrics be the result of accessing per-participant metrics for reportingContext, buyer, generate-bid.

    6. Apply interest groups limits to prioritized list:

       1. Let buyerGroupLimit be allBuyersGroupLimit.

       2. Let perBuyerGroupLimits be auctionConfig’s per buyer group limits.

       3. If perBuyerGroupLimits is not null and perBuyerGroupLimits[buyer] exists, then set buyerGroupLimit to perBuyerGroupLimits[buyer].

       4. Let igs be a new list of interest groups.

       5. For each signalsUrl → perSlotSizeQueryParam of perBuyerGenerator:

          1. For each slotSizeQueryParam → perSignalsUrlGenerator of perSlotSizeQueryParam:

             1. For each joiningOrigin → groups of perSignalsUrlGenerator:

                1. Extend igs with groups.

       6. Update storage metrics given metrics and igs.

          Note: This is done before any filtering, since it represents storage resource usage.

       7. Sort in descending order igs, with a being less than b if a’s priority is less than b’s priority.

       8. Remove the first buyerGroupLimit items from igs.

       9. For each signalsUrl → perSlotSizeQueryParam of perBuyerGenerator:

          1. For each slotSizeQueryParam → perSignalsUrlGenerator of perSlotSizeQueryParam:

             1. For each joiningOrigin → groups of perSignalsUrlGenerator:

                1. Remove from groups any interest group contained in igs.

                2. Increment metrics’s participating interest group count by size of groups.

    7. Let perBuyerSignals be null.

    8. If auctionConfig’s per buyer signals is not null and per buyer signals[buyer] exists, then set perBuyerSignals to auctionConfig’s per buyer signals[buyer].

    9. Let perBuyerTimeout be auctionConfig’s all buyers timeout.

    10. If auctionConfig’s per buyer timeouts is not null and per buyer timeouts[buyer] exists, then set perBuyerTimeout to auctionConfig’s per buyer timeouts[buyer].

    11. Let expectedCurrency be the result of looking up per-buyer currency with auctionConfig and buyer.

    12. Let multiBidLimit be the result of looking up per-buyer multi-bid limit with auctionConfig and buyer.

    13. Set browserSignals["forDebuggingOnlyInCooldownOrLockout"] to the result of running is debugging only in cooldown or lockout with buyer.

    14. Let optedInForRealTimeReporting be true if auctionConfig’s per buyer real time reporting config[buyer] is "default-local-reporting", false otherwise.

    15. For each slotSizeQueryParam → perSlotSizeQueryParam of perBuyerGenerator:

        1. For each signalsUrl → perSignalsUrlGenerator of perSlotSizeQueryParam:

           1. Let crossOriginTrustedBiddingSignalsOrigin be null.

           2. If buyer is not same origin with signalsUrl’s origin, then set crossOriginTrustedBiddingSignalsOrigin to signalsUrl’s origin.

           3. Let trustedBiddingSignalsBatcher be a new trusted bidding signals batcher.

           4. Let fetchSignalStartTime be settings’s current monotonic time.

           5. For each joiningOrigin → groups of perSignalsUrlGenerator:

              1. For each ig of groups:

                 1. Batch or fetch trusted bidding signals given trustedBiddingSignalsBatcher, ig, signalsUrl, buyerExperimentGroupId, topLevelOrigin, slotSizeQueryParam, and policyContainer.

              2. Fetch the current outstanding trusted signals batch given trustedBiddingSignalsBatcher, signalsUrl, buyer, buyerExperimentGroupId, topLevelOrigin, and slotSizeQueryParam.

              3. Fetch the trusted key value signals batch given trustedBiddingSignalsBatcher, signalsUrl, buyer, buyerExperimentGroupId, topLevelOrigin, and slotSizeQueryParam.

           6. Process updateIfOlderThanMs with buyer, and trustedBiddingSignalsBatcher’s all per interest group data.

           7. Let fetchSignalDuration be the duration from fetchSignalStartTime to settings’s current monotonic time, in milliseconds.

           8. Expend cumulative timeout time given cumulativeTimeoutTracker and fetchSignalDuration.

           9. For each joiningOrigin → groups of perSignalsUrlGenerator:

              1. For each ig of groups:

                 1. If cumulativeTimeoutTracker is expired then increment metrics’s cumulative timeouts occurred by 1 and continue.

                 2. If ig’s bidding url is null, continue.

                 3. Let effectiveBuyerTimeout be the result of computing effective timeout given cumulativeTimeoutTracker and perBuyerTimeout.

                 4. Let generateBidStartTime be settings’s current monotonic time.

                 5. Let directFromSellerSignalsForBuyer be the result of running get direct from seller signals for a buyer with directFromSellerSignals, and ig’s owner.

                 6. Let dataVersion be null.

                 7. Let allTrustedBiddingSignals be an ordered map-or-null, initially null.

                 8. Let igName be ig’s name.

                 9. If trustedBiddingSignalsBatcher’s no signals flags[igName] does not exist:

                    1. Set dataVersion to trustedBiddingSignalsBatcher’s data versions[igName].

                    2. Set allTrustedBiddingSignals to all trusted bidding signals.

                 10. Otherwise if trustedBiddingSignalsBatcher’s no signals flags[igName] is "fetch-failed", and optedInForRealTimeReporting is true, then:

                     1. Add a platform contribution with trusted bidding signals failure bucket, realTimeContributionsMap, and igName.

                 11. Remove browserSignals["dataVersion"].

                 12. Remove browserSignals["crossOriginDataVersion"].

                 13. If dataVersion is not null:

                     1. If crossOriginTrustedBiddingSignalsOrigin is not null, then set browserSignals["crossOriginDataVersion"] to dataVersion.

                     2. Otherwise, set browserSignals["dataVersion"] to dataVersion.

                 14. Let generateBidResult be the result of generate potentially multiple bids given allTrustedBiddingSignals, crossOriginTrustedBiddingSignalsOrigin, auctionSignals, a clone of browserSignals, perBuyerSignals, directFromSellerSignalsForBuyer, effectiveBuyerTimeout, expectedCurrency, multiBidLimit, ig, reportingContext, auctionStartTime, and settings.

                 15. If generateBidResult is failure, then:

                     1. If optedInForRealTimeReporting is true, then add a platform contribution with bidding script failure bucket, realTimeContributionsMap and buyer.

                     2. Continue.

                 16. Let (bidsBatch, bidDebugReportInfo, realTimeContributions, paContributions, executionMetrics) be generateBidResult.

                 17. Let generateBidDuration be the duration from generateBidStartTime to settings’s current monotonic time, in milliseconds.

                 18. Expend cumulative timeout time given cumulativeTimeoutTracker and generateBidDuration.

                 19. If cumulativeTimeoutTracker is expired then:

                     1. Increment metrics’s cumulative timeouts occurred by 1.

                     2. continue.

                 20. Let bidsToScore be the result of applying adjust bid list based on k-anonymity to bidsBatch.

                 21. Let foundKAnonBids be false.

                 22. For each generatedBid of bidsToScore:

                     1. If generatedBid’s for k-anon auction is true, set foundKAnonBids to true.

                 23. If bidsToScore is not empty but foundKAnonBids is false:

                     Note: generate potentially multiple bids is now rerun with only k-anonymous ads to give the buyer a chance to generate potentially multiple bids for k-anonymous ads. Allowing the buyer to first generate potentially multiple bids for non-k-anonymous ads provides a mechanism to bootstrap the k-anonymity count, otherwise no ads would ever trigger increment k-anonymity count and all ads would fail query k-anonymity count.

                     1. Let kAnonRestrictedIG be the result of running create a k-anon restricted deep copy of the interest group given ig.

                     2. Let effectiveBuyerTimeout be the result of computing effective timeout given cumulativeTimeoutTracker and perBuyerTimeout.

                     3. Let generateBidStartTime be settings’s current monotonic time.

                     4. Set (generatedBids, bidDebugReportInfo, realTimeContributions, paContributions, executionMetrics) to the result of running generate potentially multiple bids with allTrustedBiddingSignals, crossOriginTrustedBiddingSignalsOrigin, auctionSignals, a clone of browserSignals, perBuyerSignals, directFromSellerSignalsForBuyer, effectiveBuyerTimeout, expectedCurrency, 1 (for multiBidLimit), kAnonRestrictedIG, reportingContext, auctionStartTime, and settings.

                        Note: passing 1 for multiBidLimit limits the rerun to producing at most a single bid.

                     5. Let generateBidDuration be the duration from generateBidStartTime to settings’s current monotonic time, in milliseconds.

                     6. Expend cumulative timeout time given cumulativeTimeoutTracker and generateBidDuration.

                     7. If cumulativeTimeoutTracker is expired then:

                        1. Increment metrics’s cumulative timeouts occurred by 1.

                        2. continue.

                     8. Assert that size of generatedBids ≤ 1.

                     9. For each generatedBid of generatedBids:

                        1. Assert that query generated bid k-anonymity count given generatedBid returns true.

                        2. Apply any component ads target to a bid given generatedBid.

                        3. Append generatedBid to bidsToScore.

                 24. Register bids for reporting given bidsToScore, ig, bidDebugReportInfo, paContributions, executionMetrics, and reportingContext.

                 25. If auctionConfig’s per buyer real time reporting config[buyer] is "default-local-reporting", then insert entries to map given realTimeContributionsMap, buyer, and realTimeContributions.

                 26. For each bidToScore of bidsToScore:

                     1. If bidToScore’s for k-anon auction is true, append bidToScore’s interest group to bidIgs.

                     2. Score and rank a bid with auctionConfig, reportingContext, bidToScore, leadingBidInfo, decisionLogicFetcher, trustedScoringSignalsBatcher, directFromSellerSignalsForSeller, dataVersion, auctionLevel, componentAuctionExpectedCurrency, topLevelOrigin, realTimeContributionsMap, and policyContainer.

    16. Update cumulative buyer time metrics given metrics and cumulativeTimeoutTracker.

    17. Decrement pendingBuyers by 1.

35. Wait until both pendingBuyers and pendingAdditionalBids are 0.

36. If auctionConfig’s aborted is true, return failure.

37. Set reportingContext’s local leader info to leadingBidInfo.

38. If leadingBidInfo’s leading bid is null, return null.

39. If topLevelAuctionConfig is null:

    1. Let « sellerSignals, reportResultBrowserSignals » be the result of running report result with leadingBidInfo, reportingContext, directFromSellerSignalsForSeller, null, and global.

    2. Let directFromSellerSignalsForWinner be the result of running get direct from seller signals for a buyer with directFromSellerSignals, and leadingBidInfo’s leading bid’s interest group’s owner.

    3. Run report win with leadingBidInfo, reportingContext, sellerSignals, reportResultBrowserSignals, directFromSellerSignalsForWinner, and settings.

    4. Set reportingContext’s winner reporting id to leadingBidInfo’s leading bid’s reporting id.

40. Let replacements be an ordered map whose keys are strings and whose values are strings.

    1. For each ad keyword replacement, replacement, within deprecated render url replacements:

       1. Let k be replacement’s match.

       2. Let v be replacement’s replacement.

       3. Set replacements[k] to v.

41. Set leadingBidInfo’s leading bid’s ad descriptor to the result of substitute macros with replacements and leading bid’s ad descriptor.

42. If leadingBidInfo’s leading bid’s ad descriptors is not null:

    1. For each ad descriptor, adDescriptor, within leading bid’s ad descriptors:

       1. Set adDescriptor to the result of substitute macros with replacements and adDescriptor.

43. Return leadingBidInfo.

To build an interest group passed to generateBid given an interest group ig:

1. Let igGenerateBid be a new GenerateBidInterestGroup with the following fields:

   owner

   The serialization of ig’s owner

   name

   ig’s name

   enableBiddingSignalsPrioritization

   ig’s enable bidding signals prioritization

   priorityVector

   ig’s priority vector if not null, otherwise not set.

   executionMode

   ig’s execution mode

   biddingLogicURL

   The serialization-or-undefined of ig’s bidding url

   biddingWasmHelperURL

   The serialization of ig’s bidding wasm helper url

   updateURL

   The serialization of ig’s update url

   trustedBiddingSignalsURL

   The serialization of ig’s trusted bidding signals url

   trustedBiddingSignalsKeys

   ig’s trusted bidding signals keys, if not null, otherwise not set.

   trustedBiddingSignalsSlotSizeMode

   ig’s trusted bidding signals slot size mode

   maxTrustedBiddingSignalsURLLength

   ig’s max trusted bidding signals url length

   trustedBiddingSignalsCoordinator

   The serialization of ig’s trusted bidding signals coordinator

   userBiddingSignals

   Parse a JSON string to a JavaScript value given ig’s user bidding signals

   ads

   ig’s ads converted to an AuctionAd sequence

   adComponents

   ig’s ad components converted to an AuctionAd sequence

2. Return igGenerateBid.

To convert to an AuctionAd sequence given a list-or-null ads:

1. If ads is null, then return undefined.

2. Let adsIDL be a new sequence<AuctionAd>.

3. For each ad of ads:

   1. Let adIDL be a new AuctionAd.

   2. Set adIDL["renderURL"] to the serialization of ad’s render url.

   3. If ad’s selectable buyer and seller reporting IDs is not null:

      1. Set adIDL["selectableBuyerAndSellerReportingIds"] to ad’s selectable buyer and seller reporting IDs.

      2. If ad’s buyer and seller reporting id is not null then set adIDL["buyerAndSellerReportingId"] to ad’s buyer and seller reporting id.

      3. If ad’s buyer reporting id is not null then set adIDL["buyerReportingId"] to ad’s buyer reporting id.

   4. If ad’s size group is not null, then set adIDL["sizeGroup"] to ad’s size group.

   5. If ad’s metadata is not null, then set adIDL["metadata"] to the result of parsing a JSON string to a JavaScript value given ad’s metadata.

   6. If ad’s creative scanning metadata is not null, then set adIDL["creativeScanningMetadata"] to it.

   7. Append adIDL to adsIDL.

4. Return adsIDL.

To fetch and decode trusted scoring signals given a trusted scoring signals batcher batcher, an auction config auctionConfig, a generated bid generatedBid, a script fetcher decisionLogicFetcher, an origin topLevelOrigin, a real time reporting contributions map realTimeContributionsMap, and a policy container policyContainer:

1. Let isCrossOrigin be false.

2. Let sameOriginTrustedScoringSignals be null.

3. Let crossOriginTrustedScoringSignals be null.

4. Let scoringDataVersion be null.

5. Let sendCreativeScanningMetadata be auctionConfig’s send creative scanning metadata.

6. If auctionConfig’s trusted scoring signals coordinator is not null, set sendCreativeScanningMetadata to false.

7. Let owner be generatedBid’s interest group’s owner.

8. Let mainAd be the result of filling in creative info given sendCreativeScanningMetadata, generatedBid’s ad descriptor, owner, bid ad.

9. Let adComponents be a new empty set.

10. for each i in the range from 0 to bid ad components’s size - 1, inclusive:

    1. Let adComponentCreativeInfo be the result of filling in creative info given sendCreativeScanningMetadata, generatedBid’s ad component descriptors[i], owner, generatedBid’s bid ad components[i].

    2. Append adComponentCreativeInfo to adComponents.

11. If auctionConfig’s trusted scoring signals url is not null:

    1. Let request be a new trusted scoring signals request with the following items:

       send creative scanning metadata

       sendCreativeScanningMetadata.

       seller

       auctionConfig’s seller

       seller script fetcher

       decisionLogicFetcher

       base url

       auctionConfig’s trusted scoring signals url

       seller experiment group id

       auctionConfig’s seller experiment group id

       top level origin

       topLevelOrigin

       ad

       mainAd

       ad components

       adComponents

       policy container

       policyContainer

       signal coordinator

       auctionConfig’s trusted scoring signals coordinator

       owner origin

       owner

       joining origin

       generatedBid’s interest group’s joining origin

    2. If auctionConfig’s trusted scoring signals url’s origin is not same origin with auctionConfig’s seller, then set isCrossOrigin to true.

    3. Let result be the result of fetching trusted scoring signals with batching with batcher and request.

    4. If result is not failure:

       1. Let allTrustedScoringSignals be result’s all trusted scoring signals:

       2. Set scoringDataVersion to result’s data version.

       3. Let trustedScoringSignals be a new empty map.

       4. Set trustedScoringSignals["renderURL"] to a new empty map.

       5. If allTrustedScoringSignals["renderURLs"] exists and allTrustedScoringSignals["renderURLs"][renderURL] exists, then set trustedScoringSignals["renderURL"][renderURL] to allTrustedScoringSignals["renderURLs"][renderURL].

       6. If adComponentRenderURLs is not empty:

          1. Let adComponentRenderURLsValue be a new empty map.

          2. If allTrustedScoringSignals["adComponentRenderURLs"] exists, for each adComponentRenderURL in adComponentRenderURLs:

             1. If allTrustedScoringSignals["adComponentRenderURLs"][adComponentRenderURL] exists, then set adComponentRenderURLsValue[adComponentRenderURL] to allTrustedScoringSignals["adComponentRenderURLs"][adComponentRenderURL].

          3. Set trustedScoringSignals["adComponentRenderURLs"] to adComponentRenderURLsValue.

       7. If isCrossOrigin is false, set sameOriginTrustedScoringSignals to trustedScoringSignals.

       8. Otherwise:

          1. Set crossOriginTrustedScoringSignals to a new map.

          2. Let originKey be the serialization given auctionConfig’s trusted scoring signals url’s origin.

          3. Set crossOriginTrustedScoringSignals[originKey] to trustedScoringSignals.

    5. Otherwise if auctionConfig’s seller real time reporting config is "default-local-reporting",then:

       1. Add a platform contribution with trusted scoring signals failure bucket, realTimeContributionsMap, and auctionConfig’s seller.

12. Return «isCrossOrigin, sameOriginTrustedScoringSignals, crossOriginTrustedScoringSignals, scoringDataVersion»

To score and rank a bid given an auction config auctionConfig, a reporting context reportingContext, a generated bid generatedBid, a leading bid info leadingBidInfo, a script fetcher decisionLogicFetcher, a trusted scoring signals batcher trustedScoringSignalsBatcher a DirectFromSellerSignalsForSeller directFromSellerSignalsForSeller, an unsigned long-or-null biddingDataVersion, an enum auctionLevel, which is "single-level-auction", "top-level-auction", or "component-auction", a currency tag componentAuctionExpectedCurrency, an origin topLevelOrigin, a real time reporting contributions map realTimeContributionsMap, and a policy container policyContainer:

1. Let «trustedScoringSignalsAreCrossOrigin, sameOriginTrustedScoringSignals, crossOriginTrustedScoringSignals, scoringDataVersion» be the result of fetch and decode trusted scoring signals given trustedScoringSignalsBatcher, auctionConfig, generatedBid, decisionLogicFetcher, topLevelOrigin, realTimeContributionsMap, and policyContainer.

2. Let adMetadata be generatedBid’s ad.

3. Let bidValue be generatedBid’s bid.

4. If generatedBid’s modified bid is not null, then set bidValue to generatedBid’s modified bid.

5. Let owner be generatedBid’s interest group’s owner.

6. Let browserSignals be a ScoringBrowserSignals with the following fields:

   topWindowHostname

   The result of running the host serializer on topLevelOrigin’s host

   interestGroupOwner

   Serialized owner

   renderURL

   The result of running the URL serializer on generatedBid’s ad descriptor’s url

   renderSize

   The result of running convert an ad size to a map with generatedBid’s ad descriptor’s size if it is not null, undefined otherwise

   biddingDurationMsec

   generatedBid’s bid duration

   bidCurrency

   The result of serializing a currency tag with generatedBid’s bid’s currency

   dataVersion

   scoringDataVersion if it is not null and trustedScoringSignalsAreCrossOrigin is false, unset otherwise.

   crossOriginDataVersion

   scoringDataVersion if it is not null and trustedScoringSignalsAreCrossOrigin is true, unset otherwise.

   adComponents

   generatedBid’s ad component descriptors converted to a string sequence

   forDebuggingOnlyInCooldownOrLockout

   The result of running is debugging only in cooldown or lockout with seller

   creativeScanningMetadata

   generatedBid’s bid ad’s creative scanning metadata if non-null, unset otherwise.

   adComponentsCreativeScanningMetadata

   Unset if generatedBid’s bid ad components is empty; the result of extracting component ad creative scanning metadata given generatedBid’s bid ad components otherwise.

7. Let decisionLogicScript be the result of wait for script body from a fetcher given decisionLogicFetcher.

8. If decisionLogicScript is failure, then:

   1. If auctionConfig’s seller real time reporting config is "default-local-reporting", then add a platform contribution with scoring script failure bucket, realTimeContributionsMap and seller.

   2. Return.

9. Let metrics be the result of access per-participant metrics given reportingContext, auctionConfig’s seller, score-ad.

10. Add a sample to an averager given metrics’s code fetch time averager and decisionLogicFetcher’s fetch duration.

11. Let « scoreAdResult, debugWinReportUrl, debugLossReportUrl, realTimeContributions, paContributions, executionMetrics » be the result of evaluating a scoring script with decisionLogicScript, adMetadata, bidValue’s value, auctionConfig, reportingContext, sameOriginTrustedScoringSignals, crossOriginTrustedScoringSignals, browserSignals, directFromSellerSignalsForSeller, and auctionConfig’s seller timeout.

12. Increment metrics’s script executions attempted by 1.

13. If executionMetrics’s script timed out is true, increment metrics’s script timeouts occurred by 1.

14. If generatedBid’s for k-anon auction is true:

    Note: Non-k-anonymous bids do not participate in reporting (except for platform real-time contributions, and some special handling of private aggregation requests involving reject-reason); as it would be problematic to report a winner that didn’t actually win.

    1. Let reportingId be generatedBid’s reporting id.

    2. If reportingContext’s debug reporting info[reportingId] does not exist, set it to a new bid debug reporting info.

    3. Let bidDebugReportInfo be reportingContext’s debug reporting info [reportingId].

    4. If auctionLevel is "top-level-auction":

       1. Set bidDebugReportInfo’s top level seller debug loss report url to debugLossReportUrl.

       2. Set bidDebugReportInfo’s top level seller debug win report url to debugWinReportUrl.

    5. Otherwise:

       1. Set bidDebugReportInfo’s seller debug loss report url to debugLossReportUrl.

       2. Set bidDebugReportInfo’s seller debug win report url to debugWinReportUrl.

    6. If auctionLevel is "component-auction", then set bidDebugReportInfo’s component seller to seller.

    7. If auctionConfig’s seller real time reporting config is "default-local-reporting", then insert entries to map given realTimeContributionsMap, seller, and realTimeContributions.

    8. Insert reportingId into reportingContext’s seller participants.

    9. Commit private aggregation contributions given paContributions, reportingId, and reportingContext.

15. Let scoreAdOutput be result of processing scoreAd output with scoreAdResult.

16. Return if any of the following conditions hold:

    • scoreAdOutput is failure;

    • auctionLevel is not "single-level-auction", and scoreAdOutput ["allowComponentAuction"] is false;

    • scoreAdOutput["desirability"] ≤ 0.

17. If auctionLevel is "component-auction":

    1. Set generatedBid’s component seller to seller.

    2. Let bidToCheck be generatedBid’s bid.

    3. If scoreAdOutput["bid"] exists:

       1. Let modifiedBidValue be scoreAdOutput["bid"].

       2. If modifiedBidValue ≤ 0, return.

       3. Let modifiedBidCurrency be null.

       4. If scoreAdOutput["bidCurrency] exists, then set modifiedBidCurrency to scoreAdOutput["bidCurrency].

       5. Set generatedBid’s modified bid to a bid with currency with value modifiedBidValue and currency modifiedBidCurrency.

       6. Set bidToCheck to generatedBid’s modified bid.

    4. If the result of checking a currency tag with componentAuctionExpectedCurrency and bidToCheck’s currency is false, return.

    5. If the result of checking a currency tag with auctionConfig’s seller currency and bidToCheck’s currency is false, return.

18. If auctionConfig’s seller currency is not null:

    1. If generatedBid’s bid’s currency is equal to auctionConfig’s seller currency:

       1. Set generatedBid’s bid in seller currency to generatedBid’s bid’s value.

       2. If scoreAdOutput["incomingBidInSellerCurrency"] exists and does not equal generatedBid’s bid in seller currency, return.

    2. Otherwise if scoreAdOutput["incomingBidInSellerCurrency"] exists, then set generatedBid’s bid in seller currency to scoreAdOutput["incomingBidInSellerCurrency"].

19. Let score be scoreAdOutput["desirability"].

20. If generatedBid’s for k-anon auction is false:

    1. Let updateLeadingNonKAnonEnforcedBid be false.

    2. If leadingBidInfo’s leading non-k-anon-enforced bid is null, or score > leadingBidInfo’s top non-k-anon-enforced score:

       1. Set updateLeadingNonKAnonEnforcedBid to true.

       2. Set leadingBidInfo’s top non-k-anon-enforced bids count to 1.

    3. If leadingBidInfo’s leading non-k-anon-enforced bid is not null and score = leadingBidInfo’s top non-k-anon-enforced score:

       1. Increment leadingBidInfo’s top non-k-anon-enforced bids count by 1.

       2. Set updateLeadingNonKAnonEnforcedBid to true with 1 in leadingBidInfo’s top non-k-anon-enforced bids count chance.

    4. If updateLeadingNonKAnonEnforcedBid is true:

       1. Set leadingBidInfo’s top non-k-anon-enforced score to score.

       2. Set leadingBidInfo’s leading non-k-anon-enforced bid to generatedBid.

    5. Return.

21. Let updateLeadingBid be false.

22. If leadingBidInfo’s leading bid is null, or score > leadingBidInfo’s top score:

    1. Set updateLeadingBid to true.

    2. Set leadingBidInfo’s top bids count to 1.

    3. Set leadingBidInfo’s at most one top bid owner to true.

23. Otherwise if score equals leadingBidInfo’s top score:

    1. Increment leadingBidInfo’s top bids count by 1.

    2. Set updateLeadingBid to true with 1 in leadingBidInfo’s top bids count chance.

    3. If updateLeadingBid is false, then update highest scoring other bid with score, leadingBidInfo’s leading bid, and leadingBidInfo.

    4. If owner is not same origin with leadingBidInfo’s leading bid’s interest group’s owner, then set leadingBidInfo’s at most one top bid owner to false.

24. Otherwise if score is greater than or equal to leadingBidInfo’s second highest score, then update highest scoring other bid with score, bidValue, and leadingBidInfo.

25. If updateLeadingBid is true:

    1. If leadingBidInfo’s leading bid is not null, then update highest scoring other bid with leadingBidInfo’s top score, leadingBidInfo’s leading bid, and leadingBidInfo.

    2. Set leadingBidInfo’s top score to score.

    3. Set leadingBidInfo’s leading bid to generatedBid.

    4. Set leadingBidInfo’s auction config to auctionConfig.

    5. Set leadingBidInfo’s bidding data version to biddingDataVersion.

    6. Set leadingBidInfo’s scoring data version to scoringDataVersion.