secureSignals: add secureSignalsFromEids building GPT secure signals from cached EIDs

[etiennelatendresse-optable]

Why

A new setSecureSignals function would allow to filter cached EIDs and pass them to GPT secure signals

What Changed

• secureSignalsFromEids flattens EIDs into { provider, id } pairs for installGPTSecureSignals, filtered by sources/inserters/matchers
• Add tests
• Update README.md under GAM secure signals.

How to Test

• Tested
• Docs updated

Notes

• Breaking change
• Requires release
  Co-authored-by: Etienne Latendresse etienne.latendresse@optable.co

[jplaroche]

SecureSignalEid duplicates a type we already have. EID from iab-openrtb/v26 declares exactly these fields (inserter?, source, matcher?, uids), and it is already imported in lib/addons/uid2-refresh.ts and lib/core/resolvers/resolveMultiTargeting.ts. lib/core/prebid/rtd.ts also hand-rolls its own local EID, so this would be the third definition of the same shape — if ORTB adds or renames a field, the local copies silently drift.

The local type is looser on purpose (cached EIDs are parsed from localStorage, so uids can be missing and a uid can lack an id — the tests cover both), which the strict ORTB type does not allow. Deriving keeps the field names and the tolerance:

import type { EID, UID } from "iab-openrtb/v26";

// Cached EIDs are parsed from storage, so ORTB's required fields may be
// absent at runtime. Derived from EID so new/renamed ORTB fields flow through.
type SecureSignalEid = Partial<Omit<EID, "uids">> & Pick<EID, "source"> & { uids?: Array<Partial<UID>> };

No behaviour change, and the existing tests (including { id: "" } and {} uids) still typecheck.

Alternative, if you would rather not carry the runtime tolerance: use EID directly and adjust the two malformed-uid fixtures. That trades defensiveness against untrusted cache contents for a simpler type — your call which side to land on.

Sent using Claude

[jplaroche]

might be worth it to mention the next snippers is when using the npm package, and add an example when loading the sdk.js file on the page (as the other examples shows).

[jplaroche]

should we include this in gpt.ts instead of on it's own ?