Consolidate slot config into trusted-server.toml and namespace window globals under window._ts

[prk-Jr]

Summary

• Slot templates consolidated into trusted-server.toml: the separate creative-opportunities.toml file is removed. All [[creative_opportunities.slot]] entries now live inside the main config file, giving them the same env-var override mechanism as other settings (TRUSTED_SERVER__CREATIVE_OPPORTUNITIES__SLOT='[...]'). The build.rs validator now reads from trusted-server.toml directly.
• Window globals namespaced under window._ts: seven flat window.__ts* properties are collapsed into a single window._ts object. This reduces window namespace pollution from 7 properties to 1 and makes the Trusted Server presence on the page discoverable via a single well-known key.
• TsAdSlot.formats type corrected and ts_initial constant extracted for clarity in the GPT bootstrap script.

Breaking change — JS globals rename

Publishers and downstream integrations that read window.__ts* variables must update to window._ts.*:

Before	After
window.__ts_ad_slots	window._ts.adSlots
window.__ts_bids	window._ts.bids
window.__tsAdInit	window._ts.adInit
window.__tsPrevGptSlots	window._ts.prevGptSlots
window.__tsServicesEnabled	window._ts.servicesEnabled
window.__tsDivToSlotId	window._ts.divToSlotId
window.__tsSpaHookInstalled	window._ts.spaHookInstalled

Reading server-injected bid data in the browser:

const bids = window._ts?.bids ?? {};
// e.g. { atf_sidebar_ad: { hb_bidder: "aps", hb_pb: "1.50" } }

Slot config — new location in trusted-server.toml

[[creative_opportunities.slot]]
id = "atf_sidebar_ad"
gam_unit_path = "/a/b/news"
div_id = "div-ad-atf-sidebar"
page_patterns = ["/news/**"]
formats = [{ width = 300, height = 250 }]

[creative_opportunities.slot.targeting]
pos = "atf"
zone = "atfSidebar"

Changed files

File	What changed
creative-opportunities.toml	Deleted — slot definitions moved to trusted-server.toml
trusted-server.toml	Added [[creative_opportunities.slot]] entries
crates/trusted-server-core/build.rs	Reads slot config from trusted-server.toml; removed creative-opportunities.toml path
crates/trusted-server-core/src/settings.rs	Config struct updated to accept slots inline
crates/trusted-server-core/src/creative_opportunities.rs	Minor type/API updates
crates/trusted-server-core/src/html_processor.rs	Writes window._ts initializer instead of individual flat globals
crates/trusted-server-core/src/publisher.rs	Updated bid-injection to use window._ts.bids
crates/trusted-server-core/src/integrations/gpt.rs	Reads window._ts.* keys
crates/trusted-server-core/src/integrations/gpt_bootstrap.js	Renamed all global references; extracted ts_initial constant; fixed formats type
crates/trusted-server-core/src/auction/endpoints.rs	Minor reference update
crates/trusted-server-adapter-fastly/src/main.rs	Updated slot-config wiring
crates/trusted-server-adapter-fastly/src/route_tests.rs	Test fixtures updated
crates/js/lib/src/integrations/gpt/index.ts	All window.__ts* references renamed to window._ts.*
crates/js/lib/src/integrations/gpt/index.test.ts	Tests updated; teardown fixed to clean window._ts
docs/superpowers/plans/2026-05-29-pr680-reviewer-findings.md	Added plan doc; Prettier formatting applied

Test plan

• cargo fmt --all -- --check — passes
• cargo clippy --workspace --all-targets --all-features -- -D warnings — passes
• cargo test --workspace — 1,054 tests pass (20 + 1010 + 21 + 3)
• cd crates/js/lib && npx vitest run — 300 tests pass
• cd crates/js/lib && npm run format — passes
• cd docs && npm run format — passes (formatting fix committed)
• Smoke-test fastly compute serve and confirm window._ts is populated in browser devtools
• Confirm existing publishers consuming window.__ts_bids have been updated or notified