spec.bs

<pre class="metadata">
Title: Protected Audience (formerly FLEDGE)
Shortname: protected-audience
Repository: WICG/turtledove
Inline Github Issues: true
Group: WICG
Status: CG-DRAFT
Level: 1
URL: https://wicg.github.io/turtledove/
Boilerplate: omit conformance, omit feedback-header
Editor: Paul Jensen, Google https://www.google.com/, pauljensen@google.com
Abstract: Provides a privacy advancing API to facilitate interest group based advertising.
!Participate: <a href="https://github.com/WICG/turtledove">GitHub WICG/turtledove</a> (<a href="https://github.com/WICG/turtledove/issues/new">new issue</a>, <a href="https://github.com/WICG/turtledove/issues?state=open">open issues</a>)
!Commits: <a href="https://github.com/WICG/turtledove/commits/main/spec.bs">GitHub spec.bs commits</a>
Complain About: accidental-2119 yes, missing-example-ids yes
Indent: 2
Default Biblio Status: current
Markup Shorthands: markdown yes
Assume Explicit For: yes
</pre>

<pre class="anchors">
urlPrefix: https://fetch.spec.whatwg.org/; spec: Fetch
  type: dfn
    text: HTTP-network-or-cache fetch; url: #concept-http-network-or-cache-fetch
    text: task destination; for: fetch params; url: fetch-params-task-destination
urlPrefix: https://www.ietf.org/rfc/rfc4122.txt
  type: dfn; text: urn uuid
  type: dfn; text: string representation
  type: dfn; text: version 4 UUID
urlPrefix: https://github.com/WICG/turtledove/blob/main/FLEDGE_k_anonymity_server.md
  type: dfn; text: k-anonymity; url: what-is-k-anonymity
urlPrefix: https://developer.chrome.com/en/docs/privacy-sandbox/glossary/
  type: dfn; text: ad creative; url: ad-creative
spec: RFC6234; urlPrefix: https://www.ietf.org/rfc/rfc6234.txt
  type: dfn; text: SHA-256
urlPrefix: https://datatracker.ietf.org/doc/html/rfc8032
  type: dfn
    text: verify; url: section-5.1.7
spec: html; urlPrefix: https://html.spec.whatwg.org/C
  type: dfn
    text: create an agent; url: create-an-agent
    text: immediately; url: immediately
    text: valid floating-point number; url: valid-floating-point-number
spec: infra; urlPrefix: https://infra.spec.whatwg.org/
  type: dfn
    text: convert an Infra value to a JSON-compatible JavaScript value; url: #convert-an-infra-value-to-a-json-compatible-javascript-value
spec: RFC8941; urlPrefix: https://httpwg.org/specs/rfc8941.html
  type: dfn
    text: structured header; url: top
    for: structured header
      text: boolean; url: boolean
      text: integer; url: integer
      text: boolean; url: boolean
spec: WebAssembly; urlPrefix: https://webassembly.github.io/spec/core/
  type: dfn
    urlPrefix: appendix/embedding.html
      text: error; url: embed-error
spec: WebAssembly-js-api; urlPrefix: https://webassembly.github.io/spec/js-api/
  type: dfn
    text: compiling a WebAssembly module; url: #compile-a-webassembly-module
spec: WebIDL; urlPrefix: https://webidl.spec.whatwg.org/
  type: dfn
    text: convert a Web IDL arguments list to an ECMAScript arguments list; url: #web-idl-arguments-list-converting
spec: Fenced Frame; urlPrefix: https://wicg.github.io/fenced-frame/
  type: dfn
    for: browsing context
      text: fenced frame config instance; url: #browsing-context-fenced-frame-config-instance
spec: Private Aggregation API; urlPrefix: https://patcg-individual-drafts.github.io/private-aggregation-api
  type: dfn
    text: private-aggregation; url: #private-aggregation
spec: Shared Storage API; urlPrefix: https://wicg.github.io/shared-storage
  type: dfn
    text: shared-storage; url: #permissionspolicy-shared-storage
    text: shared-storage-select-url; url: #permissionspolicy-shared-storage-select-url
</pre>

<pre class=link-defaults>
spec:infra; type:dfn; text:user agent
</pre>

<style>
/* Put nice boxes around each algorithm. */
[data-algorithm]:not(.heading) {
  padding: .5em;
  border: thin solid #ddd; border-radius: .5em;
  margin: .5em calc(-0.5em - 1px);
}
[data-algorithm]:not(.heading) > :first-child {
  margin-top: 0;
}
[data-algorithm]:not(.heading) > :last-child {
  margin-bottom: 0;
}
[data-algorithm] [data-algorithm] {
  margin: 1em 0;
}

/* domintro from https://resources.whatwg.org/standard.css */
.domintro {
  position: relative;
  color: green;
  background: #DDFFDD;
  margin: 2.5em 0 2em 0;
  padding: 1.5em 1em 0.5em 2em;
}

.domintro dt, .domintro dt * {
  color: black;
  font-size: inherit;
}
.domintro dd {
  margin: 0.5em 0 1em 2em; padding: 0;
}
.domintro dd p {
  margin: 0.5em 0;
}
.domintro::before {
  content: 'For web developers (non-normative)';
  background: green;
  color: white;
  padding: 0.15em 0.25em;
  font-style: normal;
  position: absolute;
  top: -0.8em;
  left: -0.8em;
}
</style>

# Introduction # {#intro}

*This section is non-normative.*

The Protected Audience API facilitates selecting an advertisement to display to a user based on a
previous interaction with the advertiser or advertising network.

When a user's interactions with an advertiser indicate an interest in something, the advertiser can
ask the browser to record this interest on-device by calling
{{Window/navigator}}.{{Navigator/joinAdInterestGroup()}}. Later, when a website wants to select an
advertisement to show to the user, the website can call
{{Window/navigator}}.{{Navigator/runAdAuction()}} to ask the browser to conduct an
<dfn>auction</dfn> where each of these on-device recorded interests are given the chance to
calculate a bid to display their advertisement.


<h2 id="joining-interest-groups">Joining Interest Groups</h2>

*This first introductory paragraph is non-normative.*

When a user's interactions with a website indicate that the user may have a particular interest, an
advertiser or someone working on behalf of the advertiser (e.g. a demand side platform, DSP) can ask
the user's browser to record this interest on-device by calling
{{Window/navigator}}.{{Navigator/joinAdInterestGroup()}}. This indicates an intent to display an
advertisement relevant to this interest to this user in the future. The [=user agent=] has an
<dfn>interest group set</dfn>, a [=list=] of [=interest groups=] in which
[=interest group/owner=] / [=interest group/name=] pairs are unique.

<h3 id="join-ad-interest-groups">navigator.joinAdInterestGroup()</h3>

<xmp class="idl">
[SecureContext]
partial interface Navigator {
  Promise<undefined> joinAdInterestGroup(AuctionAdInterestGroup group);
};

dictionary AuctionAd {
  required USVString renderURL;
  any metadata;

  USVString buyerReportingId;
  USVString buyerAndSellerReportingId;
  sequence<USVString> allowedReportingOrigins;
};

dictionary GenerateBidInterestGroup {
  required USVString owner;
  required USVString name;
  required double lifetimeMs;

  boolean enableBiddingSignalsPrioritization = false;
  record<DOMString, double> priorityVector;

  DOMString executionMode = "compatibility";
  USVString biddingLogicURL;
  USVString biddingWasmHelperURL;
  USVString updateURL;
  USVString trustedBiddingSignalsURL;
  sequence<USVString> trustedBiddingSignalsKeys;
  any userBiddingSignals;
  sequence<AuctionAd> ads;
  sequence<AuctionAd> adComponents;
};

dictionary AuctionAdInterestGroup : GenerateBidInterestGroup {
  double priority = 0.0;
  record<DOMString, double> prioritySignalsOverrides;
  DOMString additionalBidKey;
};
</xmp>

{{AuctionAdInterestGroup}} is used by {{Window/navigator}}.{{Navigator/joinAdInterestGroup()}}, and
when an interest group is stored to [=interest group set=].
`priority` and `prioritySignalsOverrides` are not passed to `generateBid()` because they can be
modified by `generatedBid()` calls, so could theoretically be used to create a cross-site profile of
a user accessible to `generateBid()` methods, otherwise.

<div algorithm="joinAdInterestGroup()">

The <dfn for=Navigator method>joinAdInterestGroup(|group|)</dfn> method steps are:
<div class="note">

Temporarily, Chromium does not include the <a for="dictionary member"><span class="allow-2119">required</span></a> keyword
for {{GenerateBidInterestGroup/lifetimeMs}}, and instead starts this algorithm with the step

1. If |group|["{{GenerateBidInterestGroup/lifetimeMs}}"] does not [=map/exist=], throw a {{TypeError}}.

This is detectable because it can change the set of fields that are read from the argument when a
{{TypeError}} is eventually thrown, but it will never change whether the call succeeds or fails.

</div>
1. Let |global| be [=this=]'s [=relevant global object=].
1. If |global|'s [=associated Document=] is not [=allowed to use=] the "[=join-ad-interest-group=]"
  [=policy-controlled feature=], then [=exception/throw=] a "{{NotAllowedError}}" {{DOMException}}.
1. Let |frameOrigin| be [=this=]'s [=relevant settings object=]'s [=environment settings object/origin=].
1. [=Assert=] that |frameOrigin| is not an [=opaque origin=] and its [=origin/scheme=] is "`https`".
1. Let |interestGroup| be a new [=interest group=].
1. Validate the given |group| and set |interestGroup|'s fields accordingly.
  1. Set |interestGroup|'s [=interest group/expiry=] to the [=current wall time=] plus
    |group|["{{GenerateBidInterestGroup/lifetimeMs}}"] milliseconds.
  1. Set |interestGroup|'s [=interest group/next update after=] to the [=current wall time=] plus 24
    hours.
  1. Set |interestGroup|'s [=interest group/owner=] to the result of [=parsing an https origin=] on
    |group|["{{GenerateBidInterestGroup/owner}}"].
  1. If |interestGroup|'s [=interest group/owner=] is failure, then [=exception/throw=] a {{TypeError}}.
  1. Optionally, [=exception/throw=] a "{{NotAllowedError}}" {{DOMException}}.

    Note: This [=implementation-defined=] condition is intended to allow [=user agents=] to decline
        for a number of reasons, for example the [=interest group/owner=]'s [=site=] not being
        <a href="https://github.com/privacysandbox/attestation">enrolled</a>.
  1. Set |interestGroup|'s [=interest group/name=] to |group|["{{GenerateBidInterestGroup/name}}"].
  1. Set |interestGroup|'s [=interest group/priority=] to
    |group|["{{AuctionAdInterestGroup/priority}}"].
  1. Set |interestGroup|'s [=interest group/enable bidding signals prioritization=] to
    |group|["{{GenerateBidInterestGroup/enableBiddingSignalsPrioritization}}"].
  1. If |group|["{{GenerateBidInterestGroup/priorityVector}}"] [=map/exists=], then set
    |interestGroup|'s [=interest group/priority vector=] to
    |group|["{{GenerateBidInterestGroup/priorityVector}}"].
  1. If |group|["{{AuctionAdInterestGroup/prioritySignalsOverrides}}"] [=map/exists=], then set
    |interestGroup|'s [=interest group/priority signals overrides=] to
    |group|["{{AuctionAdInterestGroup/prioritySignalsOverrides}}"].
  1. Set |interestGroup|'s [=interest group/execution mode=] to
    |group|["{{GenerateBidInterestGroup/executionMode}}"].
  1. For each |groupMember| and |interestGroupField| in the following table
    <table class="data">
      <thead><tr><th>Group member</th><th>Interest group field</th></tr></thead>
      <tr>
        <td>"{{GenerateBidInterestGroup/biddingLogicURL}}"</td>
        <td>[=interest group/bidding url=]</td>
      </tr>
      <tr>
        <td>"{{GenerateBidInterestGroup/biddingWasmHelperURL}}"</td>
        <td>[=interest group/bidding wasm helper url=]</td>
      </tr>
      <tr>
        <td>"{{GenerateBidInterestGroup/updateURL}}"</td>
        <td>[=interest group/update url=]</td>
      </tr>
      <tr>
        <td>"{{GenerateBidInterestGroup/trustedBiddingSignalsURL}}"</td>
        <td>[=interest group/trusted bidding signals url=]</td>
      </tr>
    </table>
    1. If |group| [=map/contains=] |groupMember|:
      1. Let |parsedUrl| be the result of running the [=URL parser=] on |group|[|groupMember|].
      1. [=exception/Throw=] a {{TypeError}} if any of the following conditions hold:
        * |parsedUrl| is failure;
        * |parsedUrl| is not [=same origin=] with |interestGroup|'s [=interest group/owner=];
        * |parsedUrl| [=includes credentials=];
        * |parsedUrl| [=url/fragment=] is not null.
      1. Set |interestGroup|'s |interestGroupField| to |parsedUrl|.
  1. If |interestGroup|'s [=interest group/trusted bidding signals url=]'s [=url/query=] is not
    null, then [=exception/throw=] a {{TypeError}}.
  1. If |group|["{{GenerateBidInterestGroup/trustedBiddingSignalsKeys}}"] [=map/exists=], then set
    |interestGroup|'s [=interest group/trusted bidding signals keys=] to
    |group|["{{GenerateBidInterestGroup/trustedBiddingSignalsKeys}}"].
  1. If |group|["{{GenerateBidInterestGroup/userBiddingSignals}}"] [=map/exists=]:
    1. Set |interestGroup|'s [=interest group/user bidding signals=] to the result of
      [=serializing a JavaScript value to a JSON string=], given
      |group|["{{GenerateBidInterestGroup/userBiddingSignals}}"]. This can [=exception/throw=] a
      {{TypeError}}.
  1. For each |groupMember| and |interestGroupField| in the following table
    <table class="data">
      <thead><tr><th>Group member</th><th>Interest group field</th></tr></thead>
      <tr>
        <td>"{{GenerateBidInterestGroup/ads}}"</td>
        <td>[=interest group/ads=]</td>
      </tr>
      <tr>
        <td>"{{GenerateBidInterestGroup/adComponents}}"</td>
        <td>[=interest group/ad components=]</td>
      </tr>
    </table>
    1. If |group| [=map/contains=] |groupMember|, [=list/for each=] |ad| of |group|[|groupMember|]:
      1. Let |igAd| be a new [=interest group ad=].
      1. Let |renderURL| be the result of running the [=URL parser=] on
        |ad|["{{AuctionAd/renderURL}}"].
      1. [=exception/Throw=] a {{TypeError}} if any of the following conditions hold:
        * |renderURL| is failure;
        * |renderURL| [=url/scheme=] is not "`https`";
        * |renderURL| [=includes credentials=].
      1. Set |igAd|'s [=interest group ad/render url=] to |renderURL|.
      1. If |ad|["{{AuctionAd/metadata}}"] [=map/exists=], then let
        |igAd|'s [=interest group ad/metadata=] be the result of
        [=serializing a JavaScript value to a JSON string=], given |ad|["{{AuctionAd/metadata}}"].
        This can [=exception/throw=] a {{TypeError}}.
      1. If |groupMember| is "{{GenerateBidInterestGroup/ads}}":
        1. If |ad|["{{AuctionAd/buyerReportingId}}"] [=map/exists=], then set
          |igAd|'s [=interest group ad/buyer reporting ID=] to it.
        1. If |ad|["{{AuctionAd/buyerAndSellerReportingId}}"] [=map/exists=],
          then set |igAd|'s [=interest group ad/buyer and seller reporting ID=] to it.
        1. If |ad|["{{AuctionAd/allowedReportingOrigins}}"] [=map/exists=]:
          1. Let |allowedReportingOrigins| be a new [=list=] of [=origins=].
          1. [=list/For each=] |originStr| in |ad|["{{AuctionAd/allowedReportingOrigins}}"]:
            1. Let |origin| be the result of [=parsing an https origin=] on |originStr|.
            1. If |origin| is failure, then [=exception/throw=] a {{TypeError}}.
            1. [=list/Append=] |origin| to |allowedReportingOrigins|.
            1. If |allowedReportingOrigins|'s [=list/size=] &gt; 10, [=exception/throw=]
              a {{TypeError}}.
          1. Set |igAd|'s [=interest group ad/allowed reporting origins=] to |allowedReportingOrigins|.
      1. [=list/Append=] |igAd| to |interestGroup|'s |interestGroupField|.
  1. If |group|["{{AuctionAdInterestGroup/additionalBidKey}}"] [=map/exists=]:
    1. Let |decodedKey| be the result of running [=forgiving-base64 decode=] with
      |group|["{{AuctionAdInterestGroup/additionalBidKey}}"].
    1. [=exception/Throw=] a {{TypeError}} if any of the following conditions hold:
      * |decodedKey| is a failure;
      * |decodedKey|'s [=byte sequence/length=] is not 32;
      * |group|["{{GenerateBidInterestGroup/ads}}"] [=map/exists=];

      * |group|["{{GenerateBidInterestGroup/updateURL}}"] [=map/exists=].
    1. Set |interestGroup|'s [=interest group/additional bid key=] to |decodedKey|.
1. If |interestGroup|'s [=interest group/estimated size=] &gt; 1048576, then [=exception/throw=] a
  {{TypeError}}.
1. Let |p| be [=a new promise=].
1. Let |queue| be the result of [=starting a new parallel queue=].
1. [=parallel queue/enqueue steps|Enqueue the following steps=] to |queue|:
  1. Let |permission| be the result of [=checking interest group permissions=] with
    |interestGroup|'s [=interest group/owner=], |frameOrigin|, and "`join`".
  1. If |permission| is false, then [=queue a global task=] on [=DOM manipulation task source=],
    given |global|, to [=reject=] |p| with a "{{NotAllowedError}}" {{DOMException}} and abort these
    steps.
  1. [=Queue a global task=] on [=DOM manipulation task source=], given |global|, to [=resolve=] |p|
    with `undefined`.
  1. If the browser is currently storing an interest group with `owner` and `name` that matches
    |interestGroup|, then set the [=interest group/bid counts=],
    [=interest group/join counts=], and [=interest group/previous wins=] of
    |interestGroup| to the values of the currently stored one and remove
    the currently stored one from the browser.
  1. Set |interestGroup|'s [=interest group/joining origin=] to [=this=]'s
    [=relevant settings object=]'s [=environment/top-level origin=].
  1. Set |interestGroup|'s [=interest group/join time=] to the [=current wall time=].
  1. If the most recent entry in |interestGroup|'s [=interest group/join counts=] corresponds to
    the current day in UTC, increment its count. If not, [=list/insert=] a new [=tuple=]
    the time set to the current UTC day and a count of 1.
  1. Store |interestGroup| in the [=user agent=]'s [=interest group set=].
1. Return |p|.

</div>

<div algorithm>

The <dfn for="interest group">estimated size</dfn> of an [=interest group=] |ig| is the sum of:
1. The [=string/length=] of the [=serialization of an origin|serialization=] of |ig|'s
  [=interest group/owner=].
1. The [=string/length=] of |ig|'s [=interest group/name=].
1. 8, which is the size of |ig|'s [=interest group/priority=].
1. The [=string/length=] of |ig|'s [=interest group/execution mode=].
1. 2, which is the size of |ig|'s [=interest group/enable bidding signals prioritization=].
1. If |ig|'s [=interest group/priority vector=] is not null, [=map/for each=] |key| → |value| of
  [=interest group/priority vector=]:
  1. The [=string/length=] of |key|.
  1. 8, which is the size of |value|.
1. If |ig|'s [=interest group/priority signals overrides=] is not null, [=map/for each=] |key| → |value| of
  [=interest group/priority signals overrides=]:
  1. The [=string/length=] of |key|.
  1. 8, which is the size of |value|.
1. The [=string/length=] of the [=URL serializer|serialization=] of |ig|'s
  [=interest group/bidding url=], if the field is not null.
1. The [=string/length=] of the [=URL serializer|serialization=] of |ig|'s
  [=interest group/bidding wasm helper url=], if the field is not null.
1. The [=string/length=] of the [=URL serializer|serialization=] of |ig|'s
  [=interest group/update url=], if the field is not null.
1. The [=string/length=] of the [=URL serializer|serialization=] of |ig|'s
  [=interest group/trusted bidding signals url=], if the field is not null.
1. [=list/For each=] |key| of |ig|'s [=interest group/trusted bidding signals keys=]:
  1. The [=string/length=] of |key|.
1. The [=string/length=] of |ig|'s [=interest group/user bidding signals=].
1. If |ig|'s [=interest group/ads=] is not null, [=list/for each=] |ad| of it:
  1. The [=string/length=] of the [=URL serializer|serialization=] of |ad|'s
    [=interest group ad/render url=].
  1. The [=string/length=] of |ad|'s [=interest group ad/metadata=] if the field is not null.
  1. The [=string/length=] of |ad|'s [=interest group ad/buyer reporting ID=] if the field is not null.
  1. The [=string/length=] of |ad|'s [=interest group ad/buyer and seller reporting ID=] if the
    field is not null.
  1. If |ad|'s [=interest group ad/allowed reporting origins=] is not null, [=list/for each=]
    |origin| of it:
    1. The [=string/length=] of the [=serialization of an origin|serialization=] of |origin|.
1. If |ig|'s [=interest group/ad components=] is not null, [=list/for each=] |ad| of it:
  1. The [=string/length=] of the [=URL serializer|serialization=] of |ad|'s
    [=interest group ad/render url=].
  1. The [=string/length=] of |ad|'s [=interest group ad/metadata=] if the field is not null.
1. If |ig|'s [=interest group/additional bid key=] is not null:
  1. 32, which is its size (number of bytes). 

</div>

<div algorithm>

To <dfn>check interest group permissions</dfn> given an [=origin=] |ownerOrigin|, an [=origin=]
|frameOrigin|, and an enum |joinOrLeave| which is "`join`" or "`leave`":
1. If |ownerOrigin| is [=same origin=] with |frameOrigin|, then return true.
1. Let |encodedFrameOrigin| be the result of [=string/UTF-8 percent-encoding=] the
  [=serialization of an origin|serialized=] |frameOrigin| using [=component percent-encode set=].
1. Let |permissionsUrl| be a new [=URL=] with the following [=struct/items=]:
  :   [=url/scheme=]
  ::  |ownerOrigin|'s [=origin/scheme=]
  :   [=url/host=]
  ::  |ownerOrigin|'s [=origin/host=]
  :   [=url/port=]
  ::  |ownerOrigin|'s [=origin/port=]
  :   [=url/path=]
  ::  « ".well-known", "interest-group", "permissions" »
  :   [=url/query=]
  ::  The result of [=string/concatenating=] « "origin=", |encodedFrameOrigin| »
1. Let |request| be a new [=request=] with the following properties:
  :   [=request/URL=]
  ::  |permissionsUrl|
  :   [=request/header list=]
  ::  «`Accept`: `application/json`»
  :   [=request/client=]
  ::  `null`
  :   [=request/origin=]
  ::  |frameOrigin|
  :   [=request/mode=]
  ::  "`cors`"
  :   [=request/referrer=]
  :: "`no-referrer`"
  :   [=request/credentials mode=]
  ::  "`omit`"
  :   [=request/redirect mode=]
  :: "`error`"

  Issue: One of the side-effects of a `null` client for this subresource request is it neuters all
    service worker interceptions, despite not having to set the service workers mode.
1. Let |resource| be null.
1. [=Fetch=] |request| with [=fetch/useParallelQueue=] set to true, and
  [=fetch/processResponseConsumeBody=] set to the following steps given a [=response=] |response|
  and null, failure, or a [=byte sequence=] |responseBody|:
  1. If |responseBody| is null or failure, set |resource| to failure and return.
  1. Let |headers| be |response|'s [=response/header list=].
  1. Let |mimeType| be the result of [=header list/extracting a MIME type=] from |headers|.
  1. If |mimeType| is failure or is not a [=JSON MIME Type=], set |resource| to failure and return.
  1. Set |resource| to |responseBody|.
1. Wait for |resource| to be set.
1. If |resource| is failure, then return false.
1. Let |permissions| be the result of [=parsing JSON bytes to an Infra value=] with |resource|,
  returning false on failure.
1. If |permissions| is not an [=ordered map=], then return false.
1. If |joinOrLeave| is "`join`" and |permissions|["`joinAdInterestGroup`"] [=map/exists=], then
  return |permissions|["`joinAdInterestGroup`"].
1. If |joinOrLeave| is "`leave`" and |permissions|["`leaveAdInterestGroup`"] [=map/exists=], then
  return |permissions|["`leaveAdInterestGroup`"].
1. Return false.

The browser may cache requests for |permissionsUrl| within a network partition.

In order to prevent leaking data, the browser must request |permissionsUrl|
regardless of whether the user is a member of the ad interest group. This
prevents a leak of the user's ad interest group membership to the server.

</div>

<h3 id="interest-group-storage-maintenance">Interest Group Storage Maintenance</h3>

There is a job that periodically [=performs storage maintenance=] on the [=user agent=]'s
[=interest group set=]. It performs operations such as [=list/removing=] expired or excess
[=interest groups=]. An [=interest group set=] must respect the following limits. Implementations
may define their own values for the below constants, however we supply the below values as a
starting point, inspired by what the initial implementation of this specification uses:
  * <dfn>Interest group set max owners</dfn> is 1000, which defines the max number of
    [=interest group/owners=] in the [=user agent=]'s [=interest group set=].
  * <dfn>Max regular interest groups per owner</dfn> is 2000, which defines the max number of
    [=regular interest groups=] in the [=user agent=]'s [=interest group set=] for an
    [=interest group/owner=].
  * <dfn>Max negative interest groups per owner</dfn> is 20000, which defines the max number of
    [=negative interest groups=] in the [=user agent=]'s [=interest group set=] for an
    [=interest group/owner=].
  * <dfn>Max interest groups total size per owner</dfn> is <code>10\*1024\*1024</code>, which
    defines the max total [=interest group/estimated size|sizes=] of [=interest groups=] in the
    [=user agent=]'s [=interest group set=] for an [=interest group/owner=]. It includs both
    [=regular interest groups=] and [=negative interest groups=].

<div algorithm>
To <dfn>perform storage maintenance</dfn>:

1. Let |ownersAndExpiry| be a new [=ordered map=] whose [=map/keys=] are [=origins=] and
  [=map/values=] are [=moments=].

  Note: The [=map/key=] is from [=interest group/owner=], and [=map/value=] is from
    [=interest group/expiry=]. It's used to determine a set of [=interest group/owners=] whose
    [=interest groups=] will be removed from the [=user agent=]'s [=interest group set=] because the
    number of distinct [=interest group/owners=] exceeds the [=Interest group set max owners=] limit.
    It's sorted based on their [=map/values=] ([=interest group/expiry=]) in descending order, in
    order to remove [=interest groups=] of [=interest group/owners=] expiring soonest first.

1. Let |now| be the [=current wall time=].
1. [=list/For each=] |ig| of the [=user agent=]'s [=interest group set=]:
  1. Let |owner| be |ig|'s [=interest group/owner=].
  1. If |ig|'s [=interest group/expiry=] is before |now|, then [=list/remove=] |ig| from the
    [=user agent=]'s [=interest group set=] and [=iteration/continue=].
  1. If |ownersAndExpiry|[|owner|] [=map/exists=], then [=map/set=] |ownersAndExpiry|[|owner|] to
    |ig|'s [=interest group/expiry=] if it comes after |ownersAndExpiry|[|owner|].
  1. Otherwise, [=map/set=] |ownersAndExpiry|[|owner|] to |ig|'s [=interest group/expiry=].
1. If |ownersAndExpiry|'s [=map/size=] &gt; [=interest group set max owners=], then [=map/set=]
  |ownersAndExpiry| to |ownersAndExpiry| [=map/sorted in descending order=] with |a| being less than
  |b| if |a|'s [=map/value=] comes before |b|'s [=map/value=], where [=map/values=] are
  [=interest group/expiry=].
1. Let |owners| be the [=map/get the keys|keys=] of |ownersAndExpiry|.
1. [=list/For each=] |i| in [=the range=] from 0 to |owners|'s [=set/size=], exclusive:
  1. If |i| &ge; [=interest group set max owners=], then [=list/remove=] [=interest groups=] from
    the [=user agent=]'s [=interest group set=] whose [=interest group/owner=] is |owners|[|i|], and
    [=iteration/continue=].
  1. Let |regularIgs| be a [=list=] of [=regular interest groups=] in the [=user agent=]'s
    [=interest group set=] whose [=interest group/owner=] is |owners|[|i|].
  1. If |regularIgs|'s [=list/size=] &gt; [=max regular interest groups per owner=], then
    [=clear excess interest groups=] with |regularIgs| and [=max regular interest groups per owner=].
  1. Let |negativeIgs| be a [=list=] of [=negative interest groups=] in the [=user agent=]'s
    [=interest group set=] whose [=interest group/owner=] is |owners|[|i|].
  1. If |negativeIgs|'s [=list/size=] &gt; [=max negative interest groups per owner=], then
    [=clear excess interest groups=] with |negativeIgs| and [=max negative interest groups per owner=].
1. [=list/For each=] |owner| of |owners|:
  1. Let |igs| be a [=list=] of [=interest groups=] in the [=user agent=]'s [=interest group set=]
    whose [=interest group/owner=] is |owner|, [=list/sorted in descending order=] with |a| being
    less than |b| if |a|[=interest group/expiry=] comes before |b|[=interest group/expiry=].
  1. Let |cumulativeSize| be 0.
  1. [=list/For each=] |ig| of |igs|:
    1. If the sum of |cumulativeSize| and |ig|'s [=interest group/estimated size=]
      &gt; [=max interest groups total size per owner=], then [=list/remove=] |ig| from the
      [=user agent=]'s [=interest group set=].
    1. Otherwise, increment |cumulativeSize| by |ig|'s [=interest group/estimated size=].

</div>

<div algorithm>
To <dfn>clear excess interest groups</dfn> with a [=list=] of [=interest groups=] |igs|, and an
integer |maxIgs|:

1. Let |sortedIgs| be |igs| [=list/sorted in descending order=] with |a| being less
  than |b| if |a|'s [=interest group/expiry=] comes before |b|'s [=interest group/expiry=].

  Note: In order to remove interest groups expiring soonest first, sort interest groups based on
    their expiry in descending order.

1. [=list/For each=] |i| in [=the range=] from |maxIgs| to |igs|'s [=list/size=], exclusive:
  1. [=list/Remove=] |sortedIgs|[|i|] from the [=user agent=]'s [=interest group set=].

</div>

<h2 id="leaving-interest-groups">Leaving Interest Groups</h2>

<h3 id="leaveadinterestgroup">leaveAdInterestGroup()</h3>

*This first introductory paragraph is non-normative.*

{{Window/navigator}}.{{Navigator/leaveAdInterestGroup()}} removes a user from a particular interest
group.


<xmp class="idl">
[SecureContext]
partial interface Navigator {
  Promise<undefined> leaveAdInterestGroup(optional AuctionAdInterestGroupKey group = {});
};

dictionary AuctionAdInterestGroupKey {
  required USVString owner;
  required USVString name;
};
</xmp>

<div algorithm>

The <dfn for=Navigator method>leaveAdInterestGroup(group)</dfn> method steps are:

1. Let |global| be [=this=]'s [=relevant global object=].
1. Let |frameOrigin| be |global|'s [=environment settings object/origin=].
1. [=Assert=] that |frameOrigin| is not an [=opaque origin=] and its [=origin/scheme=] is "`https`".
1. Let |p| be [=a new promise=].
1. If |group| [=map/is empty=]:
  1. Let |instance| be |global|'s [=Window/browsing context=]'s
    [=browsing context/fenced frame config instance=].
  1. If |instance| is null, then return.
  1. Let |interestGroup| be |instance|'s [=fenced frame config instance/interest group descriptor=].
  1. Run these steps [=in parallel=]:
    1. [=Queue a global task=] on [=DOM manipulation task source=], given |global|, to [=resolve=]
      |p| with `undefined`.
    1. If |interestGroup| is not null:
      1. Let |owner| be |interestGroup|'s [=interest group descriptor/owner=].
      1. If |owner| is [=same origin=] with |frameOrigin|, then [=list/remove=] [=interest groups=]
        from the [=user agent=]'s [=interest group set=] whose [=interest group/owner=] is |owner| and
        [=interest group/name=] is |interestGroup|'s [=interest group descriptor/name=].
1. Otherwise:
  1. If |global|'s [=associated Document=] is not [=allowed to use=] the
    "[=join-ad-interest-group=]" [=policy-controlled feature=], then [=exception/throw=] a
    "{{NotAllowedError}}" {{DOMException}}.

    Note: Both joining and leaving interest groups use the "join-ad-interest-group" feature.
  1. Let |owner| be the result of [=parsing an https origin=] with
    |group|["{{AuctionAdInterestGroupKey/owner}}"].
  1. If |owner| is failure, [=exception/throw=] a {{TypeError}}.
  1. Run these steps [=in parallel=]:
    1. Let |permission| be the result of [=checking interest group permissions=] with
      |owner|, |frameOrigin|, and "`leave`".
    1. If |permission| is false, then [=queue a global task=] on [=DOM manipulation task source=],
      given |global|, to [=reject=] |p| with a "{{NotAllowedError}}" {{DOMException}} and abort
      these steps.
    1. [=Queue a global task=] on [=DOM manipulation task source=], given |global|, to [=resolve=]
      |p| with `undefined`.
    1. [=list/Remove=] [=interest groups=] from the [=user agent=]'s [=interest group set=] whose
      [=interest group/owner=] is |owner| and [=interest group/name=] is
      |group|["{{AuctionAdInterestGroupKey/name}}"].
1. Return |p|.

</div>

<h3 id="clearoriginjoinedAdInterestGroups">clearOriginJoinedAdInterestGroups()</h3>

*This first introductory paragraph is non-normative.*

{{Window/navigator}}.{{Navigator/clearOriginJoinedAdInterestGroups()}} removes a user from
[=interest groups=] whose [=interest group/joining origin=] is the associated
{{Navigator}}'s [=relevant settings object=]'s [=environment/top-level origin=].


<xmp class="idl">
[SecureContext]
partial interface Navigator {
  Promise<undefined> clearOriginJoinedAdInterestGroups(
      USVString owner, optional sequence<USVString> interestGroupsToKeep = []);
};
</xmp>

<div algorithm>

The <dfn for=Navigator method>clearOriginJoinedAdInterestGroups(|owner|, |interestGroupsToKeep|)</dfn>
method steps are:

1. Let |frameOrigin| be [=this=]'s [=relevant settings object=]'s
  [=environment settings object/origin=].
1. [=Assert=] that |frameOrigin| is not an [=opaque origin=] and its [=origin/scheme=] is "`https`".
1. Let |p| be [=a new promise=].
1. Let |global| be [=this=]'s [=relevant global object=].
1. If |global|'s [=associated Document=] is not [=allowed to use=] the
  "[=join-ad-interest-group=]" [=policy-controlled feature=], then [=exception/throw=] a
  "{{NotAllowedError}}" {{DOMException}}.

  Note: Both joining and leaving interest groups use the "join-ad-interest-group" feature.
1. Let |ownerOrigin| be the result of [=parsing an https origin=] with |owner|.
1. If |ownerOrigin| is failure, [=exception/throw=] a {{TypeError}}.
1. Run these steps [=in parallel=]:
  1. Let |permission| be the result of [=checking interest group permissions=] with
    |ownerOrigin|, |frameOrigin|, and "`leave`".
  1. If |permission| is false, then [=queue a global task=] on the [=DOM manipulation task source=]
    given |global|, [=reject=] |p| with a "{{NotAllowedError}}" {{DOMException}} and abort these steps.
  1. [=Queue a global task=] on the [=DOM manipulation task source=] given |global|, to [=resolve=] |p|
    with {{undefined}}.
  1. [=list/Remove=] [=interest groups=] from the [=user agent=]'s [=interest group set=]
    whose [=interest group/owner=] is |ownerOrigin|, whose [=interest group/joining origin=] is
    |frameOrigin|, and whose [=interest group/name=] is not in |interestGroupsToKeep|.
1. Return |p|.

</div>

<h2 id="running-ad-auctions">Running Ad Auctions</h2>

*This first introductory paragraph is non-normative.*

When a website or someone working on behalf of the website (e.g. a supply side platform, SSP) wants
to conduct an auction to select an advertisement to display to the user, they can call the
{{Window/navigator}}.{{Navigator/runAdAuction()}} function, providing an auction configuration that
tells the browser how to conduct the auction and which on-device recorded interests are allowed to
bid in the auction for the chance to display their advertisement.

<h3 id="runadauction">runAdAuction()</h3>

<xmp class="idl">
[SecureContext]
partial interface Navigator {
  Promise<(USVString or FencedFrameConfig)?> runAdAuction(AuctionAdConfig config);
};

dictionary AuctionAdConfig {
  required USVString seller;
  required USVString decisionLogicURL;
  USVString trustedScoringSignalsURL;
  sequence<USVString> interestGroupBuyers;
  Promise<any> auctionSignals;
  record<DOMString, DOMString> requestedSize;
  Promise<any> sellerSignals;
  Promise<DOMString> directFromSellerSignalsHeaderAdSlot;
  unsigned long long sellerTimeout;
  unsigned short sellerExperimentGroupId;
  USVString sellerCurrency;
  Promise<record<USVString, any>> perBuyerSignals;
  Promise<record<USVString, unsigned long long>> perBuyerTimeouts;
  Promise<record<USVString, unsigned long long>> perBuyerCumulativeTimeouts;
  record<USVString, unsigned short> perBuyerGroupLimits;
  record<USVString, unsigned short> perBuyerExperimentGroupIds;
  record<USVString, record<USVString, double>> perBuyerPrioritySignals;
  Promise<record<USVString, USVString>> perBuyerCurrencies;
  sequence<AuctionAdConfig> componentAuctions = [];
  Promise<undefined> additionalBids;
  DOMString auctionNonce;
  AbortSignal? signal;
  Promise<boolean> resolveToConfig;
};
</xmp>

<div algorithm="runAdAuction()">

The <dfn for=Navigator method>runAdAuction(|config|)</dfn> method steps are:

1. Let |global| be [=this=]'s [=relevant global object=].
1. Let |settings| be [=this=]'s [=relevant settings object=].
1. If |global|'s [=associated Document=] is not [=allowed to use=] the "[=run-ad-auction=]"
  [=policy-controlled feature=], then [=exception/throw=] a "{{NotAllowedError}}" {{DOMException}}.
1. Let |auctionConfig| be the result of running [=validate and convert auction ad config=] with
  |config| and true.
1. If |auctionConfig| is failure, then [=exception/throw=] a {{TypeError}}.
1. Optionally, [=exception/throw=] a "{{NotAllowedError}}" {{DOMException}}.

    Note: This [=implementation-defined=] condition is intended to allow [=user agents=] to decline
        for a number of reasons, for example the [=auction config/seller=]'s [=site=] not being
        <a href="https://github.com/privacysandbox/attestation">enrolled</a>.
1. Let |p| be [=a new promise=].
1. Let |configMapping| be |global|'s [=associated Document=]'s [=node navigable=]'s
  [=navigable/traversable navigable=]'s [=traversable navigable/fenced frame config mapping=].
1. Let |pendingConfig| be the result of [=constructing a pending fenced frame config=] with
  |auctionConfig|.
1. Let |urn| be the result of running [=fenced frame config mapping/store a pending config=] on
  |configMapping| with |pendingConfig|.
1. If |urn| is failure, then resolve |p| with null and return |p|.
1. Let |bidIgs| be a new [=list=] of [=interest groups=].
1. If |config|["{{AuctionAdConfig/signal}}"] [=map/exists=], then:
  1. Let |signal| be |config|["{{AuctionAdConfig/signal}}"].
  1. If |signal| is [=AbortSignal/aborted=], then [=reject=] |p| with |signal|'s
    [=AbortSignal/abort reason=] and return |p|.
  1. [=AbortSignal/Add|Add the following abort steps=] to |signal|:
    1. [=Reject=] |p| with |signal|’s [=AbortSignal/abort reason=].
    1. Run [=update bid counts=] with |bidIgs|.
    1. Run [=interest group update=] with |auctionConfig|'s
      [=auction config/interest group buyers=].
1. Let |queue| be the result of [=starting a new parallel queue=].
1. [=parallel queue/enqueue steps|Enqueue the following steps=] to |queue|:
  1. Let |winnerInfo| be the result of running [=generate and score bids=] with |auctionConfig|,
     null, |global|, |settings|'s [=environment/top-level origin=], and |bidIgs|.
  1. If |winnerInfo| is failure, then [=queue a global task=] on [=DOM manipulation task source=],
    given |global|, to [=reject=] |p| with a "{{TypeError}}".
  1. If |winnerInfo| is null or |winnerInfo|'s [=leading bid info/leading bid=] is null, then
    [=queue a global task=] on [=DOM manipulation task source=], given |global|, to resolve |p| with
    null.
  1. Otherwise:
    1. Let |winner| be |winnerInfo|'s [=leading bid info/leading bid=].
    1. Let |fencedFrameConfig| be the result of [=filling in a pending fenced frame config=] with
       |pendingConfig|, |auctionConfig|, and |winnerInfo|.
    1. [=fenced frame config mapping/Finalize a pending config=] on |configMapping| with |urn| and
       |fencedFrameConfig|.
    1. Wait until |auctionConfig|'s [=auction config/resolve to config=] is a boolean.
    1. Let |result| be |fencedFrameConfig|.
    1. If |auctionConfig|'s [=auction config/resolve to config=] is false, then set |result| to |urn|.
    1. [=Queue a global task=] on the [=DOM manipulation task source=], given |global|, to
       resolve |p| with |result|.
    1. [=Increment ad k-anonymity count=] given |winner|'s [=generated bid/interest group=] and
      |winner|'s [=generated bid/ad descriptor=]'s [=ad descriptor/url=].
    1. If |winner|'s [=generated bid/ad component descriptors=] is not null:
      1. [=set/For each=] |adComponentDescriptor| in |winner|'s
        [=generated bid/ad component descriptors=]:
        1. [=Increment component ad k-anonymity count=] given |adComponentDescriptor|'s
          [=ad descriptor/url=].
    1. [=Increment reporting ID k-anonymity count=] given |winner|'s
      [=generated bid/interest group=] and |winner|'s [=generated bid/ad descriptor=]'s
      [=ad descriptor/url=].
  1. Run [=interest group update=] with |auctionConfig|'s [=auction config/interest group buyers=].
  1. Run [=update bid counts=] with |bidIgs|.
  1. Run [=update previous wins=] with |winner|.
1. Return |p|.

</div>

<div algorithm>

To <dfn>construct a pending fenced frame config</dfn> given an [=auction config=]
|config|:
1. Return a [=fenced frame config=] with the following [=struct/items=]:
  : [=fenced frame config/mapped url=]
  :: a [=struct=] with the following [=struct/items=]:
    : [=mapped url/value=]
    :: `"about:blank"`

    : [=mapped url/visibility=]
    :: "<a for=visibility>`opaque`</a>"

  : [=fenced frame config/container size=]
  :: TODO: fill this in once container size is spec'd to be in |config|

  : [=fenced frame config/content size=]
  :: null

  : [=fenced frame config/interest group descriptor=]
  :: a [=struct=] with the following [=struct/items=]:
    : [=interest group descriptor/value=]
    :: a [=struct=] with the following [=struct/items=]:
      : [=interest group descriptor/owner=]
      :: ""

      : [=interest group descriptor/name=]
      :: ""

    : [=interest group descriptor/visibility=]
    :: "<a for=visibility>`opaque`</a>"

  : [=fenced frame config/on navigate callback=]
  :: null

  : [=fenced frame config/effective sandbox flags=]
  :: a [=struct=] with the following [=struct/items=]:
    : [=effective sandbox flags/value=]
    :: TODO: fill this in once fenced frame sandbox flags are more fully specified

    : [=effective sandbox flags/visibility=]
    :: "<a for=visibility>`opaque`</a>"

  : [=fenced frame config/effective enabled permissions=]
  :: a [=struct=] with the following [=struct/items=]:
    : [=effective enabled permissions/value=]
    :: «"<code>{{PermissionPolicy/attribution-reporting}}</code>",
        "<code>[=private-aggregation=]</code>", "<code>[=shared-storage=]</code>",
        "<code>[=shared-storage-select-url=]</code>"»

    : [=effective enabled permissions/visibility=]
    :: "<a for=visibility>`opaque`</a>"

  : [=fenced frame config/fenced frame reporting metadata=]
  :: null

  : [=fenced frame config/exfiltration budget metadata=]
  :: null

  : [=fenced frame config/nested configs=]
  :: a [=struct=] with the following [=struct/items=]:
    : [=nested configs/value=]
    :: an empty [=list=] «»

    : [=nested configs/visibility=]
    :: "<a for=visibility>`opaque`</a>"

  : [=fenced frame config/embedder shared storage context=]
  :: null

</div>

<div algorithm>

To <dfn>fill in a pending fenced frame config</dfn> given a [=fenced frame config=]
|pendingConfig|, [=auction config=] |auctionConfig|, and [=leading bid info=] |winningBidInfo|:
1. Let |winningBid| be |winningBidInfo|'s [=leading bid info/leading bid=].
1. Set |pendingConfig|'s [=fenced frame config/mapped url=]'s [=mapped url/value=] to
   |winningBid|'s [=generated bid/ad descriptor=]'s [=ad descriptor/url=].
1. Let |adSize| be |winningBid|'s [=generated bid/ad descriptor=]'s [=ad descriptor/size=].
1. If |adSize| is not null:
   1. Set |pendingConfig|'s [=fenced frame config/content size=] to a [=struct=] with the following
      [=struct/items=]:
     : [=content size/value=]
     :: |adSize| TODO: Resolve screen-relative sizes and macros and cast this properly.

     : [=content size/visibility=]
     :: "<a for=visibility>`opaque`</a>"
1. Set |pendingConfig|'s [=fenced frame config/interest group descriptor=]'s
   [=interest group descriptor/value=] to a [=struct=] with the following [=struct/items=]:
     : owner
     :: |winningBid|'s [=generated bid/interest group=]'s [=interest group/owner=]

     : name
     :: |winningBid|'s [=generated bid/interest group=]'s [=interest group/name=]
1. Let |fencedFrameReportingMap| be the [=map=] «[ "`buyer`" → «», "`seller`" → «» ]».
1. If |auctionConfig|'s [=auction config/component auctions=] is [=list/empty=], then [=map/set=]
  |fencedFrameReportingMap|["`component-seller`"] to an empty [=list=] «».
1. Set |pendingConfig|'s [=fenced frame config/fenced frame reporting metadata=] to a [=struct=]
   with the following [=struct/items=]:
    : [=fenced frame reporting metadata/value=]
    :: A [=struct=]  with the following [=struct/items=]:
       : [=fenced frame reporting metadata/fenced frame reporting map=]
       :: |fencedFrameReportingMap|

       : [=fenced frame reporting metadata/direct seller is seller=]
       :: true if |auctionConfig|'s [=auction config/component auctions=] is [=list/empty=], false
          otherwise

       : [=fenced frame reporting metadata/allowed reporting origins=]
       :: |winningBid|'s [=generated bid/bid ad=]'s [=interest group ad/allowed reporting origins=]

    : [=fenced frame reporting metadata/visibility=]
    :: "<a for=visibility>`opaque`</a>"
1. Set |pendingConfig|'s [=fenced frame config/on navigate callback=] to an algorithm with these
   steps:
   1. [=Asynchronously finish reporting=] with |pendingConfig|'s
      [=fenced frame config/fenced frame reporting metadata=]'s
      [=fenced frame reporting metadata/value=]'s
      [=fenced frame reporting metadata/fenced frame reporting map=] and |winningBidInfo|.
1. Set |pendingConfig|'s [=fenced frame config/nested configs=]'s [=nested configs/value=] to
   the result of running [=create nested configs=] with |winningBid|'s
   [=generated bid/ad component descriptors=].
1. Return |pendingConfig|.

</div>

<div algorithm>

To <dfn>asynchronously finish reporting</dfn> given a
[=fencedframetype/fenced frame reporting map=] |reportingMap| and [=leading bid info=]
|leadingBidInfo|:
1. Let |buyerDone|, |sellerDone|, and |componentSellerDone| be [=booleans=], initially false.
1. If |leadingBidInfo|'s [=leading bid info/component seller=] is null, set |componentSellerDone|
   to true.
1. [=iteration/While=]:
   1. If |buyerDone|, |sellerDone|, and |componentSellerDone| are all true, then
      [=iteration/break=].
   1. Wait until one of the following fields of |leadingBidInfo| being not null:
      * [=leading bid info/buyer reporting result=];
      * [=leading bid info/seller reporting result=];
      * [=leading bid info/component seller reporting result=].
   1. If |buyerDone| is false and |leadingBidInfo|'s [=leading bid info/buyer reporting result=]
      is not null:
      1. Let |buyerMap| be |leadingBidInfo|'s [=leading bid info/buyer reporting result=]'s
         [=reporting result/reporting beacon map=].
      1. If |buyerMap| is null, set |buyerMap| to an empty [=map=] «[]».
      1. Let |macroMap| be |leadingBidInfo|'s [=leading bid info/buyer reporting result=]'s
         [=reporting result/reporting macro map=].
      1. [=Finalize a reporting destination=] with |reportingMap|,
         {{FenceReportingDestination/buyer}}, |buyerMap|, and |macroMap|.
      1. [=Send report=] to |leadingBidInfo|'s [=leading bid info/buyer reporting result=]'s
         [=reporting result/report url=].
      1. Set |buyerDone| to true.
   1. If |sellerDone| is false and |leadingBidInfo|'s [=leading bid info/seller reporting result=]
      is not null:
      1. Let |sellerMap| be |leadingBidInfo|'s [=leading bid info/seller reporting result=]'s
         [=reporting result/reporting beacon map=].
      1. If |sellerMap| is null, set |sellerMap| to an empty [=map=] «[]».
      1. [=Finalize a reporting destination=] with |reportingMap|,
         {{FenceReportingDestination/seller}}, and |sellerMap|.
      1. [=Send report=] to |leadingBidInfo|'s [=leading bid info/seller reporting result=]'s
         [=reporting result/report url=].
      1. Set |sellerDone| to true.
   1. If |componentSellerDone| is false and |leadingBidInfo|'s
      [=leading bid info/component seller reporting result=] is not null:
      1. Let |componentSellerMap| be |leadingBidInfo|'s
         [=leading bid info/component seller reporting result=]'s
         [=reporting result/reporting beacon map=].
      1. If |componentSellerMap| is null, set |componentSellerMap| to an empty [=map=] «[]».
      1. [=Finalize a reporting destination=] with |reportingMap|,
         {{FenceReportingDestination/component-seller}}, and |componentSellerMap|.
      1. [=Send report=] to |leadingBidInfo|'s [=leading bid info/component seller reporting result=]'s
         [=reporting result/report url=].
      1. Set |componentSellerDone| to true.

</div>

<div algorithm>

To <dfn>create nested configs</dfn> given [=generated bid/ad component descriptors=]
|adComponentDescriptors|:
1. Let |nestedConfigs| be an empty [=list=] «».
1. If |adComponentDescriptors| is null:
  1. Return |nestedConfigs|.
1. [=set/For each=] |adComponentDescriptor| of |adComponentDescriptors|:
  1. Let |fencedFrameConfig| be a [=fenced frame config=] with the following [=struct/items=]:
    : [=fenced frame config/mapped url=]
    :: a [=struct=] with the following [=struct/items=]:
      : [=mapped url/value=]
      :: |adComponentDescriptor|'s [=ad descriptor/url=]

      : [=mapped url/visibility=]
      :: "<a for=visibility>`opaque`</a>"

    : [=fenced frame config/container size=]
    :: null

    : [=fenced frame config/content size=]
    :: If |adComponentDescriptor|'s [=ad descriptor/size=] is null, then null. Otherwise, a
       [=struct=] with the following [=struct/items=]:
       : [=content size/value=]
       :: |adComponentDescriptor|'s [=ad descriptor/size=] TODO: Resolve screen-relative sizes and
          macros and cast this properly.

       : [=content size/visibility=]
       :: "<a for=visibility>`opaque`</a>"

    : [=fenced frame config/interest group descriptor=]
    :: null

    : [=fenced frame config/on navigate callback=]
    :: null

    : [=fenced frame config/effective sandbox flags=]
    :: a [=struct=] with the following [=struct/items=]:
      : [=effective sandbox flags/value=]
      :: TODO: fill this in once fenced frame sandbox flags are more fully specified

      : [=effective sandbox flags/visibility=]
      :: "<a for=visibility>`opaque`</a>"

    : [=fenced frame config/effective enabled permissions=]
    :: a [=struct=] with the following [=struct/items=]:
      : [=effective enabled permissions/value=]
      :: «"<code>{{PermissionPolicy/attribution-reporting}}</code>",
          "<code>[=private-aggregation=]</code>", "<code>[=shared-storage=]</code>",
          "<code>[=shared-storage-select-url=]</code>"»
      : [=effective enabled permissions/visibility=]
      :: "<a for=visibility>`opaque`</a>"

    : [=fenced frame config/fenced frame reporting metadata=]
    :: null

    : [=fenced frame config/exfiltration budget metadata=]
    :: null

    : [=fenced frame config/nested configs=]
    :: a [=struct=] with the following [=struct/items=]:
      : [=nested configs/value=]
      :: an empty [=list=] «»

      : [=nested configs/visibility=]
      :: "<a for=visibility>`opaque`</a>"

    : [=fenced frame config/embedder shared storage context=]
    :: null

  1. [=list/Append=] |fencedFrameConfig| to |nestedConfigs|.
1. Return |nestedConfigs|.

</div>

<div algorithm="validate and convert auction ad config">

To <dfn>validate and convert auction ad config</dfn> given an {{AuctionAdConfig}} |config| and a
[=boolean=] |isTopLevel|:
1. [=Assert=] that these steps are not running [=in parallel=].
1. Let |auctionConfig| be a new [=auction config=].
1. Let |seller| be the result of [=parsing an https origin=] with |config|["{{AuctionAdConfig/seller}}"].
1. If |seller| is failure, then return failure.
1. Set |auctionConfig|'s [=auction config/seller=] to |seller|.
1. Let |decisionLogicURL| be the result of running the [=URL parser=] on
  |config|["{{AuctionAdConfig/decisionLogicURL}}"].
1. If |decisionLogicURL| is failure, or it is not [=same origin=] with |auctionConfig|'s
  [=auction config/seller=], then return failure.
1. Set |auctionConfig|'s [=auction config/decision logic url=] to |decisionLogicURL|.
1. If |config|["{{AuctionAdConfig/trustedScoringSignalsURL}}"] [=map/exists=]:
  1. Let |trustedScoringSignalsURL| be the result of running the [=URL parser=] on
    |config|["{{AuctionAdConfig/trustedScoringSignalsURL}}"].
  1. If |trustedScoringSignalsURL| is failure, or it is not [=same origin=] with |auctionConfig|'s
    [=auction config/seller=], then return failure.
  1. [=Assert=]: |trustedScoringSignalsURL|'s [=url/scheme=] is "`https`".
  1. Set |auctionConfig|'s [=auction config/trusted scoring signals url=] to
    |trustedScoringSignalsURL|.
1. If |config|["{{AuctionAdConfig/interestGroupBuyers}}"] [=map/exists=]:
  1. Let |buyers| be a new empty [=list=].
  1. [=list/For each=] |buyerString| in |config|["{{AuctionAdConfig/interestGroupBuyers}}"]:
    1. Let |buyer| be the result of [=parsing an https origin=] with |buyerString|.
    1. If |buyer| is failure, then return failure.
    1. [=list/Append=] |buyer| to |buyers|.
  1. Set |auctionConfig|'s [=auction config/interest group buyers=] to |buyers|.
1. If |config|["{{AuctionAdConfig/auctionSignals}}"] [=map/exists=]:
  1. Set |auctionConfig|'s [=auction config/auction signals=] to
    |config|["{{AuctionAdConfig/auctionSignals}}"].
  1. [=Handle an input promise in configuration=] given |auctionConfig| and |auctionConfig|'s
    [=auction config/auction signals=]:
    * To parse the value |result|, set |auctionConfig|'s [=auction config/auction signals=] to the
      result of [=serializing a JavaScript value to a JSON string=].
    * To handle an error, set |auctionConfig|'s [=auction config/auction signals=] to failure.
1. If |config|["{{AuctionAdConfig/requestedSize}}"] [=map/exists=]:
  1. Let |requestedSize| be |config|["{{AuctionAdConfig/requestedSize}}"]
  1. If |requestedSize|["height"] does not [=map/exist=], throw a {{TypeError}}.

  1. If |requestedSize|["width"] does not [=map/exist=], throw a {{TypeError}}.

  1. Let |width| and |widthUnit| be the dimension and dimension unit that results from running
    [=parse an AdRender dimension value=] with |requestedSize|["width"], respectively.
  1. If |width| is null, throw a {{TypeError}}.

  1. Let |height| and |heightUnit| be the dimension and dimension unit that results from running
    [=parse an AdRender dimension value=] with |requestedSize|["height"], respectively.
  1. If |height| is null, throw a {{TypeError}}.

  1. Let |adSize| be a new [=ad size=].
  1. Set |adSize|'s [=ad size/width=] to |width|, [=ad size/width units=] to |widthUnit|,
    [=ad size/height=] to |height|, [=ad size/height units=] to |heightUnit|.
  1. Set |auctionConfig|'s [=auction config/requested size=] to |adSize|.
1. If |config|["{{AuctionAdConfig/sellerSignals}}"] [=map/exists=]:
  1. Set |auctionConfig|'s [=auction config/seller signals=] to
    |config|["{{AuctionAdConfig/sellerSignals}}"].
  1. [=Handle an input promise in configuration=] given |auctionConfig| and |auctionConfig|'s
    [=auction config/seller signals=]:
    * To parse the value |result|, set |auctionConfig|'s [=auction config/seller signals=] to the
      result of [=serializing a JavaScript value to a JSON string=], given |result|.
    * To handle an error, set |auctionConfig|'s [=auction config/seller signals=] to failure.
1. If |config|["{{AuctionAdConfig/auctionNonce}}"] [=map/exists=], then [=map/set=] |auctionConfig|'s

  [=auction config/auction nonce=] to the result of running [=get uuid from string=] with
  |config|["{{AuctionAdConfig/auctionNonce}}"].
1. If |config|["{{AuctionAdConfig/additionalBids}}"] [=map/exists=]:
  1. [=exception/Throw=] a {{TypeError}} if any of the following conditions hold:
    * |config|["{{AuctionAdConfig/auctionNonce}}"] does not [=map/exist=];
    * |config|["{{AuctionAdConfig/interestGroupBuyers}}"] does not [=map/exist=], or is [=list/empty=];
    * |config|["{{AuctionAdConfig/componentAuctions}}"] is not [=list/empty=].
  1. Set |auctionConfig|'s [=auction config/expects additional bids=] to true.
  1. [=Handle an input promise in configuration=] given |auctionConfig| and
    |config|["{{AuctionAdConfig/additionalBids}}"]:

    Note: The JavaScript code calling {{Navigator/runAdAuction()}} is responsible for *not*
      resolving |config|["{{AuctionAdConfig/additionalBids}}"] until additional bids have been
      retrieved from one or more [:Ad-Auction-Additional-Bid:] headers, as resolving this Promise
      early would cause a race condition in which additional bids might not be included in the
      auction. There are two ways that additional bids can be retrieved. The first is for the
      JavaScript code to issue a [=request=] whose [=request/initiator type=] is `"fetch"` and whose
      {{RequestInit/adAuctionHeaders}} option is set to `true`. The JavaScript code has to resolve
      |config|["{{AuctionAdConfig/additionalBids}}"] after the corresponding call to
      {{WindowOrWorkerGlobalScope/fetch()}} has resolved to a [=response=].
      The JavaScript code can also choose to wait to call {{Navigator/runAdAuction()}} until after
      the corresponding call to {{WindowOrWorkerGlobalScope/fetch()}} has resolved to a response,
      and can then immediately resolve |config|["{{AuctionAdConfig/additionalBids}}"].

      The second way that additional bids can be retrieved is by issuing an
      <a spec="html" lt="navigate an iframe or frame">iframe navigation</a>
      request with the <{iframe/adauctionheaders}> <a spec=html>content attribute</a> set to `true`.
      In this case, the JavaScript code is retrieved as part of the iframe navigation response,
      at which point the JavaScript code in the iframe makes the call to
      {{Navigator/runAdAuction()}}, and |config|["{{AuctionAdConfig/additionalBids}}"] can be
      immediately resolved.

    * To parse the value |result|:
      1. Set |auctionConfig|'s [=auction config/expects additional bids=] to false.
    * To handle an error:
      1. Set |auctionConfig|'s [=auction config/expects additional bids=] to failure.
1. If |config|["{{AuctionAdConfig/directFromSellerSignalsHeaderAdSlot}}"] [=map/exists=]:
  1. [=Handle an input promise in configuration=] given |auctionConfig| and
    |config|["{{AuctionAdConfig/directFromSellerSignalsHeaderAdSlot}}"]:

    Note: The JavaScript code calling {{Navigator/runAdAuction()}} is responsible for *not*
      resolving |config|["{{AuctionAdConfig/directFromSellerSignalsHeaderAdSlot}}"]
      until direct from seller signals have been retrieved from one or more [:Ad-Auction-Signals:]
      headers, as resolving this Promise early would cause a race condition in which the worklet
      might run without the direct from seller signals that it needs. There are two ways that
      direct from seller signals can be retrieved. The first is for the JavaScript code to issue a
      [=request=] whose [=request/initiator type=] is `"fetch"` and whose
      {{RequestInit/adAuctionHeaders}} option is set to `true`. The JavaScript code has to resolve
      |config|["{{AuctionAdConfig/directFromSellerSignalsHeaderAdSlot}}"] after the corresponding
      call to {{WindowOrWorkerGlobalScope/fetch()}} has resolved to a [=response=]. The JavaScript
      code can also choose to wait to call {{Navigator/runAdAuction()}} until after the
      corresponding call to {{WindowOrWorkerGlobalScope/fetch()}} has resolved to a [=response=],
      and can then immediately resolve
      |config|["{{AuctionAdConfig/directFromSellerSignalsHeaderAdSlot}}"]. The second way that
      direct from seller signals can be retrieved is by issuing an
      <a spec="html" lt="navigate an iframe or frame">iframe navigation</a>
      request with the <{iframe/adauctionheaders}> <a spec=html>content attribute</a> set to `true`.
      In this case, the JavaScript code is retrieved as part of the iframe navigation response,
      at which point the JavaScript code in the iframe makes the call to
      {{Navigator/runAdAuction()}}, and
      |config|["{{AuctionAdConfig/directFromSellerSignalsHeaderAdSlot}}"] can be can be specified
      directly without a Promise.

    * To parse the value |result|:
      1. Set |auctionConfig|'s [=auction config/direct from seller signals header ad slot=] to
        |result|.
    * To handle an error:
      1. Set |auctionConfig|'s [=auction config/direct from seller signals header ad slot=] to
        failure.
1. If |config|["{{AuctionAdConfig/sellerTimeout}}"] [=map/exists=], set |auctionConfig|'s
  [=auction config/seller timeout=] to |config|["{{AuctionAdConfig/sellerTimeout}}"] in milliseconds
  or 500 milliseconds, whichever is smaller.
1. If |config|["{{AuctionAdConfig/sellerExperimentGroupId}}"] [=map/exists=], then set
  |auctionConfig|'s [=auction config/seller experiment group id=] to
  |config|["{{AuctionAdConfig/sellerExperimentGroupId}}"].
1. If |config|["{{AuctionAdConfig/sellerCurrency}}"]  [=map/exists=]:
  1. If the result of [=checking whether a string is a valid currency tag=] on
    |config|["{{AuctionAdConfig/sellerCurrency}}"] is false, then return failure.
  1. Set |auctionConfig|'s [=auction config/seller currency=] to
    |config|["{{AuctionAdConfig/sellerCurrency}}"].
1. If |config|["{{AuctionAdConfig/perBuyerSignals}}"] [=map/exists=]:
  1. Set |auctionConfig|'s [=auction config/per buyer signals=] to
    |config|["{{AuctionAdConfig/perBuyerSignals}}"].
  1. [=Handle an input promise in configuration=] given |auctionConfig| and |auctionConfig|'s
    [=auction config/per buyer signals=]:
    * To parse the value |result|:
      1. Set |auctionConfig|'s [=auction config/per buyer signals=] to a new [=ordered map=] whose
        [=map/keys=] are [=origins=] and whose [=map/values=] are [=strings=].
      1. [=map/For each=] |key| → |value| of |result|:
        1. Let |buyer| be the result of [=parsing an https origin=] with |key|. If |buyer| is
           failure, throw a {{TypeError}}.
        1. Let |signalsString| be the result of [=serializing a JavaScript value to a JSON string=],
          given |value|.
        1. [=map/Set=] |auctionConfig|'s [=auction config/per buyer signals=][|buyer|] to
          |signalsString|.
    * To handle an error, set |auctionConfig|'s [=auction config/per buyer signals=] to failure.
1. For each |idlTimeoutMember|, |perBuyerTimeoutField|, |allBuyersTimeoutField| in the following table
  <table class="data">
    <thead><tr><th>IDL timeout member</th><th>Per buyer timeout field</th><th>All buyers timeout field</th></tr></thead>
    <tr>
      <td>"{{AuctionAdConfig/perBuyerTimeouts}}"</td>
      <td>[=auction config/per buyer timeouts=]</td>
      <td>[=auction config/all buyers timeout=]</td>
    </tr>
    <tr>
      <td>"{{AuctionAdConfig/perBuyerCumulativeTimeouts}}"</td>
      <td>[=auction config/per buyer cumulative timeouts=]</td>
      <td>[=auction config/all buyers cumulative timeout=]</td>
    </tr>
  </table>
  1. If |config| [=map/contains=] |idlTimeoutMember|:
    1. Set |auctionConfig|'s |perBuyerTimeoutField| to |config|[|idlTimeoutMember|].
    1. [=Handle an input promise in configuration=] given |auctionConfig| and |auctionConfig|'s
      |perBuyerTimeoutField|:
      * To parse the value |result|:
        1. Set |auctionConfig|'s |perBuyerTimeoutField| to a new [=ordered map=] whose
          [=map/keys=] are [=origins=] and whose [=map/values=] are [=durations=] in milliseconds.
        1. [=map/For each=] |key| → |value| of |result|:
          1. If |perBuyerTimeoutField| is "{{AuctionAdConfig/perBuyerTimeouts}}", and
            |value| &gt; 500, then set |value| to 500.
          1. If |key| is "*", then set |auctionConfig|'s |allBuyersTimeoutField| to |value| in
            milliseconds, and [=iteration/continue=].
          1. Let |buyer| be the result of [=parsing an https origin=] with |key|. If |buyer| is
            failure, [=exception/throw=] a {{TypeError}}.
          1. [=map/Set=] |auctionConfig|'s |perBuyerTimeoutField|[|buyer|] to |value| in milliseconds.
      * To handle an error, set |auctionConfig|'s |perBuyerTimeoutField| to failure.
1. If |config|["{{AuctionAdConfig/perBuyerGroupLimits}}"] [=map/exists=], [=map/for each=]
  |key| → |value| of |config|["{{AuctionAdConfig/perBuyerGroupLimits}}"]:
  1. If |value| is 0, then return failure.
  1. If |key| is "*", then set |auctionConfig|'s [=auction config/all buyers group limit=]
    to |value|, and [=iteration/continue=].
  1. Let |buyer| be the result of [=parsing an https origin=] with |key|.
  1. If |buyer| is failure, then return failure.
  1. Set |auctionConfig|'s [=auction config/per buyer group limits=][|buyer|] to |value|.
1. If |config|["{{AuctionAdConfig/perBuyerExperimentGroupIds}}"] [=map/exists=], [=map/for each=]
  |key| → |value| of |config|["{{AuctionAdConfig/perBuyerExperimentGroupIds}}"]:
  1. If |key| is "*", then set |auctionConfig|'s
    [=auction config/all buyer experiment group id=] to |value|, and [=iteration/continue=].
  1. Let |buyer| the result of [=parsing an https origin=] with |key|.
  1. If |buyer| is failure, then return failure.
  1. Set |auctionConfig|'s [=auction config/per buyer experiment group ids=][|buyer|] to |value|.
1. If |config|["{{AuctionAdConfig/perBuyerPrioritySignals}}"] [=map/exists=], [=map/for each=]
  |key| → |value| of |config|["{{AuctionAdConfig/perBuyerPrioritySignals}}"]:
  1. Let |signals| be an [=ordered map=] whose [=map/keys=] are [=strings=] and whose [=map/values=]
    are {{double}}.
  1. [=map/for each=] |k| → |v| of |value|:
    1. If |k| [=string/starts with=] "browserSignals.", [=exception/throw=] a {{TypeError}}.
    1. [=map/Set=] |signals|[|k|] to |v|.
  1. If |key| is "*", then set |auctionConfig|'s
    [=auction config/all buyers priority signals=] to |value|, and [=iteration/continue=].
  1. Let |buyer| be the result of [=parsing an https origin=] with |key|.
  1. If |buyer| is failure, then return failure.
  1. [=map/Set=] |auctionConfig|'s [=auction config/per buyer priority signals=][|buyer|] to
    |signals|.
1. If |config|["{{AuctionAdConfig/perBuyerCurrencies}}"] [=map/exists=]:
  1. Set |auctionConfig|'s [=auction config/per buyer currencies=] to
    |config|["{{AuctionAdConfig/perBuyerCurrencies}}"]
  1. [=Handle an input promise in configuration=] given |auctionConfig| and |auctionConfig|'s
    [=auction config/per buyer currencies=]:
    * To parse the value |result|:
      1. Set |auctionConfig|'s [=auction config/per buyer currencies=] to a new [=ordered map=]
        whose [=map/keys=] are [=origins=] and whose [=map/values=] are [=currency tags=].
      1. [=map/for each=] |key| → |value| of |result|:
        1. If the result of [=checking whether a string is a valid currency tag=] given |value| is
          false, [=exception/throw=] a {{TypeError}}.
        1. If |key| is "*", then set |auctionConfig|'s
          [=auction config/all buyers currency=] to |value|, and [=iteration/continue=].
        1. Let |buyer| be the result of [=parsing an https origin=] with |key|. If |buyer| is
          failure, [=exception/throw=] a {{TypeError}}.
        1. [=map/Set=] |auctionConfig|'s [=auction config/per buyer currencies=][|buyer|] to |value|.
    * To handle an error, set |auctionConfig|'s [=auction config/per buyer currencies=] to failure.
1. If |config|["{{AuctionAdConfig/componentAuctions}}"] is not [=list/empty=]:
  1. If |config|["{{AuctionAdConfig/interestGroupBuyers}}"] [=map/exists=] and is not [=list/empty=],
    then return failure.
1. [=list/For each=] |component| in |config|["{{AuctionAdConfig/componentAuctions}}"]:
  1. If |isTopLevel| is false, then return failure. 
  1. Let |componentAuction| be the result of running [=validate and convert auction ad config=] with
    |component| and false.
  1. If |componentAuction| is failure, then return failure.
  1. [=list/Append=] |componentAuction| to |auctionConfig|'s [=auction config/component auctions=].
1. Set |auctionConfig|'s [=auction config/config idl=] to |config|.
1. If |config|["{{AuctionAdConfig/resolveToConfig}}"] [=map/exists=]:
  1. Let |auctionConfig|'s [=auction config/resolve to config=] be
     |config|["{{AuctionAdConfig/resolveToConfig}}"].
  1. TODO: What should happen if this rejects?
  1. [=Upon fulfillment=] of |auctionConfig|'s [=auction config/resolve to config=] with
     |resolveToConfig|, set |auctionConfig|'s [=auction config/resolve to config=] to
     |resolveToConfig|.
1. Return |auctionConfig|.

</div>

<div algorithm>

To <dfn>parse an https origin</dfn> given a [=string=] |input|:
1. Let |url| be the result of running the [=URL parser=] on |input|.
1. If |url| is failure, or its [=origin/scheme=] is not "`https`", then return failure.
1. Return |url|'s [=url/origin=].

</div>

<div algorithm>

  To <dfn>update bid count</dfn> given a [=list=] of [=interest group=]s |igs|:
  1. [=list/For each=] |ig| in |igs|:
    1. Let |loadedIg| be the [=interest group=] from the [=user agent=]'s [=interest group set=]
      whose [=interest group/owner=] is |ig|'s [=interest group/owner=] and whose
      [=interest group/name=] is |ig|'s [=interest group/name=], [=iteration/continue=] if none found.
    1. If the most recent entry in |loadedIg|'s [=interest group/bid counts=] corresponds to
      the current day in UTC, increment its count. If not, [=list/insert=] a new [=tuple=] of
      the time set to the current UTC day and a count of 1.
    1. [=list/Replace=] the [=interest group=] that has |loadedIg|'s [=interest group/owner=] and
      [=interest group/name=] in the [=user agent=]'s [=interest group set=] with |loadedIg|.

</div>

<div algorithm>

  To <dfn>update previous wins</dfn> given a [=generated bid=] |bid|:
  1. Let |ig| be |bid|'s [=generated bid/interest group=].
  1. Let |loadedIg| be the [=interest group=] from the [=user agent=]'s [=interest group set=]
    whose [=interest group/owner=] is |ig|'s [=interest group/owner=] and whose
    [=interest group/name=] is |ig|'s [=interest group/name=], return if none found.
  1. Let |win| be a new [=previous win=].
  1. Set |win|'s [=previous win/time=] to the [=current wall time=].
  1. Let |ad| be an [=interest group ad=] whose [=interest group ad/render url=] is |bid|'s
    [=generated bid/bid ad=]'s [=interest group ad/render url=], and whose
    [=interest group ad/metadata=] is |bid|'s [=generated bid/bid ad=]'s
    [=interest group ad/metadata=].
  1. Set |win|'s [=previous win/ad json=] to the result of
    [=serializing an Infra value to a JSON string=] given |ad|.
  1. [=list/Append=] |win| to |loadedIg|'s [=interest group/previous wins=].
  1. [=list/Replace=] the [=interest group=] that has |loadedIg|'s [=interest group/owner=] and
    [=interest group/name=] in the [=user agent=]'s [=interest group set=] with |loadedIg|.

</div>

<div algorithm>

To <dfn>build bid generators map</dfn> given an [=auction config=] |auctionConfig|:
1. Let |bidGenerators| be a new [=ordered map=] whose [=map/keys=] are [=origins=] and whose
  [=map/values=] are [=per buyer bid generators=].
1. Let |negativeTargetInfo| be a new [=negative target info=].
1. [=list/For each=] |buyer| in |auctionConfig|'s [=auction config/interest group buyers=]:
  1. [=list/For each=] |ig| of the [=user agent=]'s [=interest group set=] whose
    [=interest group/owner=] is |buyer|:
    1. Let |igName| be |ig|'s [=interest group/name=].
    1. If |ig|'s [=interest group/additional bid key=] is not null:
      1. [=map/Set=] |negativeTargetInfo|[(|buyer|, |igName|)] to (|ig|'s
        [=interest group/joining origin=], |ig|'s [=interest group/additional bid key=]).
    1. [=iteration/Continue=] if any of the following conditions hold:
      * |ig|'s [=interest group/bidding url=] is null;
      * |ig|'s [=interest group/ads=] is null, or [=list/is empty=].
    1. Let |signalsUrl| be |ig|'s [=interest group/trusted bidding signals url=].
    1. Let |joiningOrigin| be |ig|'s [=interest group/joining origin=].
    1. If |bidGenerators| does not [=map/contain=] |buyer|:
      1. Let |perBuyerGenerator| be a new [=per buyer bid generator=].
      1. Let |perSignalsUrlGenerator| be a new [=per signals url bid generator=].
      1. [=map/Set=] |perSignalsUrlGenerator|[|joiningOrigin|] to « |ig| ».
      1. [=map/Set=] |perBuyerGenerator|[|signalsUrl|] to |perSignalsUrlGenerator|.
      1. [=map/Set=] |bidGenerators|[|buyer|] to |perBuyerGenerator|.
      1. TODO: add a perBiddingScriptUrlGenerator layer that replaces the list of IGs with a map
        from biddingScriptUrl to a list of IGs.
    1. Otherwise:
      1. Let |perBuyerGenerator| be |bidGenerators|[|buyer|].
      1. If |perBuyerGenerator| does not [=map/contain=] |signalsUrl|:
        1. Let |perSignalsUrlGenerator| be a new [=per signals url bid generator=].
        1. [=map/Set=] |perSignalsUrlGenerator|[|joiningOrigin|] to « |ig| ».
        1. [=map/Set=] |perBuyerGenerator|[|signalsUrl|] to |perSignalsUrlGenerator|.
      1. Otherwise:
        1. Let |perSignalsUrlGenerator| be |perBuyerGenerator|[|signalsUrl|].
        1. If |perSignalsUrlGenerator| does not [=map/contain=] |joiningOrigin|, then [=map/set=]
          |perSignalsUrlGenerator|[|joiningOrigin|] to « |ig| ».
        1. Otherwise, [=list/append=] |ig| to |perSignalsUrlGenerator|[|joiningOrigin|].
1. Return « |bidGenerators|, |negativeTargetInfo| ».

</div>

<div algorithm="generate a bid">

To <dfn>generate a bid</dfn> given an [=ordered map=] |allTrustedBiddingSignals|, a [=string=]
|auctionSignals|, a {{BiddingBrowserSignals}} |browserSignals|, a [=string=]-or-null |perBuyerSignals|,
a {{DirectFromSellerSignalsForBuyer}} |directFromSellerSignalsForBuyer|, a [=duration=]
|perBuyerTimeout| in milliseconds, a [=currency tag=] |expectedCurrency|, an [=interest group=] |ig|,
and a [=moment=] |auctionStartTime|:
  1. Let |igGenerateBid| be the result of [=building an interest group passed to generateBid=]
    with |ig|.
  1. Set |browserSignals|["{{BiddingBrowserSignals/joinCount}}"] to the sum of |ig|'s
     [=interest group/join counts=] for all days within the last 30 days.
  1. Set |browserSignals|["{{BiddingBrowserSignals/recency}}"] to the [=current wall time=]
    minus |ig|'s [=interest group/join time=], in milliseconds.
  1. [=map/Set=] |browserSignals|["{{BiddingBrowserSignals/bidCount}}"] to the sum of |ig|'s
     [=interest group/bid counts=] for all days within the last 30 days.
  1. Let |prevWins| be a new <code>[=sequence=]<{{PreviousWin}}></code>.
  1. [=list/For each=] |prevWin| of |ig|'s [=interest group/previous wins=] for all days within the
    the last 30 days:
    1. Let |timeDelta| be |auctionStartTime| minus |prevWin|'s [=previous win/time=].
    1. Set |timeDelta| to 0 if |timeDelta| is negative, |timeDelta|'s nearest second (rounding down)
      otherwise.
    1. Let |prevWinIDL| be a new {{PreviousWin}}.
    1. [=map/Set=] |prevWinIDL|["{{PreviousWin/timeDelta}}"] to |timeDelta|.
    1. [=map/Set=] |prevWinIDL|["{{PreviousWin/adJSON}}"] to |prevWin|'s [=previous win/ad json=].
    1. [=list/Append=] |prevWinIDL| to |prevWins|.
  1. [=map/Set=] |browserSignals|["{{BiddingBrowserSignals/prevWinsMs}}"] to |prevWins|.
  1. Let |biddingScript| be the result of [=fetching script=] with |ig|'s
    [=interest group/bidding url=].
  1. If |biddingScript| is failure, return failure.
  1. If |ig|'s [=interest group/bidding wasm helper url=] is not null:
    1. Let |wasmModuleObject| be the result of [=fetching WebAssembly=] with |ig|'s
      [=interest group/bidding wasm helper url=].
    1. If |wasmModuleObject| is not failure, then [=map/set=]
      |browserSignals|["{{BiddingBrowserSignals/wasmHelper}}"] to |wasmModuleObject|.
  1. Let |trustedBiddingSignals| be an [=ordered map=] whose [=map/keys=] are [=strings=] and
    whose [=map/values=] are {{any}}.
  1. [=list/For each=] |key| of |ig|'s [=interest group/trusted bidding signals keys=]:
    1. If |allTrustedBiddingSignals| is an [=ordered map=] and |allTrustedBiddingSignals|[|key|]
      [=map/exists=], then [=map/set=] |trustedBiddingSignals|[|key|] to
      |allTrustedBiddingSignals|[|key|].
  1. Return the result of [=evaluating a bidding script=] with |biddingScript|, |ig|, |expectedCurrency|,
    |igGenerateBid|, |auctionSignals|, |perBuyerSignals|, |trustedBiddingSignals|, |browserSignals|,
    |directFromSellerSignalsForBuyer|, and |perBuyerTimeout|.
</div>

<div algorithm="generate and score bids">

To <dfn>generate and score bids</dfn> given an [=auction config=] |auctionConfig|, an
[=auction config=]-or-null |topLevelAuctionConfig|, a [=global object=] |global|, an [=origin=]
|topLevelOrigin|, and a [=list=] of [=interest groups=] |bidIgs|:
1. [=Assert=] that these steps are running [=in parallel=].
1. Let |auctionStartTime| be the [=current wall time=].
1. Let |decisionLogicScript| be the result of [=fetching script=] with |auctionConfig|'s
  [=auction config/decision logic url=].
1. If |decisionLogicScript| is failure, return null.
1. Let « |bidGenerators|, |negativeTargetInfo| » be the result of running
  [=build bid generators map=] with |auctionConfig|.
1. Let |leadingBidInfo| be a new [=leading bid info=].
1. Let |queue| be the result of [=starting a new parallel queue=].
1. Let |capturedAuctionHeaders| be |global|'s [=associated Document's=] [=node navigable's=]
  [=traversable navigable's=] [=traversable navigable/captured ad auction signals headers=].
1. If |auctionConfig|'s [=auction config/component auctions=] are not [=list/is empty|empty=]:
  1. [=Assert=] |topLevelAuctionConfig| is null.
  1. Let |pendingComponentAuctions| be |auctionConfig|'s [=auction config/component auctions=]'s
    [=list/size=].
  1. Let |topLevelDirectFromSellerSignalsForSeller| be null.
  1. Let |topLevelDirectFromSellerSignalsRetrieved| be false.
  1. [=list/For each=] |component| in |auctionConfig|'s [=auction config/component auctions=],
    [=parallel queue/enqueue steps|enqueue the following steps=] to |queue|:
    1. Let |compWinner| be the result of running [=generate and score bids=] with |component|,
      |auctionConfig|, |global|, and |topLevelOrigin|.
    1. If |compWinner| is failure, return failure.
    1. If [=recursively wait until configuration input promises resolve=] given |auctionConfig| returns
      failure, return failure.
    1. If |topLevelDirectFromSellerSignalsRetrieved| is false:
      1. Let |topLevelDirectFromSellerSignals| be the result of running
        [=get direct from seller signals=] given |auctionConfig|'s [=auction config/seller=],
        |auctionConfig|'s [=auction config/direct from seller signals header ad slot=], and
        |capturedAuctionHeaders|.
      1. Let |topLevelDirectFromSellerSignalsForSeller| be the result of running
        [=get direct from seller signals for a seller=] given |topLevelDirectFromSellerSignals|.
      1. Set |topLevelDirectFromSellerSignalsRetrieved| to true.
    1. If |compWinner| is not null, then run [=score and rank a bid=] with |auctionConfig|,
      |compWinner|, |leadingBidInfo|, |decisionLogicScript|, null, "top-level-auction", null, and
      |topLevelOrigin|.
    1. Decrement |pendingComponentAuctions| by 1.
  1. Wait until |pendingComponentAuctions| is 0.
  1. If |leadingBidInfo|'s [=leading bid info/leading bid=] is null, return null.
  1. Let |winningComponentConfig| be |leadingBidInfo|'s [=leading bid info/auction config=].
  1. Set |leadingBidInfo|'s [=leading bid info/auction config=] to |auctionConfig|.
  1. Set |leadingBidInfo|'s [=leading bid info/component seller=] to |winningComponentConfig|'s
    [=auction config/seller=].
  1. Let « |topLevelSellerSignals|, unusedTopLevelReportResultBrowserSignals » be the result of
    running [=report result=] with |leadingBidInfo|, |topLevelDirectFromSellerSignalsForSeller|,
    |winningComponentConfig|, and |global|.
  1. Set |leadingBidInfo|'s [=leading bid info/auction config=] to |winningComponentConfig|.
  1. Set |leadingBidInfo|'s [=leading bid info/component seller=] to null.
  1. Set |leadingBidInfo|'s [=leading bid info/top level seller=] to |auctionConfig|'s
    [=auction config/seller=].
  1. Set |leadingBidInfo|'s [=leading bid info/top level seller signals=] to
    |topLevelSellerSignals|.
  1. Let |directFromSellerSignals| be the result of running [=get direct from seller signals=] given
    |winningComponentConfig|'s [=auction config/seller=], |winningComponentConfig|'s
    [=auction config/direct from seller signals header ad slot=], and |capturedAuctionHeaders|.
  1. Let |directFromSellerSignalsForSeller| be the result of running
    [=get direct from seller signals for a seller=] given |directFromSellerSignals|.
  1. Let |directFromSellerSignalsForBuyer| be the result of running
    [=get direct from seller signals for a buyer=] with |directFromSellerSignals|, and
    |leadingBidInfo|'s [=leading bid info/leading bid=]'s [=generated bid/interest group=]'s
    [=interest group/owner=].
  1. Let « |sellerSignals|, |reportResultBrowserSignals| » be the result of running
    [=report result=] with |leadingBidInfo|, |directFromSellerSignalsForSeller|, null, and |global|.
  1. Run [=report win=] with |leadingBidInfo|, |sellerSignals|, |reportResultBrowserSignals|, and
    |directFromSellerSignalsForBuyer|.
  1. Return |leadingBidInfo|'s [=leading bid info/leading bid=].

1. If [=waiting until configuration input promises resolve=] given |auctionConfig| returns failure,
  then return failure.
1. Let |allBuyersExperimentGroupId| be |auctionConfig|'s
  [=auction config/all buyer experiment group id=].
1. Let |allBuyersGroupLimit| be |auctionConfig|'s [=auction config/all buyers group limit=].
1. Let |auctionSignals| be |auctionConfig|'s [=auction config/auction signals=].
1. Let |directFromSellerSignals| be the result of running [=get direct from seller signals=] given
  |auctionConfig|'s [=auction config/seller=], |auctionConfig|'s
  [=auction config/direct from seller signals header ad slot=], and |capturedAuctionHeaders|.
1. Let |directFromSellerSignalsForSeller| be the result of running
  [=get direct from seller signals for a seller=] given |directFromSellerSignals|.
1. Let |browserSignals| be a {{BiddingBrowserSignals}}.
1. Let |topLevelHost| be the result of running the <a spec=url>host serializer</a> on
  |topLevelOrigin|'s [=origin/host=].
1. [=map/Set=] |browserSignals|["{{BiddingBrowserSignals/topWindowHostname}}"] to |topLevelHost|.
1. [=map/Set=] |browserSignals|["{{BiddingBrowserSignals/seller}}"] to the [=serialization of an
  origin|serialization=] of |auctionConfig|'s [=auction config/seller=].
1. Let |auctionLevel| be "single-level-auction".
1. Let |componentAuctionExpectedCurrency| be null.
1. If |topLevelAuctionConfig| is not null:
  1. [=map/Set=] |browserSignals|["{{BiddingBrowserSignals/topLevelSeller}}"]] to the
    [=serialization of an origin|serialization=] of |topLevelAuctionConfig|'s
    [=auction config/seller=].
  1. Set |auctionLevel| to "component-auction".
  1. Set |componentAuctionExpectedCurrency| to the result of [=looking up per-buyer currency=] with
    |topLevelAuctionConfig| and |auctionConfig|'s [=auction config/seller=].
1. Let |pendingBuyers| be |bidGenerators|'s [=map/size=].
1. Let |additionalBids| be the result of running [=validate and convert additional bids=] with
  |auctionConfig|, |topLevelAuctionConfig|, |negativeTargetInfo| and |global|.
1. Let |pendingAdditionalBids| be the [=list/size=] of |additionalBids|.
1. [=list/For each=] |additionalBid| of |additionalBids|, run the following steps [=in parallel=]:
  1. [=Score and rank a bid=] with |auctionConfig|, |additionalBid|, |leadingBidInfo|,
    |decisionLogicScript|, null, |auctionLevel|, |componentAuctionExpectedCurrency|, and
    |topLevelOrigin|.
  1. Decrement |pendingAdditionalBids| by 1.
1. [=map/For each=] |buyer| → |perBuyerGenerator| of |bidGenerators|,
  [=parallel queue/enqueue steps|enqueue the following steps=] to |queue|:
  1. Let |perBuyerCumulativeTimeout| be |auctionConfig|'s
    [=auction config/all buyers cumulative timeout=].
  1. If |auctionConfig|'s [=auction config/per buyer cumulative timeouts=] is not null and
    [=auction config/per buyer cumulative timeouts=][|buyer|] [=map/exists=], then set
    |perBuyerCumulativeTimeout| to |auctionConfig|'s
    [=auction config/per buyer cumulative timeouts=][|buyer|].
  1. Let |buyerExperimentGroupId| be |allBuyersExperimentGroupId|.
  1. Let |perBuyerExperimentGroupIds| be |auctionConfig|'s
    [=auction config/per buyer experiment group ids=].
  1. If |perBuyerExperimentGroupIds| is not null and |perBuyerExperimentGroupIds|[|buyer|]
    [=map/exists=], then set |buyerExperimentGroupId| to |perBuyerExperimentGroupIds|[|buyer|].
  1. <dfn>Apply interest groups limits to prioritized list</dfn>:
    1. Let |buyerGroupLimit| be |allBuyersGroupLimit|.
    1. Let |perBuyerGroupLimits| be |auctionConfig|'s
      [=auction config/per buyer group limits=].
    1. If |perBuyerGroupLimits| is not null and |perBuyerGroupLimits|[|buyer|] [=map/exists=], then
      set |buyerGroupLimit| to |perBuyerGroupLimits|[|buyer|].
    1. Let |igs| be a new [=list=] of [=interest groups=].
    1. [=map/For each=] signalsUrl → |perSignalsUrlGenerator| of |perBuyerGenerator|:
      1. [=map/For each=] joiningOrigin → |groups| of |perSignalsUrlGenerator|:
        1. [=list/Extend=] |igs| with |groups|.
    1. [=list/Sort in descending order=] |igs|, with |a| being less than |b| if |a|'s
      [=interest group/priority=] is less than |b|'s [=interest group/priority=].
    1. [=list/Remove=] the first |buyerGroupLimit| items from |igs|.
    1. [=map/For each=] signalsUrl → |perSignalsUrlGenerator| of |perBuyerGenerator|:
      1. [=map/For each=] joiningOrigin → |groups| of |perSignalsUrlGenerator|:
        1. [=list/Remove=] from |groups| any [=interest group=] [=list/contained=] in |igs|.
  1. Let |perBuyerSignals| be null.
  1. If |auctionConfig|'s [=auction config/per buyer signals=] is not null and
    [=auction config/per buyer signals=][|buyer|] [=map/exists=], then set |perBuyerSignals| to
    |auctionConfig|'s [=auction config/per buyer signals=][|buyer|].
  1. Let |perBuyerTimeout| be |auctionConfig|'s [=auction config/all buyers timeout=].
  1. If |auctionConfig|'s [=auction config/per buyer timeouts=] is not null and
    [=auction config/per buyer timeouts=][|buyer|] [=map/exists=], then set |perBuyerTimeout| to
    |auctionConfig|'s [=auction config/per buyer timeouts=][|buyer|].
  1. Let |expectedCurrency| be the result of [=looking up per-buyer currency=] with |auctionConfig| and |buyer|.
  1. [=map/For each=] |signalsUrl| → |perSignalsUrlGenerator| of |perBuyerGenerator|:
    1. Let |keys| be a new [=ordered set=].
    1. Let |igNames| be a new [=ordered set=].
    1. Let |fetchSignalStartTime| be |settings|'s [=environment settings object/current monotonic time=].

    1. [=map/For each=] joiningOrigin → |groups| of |perSignalsUrlGenerator|:
      1. [=list/For each=] |ig| of |groups|:
        1. [=set/Append=] |ig|'s [=interest group/trusted bidding signals keys=] to |keys|.
        1. [=set/Append=] |ig|'s [=interest group/name=] to |igNames|.
    1. Let |biddingSignalsUrl| be the result of [=building trusted bidding signals url=] with
      |signalsUrl|, |keys|, |igNames|, |buyerExperimentGroupId|, and |topLevelOrigin|.
    1. Let « |allTrustedBiddingSignals|, |dataVersion| » be the result of [=fetching trusted signals=]
      with |biddingSignalsUrl| and true.
    1. If |dataVersion| is not null, then [=map/set=]
      |browserSignals|["{{BiddingBrowserSignals/dataVersion}}"] to |dataVersion|.
    1. Let |fetchSignalDuration| be the [=duration from=] |fetchSignalStartTime| to |settings|'s
      [=environment settings object/current monotonic time=], in milliseconds.
    1. If |perBuyerCumulativeTimeout| is not null:
      1. Decrement |perBuyerCumulativeTimeout| by |fetchSignalDuration|.
      1. If |perBuyerCumulativeTimeout| is negative, then [=iteration/break=];
    1. [=map/For each=] joiningOrigin → |groups| of |perSignalsUrlGenerator|:
      1. [=list/For each=] |ig| of |groups|:
        1. If |ig|'s [=interest group/bidding url=] is null, [=iteration/continue=].
        1. If |perBuyerCumulativeTimeout| is not null and is less than |perBuyerTimeout|, then set
          |perBuyerTimeout| to |perBuyerCumulativeTimeout|.
        1. Let |generateBidStartTime| be |settings|'s
          [=environment settings object/current monotonic time=].
        1. Let |generatedBid| be the result of [=generate a bid=] given |allTrustedBiddingSignals|,
          |auctionSignals|, a [=map/clone=] of |browserSignals|, |perBuyerSignals|,
          |perBuyerTimeout|, |expectedCurrency|, |ig|, and |auctionStartTime|.
        1. Let |generateBidDuration| be the [=duration from=] |generateBidStartTime| to |settings|'s
          [=environment settings object/current monotonic time=], in milliseconds.
        1. If |perBuyerCumulativeTimeout| is not null, decrement |perBuyerCumulativeTimeout| by
          |generateBidDuration|.
        1. If |generatedBid| is failure, [=iteration/continue=].
        1. If [=query generated bid k-anonymity count=] given |generatedBid| returns false:

          Note: [=Generate a bid=] is now rerun with only k-anonymous [=interest group/ads=] to give
          the buyer a chance to [=generate a bid=] for k-anonymous [=interest group/ads=]. Allowing
          the buyer to first [=generate a bid=] for non-k-anonymous [=interest group/ads=] provides a
          mechanism to bootstrap the k-anonymity count, otherwise no [=interest group/ads=] would
          ever trigger [=increment k-anonymity count=] and all ads would fail
          [=query k-anonymity count=].
          1. TODO: Run [=score and rank a bid=] on |generatedBid| to find the highest scoring bid
            that isn't k-anonymous. After the auction, if the highest scoring bid that isn't
            k-anonymous has a higher score than the highest scoring k-anonymous bid, then call
            [=increment ad k-anonymity count=] on it.
          1. Let |originalAds| be |ig|'s [=interest group/ads=].
          1. If |originalAds| is not null:
            1. Set |ig|'s [=interest group/ads=] to a new [=list=] of [=interest group ad=].
            1. [=list/For each=] |ad| in |originalAds|:
              1. If [=query ad k-anonymity count=] given |ig| and |ad|'s
                [=interest group ad/render url=] returns true, [=list/append=] |ad| to |ig|'s
                [=interest group/ads=].
          1. Let |originalAdComponents| be |ig|'s [=interest group/ad components=].
          1. If |originalAdComponents| is not null:
            1. Set |ig|'s [=interest group/ad components=] to a new [=list=] of [=interest group ad=].
            1. [=list/For each=] |adComponent| in |originalAdComponents|:
              1. If [=query component ad k-anonymity count=] given |adComponent|'s
                [=interest group ad/render url=] returns true, [=list/append=] |adComponent| to |ig|'s
                [=interest group/ad components=].
          1. If |perBuyerCumulativeTimeout| is not null and is less than |perBuyerTimeout|, then set
            |perBuyerTimeout| to |perBuyerCumulativeTimeout|.
          1. Let |generateBidStartTime| be |settings|'s
            [=environment settings object/current monotonic time=].
          1. Set |generatedBid| to the result of [=generate a bid=] given
            |allTrustedBiddingSignals|, |auctionSignals|, a [=map/clone=] of |browserSignals|,
            |perBuyerSignals|, |directFromSellerSignalsForBuyer|, |perBuyerTimeout|, |expectedCurrency|,
            and |ig|.
          1. Set |ig|'s [=interest group/ads=] to |originalAds|.
          1. Set |ig|'s [=interest group/ad components=] to |originalAdComponents|.
          1. Let |generateBidDuration| be the [=duration from=] |generateBidStartTime| to
            |settings|'s [=environment settings object/current monotonic time=], in milliseconds.
          1. If |perBuyerCumulativeTimeout| is not null, then decrement |perBuyerCumulativeTimeout|
            by |generateBidDuration|.
          1. If |generatedBid| is failure, [=iteration/continue=].
        1. [=list/Insert=] |generatedBid|'s [=generated bid/interest group=] in |bidIgs|.
        1. [=Score and rank a bid=] with |auctionConfig|, |generatedBid|, |leadingBidInfo|,
          |decisionLogicScript|, |directFromSellerSignalsForSeller|, |dataVersion|, |auctionLevel|,
          |componentAuctionExpectedCurrency|, and |topLevelOrigin|.
  1. Decrement |pendingBuyers| by 1.
1. Wait until both |pendingBuyers| and |pendingAdditionalBids| are 0.
1. If |leadingBidInfo|'s [=leading bid info/leading bid=] is null, return null.
1. If |topLevelAuctionConfig| is null:
  1. Let « |sellerSignals|, |reportResultBrowserSignals| » be the result of running
    [=report result=] with |leadingBidInfo|, |directFromSellerSignalsForSeller|, null, and |global|.
  1. Let |directFromSellerSignalsForWinner| be the result of running
      [=get direct from seller signals for a buyer=] with |directFromSellerSignals|, and
      |leadingBidInfo|'s [=leading bid info/leading bid=]'s [=generated bid/interest group=]'s
      [=interest group/owner=].
  1. Run [=report win=] with |leadingBidInfo|, |sellerSignals|, |reportResultBrowserSignals|, and
    |directFromSellerSignalsForWinner|.
1. Return |leadingBidInfo|'s [=leading bid info/leading bid=].

</div>

<div algorithm>
To <dfn>build an interest group passed to generateBid</dfn> given an [=interest group=] |ig|:

  1. Let |igGenerateBid| be a new {{GenerateBidInterestGroup}} with the following fields:
    <dl>
      <dt>{{GenerateBidInterestGroup/owner}}
      <dd>The [=serialization of an origin|serialization=] of |ig|'s [=interest group/owner=]
      <dt>{{GenerateBidInterestGroup/name}}
      <dd>|ig|'s [=interest group/name=]
      <dt>{{GenerateBidInterestGroup/enableBiddingSignalsPrioritization}}
      <dd>|ig|'s [=interest group/enable bidding signals prioritization=]
      <dt>{{GenerateBidInterestGroup/priorityVector}}
      <dd>|ig|'s [=interest group/priority vector=] if not null, otherwise {{undefined}}
      <dt>{{GenerateBidInterestGroup/executionMode}}
      <dd>|ig|'s [=interest group/execution mode=]
      <dt>{{GenerateBidInterestGroup/biddingLogicURL}}
      <dd>The [=serialize a URL|serialization-or-undefined=] of |ig|'s [=interest group/bidding url=]
      <dt>{{GenerateBidInterestGroup/biddingWasmHelperURL}}
      <dd>The [=serialize a URL|serialization=] of |ig|'s [=interest group/bidding wasm helper url=]
      <dt>{{GenerateBidInterestGroup/updateURL}}
      <dd>The [=serialize a URL|serialization=] of |ig|'s [=interest group/update url=]
      <dt>{{GenerateBidInterestGroup/trustedBiddingSignalsURL}}
      <dd>The [=serialize a URL|serialization=] of |ig|'s [=interest group/trusted bidding signals url=]
      <dt>{{GenerateBidInterestGroup/trustedBiddingSignalsKeys}}
      <dd>|ig|'s [=interest group/trusted bidding signals keys=]
      <dt>{{GenerateBidInterestGroup/userBiddingSignals}}
      <dd>[=Parse a JSON string to a JavaScript value=] given |ig|'s [=interest group/user bidding signals=]

      <dt>{{GenerateBidInterestGroup/ads}}
      <dd>|ig|'s [=interest group/ads=] [=converted to an AuctionAd sequence=]
      <dt>{{GenerateBidInterestGroup/adComponents}}
      <dd>|ig|'s [=interest group/ad components=] [=converted to an AuctionAd sequence=]
    </dl>
  1. Return |igGenerateBid|.
</div>

<div algorithm>
To <dfn>serialize a URL</dfn> given a [=URL=]-or-null |url|:

  1. If |url| is null, then return {{undefined}}.
  1. Return the [=URL serializer|serialization=] of |url|.
</div>

<div algorithm>
To <dfn>convert to an AuctionAd sequence</dfn> given a [=list=]-or-null |ads|:

  1. If |ads| is null, then return {{undefined}}.
  1. Let |adsIDL| be a new <code>[=sequence=]<{{AuctionAd}}></code>.
  1. [=list/For each=] |ad| of |ads|:
    1. Let |adIDL| be a new {{AuctionAd}}.
    1. [=map/Set=] |adIDL|["{{AuctionAd/renderURL}}"] to the [=URL serializer|serialization=] of
      |ad|'s [=interest group ad/render url=].
    1. If |ad|'s [=interest group ad/metadata=] is not null, then [=map/set=]
      |adIDL|["{{AuctionAd/metadata}}"] to the result of
      [=parsing a JSON string to a JavaScript value=] given |ad|'s [=interest group ad/metadata=].
    1. [=list/Append=] |adIDL| to |adsIDL|.
  1. Return |adsIDL|.
</div>

<div algorithm>

To <dfn>score and rank a bid</dfn> given an [=auction config=] |auctionConfig|, a [=generated bid=]
|generatedBid|, a [=leading bid info=] |leadingBidInfo|, a [=string=] |decisionLogicScript|, a
{{DirectFromSellerSignalsForSeller}} |directFromSellerSignalsForSeller|, an {{unsigned long}}-or-null
|biddingDataVersion|, an enum |auctionLevel|, which is "single-level-auction", "top-level-auction",
or "component-auction", a [=currency tag=] |componentAuctionExpectedCurrency|, and an [=origin=]
|topLevelOrigin|:

1. Let |renderURL| be [=URL serializer|serialized=] |generatedBid|'s
  [=generated bid/ad descriptor=]'s [=ad descriptor/url=].
1. Let |adComponentRenderURLs| be a new empty [=list=].
1. If |generatedBid|'s [=generated bid/ad component descriptors=] is not null:
  1. [=list/For each=] |adComponentDescriptor| in |generatedBid|'s
    [=generated bid/ad component descriptors=]:
    1. [=list/Append=] [=URL serializer|serialized=] |adComponentDescriptor|'s [=ad descriptor/url=]
      to |adComponentRenderURLs|.
1. Let |fullSignalsUrl| be the result of [=building trusted scoring signals url=] with |auctionConfig|'s
  [=auction config/trusted scoring signals url=], «|renderURL|», |adComponentRenderURLs|,
  |auctionConfig|'s [=auction config/seller experiment group id=], and |topLevelOrigin|.

  Implementations may batch requests by collecting render URLs and ad component render URLs
  from multiple invocations of [=score and rank a bid=] and passing them all to a single invocation
  of [=building trusted scoring signals url=] -- the network response has to be parsed to pull out
  the pieces relevant to each [=evaluating a scoring script|evaluation of a scoring script=].
1. Let |trustedScoringSignals| be null.
1. Let «|allTrustedScoringSignals|, |scoringDataVersion|» be the result of [=fetching trusted signals=]
  with |fullSignalsUrl| and false.
1. If |allTrustedScoringSignals| is an [=ordered map=]:
  1. Set |trustedScoringSignals| to a new empty [=map=].
  1. [=map/Set=] |trustedScoringSignals|["`renderURL`"] to a new empty [=map=].
  1. If |allTrustedScoringSignals|["`renderURLs`"] [=map/exists=] and
    |allTrustedScoringSignals|["`renderURLs`"][|renderURL|] [=map/exists=], then [=map/set=] |trustedScoringSignals|["`renderURL`"][|renderURL|] to
    |allTrustedScoringSignals|["`renderURLs`"][|renderURL|].
  1. If |adComponentRenderURLs| is not [=list/empty=]:
    1. Let |adComponentRenderURLsValue| be a new empty [=map=].
    1. If |allTrustedScoringSignals|["`adComponentRenderURLs`"] [=map/exists=], [=set/for each=]
      |adComponentRenderURL| in |adComponentRenderURLs|:
      1. If |allTrustedScoringSignals|["`adComponentRenderURLs`"][|adComponentRenderURL|]
        [=map/exists=], then [=map/set=] |adComponentRenderURLsValue|[|adComponentRenderURL|] to
        |allTrustedScoringSignals|["`adComponentRenderURLs`"][|adComponentRenderURL|].
    1. [=map/Set=] |trustedScoringSignals|["`adComponentRenderURLs`"] to |adComponentRenderURLsValue|.
1. Let |adMetadata| be |generatedBid|'s [=generated bid/ad=].
1. Let |bidValue| be |generatedBid|'s [=generated bid/bid=].
1. If |generatedBid|'s [=generated bid/modified bid=] is not null, then set |bidValue| to
  |generatedBid|'s [=generated bid/modified bid=].
1. Let |owner| be |generatedBid|'s [=generated bid/interest group=]'s [=interest group/owner=].
1. Let |browserSignals| be a {{ScoringBrowserSignals}} with the following fields:
  <dl>
    <dt>{{ScoringBrowserSignals/topWindowHostname}}
    <dd>The result of running the <a spec=url>host serializer</a> on |topLevelOrigin|'s [=origin/host=]
    <dt>{{ScoringBrowserSignals/interestGroupOwner}}
    <dd>[=serialization of an origin|Serialized=] |owner|
    <dt>{{ScoringBrowserSignals/renderURL}}
    <dd>The result of running the [=URL serializer=] on |generatedBid|'s
      [=generated bid/ad descriptor=]'s [=ad descriptor/url=]
    <dt>{{ScoringBrowserSignals/biddingDurationMsec}}
    <dd>|generatedBid|'s [=generated bid/bid duration=]
    <dt>{{ScoringBrowserSignals/bidCurrency}}
    <dd>The result of [=serializing a currency tag=] with |generatedBid|'s [=generated bid/bid=]'s
      [=bid with currency/currency=]
    <dt>{{ScoringBrowserSignals/dataVersion}}
    <dd>|scoringDataVersion| if it is not null, {{undefined}} otherwise
    <dt>{{ScoringBrowserSignals/adComponents}}
    <dd>|generatedBid|'s [=generated bid/ad component descriptors=] [=converted to a string sequence=]
  </dl>
1. Let |scoreAdResult| be the result of [=evaluating a scoring script=] with
   |decisionLogicScript|, |adMetadata|, |bidValue|'s [=bid with currency/value=], |auctionConfig|'s
   [=auction config/config idl=], |trustedScoringSignals|, |browserSignals|,
   |directFromSellerSignalsForSeller|, and |auctionConfig|'s [=auction config/seller timeout=].
1. Let |scoreAdOutput| be result of [=processing scoreAd output=] with |scoreAdResult|.
1. If |scoreAdOutput| is failure, return.
1. If |auctionLevel| is not "single-level-auction", and |scoreAdOutput|
  ["{{ScoreAdOutput/allowComponentAuction}}"] is false, return.
1. Let |score| be |scoreAdOutput|["{{ScoreAdOutput/desirability}}"].
1. If |score| is negative or 0, return.
1. If |auctionLevel| is "component-auction":
  1. Let |bidToCheck| be |generatedBid|'s [=generated bid/bid=].
  1. If |scoreAdOutput|["{{ScoreAdOutput/bid}}"] [=map/exists=]:
    1. Let |modifiedBidValue| be |scoreAdOutput|["{{ScoreAdOutput/bid}}"].
    1. If |modifiedBidValue| is negative or 0, return.
    1. Let |modifiedBidCurrency| be null.
    1. If |scoreAdOutput|["{{ScoreAdOutput/bidCurrency}}] [=map/exists=], then set
      |modifiedBidCurrency| to |scoreAdOutput|["{{ScoreAdOutput/bidCurrency}}].
    1. Set |generatedBid|'s [=generated bid/modified bid=] to a [=bid with currency=] with
      [=bid with currency/value=] |modifiedBidValue| and [=bid with currency/currency=]
      |modifiedBidCurrency|.
    1. Set |bidToCheck| to |generatedBid|'s [=generated bid/modified bid=].
  1. If the result of [=checking a currency tag=] with |componentAuctionExpectedCurrency| and
    |bidToCheck|'s [=bid with currency/currency=] is false, return.
  1. If the result of [=checking a currency tag=] with |auctionConfig|'s
    [=auction config/seller currency=] and |bidToCheck|'s [=bid with currency/currency=] is false,
    return.
1. If |auctionConfig|'s [=auction config/seller currency=] is not null:
  1. If |generatedBid|'s [=generated bid/bid=]'s [=bid with currency/currency=] is equal to
    |auctionConfig|'s [=auction config/seller currency=]:
    1. Set |generatedBid|'s [=generated bid/bid in seller currency=] to |generatedBid|'s
      [=generated bid/bid=]'s [=bid with currency/value=].
    1. If |scoreAdOutput|["{{ScoreAdOutput/incomingBidInSellerCurrency}}"] [=map/ exists=] and does
      not equal |generatedBid|'s [=generated bid/bid in seller currency=], return.
  1. Otherwise if |scoreAdOutput|["{{ScoreAdOutput/incomingBidInSellerCurrency}}"] [=map/ exists=],
    then set |generatedBid|'s [=generated bid/bid in seller currency=] to
    |scoreAdOutput|["{{ScoreAdOutput/incomingBidInSellerCurrency}}"]
1. Let |updateLeadingBid| be false.
1. If |leadingBidInfo|'s [=leading bid info/leading bid=] is null, or |score| is greater than
  |leadingBidInfo|'s [=leading bid info/top score=]:
  1. Set |updateLeadingBid| to true.
  1. Set |leadingBidInfo|'s [=leading bid info/top bids count=] to 1.
  1. Set |leadingBidInfo|'s [=leading bid info/at most one top bid owner=] to true.
1. Otherwise if |score| equals |leadingBidInfo|'s [=leading bid info/top score=]:
  1. Increment |leadingBidInfo|'s [=leading bid info/top bids count=] by 1.
  1. Set |updateLeadingBid| to true with 1 in |leadingBidInfo|'s [=leading bid info/top bids count=]
    chance.
  1. If |updateLeadingBid| is false, then [=update highest scoring other bid=] with |score|,
    |leadingBidInfo|'s [=leading bid info/leading bid=], and |leadingBidInfo|.
  1. If |owner| is not [=same origin=] with |leadingBidInfo|'s [=leading bid info/leading bid=]'s
    [=generated bid/interest group=]'s [=interest group/owner=], then set |leadingBidInfo|'s
    [=leading bid info/at most one top bid owner=] to false.
1. Otherwise if |score| is greater than or equal to |leadingBidInfo|'s
  [=leading bid info/second highest score=], then [=update highest scoring other bid=] with |score|,
  |bidValue|, and |leadingBidInfo|.
1. If |updateLeadingBid| is true:
  1. If |leadingBidInfo|'s [=leading bid info/leading bid=] is not null, then
    [=update highest scoring other bid=] with |leadingBidInfo|'s [=leading bid info/top score=],
    |leadingBidInfo|'s [=leading bid info/leading bid=], and |leadingBidInfo|.
  1. Set |leadingBidInfo|'s [=leading bid info/top score=] to |score|.
  1. Set |leadingBidInfo|'s [=leading bid info/leading bid=] to |generatedBid|.
  1. Set |leadingBidInfo|'s [=leading bid info/auction config=] to |auctionConfig|.
  1. Set |leadingBidInfo|'s [=leading bid info/bidding data version=] to |biddingDataVersion|.
  1. Set |leadingBidInfo|'s [=leading bid info/scoring data version=] to |scoringDataVersion|.

</div>

<div algorithm>
To <dfn>convert to a string sequence</dfn> given a [=list=]-or-null |adComponents|:

  1. If |adComponents| is null, return {{undefined}}.
  1. Let |result| be a new <code>[=sequence=]<{{USVString}}></code>.
  1. [=list/For each=] |component| of |adComponents|:
    1. [=list/Append=] [=URL serializer|serialized=] |component|'s [=ad descriptor/url=] to |result|.
  1. Return |result|.
</div>

<div algorithm>
To <dfn>update highest scoring other bid</dfn> given a {{double}} |score|, a
[=generated bid=]-or-null |bid|, and a [=leading bid info=] |leadingBidInfo|:

  1. If |bid| is null, return.
  1. Let |owner| be |bid|'s [=generated bid/interest group=]'s [=interest group/owner=].
  1. If |score| is greater than |leadingBidInfo|'s [=leading bid info/second highest score=]:
    1. Set |leadingBidInfo|'s [=leading bid info/highest scoring other bid=] to |bid|.
    1. Set |leadingBidInfo|'s [=leading bid info/highest scoring other bids count=] to 1.
    1. Set |leadingBidInfo|'s [=leading bid info/second highest score=] to |score|.
    1. Set |leadingBidInfo|'s [=leading bid info/highest scoring other bid owner=] to |owner| if
      |leadingBidInfo|'s [=leading bid info/at most one top bid owner=] is true, null otherwise.
  1. Otherwise if |score| is equal to |leadingBidInfo|'s [=leading bid info/second highest score=]:
    1. Increment |leadingBidInfo|'s [=leading bid info/highest scoring other bids count=] by 1.
    1. Set |leadingBidInfo|'s [=leading bid info/highest scoring other bid=] to |bid| with 1 in
      |leadingBidInfo|'s [=leading bid info/highest scoring other bids count=] chance.
    1. If |leadingBidInfo|'s [=leading bid info/highest scoring other bid owner=] is not null and
      |owner| is not [=same origin=] with |leadingBidInfo|'s
      [=leading bid info/highest scoring other bid owner=], then set |leadingBidInfo|'s
      [=leading bid info/highest scoring other bid owner=] to null.
</div>

The <dfn http-header><code>Ad-Auction-Allowed</code></dfn> HTTP response header is a
[=structured header=] whose value must be a [=structured header/boolean=].

<div algorithm>
To <dfn>validate fetching response</dfn> given a [=response=] |response|, null, failure, or a
[=byte sequence=] |responseBody|, and a [=string=] |mimeType|:

  1. If |responseBody| is null or failure, return false.
  1. If [=header list/getting a structured field value|getting=] [:Ad-Auction-Allowed:] and
    "`item`" from |response|'s [=response/header list=] does not return a true value, return false.
  1. Let |headerMimeType| be the result of [=header list/extracting a MIME type=] from |response|'s
    [=response/header list=].
  1. Return false if any of the following conditions hold:
    * |headerMimeType| is failure;
    * |mimeType| is "`text/javascript`" and |headerMimeType| is not a [=JavaScript MIME type=];
    * |mimeType| is "`application/json`" and |headerMimeType| is not a [=JSON MIME type=].
  1. Let |mimeTypeCharset| be |headerMimeType|'s [=MIME type/parameters=]["`charset`"].
  1. Return false if any of the following conditions hold:
    * |mimeTypeCharset| does not [=map/exist=], or |mimeTypeCharset| is "utf-8", and |responseBody|
      is not [=UTF-8=] encoded;
    * |mimeTypeCharset| is "us-ascii", and not all bytes in |responseBody| are [=ASCII bytes=].
  1. Return true.
</div>

<div algorithm>
To <dfn>fetch script</dfn> given a [=URL=] |url|:
  1. Let |request| be a new [=request=] with the following properties:
    :   [=request/URL=]
    ::  |url|
    :   [=request/header list=]
    ::  «`Accept`: `text/javascript`»
    :   [=request/client=]
    ::  `null`
    :   [=request/mode=]
    ::  "`no-cors`"
    :   [=request/referrer=]
    :: "`no-referrer`"
    :   [=request/credentials mode=]
    ::  "`omit`"
    :   [=request/redirect mode=]
    :: "`error`"

    Issue: One of the side-effects of a `null` client for this subresource request is it neuters all
    service worker interceptions, despite not having to set the service workers mode.

    Issue: Stop using "`no-cors`" mode where possible
    (<a href="https://github.com/WICG/turtledove/issues/667">WICG/turtledove#667</a>).
  1. Let |script| be null.
  1. [=Fetch=] |request| with [=fetch/useParallelQueue=] set to true, and
    [=fetch/processResponseConsumeBody=] set to the following steps given a [=response=] |response|
    and null, failure, or a [=byte sequence=] |responseBody|:
    1. If [=validate fetching response=] with |response|, |responseBody| and "`text/javascript`"
      returns false, set |script| to failure and return.
    1. Set |script| to |responseBody|.
  1. Wait for |script| to be set.
  1. Return |script|.
</div>

<div algorithm>
To <dfn>fetch WebAssembly</dfn> given a [=URL=] |url|:

  1. Let |request| be a new [=request=] with the following properties:
    :   [=request/URL=]
    ::  |url|
    :   [=request/header list=]
    ::  «`Accept`: `application/wasm`»
    :   [=request/client=]
    ::  `null`
    :   [=request/mode=]
    ::  "`no-cors`"
    :   [=request/referrer=]
    :: "`no-referrer`"
    :   [=request/credentials mode=]
    ::  "`omit`"
    :   [=request/redirect mode=]
    :: "`error`"

    Issue: One of the side-effects of a `null` client for this subresource request is it neuters all
    service worker interceptions, despite not having to set the service workers mode.

    Issue: Stop using "`no-cors`" mode where possible
    (<a href="https://github.com/WICG/turtledove/issues/667">WICG/turtledove#667</a>).
  1. Let |moduleObject| be null.
  1. [=Fetch=] |request| with [=fetch/processResponseConsumeBody=] set to the following steps given
    a [=response=] |response| and null, failure, or a [=byte sequence=] |responseBody|:
    1. Set |moduleObject| to failure and return, if any of the following conditions hold:
      * |responseBody| is null or failure;
      * [=header list/getting a structured field value|Getting=] [:Ad-Auction-Allowed:] and "`item`"
        from |response|'s [=response/header list=] does not return a true value.
    1. Let |module| be the result of [=compiling a WebAssembly module=] |response|.
    1. If |module| is [=error=], set |moduleObject| to failure.
    1. Otherwise, set |moduleObject| to |module|.
  1. Wait for |moduleObject| to be set.
  1. Return |moduleObject|.
</div>

The <dfn http-header><code>Data-Version</code></dfn> HTTP response header is a
[=structured header=] whose value must be an [=structured header/integer=].
The <dfn http-header><code>X-fledge-bidding-signals-format-version</code></dfn> HTTP response header
is a [=structured header=] whose value must be an [=structured header/integer=].

<div algorithm>
To <dfn>fetch trusted signals</dfn> given a [=URL=] |url|, and a [=boolean=] |isBiddingSignal|:

  1. Let |request| be a new [=request=] with the following properties:
    :   [=request/URL=]
    ::  |url|
    :   [=request/header list=]
    ::  «`Accept`: `application/json`»
    :   [=request/client=]
    ::  `null`
    :   [=request/mode=]
    ::  "`no-cors`"
    :   [=request/referrer=]
    :: "`no-referrer`"
    :   [=request/credentials mode=]
    ::  "`omit`"
    :   [=request/redirect mode=]
    :: "`error`"

    Issue: One of the side-effects of a `null` client for this subresource request is it neuters all
    service worker interceptions, despite not having to set the service workers mode.

    Issue: Stop using "`no-cors`" mode where possible
    (<a href="https://github.com/WICG/turtledove/issues/667">WICG/turtledove#667</a>).
  1. Let |signals| be null.
  1. Let |dataVersion| be null.
  1. Let |formatVersion| be null.
  1. [=Fetch=] |request| with [=fetch/useParallelQueue=] set to true, and
    [=fetch/processResponseConsumeBody=] set to the following steps given a [=response=] |response|
    and null, failure, or a [=byte sequence=] |responseBody|:
    1. If [=validate fetching response=] with |response|, |responseBody| and "`application/json`"
      returns false, set |signals| to failure and return.
    1. Let |headers| be |response|'s [=response/header list=].
    1. Set |dataVersion| to the result of [=header list/getting a structured field value=]
      given [:Data-Version:] and "`item`" from |headers|.
    1. If |dataVersion| is not null:
      1. If |dataVersion| is not an integer, or is less than 0 or more than 2<sup>32</sup>&minus;1,
        set |signals| to failure and return.
    1. If |isBiddingSignal| is true, then set |formatVersion| to the result of
      [=header list/getting a structured field value=] given
      [:X-fledge-bidding-signals-format-version:] and "`item`" from |headers|.
    1. Set |signals| to the result of [=parsing JSON bytes to an Infra value=] |responseBody|.
  1. Wait for |signals| to be set.
  1. If |signals| is a parsing exception, or if |signals| is not an [=ordered map=], return « null,
    null ».
  1. [=map/For each=] |key| → |value| of |signals|:
    1. [=map/Set=] |signals|[|key|] to the result of [=serializing an Infra value to a JSON string=]
      given |value|.
  1. If |formatVersion| is 2:
    1. If |signals|["`keys`"] does not [=map/exist=], return « null, null ».
    1. Set |signals| to |signals|["`keys`"].
    1. If |signals| is not an [=ordered map=], return « null, null ».
    1. TODO: handle priority vector.
  1. Return « |signals|, |dataVersion| ».
</div>

<div algorithm>

To <dfn>encode trusted signals keys</dfn> given an [=ordered set=] of [=strings=] |keys|:
1. Let |list| be a new empty [=list=].
1. Let |keysStr| be the result of [=string/concatenating=] |keys| with separator set to ",".
1. [=list/Append=] the result of [=string/UTF-8 percent-encoding=] |keysStr| using
  [=component percent-encode set=] to |list|.

  Issue: The Chrome implementation encodes 0x20 (SP) to U+002B (+), while [=string/UTF-8 percent-encoding=]
    encodes it to "%20".
1. Return |list|.

</div>

<div algorithm>

To <dfn>build trusted bidding signals url</dfn> given a [=URL=] |signalsUrl|, an [=ordered set=] of
[=strings=] |keys|, an [=ordered set=] of [=strings=] |igNames|, an {{unsigned short}}-or-null
|experimentGroupId|, and an [=origin=] |topLevelOrigin|:
1. Let |queryParamsList| be a new empty [=list=].

  Note: These steps create a [=url/query=] of the form "`&<name>=<values in comma-delimited list>`".
  E.g., "`hostname=publisher1.com&keys=key1,key2&interestGroupNames=ad+platform,name2&experimentGroupId=1234`".
    <br><br>These steps don't use the [=urlencoded serializer|application/x-www-form-urlencoded
    serializer=] to construct the query string because it repeats a key if it has multiple values
    instead of a comma-demilited list (e.g., "`keys=key1&keys=key2`", instead of
    "`keys=key1,key2`"), and it also uses a different percent encode set from the Chrome
    implementation.

1. [=list/Append=] "hostname=" to |queryParamsList|.
1. [=list/Append=] the result of [=string/UTF-8 percent-encoding=] the
  [=serialization of an origin|serialized=] |topLevelOrigin| using [=component percent-encode set=]
  to |queryParamsList|.
1. If |keys| is not [=set/is empty|empty=]:
  1. [=list/Append=] "`&keys=`" to |queryParamsList|.
  1. [=list/Extend=] |queryParamsList| with the result of [=encode trusted signals keys=] with
    |keys|.
1. If |igNames| is not [=set/is empty|empty=]:
  1. [=list/Append=] "`&interestGroupNames=`" to |queryParamsList|.
  1. [=list/Extend=] |queryParamsList| with the result of [=encode trusted signals keys=] with
    |igNames|.
1. If |experimentGroupId| is not null:
  1. [=list/Append=] "`&experimentGroupId=`" to |queryParamsList|.
  1. [=list/Append=] [=serialize an integer|serialized=] |experimentGroupId| to |queryParamsList|.
1. Let |fullSignalsUrl| be |signalsUrl|.
1. Set |fullSignalsUrl|'s [=url/query=] to the result of [=string/concatenating=] |queryParamsList|.
1. return |fullSignalsUrl|.

</div>

<div algorithm>

To <dfn>build trusted scoring signals url</dfn> given a [=URL=] |signalsUrl|, a [=list=] of
[=strings=] |renderURLs|, an [=ordered set=] of [=strings=] |adComponentRenderURLs|, an
{{unsigned short}} |experimentGroupId|, and an [=origin=] |topLevelOrigin|:

Note: When trusted scoring signals fetches are not batched, |renderURLs|'s [=list/size=] is 1.

1. Let |queryParamsList| be a new empty [=list=].
1. [=list/Append=] "hostname=" to |queryParamsList|.
1. [=list/Append=] the result of [=string/UTF-8 percent-encoding=] |topLevelOrigin| using
  [=component percent-encode set=] to |queryParamsList|.
1. If |renderURLs| is not [=set/is empty|empty=]:
  1. [=list/Append=] "`&renderURLs=`" to |queryParamsList|.
  1. [=list/Extend=] |queryParamsList| with the result of [=encode trusted signals keys=] with
    |renderURLs|.
1. If |adComponentRenderURLs| is not [=set/is empty|empty=]:
  1. [=list/Append=] "`&adComponentRenderURLs=`" to |queryParamsList|.
  1. [=list/Extend=] |queryParamsList| with the result of [=encode trusted signals keys=] with
    |adComponentRenderURLs|.
1. If |experimentGroupId| is not null:
  1. [=list/Append=] "`&experimentGroupId=`" to |queryParamsList|.
  1. [=list/Append=] [=serialize an integer|serialized=] |experimentGroupId| to |queryParamsList|.
1. Set |signalsUrl|'s [=url/query=] to the result of [=string/concatenating=] |queryParamsList|.
1. return |signalsUrl|.

</div>

<div algorithm>
To <dfn>send report</dfn> given a [=URL=] |url|:

  1. Let |request| be a new [=request=] with the following properties:
    :   [=request/URL=]
    ::  |url|
    :   [=request/client=]
    ::  `null`
    :   [=request/mode=]
    ::  "`no-cors`"
    :   [=request/referrer=]
    :: "`no-referrer`"
    :   [=request/credentials mode=]
    ::  "`omit`"
    :   [=request/redirect mode=]
    :: "`error`"

    Issue: Stop using "`no-cors`" mode where possible
    (<a href="https://github.com/WICG/turtledove/issues/667">WICG/turtledove#667</a>).
  1. [=Fetch=] |request| with [=fetch/useParallelQueue=] set to true.
</div>

<div algorithm>

To <dfn>serialize an integer</dfn>, represent it as a string of the shortest possible decimal
number.

Issue: This would ideally be replaced by a more descriptive algorithm in Infra. See
<a href="https://github.com/whatwg/infra/issues/201">infra/201</a>

</div>

<div algorithm>
To <dfn>round a value</dfn> given a {{double}} |value|:
  1. If |value| is not a [=valid floating-point number=], return |value|.
  1. Let |valueExp| be |value|'s IEEE 754 biased exponent field minus 1023.
  1. Let |normValue| be |value| multiplied by 2<sup>(&minus;1 &times; |valueExp|)</sup>.
  1. If |valueExp| is less than &minus;128:
    1. If |value| is less than 0, return &minus;0.
    1. Otherwise, return 0.
  1. If |valueExp| is greater than 127:
    1. If |value| is less than 0, return &minus;&infin;.
    1. Otherwise, return &infin;.
  1. Let |precisionScaledValue| be |normValue| multiplied by 256.
  1. Let |noisyScaledValue| be |precisionScaledValue| plus a random {{double}} value greater than or
    equal to 0 but less than 1.
  1. Let |truncatedScaledValue| be the largest integer not greater than |noisyScaledValue|.
  1. Return |truncatedScaledValue| multiplied by 2<sup>(|valueExp| &minus; 8)</sup>.

</div>

<div algorithm>
To <dfn>get direct from seller signals</dfn> given an [=origin=] |seller|, a [=string=]-or-null
|adSlot|, and a [=map=] |capturedAuctionHeaders|:

  1. If |adSlot| is not a [=string=], then return null.
  1. Let |directFromSellerSignals| be null.
  1. Let |directFromSellerSignalsKey| be a new [=direct from seller signals key=] with its
    [=direct from seller signals key/seller=] set to |seller|, and
    [=direct from seller signals key/ad slot=] set to |adSlot|.
  1. If |capturedAuctionHeaders|[|directFromSellerSignalsKey|] [=map/exists=]:
    1. Set |directFromSellerSignals| to |capturedAuctionHeaders|[|directFromSellerSignalsKey|].
  1. Return |directFromSellerSignals|.
</div>

<div algorithm>
To <dfn>get direct from seller signals for a seller</dfn> given a
[=direct from seller signals=]-or-null |directFromSellerSignals|:

  1. Let |directFromSellerSignalsForSeller| be a new {{DirectFromSellerSignalsForSeller}}.
  1. If |directFromSellerSignals| is null, then return |directFromSellerSignalsForSeller|.
  1. [=map/Set=] |directFromSellerSignalsForSeller|["auctionSignals"] to the result of running
    [=parse a JSON string to an Infra value=] given |directFromSellerSignals|'s
    [=direct from seller signals/auction signals=].
  1. [=map/Set=] |directFromSellerSignalsForSeller|["sellerSignals"] to the result of running
    [=parse a JSON string to an Infra value=] given |directFromSellerSignals|'s
    [=direct from seller signals/seller signals=].
  1. Return |directFromSellerSignalsForSeller|.
</div>

<div algorithm>
To <dfn>get direct from seller signals for a buyer</dfn> given a
[=direct from seller signals=]-or-null |directFromSellerSignals|, and an [=origin=] |owner|:

  1. Let |directFromSellerSignalsForBuyer| be a new {{DirectFromSellerSignalsForBuyer}}.
  1. If |directFromSellerSignals| is null, then return |directFromSellerSignalsForBuyer|.
  1. [=map/Set=] |directFromSellerSignalsForBuyer|["auctionSignals"] to the result of running
    [=parse a JSON string to an Infra value=] given |directFromSellerSignals|'s
    [=direct from seller signals/auction signals=].
  1. If |directFromSellerSignals|'s [=direct from seller signals/per buyer signals=][|owner|]
    [=map/exists=]:
    1. [=map/Set=] |directFromSellerSignalsForBuyer|["perBuyerSignals"] to the result of running
      [=parse a JSON string to an Infra value=] given |directFromSellerSignals|'s
      [=direct from seller signals/per buyer signals=][|owner|].
  1. Return |directFromSellerSignalsForBuyer|.
</div>

<div algorithm>
To <dfn>report result</dfn> given a [=leading bid info=] |leadingBidInfo|, a
[=direct from seller signals=]-or-null |directFromSellerSignals|, an [=auction config=]-or-null 
|winningComponentConfig|, and a [=global object=] |global|:
  1. Let |config| be |leadingBidInfo|'s [=leading bid info/auction config=].
  1. Let |bidCurrency| be null.
  1. If |winningComponentConfig| is not null:
    1. [=Assert=] that |leadingBidInfo|'s [=leading bid info/component seller=] is not null.
    1. Set |bidCurrency| to |winningComponentConfig|'s [=auction config/seller currency=].
    1. If |bidCurrency| is null, then set |bidCurrency| to the result of
      [=looking up per-buyer currency=] with |config| and |leadingBidInfo|'s
      [=leading bid info/component seller=].
  1. Otherwise, set |bidCurrency| to the result of [=looking up per-buyer currency=] with |config|
    and |leadingBidInfo|'s [=leading bid info/leading bid=]'s [=generated bid/interest group=]'s
    [=interest group/owner=].
  1. Let |winner| be |leadingBidInfo|'s [=leading bid info/leading bid=].
  1. Let |sellerCurrency| be |leadingBidInfo|'s [=leading bid info/auction config=]'s
    [=auction config/seller currency=].
  1. Let |highestScoringOtherBid| be |leadingBidInfo|'s
    [=leading bid info/highest scoring other bid=]'s [=generated bid/bid in seller currency=] (or
    0 if encountered a null).
  1. If |sellerCurrency| is null, then set |highestScoringOtherBid| to |leadingBidInfo|'s
      [=leading bid info/highest scoring other bid=]'s [=generated bid/bid=]'s
      [=bid with currency/value=] (or 0 if encountered a null).
  1. Let |bid| be |winner|'s [=generated bid/bid=]'s [=bid with currency/value=].
  1. Let |modifiedBid| be null.
  1. If |winner|'s [=generated bid/modified bid=] is not null:
    1. If |leadingBidInfo|'s [=leading bid info/component seller=] is not null, then set |bid| to
      |winner|'s [=generated bid/modified bid=].
    1. Otherwise, set |modifiedBid| to |winner|'s [=generated bid/modified bid=].
  1. Let |browserSignals| be a {{ReportResultBrowserSignals}} with the following fields:
    <dl link-for-hint="ReportingBrowserSignals">
      <dt>{{topWindowHostname}}
      <dd>The result of running the <a spec=url>host serializer</a> on |global|'s
        [=environment/top-level origin=]'s [=origin/host=].
      <dt>{{interestGroupOwner}}
      <dd>[=serialization of an origin|Serialized=] |winner|'s [=generated bid/interest group=]'s
        [=interest group/owner=].
      <dt>{{renderURL}}
      <dd>[=URL serializer|Serialized=] |winner|'s [=generated bid/ad descriptor=]'s [=ad descriptor/url=]
      <dt>{{bid}}
      <dd>[=round a value|Stochastically rounded=] |bid|
      <dt>{{bidCurrency}}
      <dd>The result of [=serializing a currency tag=] with |bidCurrency|
      <dt>{{highestScoringOtherBid}}
      <dd>|highestScoringOtherBid|
      <dt>{{highestScoringOtherBidCurrency}}
      <dd>|sellerCurrency| if it is not null, "`???`" otherwise
      <dt>{{topLevelSeller}}
      <dd>|leadingBidInfo|'s [=leading bid info/top level seller=] if it is not null, {{undefined}}
        otherwise
      <dt>{{componentSeller}}
      <dd>|leadingBidInfo|'s [=leading bid info/component seller=] if it is not null, {{undefined}}
        otherwise
      <dt>{{ReportResultBrowserSignals/desirability}}
      <dd>[=round a value|Stochastically rounded=] |leadingBidInfo|'s [=leading bid info/top score=]
      <dt>{{ReportResultBrowserSignals/topLevelSellerSignals}}
      <dd>|leadingBidInfo|'s [=leading bid info/top level seller signals=] if it is not null,
        {{undefined}} otherwise
      <dt>{{ReportResultBrowserSignals/modifiedBid}}
      <dd>[=round a value|Stochastically rounded=] |modifiedBid| if it is not null, {{undefined}}
        otherwise
      <dt>{{ReportResultBrowserSignals/dataVersion}}
      <dd>|leadingBidInfo|'s [=leading bid info/scoring data version=] if it is not null,
        {{undefined}} otherwise
    </dl>
  1. Let |igAd| be the [=interest group ad=] from |winner|'s [=generated bid/interest group=]'s
    [=interest group/ads=] whose [=interest group ad/render url=] is |winner|'s
    [=generated bid/ad descriptor=]'s [=ad descriptor/url=].
  1. If |igAd|'s [=interest group ad/buyer and seller reporting ID=]
     [=map/exists=] and the result of [=query reporting ID k-anonymity count=]
     given |winner|'s [=generated bid/interest group=] and |igAd| is true, then [=map/set=] |browserSignals|["{{ReportingBrowserSignals/buyerAndSellerReportingId}}"] to |igAd|'s
     [=interest group ad/buyer and seller reporting ID=].
  1. Let |sellerReportingScript| be the result of [=fetching script=] with |config|'s
    [=auction config/decision logic url=].
  1. Let « |sellerSignals|, |reportUrl|, |reportingBeaconMap|, ignored » be the result of
    [=evaluating a reporting script=] with |sellerReportingScript|, "`reportResult`", and
    « |config|'s [=auction config/config idl=], |browserSignals|, |directFromSellerSignals| ».
   1. Let |reportingResult| be a [=reporting result=] with the following [=struct/items=]:
     : [=reporting result/report url=]
     :: |reportUrl|

     : [=reporting result/reporting beacon map=]
     :: |reportingBeaconMap|
  1. If |leadingBidInfo|'s [=leading bid info/top level seller=] is null (i.e., if we are reporting
     for a component seller), set |leadingBidInfo|'s
     [=leading bid info/component seller reporting result=] to |reportingResult|.
  1. Otherwise, set |leadingBidInfo|'s [=leading bid info/seller reporting result=] to
     |reportingResult|.
  1. [=map/Remove=] |browserSignals|["`desirability`"].
  1. [=map/Remove=] |browserSignals|["`modifiedBid`"].
  1. [=map/Remove=] |browserSignals|["`topLevelSellerSignals`"].
  1. [=map/Remove=] |browserSignals|["`dataVersion`"].

    Note: Remove fields specific to {{ReportResultBrowserSignals}} which only sellers can learn about,
    so that they are not passed to "`reportWin()`".

  1. Return « |sellerSignals|, |browserSignals| ».
</div>

<div algorithm>
To <dfn>report win</dfn> given a [=leading bid info=] |leadingBidInfo|, a [=string=] |sellerSignals|,
a {{ReportingBrowserSignals}} |browserSignals|, and a [=direct from seller signals=]-or-null
|directFromSellerSignals|:

  1. Let |config| be |leadingBidInfo|'s [=leading bid info/auction config=].
  1. Let |winner| be |leadingBidInfo|'s [=leading bid info/leading bid=].
  1. Let |perBuyerSignals| be |config|'s [=auction config/per buyer signals=].
  1. Let |buyer| be |winner|'s [=generated bid/interest group=]'s [=interest group/owner=].
  1. Let |perBuyerSignalsForBuyer| be |perBuyerSignals|[|buyer|] if that member [=map/exists=],
    and null otherwise.
  1. Let |reportWinBrowserSignals| be a {{ReportWinBrowserSignals}} with the members that
    are declared on {{ReportingBrowserSignals}} initialized to their values in |browserSignals|.
  1. Add the following fields to |reportWinBrowserSignals|:
    <dl>
      <dt>{{ReportWinBrowserSignals/dataVersion}}
      <dd>|leadingBidInfo|'s [=leading bid info/bidding data version=] if it is not null,
        {{undefined}} otherwise.
      <dt>{{ReportWinBrowserSignals/adCost}}
      <dd>[=Round a value|Rounded=] |winner|’s [=generated bid/ad cost=]
      <dt>{{ReportWinBrowserSignals/seller}}
      <dd>[=serialization of an origin|Serialized=] |config|'s [=auction config/seller=]
      <dt>{{ReportWinBrowserSignals/madeHighestScoringOtherBid}}
      <dd>Set to true if |leadingBidInfo|'s [=leading bid info/highest scoring other bid owner=] is
        not null, and |buyer| is [=same origin=] with |leadingBidInfo|'s
        [=leading bid info/highest scoring other bid owner=], false otherwise
      <dt>{{ReportWinBrowserSignals/modelingSignals}}
      <dd>|winner|'s [=generated bid/modeling signals=] if it is not null, {{undefined}} otherwise
        (TODO: noise and bucket this signal)
    </dl>
  1. Let |igAd| be the [=interest group ad=] from |winner|'s
     [=generated bid/interest group=]'s [=interest group/ads=] whose
     [=interest group ad/render url=] is |winner|'s
     [=generated bid/ad descriptor=]'s [=ad descriptor/url=].
  1. If |igAd|'s [=interest group ad/buyer and seller reporting ID=]
     does not [=map/exist=] and the result of [=query reporting ID k-anonymity count=] given
     |winner|'s [=generated bid/interest group=] and |igAd| is true:
    1. If |igAd|'s [=interest group ad/buyer reporting ID=] [=map/exists=],
      [=map/set=] |reportWinBrowserSignals|["{{ReportWinBrowserSignals/buyerReportingId}}"] to
      |igAd|'s [=interest group ad/buyer reporting ID=].
    1. Otherwise, [=map/Set=] |reportWinBrowserSignals|["{{ReportWinBrowserSignals/interestGroupName}}"]
      to |winner|'s [=generated bid/interest group=] [=interest group/name=].
  1. Let |buyerReportingScript| be the result of [=fetching script=] with |winner|'s
    [=generated bid/interest group=]'s [=interest group/bidding url=].
  1. Let |reportFunctionName| be "`reportWin`".
  1. If |winner|'s [=generated bid/provided as additional bid=] is true:
    1. Set |reportFunctionName| be "`reportAdditionalBidWin`".
  1. Let « ignored, |resultUrl|, |reportingBeaconMap|, |reportingMacroMap| » be the result of
    [=evaluating a reporting script=] with |buyerReportingScript|, "`reportWin`", and
     « |leadingBidInfo|'s [=leading bid info/auction config=]'s [=auction config/config idl=]'s
      {{AuctionAdConfig/auctionSignals}}, |perBuyerSignalsForBuyer|, |sellerSignals|,
      |reportWinBrowserSignals|, |directFromSellerSignals| ».
  1. Set |leadingBidInfo|'s [=leading bid info/buyer reporting result=] to a [=reporting result=]
     with the following [=struct/items=]:
     : [=reporting result/report url=]
     :: |resultUrl|

     : [=reporting result/reporting beacon map=]
     :: |reportingBeaconMap|

     : [=reporting result/reporting macro map=]
     :: |reportingMacroMap|
</div>

# Additional Bids and Negative Targeting # {#additional-bids-and-negative-targeting}

## createAuctionNonce() ## {#create-auction-nonce}

*This first introductory paragraph is non-normative.*

{{Window/navigator}}.{{Navigator/createAuctionNonce()}} creates an <dfn>auction nonce</dfn>, a
one-time [=version 4 UUID=] uniquely associated with a single call to
{{Window/navigator}}.{{Navigator/runAdAuction()}}. For multi-seller auctions, this ID is uniquely
associated with all {{AuctionAdConfig/componentAuctions}}. This nonce will need to be passed back in
via a subsequent call to {{Window/navigator}}.{{Navigator/runAdAuction()}} via the
{{AuctionAdConfig}}. This is currently only needed for [=auctions=] that use [=additional bids=],
for which the [=auction nonce=] will be included in each [=additional bid=] as a way of ensuring
that those bids are only used in the [=auctions=] for which they were intended.

<xmp class="idl">
[SecureContext]
partial interface Navigator {
  Promise<DOMString> createAuctionNonce();
};
</xmp>

<div algorithm="createAuctionNonce()">
The <dfn for=Navigator method>createAuctionNonce()</dfn> method steps are:

  1. Let |p| be [=a new promise=].
  1. Run the following steps [=in parallel=]:
    1. Let |nonce| be the [=string representation=] of a [=version 4 UUID=].

    <div class=note>
    Because we're going in parallel:
      * There is no guarantee that the promise will be resolved before other tasks get queued on the
        main thread;
      * ...which gives browsers the freedom to generate this UUID in another process, and
        asynchronously send it back to the main thread at an arbitrary future time.
    </div>
    1. [=Queue a global task=] on [=DOM manipulation task source=], given [=this=]'s
      [=relevant global object=], to [=resolve=] |p| with |nonce|.
  1. Return |p|.
</div>

## Additional Bids ## {#additional-bids-section}

*This first introductory paragraph is non-normative.*

In addition to [=generate a bid|bids generated by interest groups=], sellers can enable buyers to
introduce bids generated outside of the auction, which are called <dfn>additional bids</dfn>.
[=Additional bids=] are commonly triggered using contextual signals. Buyers compute the
[=additional bids=], likely as part of a contextual auction. Buyers need to package up each
[=additional bid=] using a new data structure that encapsulates all of the information needed for
the [=additional bid=] to compete against other bids in a Protected Audience [=auction=].

<div id="additional-bid-example" class=example>
  <p> Each additional bid is expressed using the following JSON data structure:</p>
  <pre highlight="js">
  const additionalBid = {
    "bid": {
      "ad": 'ad-metadata',
      "adCost": 2.99,
      "bid": 1.99,
      "bidCurrency": "USD",
      "render": "https://www.example-dsp.com/ad/123.jpg",
      "adComponents": [adComponent1, adComponent2],
      "allowComponentAuction": true,
      "modelingSignals": 123,
    },
    "interestGroup": {
      "owner": "https://www.example-dsp.com"
      "name": "campaign123",
      "biddingLogicURL": "https://www.example-dsp.com/bid_logic.js"
    },
    "negativeInterestGroups": {
      joiningOrigin: "https://www.example-advertiser.com",
      interestGroupNames: [
        "example_advertiser_negative_interest_group_a",
        "example_advertiser_negative_interest_group_b",
      ]
    },
    "auctionNonce": "12345678-90ab-cdef-fedcba09876543210",
    "seller": "https://www.example-ssp.com",
    "topLevelSeller": "https://www.another-ssp.com"
  }
  </pre>
</div>

<div algorithm>
To <dfn>validate and convert additional bids</dfn> given an [=auction config=] |auctionConfig|, an
[=auction config=]-or-null |topLevelAuctionConfig|, a [=negative target info=] |negativeTargetInfo|,
and a [=global object=] |global|:

  1. [=Assert=] that these steps are running [=in parallel=].
  1. [=Assert=] that |auctionConfig|'s [=auction config/auction nonce=] is not null.
  1. Let |auctionNonce| be the [=string representation=] of |auctionConfig|'s
    [=auction config/auction nonce=].
  1. Let |capturedAdditionalBidsHeaders| be |global|'s [=associated Document's=]
    [=node navigable's=] [=traversable navigable's=] [=captured additional bids headers=].
  1. Let |additionalBids| be a new [=list=] of [=decoded additional bids=].
  1. [=list/For each=] |encodedSignedAdditionalBid| of |capturedAdditionalBidsHeaders|[|auctionNonce|]:
    1. Let |signedAdditionalBid| be the result of running [=forgiving-base64 decode=] with
      |encodedSignedAdditionalBid|.
    1. If |signedAdditionalBid| is failure, then [=iteration/continue=].
    1. Let |additionalBid| be the result of running [=parse a signed additional bid=] given
      |signedAdditionalBid|, |auctionConfig|, |topLevelAuctionConfig|, and |negativeTargetInfo|. 
    1. If |additionalBid| is not null, then [=list/append=] |additionalBid| to |additionalBids|.
  1. Return |additionalBids|.
</div>

<div algorithm>
To <dfn>parse a signed additional bid</dfn> given a [=byte sequence=] |signedAdditionalBid|, an
[=auction config=] |auctionConfig|, an [=auction config=]-or-null |topLevelAuctionConfig|, and a
[=negative target info=] |negativeTargetInfo|:

  1. [=Assert=] that these steps are running [=in parallel=].
  1. Let |parsedSignedAdditionalBid| be the result of running [=parse a JSON string to an infra value=]
    given |signedAdditionalBid|.
  1. Return null if any of the following conditions hold:
    * |parsedSignedAdditionalBid| is not a [=map=];
    * |parsedSignedAdditionalBid|["bid"] does not [=map/exist=], or is not a [=string=];
    * |parsedSignedAdditionalBid|["signatures"] does not [=map/exist=], or is not a [=list=].
  1. Let |signatures| be a new [=list=] of [=signed additional bid signatures=].
  1. Let |decodeSignatureFailed| be false.
  1. [=list/For each=] |sig| of |parsedSignedAdditionalBid|["signatures"]:
    1. Set |decodeSignatureFailed| to true and [=iteration/break=] if any of the following
      conditions hold:
      * |sig| is not a [=map=];
      * |sig|["key"] does not [=map/exist=], or is not a [=string=];
      * |sig|["signature"] does not [=map/exist=], or is not a [=string=].
    1. Let |maybeKey| be the result of running [=forgiving-base64 decode=] with |sig|["key"].
    1. Let |maybeSignature| be the result of running [=forgiving-base64 decode=] with
      |sig|["signature"].
    1. Set |decodeSignatureFailed| to true and [=iteration/break=] if any of the following
      conditions hold:
      * |maybeKey| is failure, or its [=byte sequence/length=] is not 32;
      * |maybeSignature| is failure, or its [=byte sequence/length=] is not 64;
    1. Let |signature| be a [=signed additional bid signatures=], whose
      [=signed additional bid signature/key=] is |maybeKey|, and
      [=signed additional bid signature/signature=] is |maybeSignature|.
    1. [=list/Append=] |signature| to |signatures|.
  1. If |decodeSignatureFailed| is true, then return null.
  1. Let |decodedAdditionalBid| be the result of [=decode an additional bid json=] given
    |parsedSignedAdditionalBid|["bid"], |auctionConfig| and |topLevelAuctionConfig|.
  1. Return null if any of the following conditions hold:
    * |decodedAdditionalBid| is failure;
    * The result of [=checking a currency tag=] with |decodedAdditionalBid|'s
      [=decoded additional bid/bid=]'s [=generated bid/bid=]'s [=bid with currency/currency=] and
      the result of running [=look up per-buyer currency=] with |auctionConfig|.
  1. Let |verifiedSignatureKeys| be a new [=set=] of [=byte sequences=].
  1. [=list/For each=] |signature| of |signatures|:
    1. Let |isSignatureValid| be the result of running [=verify=] |signature|'s
      [=signed additional bid signature/signature=] on message |parsedSignedAdditionalBid|["bid"]
      using |signature|'s [=signed additional bid signature/key=], with 0 for Ed25519ctx.
    1. If |isSignatureValid| is true, then [=set/append=] |signature|'s
      [=signed additional bid signature/key=] to |verifiedSignatureKeys|.
  1. If the result of [=checking whether negative targeted=] given |decodedAdditionalBid|,
    |verifiedSignatureKeys| and |negativeTargetInfo| is true, then return null.
  1. Return |decodedAdditionalBid|.
</div>

<div algorithm>
To <dfn>decode an additional bid json</dfn> given a [=string=] |additionalBidJson|, an
[=auction config=] |auctionConfig|, and an [=auction config=]-or-null |topLevelAuctionConfig|:

  1. [=Assert=] that these steps are running [=in parallel=].
  1. Let |parsedAdditionalBid| be the result of [=parse a JSON string to an infra value=] given
    |additionalBidJson|.
  1. If |parsedAdditionalBid| is not a [=map=], then return failure.
  1. Let |result| be a new [=decoded additional bid=].
  1. Return failure if any of the following conditions hold:
    * |parsedAdditionalBid|["auctionNonce"] does not [=map/exist=];
    * |parsedAdditionalBid|["auctionNonce"] is not the [=string representation=] of
      |auctionConfig|'s [=auction config/auction nonce=];
    * |parsedAdditionalBid|["seller"] does not [=map/exist=];
    * The result of running the [=parse an https origin=] with |parsedAdditionalBid|["seller"] is
      failure, or not [=same origin=] with |auctionConfig|'s [=auction config/seller=].
  1. If |topLevelAuctionConfig| is null:
    1. If |parsedAdditionalBid|["topLevelSeller"] [=map/exists=], then return failure.
  1. Otherwise:
    1. If |parsedAdditionalBid|["topLevelSeller"] does not [=map/exist=], then return failure.
    1. Let |bidTopLevelSeller| be the result of running the [=parse an https origin=] with
      |parsedAdditionalBid|["topLevelSeller"].
    1. If |bidTopLevelSeller| is failure, or |bidTopLevelSeller| is not [=same origin=] with
      |topLevelAuctionConfig|'s [=auction config/seller=], then return failure.
  1. If |parsedAdditionalBid|["interestGroup"] does not [=map/exist=], then return failure.
  1. Let |igMap| be |parsedAdditionalBid|["interestGroup"].
  1. Return failure if any the following conditions hold:
    * |igMap| is not a [=map=];
    * |igMap|["name"] does not [=map/exist=], or is not a [=string=];
    * |igMap|["biddingLogicURL"] does not [=map/exist=], or is not a [=string=];
    * |igMap|["owner"] does not [=map/exist=], or is not a [=string=];
  1. Let |igOwner| be the result of running [=parse an https origin=] given |igMap|["owner"].
  1. Let |igName| be |igMap|["name"].
  1. Let |igBiddingUrl| be the result of running [=url parser=] on |igMap|["biddingLogicURL"].
  1. Return failure if any of the following conditions hold:
    * |igOwner| is failure;
    * |auctionConfig|'s [=auction config/interest group buyers=] does not [=list/contain=] |igOwner|;
    * |igBiddingUrl| is failure;
    * |igOwner| is not [=same origin=] with |igBiddingUrl|.
  1. Let |ig| be a new [=interest group=] with the following properties:
    :   [=interest group/owner=]
    ::  |igOwner|
    :   [=interest group/name=]
    ::  |igName|
    :   [=interest group/bidding url=]
    ::  |igBiddingUrl|
  1. If |parsedAdditionalBid|["bid"] does not [=map/exist=], or is not a [=map=], return failure.
  1. Let |bidMap| be |parsedAdditionalBid|["bid"].
  1. If |bidMap|["render"] does not [=map/exist=] or is not a [=string=], then return failure.
  1. Let |renderUrl| be the result of running [=URL parser=] on |bidMap|["render"].

  1. If |renderUrl| is failure, then return failure.
  1. Let |ad| be a new [=interest group ad=] whose [=interest group ad/render url=] is |renderUrl|.
  1. Set |ig|'s [=interest group/ads=] to « |ad| ».
  1. Let |bidVal| be |bidMap|["bid"] if it [=map/exists=], otherwise return failure.
  1. If |bidVal| is not a {{double}}, or is less than or equal to 0, then return failure.
  1. Let |adMetadata| be "null".
  1. If |bidMap|["ad"] [=map/exists=]:
    1. Set |adMetadata| to the result of running [=serialize an Infra value to a JSON string=] with
      |bidMap|["ad"].
  1. Let |bidCurrency| be null.
  1. If |bidMap|["bidCurrency"] [=map/exists=]:
    1. If |bidMap|["bidCurrency"] is not a [=string=], or the result of [=checking whether a string
      is a valid currency tag=] is failure, then return failure.
    1. Set |bidCurrency| to |bidMap|["bidCurrency"].
  1. Let |adCost| be null.
  1. If |bidMap|["adCost"] [=map/exists=]:
    1. If |bidMap|["adCost"] is not a {{double}}, then return failure.
    1. Set |adCost| to |bidMap|["adCost"].
  1. Let |modelingSignals| be null.
  1. If |bidMap|["modelingSignals"] [=map/exists=]:
    1. If |bidMap|["modelingSignals"] is not a {{double}}, then return failure.
    1. If |bidMap|["modelingSignals"] &ge; 0, and &lt; 4096, then set |modelingSignals| to
      |bidMap|["modelingSignals"].
  1. Let |adComponents| be a new [=list=] of [=ad descriptors=].
  1. If |bidMap|["adComponents"] [=map/exists=]:
    1. If |bidMap|["adComponents"] is not a [=list=], then return failure.
    1. [=list/For each=] |component| of |bidMap|["adComponents"]:
      1. If |component| is not a [=string=], then return failure.
      1. Let |componentUrl| be the result of running [=URL parser=] on |component|.
      1. If |componentUrl| is failure, then return failure.
      1. Let |componentDescriptor| be a new [=ad descriptor=] whose [=ad descriptor/url=] is
        |componentUrl|.
      1. [=list/Append=] |componentDescriptor| to |adComponents|.
    1. Set |ig|'s [=interest group/ad components=] to |adComponents|.
  1. If |parsedAdditionalBid|["negativeInterestGroup"] [=map/exists=]:
    1. If |parsedAdditionalBid|["negativeInterestGroups"] [=map/exists=], or
      |parsedAdditionalBid|["negativeInterestGroup"] is not a [=string=], then return failure.
    1. [=list/Append=] |parsedAdditionalBid|["negativeInterestGroup"] to |result|'s
      [=decoded additional bid/negative target interest group names=].
  1. If |parsedAdditionalBid|["negativeInterestGroups"] [=map/exists=]:
    1. Let |multipleNegativeIg| be |parsedAdditionalBid|["negativeInterestGroups"].
    1. Return failure if any of the following conditions hold:
      * |multipleNegativeIg| is not a [=map=];
      * |multipleNegativeIg|["joiningOrigin"] does not [=map/exist=], or is not a [=string=];
      * |multipleNegativeIg|["interestGroupNames"] does not [=map/exist=], or is not a [=list=].
    1. Let |joiningOrigin| be the result of running [=parse an https origin=] with
      |multipleNegativeIg|["joiningOrigin"].
    1. If |joiningOrigin| is failure, then return failure.
    1. Set |result|'s [=decoded additional bid/negative target joining origin=] to |joiningOrigin|.
    1. [=list/For each=] |igName| of |multipleNegativeIg|["interestGroupNames"]:
      1. If |igName| is not a [=string=], then return failure.
      1. [=list/Append=] |igName| to |result|'s
        [=decoded additional bid/negative target interest group names=].
  1. Set |result|'s [=decoded additional bid/bid=] to a new [=generated bid=] with the following
    properties:
    :   [=generated bid/bid=]
    ::  A [=bid with currency=] whose [=bid with currency/value=] is |bidVal|, and
      [=bid with currency/currency=] is |bidCurrency|
    :   [=generated bid/ad=]
    ::  |adMetadata|
    :   [=generated bid/ad descriptor=]
    ::  An [=ad descriptor=] whose [=ad descriptor/url=] is |renderUrl|
    :   [=generated bid/ad component descriptors=]
    ::  |adComponents|
    :   [=generated bid/ad cost=]
    ::  |adCost|
    :   [=generated bid/modeling signals=]
    ::  |modelingSignals|
    :   [=generated bid/interest group=]
    ::  |ig|
    :   [=generated bid/bid ad=]
    ::  A [=interest group ad=] whose [=interest group ad/render url=] is |renderUrl|, and
      [=interest group ad/metadata=] is |adMetadata|
    :   [=generated bid/provided as additional bid=]
    ::  true
  1. Return |result|.
</div>

A <dfn>signed additional bid signature</dfn> is a [=struct=] with the following [=struct/items=]:
<dl dfn-for="signed additional bid signature">
  : <dfn>key</dfn>
  :: A [=byte sequence=] of length 32.
  : <dfn>signature</dfn>
  :: A [=byte sequence=] of length 64.
</dl>

A <dfn>decoded additional bid</dfn> is a [=struct=] with the following [=struct/items=]:
<dl dfn-for="decoded additional bid">
  : <dfn>bid</dfn>
  :: A [=generated bid=]. Fields analogous to those returned by `generateBid()`.
  : <dfn>negative target interest group names</dfn>
  :: A [=list=] of [=strings=].
  : <dfn>negative target joining origin</dfn>
  :: Null or an [=origin=]. Required if there is more than one entry in
    [=decoded additional bid/negative target interest group names=].
</dl>

Each [=traversable navigable=] has a <dfn>captured additional bids headers</dfn>, which is a [=map=]
whose [=map/keys=] are [=strings=] for [=auction nonces=], and whose values are [=list=] of
[=strings=] for encoded additional bids.

## Negative Targeting ## {#negative-targeting-section}

*This first introductory paragraph is non-normative.*

In online ad auctions for ad space, it’s sometimes useful to prevent showing an ad to certain
audiences, a concept known as <dfn>negative targeting</dfn>. To facilitate [=negative targeting=] in
Protected Audience [=auctions=], each [=additional bid=] is allowed to identify one or more
[=negative interest groups=]. If the user has been joined to any of the identified
[=negative interest groups=], the [=additional bid=] is dropped; otherwise it participates in the
[=auction=], competing alongside bids created by calls to `generateBid()`. An [=additional bid=]
that specifies no [=negative interest groups=] is always accepted into the [=auction=].

<div algorithm>
To <dfn>check whether negative targeted</dfn> given an [=decoded additional bid=] |additionalBid|, a
[=set=] of [=byte sequences=] |verifiedSignatureKeys|, and a [=negative target info=]
|negativeTargetInfo|:

  1. [=Assert=] that these steps are running [=in parallel=].
  1. Let |negativeTargeted| be false.
  1. Let |additionalBidBuyer| be |additionalBid|'s [=decoded additional bid/bid=]'s
    [=generated bid/interest group=]'s [=interest group/owner=].
  1. [=list/For each=] |igName| of |additionalBid|'s
    [=decoded additional bid/negative target interest group names=]:
    1. If |negativeTargetInfo|[(|additionalBidBuyer|, |igName|)] [=map/exists=]:
      1. Let (|joiningOrigin|, |additionalBidKey|) be
        |negativeTargetInfo|[(|additionalBidBuyer|, |igName|)].
      1. If |verifiedSignatureKeys| [=list/contains=] |additionalBidKey|:
        1. If |joiningOrigin| is not null:
          1. If |joiningOrigin| is not [=same origin=] with |additionalBid|'s
            [=decoded additional bid/negative target joining origin=], then [=iteration/continue=].
        1. Set |negativeTargeted| to true, and [=iteration/break=].

   Note: If the signature doesn't verify successfully, the [=additional bid=] proceeds as if the
      [=negative interest group=] is not present. This ensures that only the
      [=interest group/owner=] of the [=negative interest group=], who created the
      {{AuctionAdInterestGroup/additionalBidKey}}, is allowed to
      [=negative targeting|negatively target=] the interest group, and that nobody else can learn
      whether the [=interest group set=] [=list/contains=] the interest group.
  1. Return |negativeTargeted|.
</div>

A <dfn>negative target info</dfn> is a [=map=]. Its [=map/keys=] are [=tuples=] consisting of an
[=origin=] for [=interest group/owner=] and a [=string=] for [=interest group/name=].
Its [=map/values=] are [=tuples=] consisting of an [=origin=] for [=interest group/joining origin=]
and a [=byte sequence=] for [=interest group/additional bid key=].

### Negative Interest Groups ### {#negative-interest-groups}

*This section is non-normative.*

Though [=negative interest groups=] are joined using the same {{Navigator/joinAdInterestGroup()}}
API as [=regular interest groups=], they remain distinct from one another. Only
[=negative interest groups=]'s [=interest group/additional bid key=] can be non-null, while only
[=regular interest groups=]'s [=interest group/ads=] can be non-null. Because the subset of fields
used by a [=negative interest group=] cannot be meaningfully updated, a [=negative interest group=]'s
[=interest group/update url=] must be null, otherwise a {{TypeError}} will be [=exception/thrown=] by
{{Navigator/joinAdInterestGroup()}} API.

[=Additional bids=] specify the [=negative interest groups=] they're [=negatively targeting=]
against using at most one of the following two fields in their JSON data structure:
  * negativeInterestGroup, for a single negative interest group;
  * negativeInterestGroups, for more than one negative interest groups.

If an [=additional bid=] needs to specify more than one [=negative interest groups=], all of those
[=negative interest groups=] must be joined from the [=same origin=], and that [=origin=] must be
identified ahead of time in the [=additional bid=]'s `joiningOrigin` field. Any
[=negative interest group=] that wasn't joined from that identified [=origin=] is ignored for
[=negative targeting=].

<div id="negative-igs-example" class=example>
  <p>Use `negativeInterestGroup` in additional bid's JSON:</p>
  <pre highlight="js">
  const additionalBid = {
    ...
    "negativeInterestGroup": "example_advertiser_negative_interest_group",
    ...
  }
  </pre>
  <p>Use `negativeInterestGroups` in additional bid's JSON:</p>
  <pre highlight="js">
  const additionalBid = {
    ...
    "negativeInterestGroups": {
      joiningOrigin: "https://example-advertiser.com",
      interestGroupNames: [
        "example_advertiser_negative_interest_group_a",
        "example_advertiser_negative_interest_group_b",
      ]
    },
    ...
  }
  </pre>
</div>

# K-anonymity # {#k-anonymity}

Two goals of this specification rely on applying [=k-anonymity=] thresholds:

  * To prevent cross-site leaks:  Inputs to event-level reporting functions, `reportWin()` and
    `reportResult()`, only contain limited cross-site information. As described in
    [[#privacy-considerations]], part of this limiting is done by
    applying [=k-anonymity=] requirements to the ad URLs.
  * To prevent microtargeting:  The browser applies [=k-anonymity=] requirements on the ad URLs to
    ensure that the same ad or ad component is being shown to at least some minimum number of
    people.

The browser enforces these [=k-anonymity=] requirements by maintaining counts of how many times each
ad and ad component has been shown to users. These counts are maintained across users, so the counting must
be done on a central <dfn>k-anonymity server</dfn>. This specification relies on two operations to query and
increment the counts: [=query k-anonymity count=] and [=increment k-anonymity count=].

The details of how the [=k-anonymity server=] is operated and accessed are [=implementation-defined=]
but it should be done in a way that prevents the server operator from joining the identity of two
query or increment requests. One way to help prevent this is by making accesses to the server go
through an HTTP proxy that prevents the server from seeing the browsers' IP addresses.

The browser should choose a <dfn>k-anonymity threshold</dfn>, otherwise known as the value for "k",
and a <dfn>k-anonymity duration</dfn> depending
on the projected sizes of interest groups and the browser's privacy goals. For example an implementation
might choose to require a [=k-anonymity=] threshold of fifty users over a seven day period. The server
will maintain the count over the chosen duration and compare the count to the chosen [=k-anonymity=]
threshold when responding to [=query k-anonymity count=].

<div algorithm>
  To <dfn>query k-anonymity count</dfn> given a |hashCode|:
    1. If the [=k-anonymity server=] has recorded at least [=k-anonymity threshold=] users
        seeing |hashCode| over the last [=k-anonymity duration=], return true.
        Otherwise return false.
    1. Return true if it is above the threshold, otherwise return false.
</div>

<div algorithm>
  To <dfn>query ad k-anonymity count</dfn> given an [=interest group=] |ig| and a [=URL=] |ad|:
    1. Let |keyString| be the [=string/concatenation=] of the following strings separated with U+000A LF:
      1. "AdBid"
      1. the [=serialization of an origin|serialization=] of |ig|'s [=interest group/owner=]
      1. the [=URL serializer|serialization=] of |ig|'s [=interest group/bidding url=]
      1. the [=URL serializer|serialization=] of |ad|.
    1. Let |keyHash| be the [=SHA-256=] hash of the [=ASCII encoding=] of |keyString|.

    1. Return the result of [=query k-anonymity count|querying the k-anonymity count=] given |keyHash|.
</div>

<div algorithm>
  To <dfn>compute the key hash of reporting ID</dfn> given an [=interest group=] |ig| and an
  [=interest group ad=] |igAd|:
    1. Let |keyString| be the [=string/concatenation=] of the following strings separated with U+000A (LF):

      1. "NameReport"
      1. the [=serialization of an origin|serialization=] of |ig|'s [=interest group/owner=]
      1. the [=URL serializer|serialization=] of |ig|'s [=interest group/bidding url=]
      1. the [=URL serializer|serialization=] of |igAd|'s [=interest group ad/render url=]
      1. If |igAd|'s [=interest group ad/buyer and seller reporting ID=]
          [=map/exists=]:
        1. "BuyerAndSellerReportingId"
        1. |igAd|'s [=interest group ad/buyer and seller reporting ID=]
      1. Otherwise, if |igAd|'s [=interest group ad/buyer reporting ID=]
          [=map/exists=]:
        1. "BuyerReportingId"
        1. |igAd|'s [=interest group ad/buyer reporting ID=]
      1. Otherwise:
        1. "IgName"
        1. |ig|'s [=interest group/name=].
    1. Return the [=SHA-256=] hash of the [=ASCII encoding=] of |keyString|.
</div>

<div algorithm>
  To <dfn>query component ad k-anonymity count</dfn> given a [=URL=] |ad|:
    1. Let |keyString| be the [=string/concatenation=] of the following strings separated with U+000A LF:
      1. "ComponentBid"
      1. the [=URL serializer|serialization=] of |ad|.
    1. Let |keyHash| be the [=SHA-256=] hash of the [=ASCII encoding=] of |keyString|.

    1. Return the result of [=query k-anonymity count|querying the k-anonymity count=] given |keyHash|.
</div>

<div algorithm>
  To <dfn>query generated bid k-anonymity count</dfn> given a [=generated bid=] |bid|:
    1. If [=query ad k-anonymity count=] given |bid|'s [=generated bid/ad descriptor=]'s
      [=ad descriptor/url=] returns false, return false.
    1. If |bid|'s [=generated bid/ad component descriptors=] is not null:
      1. [=set/For each=] |adComponentDescriptor| in |bid|'s
        [=generated bid/ad component descriptors=]:
        1. If [=query component ad k-anonymity count=] given |adComponentDescriptor|'s
          [=ad descriptor/url=] returns false, return false.
    1. Return true.

</div>

<div algorithm>
  To <dfn>query reporting ID k-anonymity count</dfn> given an [=interest group=]
  |ig| and [=interest group ad=] |igAd|:
    1. Let |keyHash| be the result of [=computing the key hash of reporting ID=] given |ig| and |igAd|.
    1. Return the result of [=query k-anonymity count|querying the k-anonymity count=] given |keyHash|.
</div>

<div algorithm>
  To <dfn>increment k-anonymity count</dfn> given a |hashCode|:
    1. Ask the [=k-anonymity server=] to record that this [=user agent=] has seen |hashCode|.
</div>

<div algorithm>
  To <dfn>increment ad k-anonymity count</dfn> given an [=interest group=] |ig| and a [=URL=] |ad|:
    1. Let |keyString| be the [=string/concatenation=] of the following strings separated with U+000A LF:
      1. "AdBid"
      1. the [=serialization of an origin|serialization=] of |ig|'s [=interest group/owner=]
      1. the [=URL serializer|serialization=] of |ig|'s [=interest group/bidding url=]
      1. the [=URL serializer|serialization=] of |ad|.
    1. Let |keyHash| be the [=SHA-256=] hash of the [=ASCII encoding=] of |keyString|.
    1. [=Increment k-anonymity count=] given |keyHash|.
</div>

<div algorithm>
  To <dfn>increment component ad k-anonymity count</dfn> given a [=URL=] |ad|:
    1. Let |keyString| be the [=string/concatenation=] of the following strings separated with U+000A LF:
      1. "ComponentBid"
      1. the [=URL serializer|serialization=] of |ad|.
    1. Let |keyHash| be the [=SHA-256=] hash of the [=ASCII encoding=] of |keyString|.
    1. [=Increment k-anonymity count=] given |keyHash|.
</div>

<div algorithm>
  To <dfn>increment reporting ID k-anonymity count</dfn> given an [=interest group=] |ig| and a [=URL=]
  |ad|:
    1. Let |igAd| be the [=interest group ad=] from |ig|'s [=interest group/ads=] whose
      [=interest group ad/render url=] is |ad|.
    1. Let |keyHash| be the result of [=computing the key hash of reporting ID=] given |ig| and |igAd|.
    1. [=Increment k-anonymity count=] given |keyHash|.
</div>

# Script Runners # {#script-runners}

*This introduction sub-section is non-normative*.

This specification defines a new type of script execution environment called a [=script runner=]. On
the surface, these are similar to <a href=https://html.spec.whatwg.org/C#worklets-intro>Worklets</a>
in that they too are used for running scripts independent of the *main* execution environment with a
flexible implementation model.

However, some key differences from traditional Worklets motivate us to create a new kind of script
execution environment. In particular, they:

 * Are not scoped to a particular {{Document}}, but are rather scoped to a [=user agent=], as they
   are spun up by [=interest groups=] in the [=user agent=]'s [=interest group set=].
 * Consequently have a different, more flexible [=ECMAScript/agent cluster=] allocation model —
   specifically, they need not execute in the same [=ECMAScript/agent cluster=] as any {{Document}},
   and for privacy reasons implementations may be motivated to enjoy this flexibility.
 * Do not have any other WebIDL interfaces exposed to their global besides the ones defined in this
   specification, unlike other Worklet types.
 * Have a restricted set of ECMAScript APIs exposed to them; for example {{Date}} is not exposed in
   these environments.
 * Are not [=module scripts=], and are instead evaluated as if they were [=classic scripts=].
 * Are not [=scripts=] in the [[HTML]] sense, and as such:
   * Their [=ECMAScript/agent=] does not have an [=event loop=]
   * Their [=ECMAScript/realm=] does not have a [=realm/settings object=], and therefore functions
     inside them are not run with the familiar [[WebIDL]] [=invoke|invocation=] mechanism.
   * They do not [=perform a microtask checkpoints=].

## Realm and agent ## {#realm-and-agent}

<div algorithm>
  To <dfn>create a new script runner agent</dfn>, run these steps:

    1. Let |signifier| be a new unique internal value.

    1. Let |candidateExecution| be a new [=ECMAScript/candidate execution=].

    1. Return a new [=ECMAScript/agent=] whose \[[CanBlock]] is false, \[[Signifier]] is
       |signifier|, \[[CandidateExecution]] is |candidateExecution|, and \[[IsLockFree1]],
       \[[IsLockFree2]], and \[[LittleEndian]] are set at the implementation's discretion.

  Note: This algorithm is almost identical to [[HTML]]'s [=create an agent=] algorithm, with the
  exception that we do not give the returned agent a new [=event loop=], since it does not process
  [=tasks=] within [=task sources=] in the usual way.
</div>

<div algorithm>
  To <dfn>obtain a script runner agent</dfn>, run these steps:

    1. Let |agentCluster| be a new [=ECMAScript/agent cluster=].

    1. Let |agent| be the result of [=creating a new script runner agent=].

    1. Add |agent| to |agentCluster|.

    1. Return |agent|.
</div>

<div algorithm>
  To <dfn>create a new script runner realm</dfn> with a global type |globalType|, run these steps:

    1. [=Assert=] that these steps are running [=in parallel=].

    1. Let |agent| be the result of [=obtaining a script runner agent=] given null, true, and false.
      Run the rest of these steps in |agent|.

       Issue: This exclusively creates a new [=ECMAScript/agent cluster=] for a given script to run
       in, but we should make this work with [=interest group/execution mode=] somehow.

    1. Let |realmExecutionContext| be the result of [=creating a new realm=] given |agent| and the
       following customizations:

        * For the global object, create a new object of type |globalType|.

    1. Let |realm| be |realmExecutionContext|'s Realm component.

    1. Let |global| be |realm|'s [=realm/global object=], and run these steps:

      1. Perform !|global|.\[[Delete]]("`Date`").

      1. If !|global|.\[[HasProperty]]("`Temporal`") is true, then perform
         !|global|.\[[Delete]]("`Temporal`").

      Advisement: This is not the best way to perform such API neutering (see
      <a href="https://github.com/tc39/ecma262/issues/1357#issuecomment-817560121">tc39/ecma262#1357</a>),
      but at the moment it's the way that host environments do this.

      Note: Removing time-referencing APIs from the |global| object is imperative for privacy, as a
      script might otherwise be able to more easily exfiltrate data by using more accurate time
      measurements.

    1. Return |realm|.
</div>

## Script evaluation ## {#script-evaluation}

Concretely, a <dfn>script runner</dfn> is a JavaScript execution environment instantiated with one
of the following global objects:

 * {{InterestGroupBiddingScriptRunnerGlobalScope}}
 * {{InterestGroupScoringScriptRunnerGlobalScope}}
 * {{InterestGroupReportingScriptRunnerGlobalScope}}

<div algorithm>
  To <dfn>evaluate a bidding script</dfn> given a [=string=] |script|, an [=interest group=] |ig|, a
  [=currency tag=] |expectedCurrency|, a {{GenerateBidInterestGroup}} |igGenerateBid|, a [=string=]-or-null
  |auctionSignals|, a [=string=]-or-null |perBuyerSignals|, an [=ordered map=] |trustedBiddingSignals|,
  a {{BiddingBrowserSignals}} |browserSignals|, a {{DirectFromSellerSignalsForBuyer}}
  |directFromSellerSignalsForBuyer| and an integer millisecond [=duration=] |timeout|:

    1. Let |realm| be the result of [=creating a new script runner realm=] given
      {{InterestGroupBiddingScriptRunnerGlobalScope}}.
    1. Let |global| be |realm|'s [=realm/global object=].
    1. Let |settings| be |realm|'s [=realm/settings object=].

      Issue: <a href="https://github.com/WICG/turtledove/issues/676">WICG/turtledove#676</a> needs
      to be fixed in order to get |realm|'s [=realm/settings object=].
    1. Set |global|'s
      [=InterestGroupBiddingScriptRunnerGlobalScope/group has ad components=] to true if |ig|'s
      [=interest group/ad components=] is not null, or false otherwise.
    1. Set |global|'s [=InterestGroupBiddingScriptRunnerGlobalScope/expected currency=] to |expectedCurrency|.
    1. Let |isComponentAuction| be true if |browserSignals|["{{BiddingBrowserSignals/topLevelSeller}}"] is not null, or
      false otherwise.
    1. Set |global|'s [=InterestGroupBiddingScriptRunnerGlobalScope/is component auction=] to
      |isComponentAuction|.
    1. Set |global|'s [=InterestGroupBiddingScriptRunnerGlobalScope/interest group=] to |ig|.
    1. Let |igJS| be the result of [=converted to ECMAScript values|converting to ECMAScript values=]
      given |igGenerateBid|.
    1. Let |auctionSignalsJS| be the result of [=parsing a JSON string to a JavaScript value=] given
      |auctionSignals| if |auctionSignals| is not null, otherwise {{undefined}}.
    1. Let |perBuyerSignalsJS| be the result of [=parsing a JSON string to a JavaScript value=]
      given |perBuyerSignals| if |perBuyerSignals| is not null, otherwise {{undefined}}.
    1. Let |trustedBiddingSignalsJS| be |trustedBiddingSignals| [=converted to ECMAScript values=].
    1. Let |browserSignalsJS| be |browserSignals| [=converted to ECMAScript values=].
    1. Let |directFromSellerSignalsJs| be |directFromSellerSignalsForBuyer|
      [=converted to ECMAScript values=].
    1. Let |startTime| be |settings|'s [=environment settings object/current monotonic time=].
    1. Let |result| be the result of [=evaluating a script=] with |realm|, |script|, "`generateBid`",
      « |igJS|, |auctionSignalsJS|, |perBuyerSignalsJS|, |trustedBiddingSignalsJS|, |browserSignalsJS|,
      |directFromSellerSignalsJs| », and |timeout|.
    1. Let |duration| be |settings|'s [=environment settings object/current monotonic time=] minus
      |startTime| in milliseconds.
    1. If |global|'s [=InterestGroupBiddingScriptRunnerGlobalScope/priority=] is not null and not failure:
      1. Set |ig|'s [=interest group/priority=] to |global|'s
        [=InterestGroupBiddingScriptRunnerGlobalScope/priority=].
      1. [=list/Replace=] the [=interest group=] that has |ig|'s [=interest group/owner=] and
        [=interest group/name=] in the [=user agent=]'s [=interest group set=] with |ig|.
    1. If |global|'s [=InterestGroupBiddingScriptRunnerGlobalScope/priority signals=]
      [=map/is not empty=]:
      1. [=map/For each=] |k| → |v| of |global|'s
        [=InterestGroupBiddingScriptRunnerGlobalScope/priority signals=]:
        1. If |v| is null, [=map/remove=] |ig|'s [=interest group/priority signals overrides=][|k|].
        1. Otherwise, [=map/set=] |ig|'s [=interest group/priority signals overrides=][|k|] to |v|.
      1. [=list/Replace=] the [=interest group=] that has |ig|'s [=interest group/owner=] and
        [=interest group/name=] in the [=user agent=]'s [=interest group set=] with |ig|.
    1. Let |generatedBid| be |global|'s [=InterestGroupBiddingScriptRunnerGlobalScope/bid=].
    1. If |result| is a [=ECMAScript/normal completion=]:
      1. Let |generatedBidIDL| be the result of [=converted to an IDL value|converting=]
        |result|'s \[[Value]] to a {{GenerateBidOutput}}.
      1. If no exception was [=exception/thrown=] in the previous step, then set |generatedBid| to
        the result of [=converting GenerateBidOutput to generated bid=] with |generatedBidIDL|,
        |ig|, |expectedCurrency|, |isComponentAuction|, and |global|'s
        [=InterestGroupBiddingScriptRunnerGlobalScope/group has ad components=].
      1. Otherwise, set |generatedBid| to failure.
    1. If |generatedBid| is a [=generated bid=] and |generatedBid|'s [=generated bid/bid=]'s
      [=bid with currency/value=] &le; 0, set |generatedBid| to failure.
    1. If |generatedBid| is null, set it to failure.
    1. If |generatedBid| is not failure:
      1. Set |generatedBid|'s [=generated bid/bid duration=] to |duration|.
      1. Set |generatedBid|'s [=generated bid/interest group=] to |ig|.
    1. Return |generatedBid|.
</div>

<div algorithm>
  To <dfn>evaluate a scoring script</dfn> given a [=string=] |script|, a [=string=] |adMetadata|,
  a {{double}} |bidValue|, an {{AuctionAdConfig}} |auctionConfigIDL|, an [=ordered map=]
  |trustedScoringSignals|, a {{ScoringBrowserSignals}} |browserSignals|, a
  {{DirectFromSellerSignalsForSeller}} |directFromSellerSignalsForSeller|, and an integer
  millisecond [=duration=] |timeout|:

    1. Let |realm| be the result of [=creating a new script runner realm=] given
      {{InterestGroupScoringScriptRunnerGlobalScope}}.
    1. Let |browserSignalsJS| be |browserSignals| [=converted to ECMAScript values=].
    1. Let |auctionConfigJS| be |auctionConfigIDL| [=converted to ECMAScript values=].
    1. Let |trustedScoringSignalsJS| be |trustedScoringSignals| [=converted to ECMAScript values=].
    1. Let |directFromSellerSignalsJs| be |directFromSellerSignalsForSeller|
      [=converted to ECMAScript values=].
    1. Return the result of [=evaluating a script=] with |realm|, |script|, "`scoreAd`",
      «|adMetadata|, |bidValue|, |auctionConfigJS|, |trustedScoringSignalsJS|, |browserSignalsJS|,
      |directFromSellerSignalsJs|», and |timeout|.
</div>

<div algorithm>
  To <dfn>evaluate a reporting script</dfn> given a [=string=] |script|, a [=string=]
  |functionName|, and a [=list=] of arguments |arguments|:

    1. Let |realm| be the result of [=creating a new script runner realm=] given
      {{InterestGroupReportingScriptRunnerGlobalScope}}.
    1. Let |global| be |realm|'s [=realm/global object=].
    1. Let |argumentsJS| be the result of [=converting a Web IDL arguments list to an ECMAScript
      arguments list|converting=] |arguments| to an ECMAScript arguments list. If this
      [=exception/throws=] an exception, return « "null", null, null, null ».
    1. Let |result| be the result of [=evaluating a script=] with |realm|, |script|,
      |functionName|, |argumentsJS|, and 50 milliseconds.
    1. If |result| is an [=ECMAScript/abrupt completion=], return « "null", null, null, null ».
    1. Let |resultJSON| be "null".
    1. If |functionName| is "`reportResult`", then set |resultJSON| to the result of
      [=serializing a JavaScript value to a JSON string=] given |result|.

      Note: Consider a return value that can't be converted to JSON a valid result, so if an
      exception was [=exception/thrown=] in the previous step, keep |resultJSON| as "null".
    1. Let |reportURL| be |global|'s [=InterestGroupReportingScriptRunnerGlobalScope/report url=]
    1. If |reportURL| is failure, set |reportURL| to null.
    1. Let |macroMap| be |global|'s [=InterestGroupReportingScriptRunnerGlobalScope/reporting macro map=]
      if |functionName| is "`reportWin`" or "`reportAdditionalBidWin`", null otherwise.
    1. Return « |resultJSON|, |reportURL|,
       |global|'s [=InterestGroupReportingScriptRunnerGlobalScope/reporting beacon map=], |macroMap| ».
</div>

<div algorithm>
  To <dfn>evaluate a script</dfn> with a [=ECMAScript/realm=] |realm|, [=string=] |script|, [=string=]
  |functionName|, a [=list=] |arguments|, and an integer millisecond [=duration=] |timeout|, run these steps.
  They return a [=ECMAScript/Completion Record=], which is either an [=ECMAScript/abrupt completion=] (in
  the case of a parse failure or execution error), or a [=ECMAScript/normal completion=] populated with the
  [=ECMAScript/ECMAScript language value=] result of invoking |functionName|.

    1. [=Assert=] that these steps are running [=in parallel=].

    1. If |timeout| &le; 0, [=immediately=] interrupt the execution and set |finalCompletion| to a
      new [=ECMAScript/throw completion=] given null.

    1. Let |global| be |realm|'s [=realm/global object=], and run these steps in |realm|'s [=realm/agent=]:

    1. Let |result| be [$ParseScript$](|script|, |realm|, `empty`).

       Note: The resulting [=ECMAScript/Script Record=] will have no \[[HostDefined]] component,
       unlike traditional [=scripts=] on the web platform.

    1. If |result| is a list of errors, return
       Completion { \[[Type]]: `throw`, \[[Value]]: |result|, \[[Target]]: `empty` }.

    1. [=Assert=]: |result| is a [=ECMAScript/Script Record=].

    1. *Prepare to run script*: Push |realmExecutionContext| onto the [=ECMAScript/execution context
       stack|JavaScript execution context stack=]; it is now the [=ECMAScript/running execution
       context|running JavaScript execution context=].

    1. Let |evaluationStatus| be the result of [$ScriptEvaluation$](result).

    1. If |evaluationStatus| is an [=ECMAScript/abrupt completion=], jump to the step labeled <i>
       <a href="#evaluate-script-return">return</a></i>.

    1. Let |F| be [$Get$](|global|, |functionName|). If that returns a [=ECMAScript/throw completion=],
       set |finalCompletion| to |F| and jump to the step labeled <i>
       <a href="#evaluate-script-return">return</a></i>.

    1. Set |finalCompletion| be [=ECMAScript/Completion Record|Completion=]([$Call$](F, `undefined`,
       |arguments|)).

       In |timeout| milliseconds, if the invocation of [$Call$] has not completed,
       [=immediately=] interrupt the execution and set |finalCompletion| to a new
       [=ECMAScript/throw completion=] given null.

    1. <i id=evaluate-script-return>Return</i>: at this point |finalCompletion| will be set to a
       [=ECMAScript/Completion Record=].

      1. *Clean up after script*: [=Assert=] |realmExecutionContext| is the [=ECMAScript/running
         execution context|running JavaScript execution context=], and remove it from the
         [=ECMAScript/execution context stack|JavaScript execution context stack=].

      1. Return |finalCompletion|.
</div>

## Global scopes ## {#global-scopes}

An additional requirement to the interest group script runner globals defined in this specification
is that they must not expose any interfaces from other specifications whose own exposure set is the
special value "*". The only interfaces that can be exposed inside of the globals defined in this
specification are those that explicitly list the global names provided here.

<pre class="idl">
[Exposed=InterestGroupScriptRunnerGlobalScope]
interface InterestGroupScriptRunnerGlobalScope {
};

</pre>

### InterestGroupBiddingScriptRunnerGlobalScope ### {#bidding-global-scope}

<pre class="idl">
[Exposed=InterestGroupBiddingScriptRunnerGlobalScope,
 Global=(InterestGroupScriptRunnerGlobalScope,
         InterestGroupBiddingScriptRunnerGlobalScope)]
interface InterestGroupBiddingScriptRunnerGlobalScope
        : InterestGroupScriptRunnerGlobalScope {
  boolean setBid(optional GenerateBidOutput generateBidOutput = {});
  undefined setPriority(double priority);
  undefined setPrioritySignalsOverride(DOMString key, optional double? priority);
};

dictionary AdRender {
  required DOMString url;
  DOMString width;
  DOMString height;
};

dictionary GenerateBidOutput {
  double bid = -1;
  DOMString bidCurrency;
  (DOMString or AdRender) render;
  any ad;
  sequence<(DOMString or AdRender)> adComponents;
  double adCost;
  unrestricted double modelingSignals;
  boolean allowComponentAuction = false;
};

</pre>

Each {{InterestGroupBiddingScriptRunnerGlobalScope}} has a
<dl dfn-for="InterestGroupBiddingScriptRunnerGlobalScope">
: <dfn>bid</dfn>
:: A [=generated bid=]
: <dfn>priority</dfn>
:: Null, failure, or a {{double}}. Defaulting to null.
: <dfn>priority signals</dfn>
:: An [=ordered map=] whose [=map/keys=] are [=strings=] and whose [=map/values=] are {{double}} or null.
: <dfn>interest group</dfn>
:: An [=interest group=]
: <dfn>expected currency</dfn>
:: A [=currency tag=]
: <dfn>is component auction</dfn>
:: A [=boolean=]
: <dfn>group has ad components</dfn>
:: A [=boolean=]

</dl>


<div algorithm>

To <dfn>convert GenerateBidOutput to generated bid</dfn> given a {{GenerateBidOutput}}
|generateBidOutput|, an [=interest group=] |ig|, a [=currency tag=] |expectedCurrency|, a [=boolean=]
|isComponentAuction| and a [=boolean=] |groupHasAdComponents|:
  1. Let |bid| be a new [=generated bid=].
  1. If |generateBidOutput|["{{GenerateBidOutput/bid}}"] &le; 0:
    1. Set |bid|'s [=generated bid/bid=] to a [=bid with currency=] with [=bid with currency/value=] |generateBidOutput|["{{GenerateBidOutput/bid}}"] and [=bid with currency/currency=] null.
    1. Return |bid|.
  1. If |generateBidOutput|["{{GenerateBidOutput/render}}"] does not [=map/exist=], return failure.
  1. If |isComponentAuction| is true, and
    |generateBidOutput|["{{GenerateBidOutput/allowComponentAuction}}"] is false, then return failure.
  1. Let |bidCurrency| be null.
  1. If |generateBidOutput|["{{GenerateBidOutput/bidCurrency}}"] is specified:
     1. If the result of [=checking whether a string is a valid currency tag=] on
      |generateBidOutput|["{{GenerateBidOutput/bidCurrency}}"] is true, then set |bidCurrency| to |generateBidOutput|["{{GenerateBidOutput/bidCurrency}}"]
     1. Otherwise return failure.
  1. If the result of [=checking a currency tag=] with |expectedCurrency| and |bidCurrency| is
    false, return failure.
  1. Set |bid|'s [=generated bid/bid=] to a [=bid with currency=] with [=bid with currency/value=]
    |generateBidOutput|["{{GenerateBidOutput/bid}}"] and [=bid with currency/currency=] |bidCurrency|.
  1. If |generateBidOutput|["{{GenerateBidOutput/ad}}"] [=map/exists=]:
    1. Let |adJSON| be the result of [=serializing a JavaScript value to a JSON string=], given
      |generateBidOutput|["{{GenerateBidOutput/ad}}"].
    1. If |adJSON| is failure, return failure.
    1. Set |bid|'s [=generated bid/ad=] to |adJSON|.
  1. Let |adDescriptor| be a new [=ad descriptor=].
  1. If |generateBidOutput|["{{GenerateBidOutput/render}}"] is a {{DOMString}}:
    1. Let |adUrl| be the result of running the [=URL parser=] on
      |generateBidOutput|["{{GenerateBidOutput/render}}"].
    1. If |adUrl| is failure, return failure.
    1. Set |adDescriptor|'s [=ad descriptor/url=] to |adUrl|.
  1. Otherwise:
    1. Set |adDescriptor| to the result of [=converting an ad render=] given
      |generateBidOutput|["{{GenerateBidOutput/render}}"].
    1. If |adDescriptor| is failure, return failure.
  1. Let |bidAd| be the result of [=finding matching ad=] given |adDescriptor|, |ig|, and false.
  1. If |bidAd| is null, return failure.
  1. Set |bid|'s [=generated bid/ad descriptor=] to |adDescriptor|.
  1. Set |bid|'s [=generated bid/bid ad=] to |bidAd|.
  1. If |generateBidOutput|["{{GenerateBidOutput/adComponents}}"] [=map/exists=]:
    1. Let |adComponents| be |generateBidOutput|["{{GenerateBidOutput/adComponents}}"].
    1. Return failure if any of the following conditions hold:
      * |groupHasAdComponents| is false;
      * |adComponents|'s size is greater than 20.
    1. Let |adComponentDescriptors| be a new [=list=] of [=ad descriptors=].
    1. For |component| in |adComponents|:
      1. Let |componentDescriptor| be a new [=ad descriptor=].
      1. If |component| is {{DOMString}}:
        1. Let |componentUrl| be the result of running the [=URL parser=] on |component|.
        1. If |componentUrl| is failure, return failure.
        1. Set |componentDescriptor|'s [=ad descriptor/url=] to |componentUrl|.
      1. Otherwise:
        1. Set |componentDescriptor| to the result of [=converting an ad render=] given |component|.
        1. If |componentDescriptor| is failure, return failure.
      1. If [=finding matching ad=] given |componentUrl|, |ig|, and true returns null, return failure.
      1. [=list/Append=] |componentDescriptor| to |adComponentDescriptors|.
    1. Set |bid|'s [=generated bid/ad component descriptors=] to |adComponentDescriptors|.
  1. If |generateBidOutput|["{{GenerateBidOutput/adCost}}"] [=map/exists=], then set |bid|'s
    [=generated bid/ad cost=] to |generateBidOutput|["{{GenerateBidOutput/adCost}}"].
  1. If |generateBidOutput|["{{GenerateBidOutput/modelingSignals}}"] [=map/exists=]:
    1. Let |modelingSignals| be |generateBidOutput|["{{GenerateBidOutput/modelingSignals}}"].
    1. If |modelingSignals| &ge; 0 and |modelingSignals| &lt; 4096, then set |bid|'s
      [=generated bid/modeling signals=] to the result of [=converted to an IDL value|converting=]
      the ECMAScript value represented by |modelingSignals| to an {{unsigned short}}.
  1. Return |bid|.

</div>

<div algorithm>
  To <dfn>parse an AdRender dimension value</dfn> given a [=string=] |input|:

  1. Let |position| be a [=string/position variable=], initially pointing at the start of |input|.
  1. [=Strip leading and trailing ASCII whitespace=] from |input|.
  1. If |input| [=string/starts with=] "`0`" but [=string/is=] not "`0`" and does not
    [=string/start with=] "`0.`", then return null as the dimension and the empty string as the
    dimension unit.
  1. [=Collect a sequence of code points=] that are [=ASCII digits=] or U+002E (.), given |position|.
    Let that be |dimensionString|.
  1. If |dimensionString| is the empty string, then return null as the dimension and the empty
    string as the dimension unit.
  1. Let |dimension| be the result of parsing |dimensionString| using the
    [=rules for parsing floating-point number values=].
  1. If |dimension| is an error, then return null as the dimension and the empty string as the dimension unit.
  1. [=Collect a sequence of code points=] that are [=ASCII lower alpha=], given |position|. Let
    that be |dimensionUnit|.
  1. If |position| is not past the end of |input|, then return null as the dimension and the empty
    string as the dimension unit.
  1. If |dimensionUnit| [=string/is=] the empty string, then set |dimensionUnit| to "px".
  1. If |dimensionUnit| [=string/is=] not "px", "sh", or "sw", then return null as the dimension and
    the empty string as the dimension unit.
  1. Return |dimension| as the dimension and |dimensionUnit| as the dimension unit.
</div>

<div algorithm>
  To <dfn>convert an ad render</dfn> given an {{AdRender}} |adRender|:

  1. Let |adUrl| be the result of running the [=URL parser=] on |adRender|["{{AdRender/url}}"].
  1. If |adUrl| is failure, return failure.
  1. Let |adDescriptor| be a new [=ad descriptor=].
  1. Set |adDescriptor|'s [=ad descriptor/url=] to |adUrl|.
  1. If |adRender|["{{AdRender/width}}"] [=map/exists=]:
    1. If |adRender|["{{AdRender/height}}"] does not [=map/exist=], return failure.
    1. Let |width| and |widthUnit| be the dimension and dimension unit that results from running
      [=parse an AdRender dimension value=] with |adRender|["{{AdRender/width}}"], respectively.
    1. If |width| is null, return failure.
    1. Let |height| and |heightUnit| be the dimension and dimension unit that results from running
      [=parse an AdRender dimension value=] with |adRender|["{{AdRender/height}}"], respectively.
    1. If |height| is null, return failure.
    1. Let |adSize| be a new [=ad size=].
    1. Set |adSize|'s [=ad size/width=] to |width|, [=ad size/width units=] to |widthUnit|,
      [=ad size/height=] to |height|, [=ad size/height units=] to |heightUnit|.
    1. Set |adDescriptor|'s [=ad descriptor/size=] to |adSize|.
  1. Return |adDescriptor|.
</div>

<div algorithm>
  To <dfn>find matching ad</dfn> given an [=ad descriptor=] |adDescriptor|, an [=interest group=]
  |ig|, and a [=boolean=] |isComponent|:

  1. Let |adUrl| be |adDescriptor|'s [=ad descriptor/url=].
  1. If |adUrl|'s [=url/scheme=] is not "`https`", return null.
  1. TODO: Need to check [=ad descriptor/size=] as well.
  1. If |isComponent|, [=list/for each=] |ad| in |ig|'s [=interest group/ad components=]:
    1. If |ad|'s [=interest group ad/render url=] equals |adUrl|, return |ad|.
  1. Otherwise, [=list/for each=] |ad| in |ig|'s [=interest group/ads=]:
    1. If |ad|'s [=interest group ad/render url=] equals |adUrl|, return |ad|.
  1. Return null.
</div>

<div algorithm>
  The <dfn method for="InterestGroupBiddingScriptRunnerGlobalScope">setBid(|generateBidOutput|)</dfn>
  method steps are:

  1. Let |global| be [=this=]'s [=relevant global object=].
  1. Set |global|'s [=InterestGroupBiddingScriptRunnerGlobalScope/bid=] to null.
  1. Let |ig| be |global|'s [=InterestGroupBiddingScriptRunnerGlobalScope/interest group=].
  1. Let |expectedCurrency| be |global|'s
    [=InterestGroupBiddingScriptRunnerGlobalScope/expected currency=].
  1. Let |bidToSet| be the result of [=converting GenerateBidOutput to generated bid=] with
    |generateBidOutput|, |ig|, |expectedCurrency|, |global|'s
    [=InterestGroupBiddingScriptRunnerGlobalScope/is component auction=], and |global|'s
    [=InterestGroupBiddingScriptRunnerGlobalScope/group has ad components=].
  1. If |bidToSet| is failure, [=exception/throw=] a {{TypeError}}.
  1. Set |global|'s [=InterestGroupBiddingScriptRunnerGlobalScope/bid=] to |bidToSet|.
</div>

<div algorithm>
  The <dfn method for="InterestGroupBiddingScriptRunnerGlobalScope">setPriority(|priority|)</dfn>
  method steps are:

  1. Let |global| be [=this=]'s [=relevant global object=].
  1. If |global|'s [=InterestGroupBiddingScriptRunnerGlobalScope/priority=] is not null, then set
    |global|'s [=InterestGroupBiddingScriptRunnerGlobalScope/priority=] to failure, and
    [=exception/throw=] a {{TypeError}}.
  1. Set |global|'s [=InterestGroupBiddingScriptRunnerGlobalScope/priority=] to |priority|.
</div>

<div algorithm>
  The <dfn method for="InterestGroupBiddingScriptRunnerGlobalScope">setPrioritySignalsOverride(|key|, |priority|)</dfn>
  method steps are:

  1. [=map/Set=] [=this=]'s [=relevant global object=]'s
    [=InterestGroupBiddingScriptRunnerGlobalScope/priority signals=][|key|] to |priority|.
</div>

### InterestGroupScoringScriptRunnerGlobalScope ### {#scoring-global-scope}

<pre class="idl">
[Exposed=InterestGroupScoringScriptRunnerGlobalScope,
 Global=(InterestGroupScriptRunnerGlobalScope,
         InterestGroupScoringScriptRunnerGlobalScope)]
interface InterestGroupScoringScriptRunnerGlobalScope
        : InterestGroupScriptRunnerGlobalScope {
};

</pre>

### InterestGroupReportingScriptRunnerGlobalScope ### {#reporting-global-scope}

<pre class="idl">
[Exposed=InterestGroupReportingScriptRunnerGlobalScope,
 Global=(InterestGroupScriptRunnerGlobalScope,
         InterestGroupReportingScriptRunnerGlobalScope)]
interface InterestGroupReportingScriptRunnerGlobalScope
        : InterestGroupScriptRunnerGlobalScope {
  undefined sendReportTo(DOMString url);
  undefined registerAdBeacon(record&lt;DOMString, USVString&gt; map);
  undefined registerAdMacro(DOMString name, USVString value);
};

</pre>

Note: {{InterestGroupReportingScriptRunnerGlobalScope/registerAdMacro(name, value)}} is only
available in [=report win=], but not [=report result=].

Each {{InterestGroupReportingScriptRunnerGlobalScope}} has a
<dl dfn-for="InterestGroupReportingScriptRunnerGlobalScope">
: <dfn>report url</dfn>
:: Null, failure, or a [=URL=]. Defaulting to null.
: <dfn>reporting beacon map</dfn>
:: Null or an [=ordered map=] whose [=map/keys=] are [=strings=] and whose [=map/values=] are
  [=URLs=]. Defaulting to null.
: <dfn>reporting macro map</dfn>
:: Null or an [=ordered map=] whose [=map/keys=] are [=strings=] and whose [=map/values=] are
  [=strings=]. Defaulting to null.

</dl>

<div algorithm>
  The <dfn method for="InterestGroupReportingScriptRunnerGlobalScope">sendReportTo(|url|)</dfn>
  method steps are:

  1. Let |global| be [=this=]'s [=relevant global object=].
  1. If |global|'s [=InterestGroupReportingScriptRunnerGlobalScope/report url=] is not null, then
    set |global|'s [=InterestGroupReportingScriptRunnerGlobalScope/report url=] to failure, and
    [=exception/Throw=] a {{TypeError}}.
  1. Let |parsedUrl| be the result of running the [=URL parser=] on |url|.
  1. If |parsedUrl| is failure, or |parsedUrl|'s [=url/scheme=] is not "`https`", set |global|'s
    [=InterestGroupReportingScriptRunnerGlobalScope/report url=] to failure, and [=exception/throw=]
    a {{TypeError}}.
  1. Optionally, return.

    Note: This [=implementation-defined=] condition is intended to allow [=user agents=] to decline
        for a number of reasons, for example the |parsedUrl|'s [=site=] not being
        <a href="https://github.com/privacysandbox/attestation">enrolled</a>.
  1. Set |global|'s [=InterestGroupReportingScriptRunnerGlobalScope/report url=] to |parsedUrl|.
</div>

<div algorithm>
  The <dfn method for="InterestGroupReportingScriptRunnerGlobalScope">registerAdBeacon(|map|)</dfn>
  method steps are:

  1. If [=this=]'s [=relevant global object=]'s [=InterestGroupReportingScriptRunnerGlobalScope/
     reporting beacon map=] is not null, then [=exception/Throw=] a {{TypeError}}.

  1. [=map/For each=] |url| of |map|'s [=map/values=]:

     1. Let |parsedURL| be the result of running [=URL parser=] on |url|.

     1. [=exception/Throw=] a {{TypeError}} if any of the following conditions hold:
        * |parsedURL| is failure;
        * |parsedURL|'s [=url/scheme=] is not "`https`".

  1. Set [=this=]'s [=relevant global object=]'s [=InterestGroupReportingScriptRunnerGlobalScope/
     reporting beacon map=] to |map|.
</div>

<div algorithm>
  The <dfn method for="InterestGroupReportingScriptRunnerGlobalScope">registerAdMacro(|name|,
  |value|)</dfn> method steps are:

  1. [=map/Set=] [=this=]'s [=relevant global object=]'s
    [=InterestGroupReportingScriptRunnerGlobalScope/reporting macro map=][|name|] to |value|.
</div>

# Interest Group Updates # {#interest-group-updates}

*This first introductory paragraph is non-normative.*

[=Interest groups=] have an [=interest group/update url=] field that allows updating the
interest group definition stored on disk with information periodically retrieved from the
[=interest group/update url=].  The [=interest group update=] steps are triggered during
{{Navigator/runAdAuction()}} and by calls to {{Navigator/updateAdInterestGroups()}} API:

<xmp class="idl">
[SecureContext]
partial interface Navigator {
  undefined updateAdInterestGroups();
};
</xmp>

<div algorithm>

The <dfn for=Navigator method>updateAdInterestGroups()</dfn> method steps are:

1. [=In parallel=], run [=interest group update=] with
  « [=relevant settings object=]'s [=environment/top-level origin=] »

</div>
<div algorithm>
  To <dfn lt="interest group update">update interest groups</dfn> given a [=list=] of [=origins=]
  |owners|:

1. [=list/For each=] |owner| of |owners|:
  1. [=list/For each=] |originalInterestGroup| of the [=user agent=]'s [=interest group set=] whose
    [=interest group/owner=] is |owner| and [=interest group/next update after=] is before
    the [=current wall time=]:

    Note: Implementations can consider loading only a portion of these interest groups
    at a time to avoid issuing too many requests at once.
    1. Let |ig| be a deep copy of |originalInterestGroup|.
    1. Let |request| be a new [=request=] with the following properties:
      :   [=request/URL=]
      ::  |ig|'s [=interest group/update url=]
      :   [=request/header list=]
      ::  «`Accept`: `application/json`»
      :   [=request/client=]
      ::  `null`
      :   [=request/mode=]
      ::  "`no-cors`"
      :   [=request/referrer=]
      :: "`no-referrer`"
      :   [=request/credentials mode=]
      ::  "`omit`"
      :   [=request/redirect mode=]
      :: "`error`"

      Issue: One of the side-effects of a `null` client for this subresource request is it neuters
      all service worker interceptions, despite not having to set the service workers mode.

      Issue: Stop using "`no-cors`" mode where possible
      (<a href="https://github.com/WICG/turtledove/issues/667">WICG/turtledove#667</a>).
    1. Let |update| be null.
    1. [=Fetch=] |request| with [=fetch/useParallelQueue=] set to true, and
      [=fetch/processResponseConsumeBody=] set to the following steps given a [=response=] |response|
      and null, failure, or a [=byte sequence=] |responseBody|:
      1. If [=validate fetching response=] with |response|, |responseBody| and "`application/json`"
        returns false, set |update| to failure and return.
      1. Set |update| to |responseBody|.
    1. Wait for |update| to be set.
    1. If |update| is failure, [=iteration/continue=].
    1. Let |parsedUpdate| be the result of [=parsing JSON bytes to an Infra value=], given |update|.
    1. If |parsedUpdate| is failure, [=iteration/continue=].
    1. If |parsedUpdate| is not an [=ordered map=], [=iteration/continue=].
    1. If |parsedUpdate|["`name`"] exists and doesn't match |ig|'s [=interest group/name=],
      [=iteration/continue=].
    1. If |parsedUpdate|["`owner`"] exists and doesn't match |ig|'s [=interest group/owner=],
      [=iteration/continue=].
    1. [=map/For each=] |key| → |value| of |parsedUpdate|:
      1. Switch on |key|:
        <dl class=switch>
        <dt>"`priority`"
        <dd>
        1. If |value| is a {{double}}, set |ig|'s [=interest group/priority=]
          to |value|.
        1. Otherwise, jump to the step labeled <i><a href=#abort-update>Abort update</a></i>.

        <dt>"`enableBiddingSignalsPrioritization`"
        <dd>
        1. If |value| is a {{boolean}}, set |ig|'s
          [=interest group/enable bidding signals prioritization=] to |value|.
        1. Otherwise, jump to the step labeled <i><a href=#abort-update>Abort update</a></i>.

        <dt>"`priorityVector`"
        <dd>
        1. If |value| is null or an [=ordered map=] whose [=map/keys=] are [=strings=] and
          whose [=map/values=] are {{double}}, set |ig|'s [=interest group/priority vector=] to
          |value|.
        1. Otherwise, jump to the step labeled <i><a href=#abort-update>Abort update</a></i>.

        <dt>"`prioritySignalsOverrides`"
        <dd>
        1. If |value| is an [=ordered map=] whose [=map/keys=] are
          [=strings=] and whose [=map/values=] are {{double}} or null:
          1. [=map/For each=] |pvKey| → |pvValue| of |value|:
            1. If |pvValue| is null, [=map/remove=] |ig|'s [=interest group/priority signals overrides=][|pvKey|].
            1. Otherwise, [=map/set=] |ig|'s [=interest group/priority signals overrides=][|pvKey|] to |pvValue|.
        1. Otherwise, jump to the step labeled <i><a href=#abort-update>Abort update</a></i>.

        <dt>"`executionMode`"
        <dd>
        1. If |value| is "`compatibility`" or "`group-by-origin`",
          set |ig|'s [=interest group/execution mode=] to |value|.
        1. Otherwise, jump to the step labeled <i><a href=#abort-update>Abort update</a></i>.

        <dt>"`biddingLogicURL`"
        <dt>"`biddingWasmHelperURL`"
        <dt>"`updateURL`"
        <dt>"`trustedBiddingSignalsURL`"
        <dd>
        1. For each |groupMember| and |interestGroupField| in the following table
          <table class="data">
            <thead><tr><th>Group member</th><th>Interest group field</th></tr></thead>
            <tr>
              <td>"`biddingLogicURL`"</td>
              <td>[=interest group/bidding url=]</td>
            </tr>
            <tr>
              <td>"`biddingWasmHelperURL`"</td>
              <td>[=interest group/bidding wasm helper url=]</td>
            </tr>
            <tr>
              <td>"`updateURL`"</td>
              <td>[=interest group/update url=]</td>
            </tr>
            <tr>
              <td>"`trustedBiddingSignalsURL`"</td>
              <td>[=interest group/trusted bidding signals url=]</td>
            </tr>
          </table>
          1. Let |parsedURL| be the result of running the [=URL parser=] on |value|.
          1. If |key| is not |groupMember|, [=iteration/continue=].
          1. Jump to the step labeled <i><a href=#abort-update>Abort update</a></i>
            if any of the following conditions hold:
            * |parsedURL| is failure;
            * |parsedURL|'s [=url/origin=] is not [=same origin=] with |ig|'s
              [=interest group/owner=];
            * |parsedURL| [=includes credentials=];
            * |parsedURL| [=url/fragment=] is not null.
          1. Set |ig|'s |interestGroupField| to |parsedURL|.

        <dt>"`trustedBiddingSignalsKeys`"
        <dd>
        1. If |value| is a [=list=] of [=strings=],
          set |ig|'s [=interest group/trusted bidding signals keys=] to |value|.
        1. Otherwise, jump to the step labeled <i><a href=#abort-update>Abort update</a></i>.

        <dt>"`userBiddingSignals`"
        <dd>
        1. Set |ig|'s [=interest group/user bidding signals=] to the result of [=serialize an Infra
          value to JSON bytes=] given |value|.
        1. Otherwise, jump to the step labeled <i><a href=#abort-update>Abort update</a></i>.

        Issue:  Serializing an Infra value to JSON bytes expects to be called within a valid ES realm. See
        <a href="https://github.com/whatwg/infra/issues/625">infra/625</a>

        <dt>"`ads`"
        <dt>"`adComponents`"
        <dd>
        1. For each |groupMember| and |interestGroupField| in the following table
          <table class="data">
            <thead><tr><th>Group member</th><th>Interest group field</th></tr></thead>
            <tr>
              <td>"`ads`"</td>
              <td>[=interest group/ads=]</td>
            </tr>
            <tr>
              <td>"`adComponents`"</td>
              <td>[=interest group/ad components=]</td>
            </tr>
          </table>
          1. If |key| is not |groupMember|, [=iteration/continue=].
          1. If |value| is not a [=list=] of {{AuctionAd}}, jump to the step
            labeled <i><a href=#abort-update>Abort update</a></i>.
          1. Let |igAds| be a new [=list=] of [=interest group ads=].
          1. [=list/For each=] |ad| of |value|:
            1. Let |igAd| be a new [=interest group ad=].
            1. Let |renderURL| be the result of running the [=URL parser=] on
              |ad|["{{AuctionAd/renderURL}}"].
            1. Jump to the step labeled <i><a href=#abort-update>Abort update</a></i>
              if any of the following conditions hold:
              * |renderURL| is failure;
              * |renderURL| [=url/scheme=] is not "`https`";
              * |renderURL| [=includes credentials=].
            1. Set |igAd|'s [=interest group ad/render url=] to |renderURL|.
            1. If |ad|["{{AuctionAd/metadata}}"] [=map/exists=], then let
              |igAd|'s [=interest group ad/metadata=] be the result of
              [=serializing a JavaScript value to a JSON string=], given |ad|["{{AuctionAd/metadata}}"].
              If this [=exception/throws=], jump to the step
              labeled <i><a href=#abort-update>Abort update</a></i>.
            1. If |groupMember| is "`ads`":
              1. If |ad|["{{AuctionAd/buyerReportingId}}"] [=map/exists=] then set
                  |igAd|'s [=interest group ad/buyer reporting ID=] to it.
              1. If |ad|["{{AuctionAd/buyerAndSellerReportingId}}"] [=map/exists=]
                  then set |igAd|'s [=interest group ad/buyer and seller reporting ID=] to it.
            1. [=list/Append=] |igAd| to |igAds|.
          1. If |igAds| is not [=list/is empty=]:
            1. Set |ig|'s |interestGroupField| to |igAds|.

        <dt>"`additionalBidKey`"
        <dd>
        1. Let |decodedKey| be the result of running [=forgiving-base64 decode=] with |value|.
        1. Jump to the step labeled <i><a href=#abort-update>Abort update</a></i> if any of the
          following conditions hold:
            * |decodedKey| is a failure;
            * |decodedKey|'s [=byte sequence/length=] is not 32;
        1. Set |ig|'s [=interest group/additional bid key=] to |decodedKey|.

        </dl>
    1. Jump to the step labeled <i><a href=#abort-update>Abort update</a></i> if any of the
      following conditions hold:
      * |ig|'s [=interest group/ads=] is not null, and |ig|'s [=interest group/additional bid key=]
        is not null;
      * |ig|'s [=interest group/estimated size=] is greater than 50 KB.
    1. Set |ig|'s [=interest group/next update after=] to the [=current wall time=] plus 24 hours.
    1. [=list/Replace=] the [=interest group=] that has |ig|'s [=interest group/owner=] and
      [=interest group/name=] in the [=user agent=]'s [=interest group set=] with |ig|.
    1. <i id=abort-update>Abort update</i>: We jump here if some part of the
      [=interest group=] update failed. [=iteration/Continue=] to the next [=interest group=] update.

</div>


# Common Algorithms # {#common-algorithms}

The following algorithms are some helper methods used in this document.

<div algorithm>
  To <dfn>get uuid from string</dfn> given a [=string=] |input|:

    1. If |input|'s [=string/length=] is not 36, return an empty [=string=].
    1. Let |uuidStr| be an empty [=string=].
    1. [=list/For each=] |i| in [=the range=] from 1 to 36, inclusive:
      1. Let |unit| be |input|'s |i|th [=code unit=].
      1. If « 8, 13, 18, 23 » [=list/contains=] |i|:
        1. If |unit| is not 0x002D (-):

          1. Return an empty [=string=].
      1. Otherwise:
        1. If |unit| is not an [=ASCII lower hex digit=]:
          1. Return an empty [=string=].
        1. Append |unit| to the end of |uuidStr|.
    1. Return [=ASCII encoded=] |uuidStr|.
</div>


# Permissions Policy integration # {#permissions-policy-integration}

This specification defines two [=policy-controlled features=] identified by the strings
"<code><dfn noexport>join-ad-interest-group</dfn></code>", and
"<code><dfn noexport>run-ad-auction</dfn></code>". Their
[=policy-controlled feature/default allowlists=] are "`*`".

Issue(WICG/turtledove#522): Move from "`*`" to "`self`".


# Fetch Patch for Auction Headers # {#fetch-patch-for-auction-headers}

This section specifies a manner by which some data, including [=additional bids=] and
[=direct from seller signals=], may be provided to auctions such that the data is only used within
their intended auction.

Any {{Document}} in a [=traversable navigable=] may run a Protected Audience auction (with
{{Window/navigator}}.{{Navigator/runAdAuction()}}) whose worklet functions receive signal objects
derived from JSON from an [:Ad-Auction-Signals:] header, or [=additional bids=] derived from an
[:Ad-Auction-Additional-Bid:] header, captured by a {{WindowOrWorkerGlobalScope/fetch()}} call
(using the {{RequestInit/adAuctionHeaders}} option) initiated by any *other* {{Document}} in the
*same* [=traversable navigable=], or from an
<a spec="html" lt="navigate an iframe or frame">iframe navigation</a>
request (using the <{iframe/adauctionheaders}>
<a spec=html>content attribute</a> on the <{iframe}> element).

<div algorithm="fetch per traversable navigable structures patch">
Modify [[FETCH]]'s [[FETCH#infrastructure]] to add a new section called "Per Traversable Navigable
Structures", with the following content:

Each [=traversable navigable=] has a <dfn for="traversable navigable">captured ad auction signals
headers</dfn>, which is a [=map=] whose [=map/keys=] are [=direct from seller signals keys=] and
whose [=map/values=] are [=direct from seller signals=].

NOTE: This is only captured during a [=request=] whose [=request/initiator type=] is `"fetch"`, made
with the {{RequestInit/adAuctionHeaders}} option set to `true`, or during an
<a spec="html" lt="navigate an iframe or frame">iframe navigation</a>
request with the <{iframe/adauctionheaders}>
<a spec=html>content attribute</a> set to `true`, as described in the
[:Ad-Auction-Signals:] header description.

Each [=traversable navigable=] has a <dfn for="traversable navigable">captured ad auction additional
bids headers</dfn>, which is a [=map=] whose [=map/keys=] are [=auction nonces=] and whose
[=map/values=] are [=strings=].

NOTE: This is only captured during a [=request=] whose [=request/initiator type=] is `"fetch"`, made
with the {{RequestInit/adAuctionHeaders}} option set to `true`, or during an
<a spec="html" lt="navigate an iframe or frame">iframe navigation</a>
request with the <{iframe/adauctionheaders}> <a spec=html>content attribute</a>
set to `true`, as described in the [:Ad-Auction-Additional-Bid:] header description.
</div>

<div algorithm="fetch capture adAuctionHeaders boolean patch">
Modify the definition of a [=request=]:

A [=request=] has an associated boolean <dfn for=request>capture-ad-auction-headers</dfn>.
Unless stated otherwise it is false.
</div>

<div algorithm="fetch capture adAuctionHeaders RequestInit patch">
Modify [[FETCH]]'s {{RequestInit}} dictionary to add an adAuctionHeaders attribute:

<pre class=idl>
partial dictionary RequestInit {
  boolean adAuctionHeaders;
};
</pre>
</div>

<div algorithm="fetch new request patch">
The following step will be added to the <code><a constructor for="Request" lt="Request()">
new Request (<var ignore>input</var>, <var ignore>init</var>)</a></code> constructor steps, before
step "Set [=this=]'s [=Request/request=] to |request|":

1. If <var ignore>init</var>["{{RequestInit/adAuctionHeaders}}"] [=map/exists=], then set
  |request|'s [=request/capture-ad-auction-headers=] to it.

</div>

<div algorithm="iframe navigation capture adAuctionHeaders attribute patch">
Modify the <{iframe}> element to add a
<dfn element-attr for="iframe">adauctionheaders</dfn> <a spec=html>content attribute</a>.
The IDL attribute {{HTMLIFrameElement/adAuctionHeaders}} [=reflects=]
the <{iframe/adauctionheaders}> <a spec=html>content attribute</a>.

<pre class=idl>
partial interface HTMLIFrameElement {
  [CEReactions] attribute boolean adAuctionHeaders;
};
</pre>
</div>

<div algorithm="iframe navigation patch">
The following step will be added to the
<a spec="html">create navigation params by fetching</a> steps
after step "Let |request| be a new [=request=], with ...":

1. If <var ignore>navigable</var>'s [=navigable/container=] is an <{iframe}> element,
  and if it has a <{iframe/adauctionheaders}> <a spec=html>content attribute</a>,
  then set |request|'s [=request/capture-ad-auction-headers=] to true.

</div>

<div algorithm="fetch Sec-Ad-Auction-Fetch patch">
The following step will be added to the [=HTTP-network-or-cache fetch=] algorithm, before step
"Modify |httpRequest|'s [=request/header list=] per HTTP. ...":

1. If [=request=]'s [=request/capture-ad-auction-headers=] is true, then [=header list/set a
  structured field value=] given «[:Sec-Ad-Auction-Fetch:], the [=structured header/boolean=] `?1`»
  in |httpRequest|'s [=header list=].

</div>

<div algorithm="fetch auction headers patch">
The following will be added to [[Fetch#http-extensions]]:

<h3 id=sec-ad-auction-fetch-header>The \`<a http-header><code>Sec-Ad-Auction-Fetch</code></a>\` HTTP
request header</h3>

The \`<dfn http-header><code>Sec-Ad-Auction-Fetch</code></dfn>\` request header is an optional
[=structured header=] with of type [=structured header/boolean=]. [:Sec-Ad-Auction-Fetch:] will only
be set on a [=request=] whose [=request/initiator type=] is `"fetch"`, made with the
{{RequestInit/adAuctionHeaders}} option set to `true`, or on an
<a spec="html" lt="navigate an iframe or frame">iframe navigation</a>
request with the <{iframe/adauctionheaders}> <a spec=html>content attribute</a>
set to `true`. If [:Sec-Ad-Auction-Fetch:] is equal to `?1`,
the user agent will remove any [:Ad-Auction-Signals:] or [:Ad-Auction-Additional-Bid:] from the
returned [=response=] -- the [:Ad-Auction-Signals:] or [:Ad-Auction-Additional-Bid:] value will
instead only be used in Protected Audiences auctions.

<h3 id=ad-auction-signals-header>The \`<a http-header><code>Ad-Auction-Signals</code></a>\` HTTP
response header</h3>

The \`<dfn http-header><code>Ad-Auction-Signals</code></dfn>\` response header provides value
of a JSON array of dictionaries, each with an `adSlot` key. Protected Audience non-component,
component, and top-level auctions may specify which signals to load by the `adSlot` key.

<h3 id=ad-auction-additional-bid-header>The \`<a http-header><code>Ad-Auction-Additional-Bid</code></a>\`
HTTP response header.</h3>

The \`<dfn http-header><code>Ad-Auction-Additional-Bid</code></dfn>\` response header provides value
of a string in the format of `<auction nonce>:<base64-encoding of the signed additional bid>`, which
corresponds to a single [=additional bid=]. The response may include more than one [=additional bid=]
by specifying multiple instances of the [:Ad-Auction-Additional-Bid:] response header.
</div>

<div algorithm="ad auction fetch redirect patch">
The following steps will be added to the [=HTTP fetch=] algorithm, immediately under the step "If
<var ignore>internalResponse</var>’s [=status=] is a [=redirect status=]:"

1. [=header list/Delete=] "[:Ad-Auction-Signals:]" from |response|'s
  [=response/header list=].
1. [=header list/Delete=] "[:Ad-Auction-Additional-Bid:]" from |response|'s
  [=response/header list=].

</div>

<div algorithm="fetch auction signals response patch">
The following step will be added to the [=HTTP fetch=] algorithm, before step
"Return |response|.":

1. If |response| is not null, |response|'s [=status=] is not a [=redirect status=], |fetchParams|'s
  [=fetch params/task destination=] is a [=global object=] that's a {{Window}} object, and
  |request|'s [=request/capture-ad-auction-headers=] is `true`:
  1. Let |navigable| be |fetchParams|'s [=fetch params/task destination=]'s [=associated Document=]'s
    [=node navigable=]'s [=traversable navigable=].
  1. Run [=update captured headers=] with |navigable|'s
    [=traversable navigable/captured ad auction signals headers=], |navigable|'s
    [=traversable navigable/captured ad auction additional bids headers=], |response|'s
    [=response/header list=], and |request|'s [=request/URL=]'s [=url/origin=].

</div>

<div algorithm="fetch update captured headers patch">
The following algorithm will be added to the [[FETCH#fetching]] section:

  To <dfn id=concept-update-captured-headers>update captured headers</dfn> with a [=traversable
  navigable/captured ad auction signals headers=] |storedSignalsHeaders|,
  [=traversable navigable/captured ad auction additional bids headers=] |storedAdditionalBidsHeaders|,
  [=header list=] |responseHeaders|, and [=origin=] |requestOrigin|:
  1. Let |adAuctionSignals| be the result of [=header list/getting=] [:Ad-Auction-Signals:] from
    |responseHeaders|.
  1. If |adAuctionSignals| is not null:
    1. [=header list/Delete=] "[:Ad-Auction-Signals:]" from |responseHeaders|.

      NOTE: This step prevents the header value from being used outside the intended auctions --
      that is, scripts making the {{WindowOrWorkerGlobalScope/fetch()}} request aren't able to load
      the header value.
    1. [=Handle ad auction signals header value=] given |adAuctionSignals|, |storedSignalsHeaders| and
      |requestOrigin|.
  1. Let |additionalBids| be the result of [=header list/getting, decoding, and splitting=]
    [:Ad-Auction-Additional-Bid:] from |responseHeaders|.
  1. If |additionalBids| is not null:
    1. [=header list/Delete=] "[:Ad-Auction-Additional-Bid:]" from |responseHeaders|.

      NOTE: This step prevents the header value from being used outside the intended auctions --
      that is, scripts making the {{WindowOrWorkerGlobalScope/fetch()}} request aren't able to load
      the header value.
    1. [=list/For each=] |bid| of |additionalBids|:
      1. Let |nonceAndAdditionalBid| be the result of [=strictly splitting=] |bid| on U+003A (:).
      1. If |nonceAndAdditionalBid|'s [=list/size=] is not 2, then [=iteration/continue=].
      1. Let |nonce| be |nonceAndAdditionalBid|[0].
      1. If |nonce|'s [=string/length=] is not 36, then [=iteration/continue=].
      1. Set |storedAdditionalBidsHeaders|[|nonce|] to |nonceAndAdditionalBid|[1].

</div>

<div algorithm>
To <dfn>handle ad auction signals header value</dfn> given a [=byte sequence=] |adAuctionSignals|,
[=traversable navigable/captured ad auction signals headers=] |storedSignalsHeaders|, and [=origin=]
|requestOrigin|:

  1. Let |parsedSignals| be the result of [=parsing JSON bytes to an Infra value=], given
    |adAuctionSignals|.
  1. If |parsedSignals| is failure or not a [=list=], return.
  1. Let |headerAdSlots| be a new [=ordered set=].
  1. [=list/For each=] |signal| of |parsedSignals|:
    1. If |signal| is not an [=ordered map=], [=iteration/continue=].
    1. If |signal|["`adSlot`"] doesn't exist, [=iteration/continue=].
    1. If |headerAdSlots| [=set/contains=] |signal|["`adSlot`"], [=iteration/continue=]. Optionally,
      [=report a warning to the console=] with a diagnostic error message indicating that a
      duplicate [:Ad-Auction-Signals:] `adSlot` dictionary was ignored.
    1. [=set/Append=] |signal|["`adSlot`"] to |headerAdSlots|.
    1. Let |signalsKey| be a new [=direct from seller signals key=], with its
      [=direct from seller signals key/seller=] set to |requestOrigin| and its
      [=direct from seller signals key/ad slot=] set to |signal|["`adSlot`"].
    1. Let |processedSignals| be a new [=direct from seller signals=].
    1. [=map/Remove=] |signal|["`adSlot`"].
    1. [=map/For each=] |key| → |value| of |signal|:
      1. Switch on |key|:
        <dl class=switch>
          <dt>"`sellerSignals`"
          <dd>
          1. Set |processedSignals|'s [=direct from seller signals/seller signals=] to the result
            of [=serializing an Infra value to a JSON string=], given |value|.

          <dt>"`auctionSignals`"
          <dd>
          1. Set |processedSignals|'s [=direct from seller signals/auction signals=] to the result
            of [=serializing an Infra value to a JSON string=], given |value|.

          <dt>"`perBuyerSignals`"
          <dd>
          1. If |value| is not an [=ordered map=], [=iteration/continue=].
          1. For each |buyer| → |buyerSignals| of |value|:
            1. Let |buyerOrigin| be the result of [=parsing an https origin=] on |buyer|.
            1. If |buyerOrigin| is failure, [=iteration/continue=].
            1. Let |buyerSignalsString| be the result of
              [=serializing an Infra value to a JSON string=], given |buyerSignals|.
            1. Set |processedSignals|'s
              [=direct from seller signals/per buyer signals=][|buyerOrigin|] to |buyerSignalsString|.
        </dl>

    1. Set |storedSignalsHeaders|[|signalsKey|] to |processedSignals|.
</div>


# Structures # {#structures}

<xmp class="idl">
dictionary PreviousWin {
  required long long timeDelta;
  required DOMString adJSON;
};

dictionary BiddingBrowserSignals {
  required DOMString topWindowHostname;
  required USVString seller;
  required long joinCount;
  required long bidCount;
  required long recency;

  USVString topLevelSeller;
  sequence<PreviousWin> prevWinsMs;
  object wasmHelper;
  unsigned long dataVersion;
};

dictionary ScoringBrowserSignals {
  required DOMString topWindowHostname;
  required USVString interestGroupOwner;
  required USVString renderURL;
  required unsigned long biddingDurationMsec;
  required DOMString bidCurrency;

  unsigned long dataVersion;
  sequence<USVString> adComponents;
};
</xmp>

Note: {{ScoringBrowserSignals}}'s {{ScoringBrowserSignals/adComponents}} is {{undefined}} when
[=generated bid/ad component descriptors=] is null or [=list/is empty|an empty list=]. It cannot be
an [=list/is empty|empty list=].

<xmp class="idl">
dictionary ReportingBrowserSignals {
  required DOMString topWindowHostname;
  required USVString interestGroupOwner;
  required USVString renderURL;
  required double bid;
  required double highestScoringOtherBid;

  DOMString bidCurrency;
  DOMString highestScoringOtherBidCurrency;
  USVString topLevelSeller;
  USVString componentSeller;

  USVString buyerAndSellerReportingId;
};
</xmp>

{{ReportingBrowserSignals}} includes browser signals both `reportResult()` and `reportWin()` get.
<dl class=domintro>
  <dt>{{ReportingBrowserSignals/topWindowHostname}}
  <dd>[=environment/Top-level origin=]'s [=origin/host=]
  <dt>{{ReportingBrowserSignals/interestGroupOwner}}
  <dd>The winning [=interest group=]'s [=interest group/owner=].
  <dt>{{ReportingBrowserSignals/renderURL}}
  <dd>The render URL returned by "`generateBid()`". It is
    [=query reporting ID k-anonymity count|k-anonymous=]
  <dt>{{ReportingBrowserSignals/bid}}
  <dd>[=round a value|Stochastically rounded=] winning bid. This is always in the bidder's own
    currency
  <dt>{{ReportingBrowserSignals/highestScoringOtherBid}}
  <dd>The [=round a value|stochastically rounded value=] of the bid that got the second highest
    score, or 0 if it's not available. 0 for top-level auctions with components
  <dt>{{ReportingBrowserSignals/bidCurrency}}
  <dd>The currency the {{ReportingBrowserSignals/bid}} is in
  <dt>{{ReportingBrowserSignals/highestScoringOtherBidCurrency}}
  <dd>The currency the {{ReportingBrowserSignals/highestScoringOtherBid}} is in
  <dt>{{ReportingBrowserSignals/topLevelSeller}}
  <dd>Copied from [=leading bid info/top level seller=]
  <dt>{{ReportingBrowserSignals/componentSeller}}
  <dd>Copied from [=leading bid info/component seller=]
  <dt>{{ReportingBrowserSignals/buyerAndSellerReportingId}}
  <dd>Set if the winning ad had a [=interest group ad/buyer and seller reporting ID=] set in its listing in the interest group, and that value was [=query reporting ID k-anonymity count|jointly k-anonymous=] combined with interest group owner, bidding script URL, and [=ad creative=] URL.
</dl>

<xmp class="idl">
dictionary ReportResultBrowserSignals : ReportingBrowserSignals {
  required double desirability;

  DOMString topLevelSellerSignals;
  double modifiedBid;
  unsigned long dataVersion;
};
</xmp>

<dl class=domintro>
  <dt>{{ReportResultBrowserSignals/desirability}}
  <dd>The [=round a value|stochastically rounded value=] of the score returned by "`scoreAd()`" for
    the winning bid
  <dt>{{ReportResultBrowserSignals/topLevelSellerSignals}}
  <dd>Metadata returned by the top-level seller's "`reportResult()`", as JSON
  <dt>{{ReportResultBrowserSignals/modifiedBid}}
  <dd>The [=round a value|stochastically rounded value=] of the bid value returned by the component
    seller's "`scoreAd()`" method
  <dt>{{ReportResultBrowserSignals/dataVersion}}
  <dd>Set to the value of the [:Data-Version:] header from the trusted
    scoring signals server, if any.
</dl>

<xmp class="idl">
dictionary ReportWinBrowserSignals : ReportingBrowserSignals {
  double adCost;
  USVString seller;
  boolean madeHighestScoringOtherBid;
  DOMString interestGroupName;
  DOMString buyerReportingId;
  unsigned short modelingSignals;
  unsigned long dataVersion;
  KAnonStatus kAnonStatus;
};

enum KAnonStatus { "passedAndEnforced", "passedNotEnforced", "belowThreshold", "notCalculated" };
</xmp>

<dl class=domintro>
  <dt>{{ReportWinBrowserSignals/adCost}}
  <dd>[=round a value|Stochastically rounded=] winner's [=generated bid/ad cost=].
  <dt>{{ReportWinBrowserSignals/seller}}
  <dd>The origin of the seller running the ad auction
  <dt>{{ReportWinBrowserSignals/madeHighestScoringOtherBid}}
  <dd>True if the interest group owner was the only bidder that made bids with the second highest
    score
  <dt>{{ReportWinBrowserSignals/buyerReportingId}}
  <dd>Set if the winning ad had a [=interest group ad/buyer reporting ID=] but not a
    [=interest group ad/buyer and seller reporting ID=] set in its listing in the interest group,
    and that value was [=query reporting ID k-anonymity count|jointly k-anonymous=] combined with
    interest group owner, bidding script URL, and [=ad creative=] URL.

  <dt>{{ReportWinBrowserSignals/interestGroupName}}
  <dd>Only set if the tuple of interest group owner, name, bidding script URL and [=ad creative=] URL

    were [=query reporting ID k-anonymity count|jointly k-anonymous=], and the
    winning ad had neither [=interest group ad/buyer and seller reporting ID=]
    nor [=interest group ad/buyer reporting ID=] set in its listing in the interest group.
  <dt>{{ReportWinBrowserSignals/modelingSignals}}
  <dd>A 0-4095 integer (12-bits) passed to `reportWin()`, with noising
  <dt>{{ReportWinBrowserSignals/dataVersion}}
  <dd>Only set if the Data-Version header was provided in the response headers from the trusted
    bidding signals server
  <dt>{{ReportWinBrowserSignals/kAnonStatus}}
  <dd>Indicate the k-anonymity status of the ad with the following {{KAnonStatus}} enums:
      * {{KAnonStatus/passedAndEnforced}}: The ad was k-anonymous and k-anonymity was required to win the auction.
      * {{KAnonStatus/passedNotEnforced}}: The ad was k-anonymous though k-anonymity was not required to win the auction.
      * {{KAnonStatus/belowThreshold}}: The ad was not k-anonymous but k-anonymity was not required to win the auction.
      * {{KAnonStatus/notCalculated}}: The browser did not calculate the k-anonymity status of the ad, and k-anonymity was not required to win the auction.

    From a long-term perspective, the status will always be set to `passedAndEnforced` after 
    k-anonymity is enforced. However, as a temporary solution, current implementations may set 
    `kAnonStatus` to one of the other three statuses to allow API users to assess the future 
    impact of enforcing that ads are k-anonymous.
</dl>

<xmp class="idl">
dictionary DirectFromSellerSignalsForBuyer {
  any auctionSignals = null;
  any perBuyerSignals = null;
};
</xmp>

<xmp class="idl">
dictionary DirectFromSellerSignalsForSeller {
  any auctionSignals = null;
  any sellerSignals = null;
};
</xmp>

<h3 dfn-type=dfn>Interest group</h3>

An interest group is a [=struct=] with the following [=struct/items=]:

<dl dfn-for="interest group">
: <dfn>expiry</dfn>
:: A [=moment=] at which the browser will forget about this interest group.
: <dfn>owner</dfn>
:: An [=origin=]. Frames that join interest groups owned by [=interest group/owner=] must either be
  served from [=interest group/owner=], or another origin delegated by [=interest group/owner=] (See
  [=checking interest group permissions=] for details). The [=origin/scheme=] must be "`https`".
: <dfn>name</dfn>
:: A [=string=]. The ([=interest group/owner=], [=interest group/name=]) tuple is a key that
  uniquely defines each interest group.
: <dfn>priority</dfn>
:: A {{double}}, initially 0.0. Used to select which interest groups participate in an auction
  when the number of interest groups are limited by {{AuctionAdConfig/perBuyerGroupLimits}}.
  See [=applying interest groups limits to prioritized list=].
: <dfn>enable bidding signals prioritization</dfn>
:: A [=boolean=], initially false. Being true if the interest group's priority should be
  calculated using vectors from bidding signals fetch.
: <dfn>priority vector</dfn>
:: Null or an [=ordered map=] whose [=map/keys=] are [=strings=] and whose [=map/values=] are
  {{double}}. Its dot product with the {{AuctionAdConfig/perBuyerPrioritySignals}} will be used
  in place of [=interest group/priority=], if set.
: <dfn>priority signals overrides</dfn>
:: Null or an [=ordered map=] whose [=map/keys=] are [=strings=] and whose [=map/values=] are
  {{double}}. Overrides the {{AuctionAdConfig}}'s corresponding priority signals.
: <dfn>execution mode</dfn>
:: "`compatibility`" or "`group-by-origin`".
  TODO: Define spec for these execution modes, link to it from here and explain these modes.
: <dfn>bidding url</dfn>
:: Null or a [=URL=]. The URL to fetch the buyer's JavaScript from.
  <p class="note">
    When non-null, the [=interest group/bidding url=]'s [=origin=] will always be [=same origin=]
    with [=interest group/owner=].
  </p>
: <dfn>bidding wasm helper url</dfn>
:: Null or a [=URL=]. Lets the bidder provide computationally-expensive subroutines in WebAssembly,
  in addition to JavaScript, to be driven from the JavaScript function provided by
  [=interest group/bidding url=].
  <p class="note">
    When non-null, the [=interest group/bidding wasm helper url=]'s [=origin=] will always be
    [=same origin=] with [=interest group/owner=].
  </p>
: <dfn>update url</dfn>
:: Null or a [=URL=]. Provides a mechanism for the group's owner to periodically update the
  attributes of the interest group. See [[#interest-group-updates]]. Must be null if
  [=interest group/additional bid key=] is not null.
  <p class="note">
    When non-null, the [=interest group/update url=]'s [=origin=] will always be [=same origin=]
    with [=interest group/owner=].
  </p>
: <dfn>trusted bidding signals url</dfn>
:: Null or a [=URL=]. Provide a mechanism for making real-time data available for use at bidding
  time. See [=building trusted bidding signals url=].
  <p class="note">
    When non-null, the [=interest group/trusted bidding signals url=]'s [=origin=] will always be
    [=same origin=] with [=interest group/owner=].
  </p>
: <dfn>trusted bidding signals keys</dfn>
:: Null or a [=list=] of [=string=]. See [=building trusted bidding signals url=].
: <dfn>user bidding signals</dfn>
:: Null or a [=string=]. Additional metadata that the owner can use during on-device bidding.
: <dfn>ads</dfn>
:: Null or a [=list=] of [=interest group ad=]. Contains various ads that the interest group might
  show. Must be null if [=interest group/additional bid key=] is not null.
: <dfn>ad components</dfn>
:: Null or a [=list=] of [=interest group ad=]. Contains various ad components (or "products") that
  can be used to construct ads composed of multiple pieces — a top-level ad template "container"
  which includes some slots that can be filled in with specific "products".
: <dfn>additional bid key</dfn>
:: Null or a [=byte sequence=] of length 32. Must be null if [=interest group/ads=] or
  [=interest group/update url=] is not null. The Ed25519 public key (a 256-bit EdDSA public key)
  used to guarantee that this [=interest group=], if used by an additional bid for a negative
  targeting, can only be used by its [=interest group/owner=].
: <dfn>joining origin</dfn>
:: An [=origin=]. The top level page origin from where the interest group was joined.
: <dfn>join counts</dfn>
:: A [=list=] containing [=tuples=] of the day and per day join count. The day
  is calculated based on UTC time. The join count is a count of the number of
  times {{Navigator/joinAdInterestGroup()}} was called for this interest group on the
  corresponding day.
: <dfn>join time</dfn>
:: A [=moment=] at which the browser joined this interest group, updated upon each join and
  re-join.
: <dfn>bid counts</dfn>
:: A [=list=] containing [=tuples=] of the day and per day bid count. The day
  is calculated based on UTC time. The bid count is a count of the number of
  times the bid calculated during {{Navigator/runAdAuction()}} was greater than 0.
: <dfn>previous wins</dfn>
:: A [=list=] of [=previous wins=].
: <dfn>next update after</dfn>
:: A [=moment=] at which the browser will permit updating this interest group. See
  [[#interest-group-updates]].

</dl>

A <dfn>regular interest group</dfn> is an [=interest group=] whose
[=interest group/additional bid key=] is null.

A <dfn>negative interest group</dfn> is an [=interest group=] whose
[=interest group/additional bid key=] is not null.

<h3 dfn-type=dfn>Interest group ad</h3>

An interest group ad is a [=struct=] with the following [=struct/items=]:

<dl dfn-for="interest group ad">
: <dfn>render url</dfn>
:: A [=URL=]. If this ad wins the auction, this URL (or a [=urn uuid=] that maps to this URL) will
  be returned by {{Navigator/runAdAuction()}}. This URL is intended to be loaded into an ad
  <{iframe}> (or a <{fencedframe}>).
: <dfn>metadata</dfn>
:: Null or a [=string=]. Extra arbitary information about this ad, passed to `generateBid()`.
: <dfn>buyer reporting ID</dfn>
:: Null or a [=string=]. Will be passed in place of interest group name to [=report win=], subject
  to [=k-anonymity=] checks. Only meaningful in [=interest group/ads=], but ignored in
  [=interest group/ad components=].
: <dfn>buyer and seller reporting ID</dfn>
:: Null or a [=string=]. Will be passed in place of interest group name or
  [=interest group ad/buyer reporting ID=] to [=report win=] and [=report result=], subject to
  [=k-anonymity=] checks. Only meaningful in [=interest group/ads=], but ignored in
  [=interest group/ad components=].
: <dfn>allowed reporting origins</dfn>
:: Null or a [=list=] of [=origins=]. A list of up to 10 reporting origins that can receive reports
  with registered macros. All origins must be HTTPS origins and
  <a href="https://github.com/privacysandbox/attestation">enrolled</a>. Only meaningful in
  [=interest group/ads=], but ignored in [=interest group/ad components=].

</dl>

<h3 dfn-type=dfn>Currency tag</h3>
A currency tag is a [=string=] containing exactly 3 upper-case ASCII letters, or null. The null
value is used to denote that the currency is unspecified.

<div algorithm>
  To <dfn>serialize a currency tag</dfn> given a [=currency tag=] |currency|:
  1. If |currency| is null, return "???".
  1. Return |currency|.
</div>

<div algorithm>
  To <dfn>check whether a string is a valid currency tag</dfn> given [=string=] |currencyString|:
  1. If [=string/length=] of |currencyString| is not 3, return false.
  1. If |currencyString|[0] is not a [=ASCII upper alpha=] code point, return false.
  1. If |currencyString|[1] is not a [=ASCII upper alpha=] code point, return false.
  1. If |currencyString|[2] is not a [=ASCII upper alpha=] code point, return false.
  1. Return true.
</div>

<div algorithm>
  To <dfn>check a currency tag</dfn> given the [=currency tags=] |expected| and |actual|:

  1. If |expected| is null, return true.
  1. If |actual| is null, return true.
  1. If |actual| is equal to |expected|, return true.
  1. Return false.
</div>

<h3 dfn-type=dfn>Auction config</h3>

An auction config is a [=struct=] with the following items:

<dl dfn-for="auction config">
: <dfn>seller</dfn>
:: An [=origin=].
  The origin of the seller running the ad auction. The [=origin/scheme=] must be "<code>https</code>".
: <dfn>decision logic url</dfn>
:: A [=URL=].
  The URL to fetch the seller's JavaScript from.
  <p class="note">
    The [=auction config/decision logic url=]'s [=origin=] will always be [=same origin=] with
    [=auction config/seller=].
  </p>
: <dfn>trusted scoring signals url</dfn>
:: Null or a [=URL=].
  Provide a mechanism for making real-time data (information about a specific [=ad creative=]) available
  for use at scoring time, e.g. the results of some ad scanning system.
  <p class="note">
    When non-null, the [=auction config/trusted scoring signals url=]'s [=origin=] will always be
    [=same origin=] with [=auction config/seller=].
  </p>
: <dfn>interest group buyers</dfn>
:: Null or a [=list=] of [=origins=].
  Owners of interest groups allowed to participate in the auction. Each [=origin's=] [=origin/scheme=]
  must be "<code>https</code>".
: <dfn>auction signals</dfn>
:: Null, a [=string=], a {{Promise}}, or failure.
  Opaque JSON data passed to both sellers' and buyers' [=script runners=].
: <dfn>requested size</dfn>
:: Null or an [=ad size=], initially null.
  The size of the frame for the ad being selected by the auction.
: <dfn>seller signals</dfn>
:: Null, a [=string=], a {{Promise}}, or failure.
  Opaque JSON data passed to the seller's [=script runner=].
: <dfn>seller timeout</dfn>
:: A [=duration=] in milliseconds, initially 50 milliseconds.
  Restricts the runtime of the seller's `scoreAd()` script. If scoring does not complete before
  the timeout, the bid being scored is not considered further.
: <dfn>per buyer signals</dfn>
:: Null, a {{Promise}}, failure, or an [=ordered map=] whose [=map/keys=] are [=origins=] and
  whose [=map/values=] are [=strings=].
  [=map/Keys=] are buyers and must be valid HTTPS origins. [=map/Values=] are opaque JSON data
  passed to corresponding buyer's [=script runner=].
: <dfn>per buyer timeouts</dfn>
:: Null, a {{Promise}}, failure, or an [=ordered map=] whose [=map/keys=] are [=origins=] and
  whose [=map/values=] are [=durations=] in milliseconds.
  [=map/Keys=] are buyers and must be valid HTTPS origins. [=map/Values=] restrict the runtime of
  corresponding buyer's `generateBid()` script. If the timeout expires, only the bid submitted
  via `setBid()` is considered.
: <dfn>all buyers timeout</dfn>
:: A [=duration=] in milliseconds, initially 50 milliseconds.
  Restricts the `generateBid()` script's runtime for all buyers without a timeout specified in
  [=auction config/per buyer timeouts=]. If the timeout expires, only the bid submitted via
  `setBid()` is considered.
: <dfn>per buyer cumulative timeouts</dfn>
:: Null, a {{Promise}}, failure, or an [=ordered map=] whose [=map/keys=] are [=origins=] and
  whose [=map/values=] are [=durations=] in milliseconds.
  [=map/Keys=] are buyers and must be valid HTTPS [=origins=]. [=map/Values=] are collective
  timeouts for all interest groups of the buyer represented by the [=map/key=]. Includes the time of
  loading scripts and signals, and running the `generateBid()` functions. Once the timer expires,
  the affected buyer's interest groups may no longer generate any bids. All bids generated before
  the timeout will continue to participate in the auction.
  Implementations should attempt, on a best-effort basis, to generate bids for each buyer in
  priority order, so lower priority [=interest groups=] are the ones more likely to be timed out. If
  {{Promise}}s are passed in to the [=auction config=] for fields that support them,
  [=wait until configuration input promises resolve=] before starting the timer.

: <dfn>all buyers cumulative timeout</dfn>
:: Null or a [=duration=] in milliseconds, initially null.
  Restricts a buyer's cumulative timeout for all buyers without one specified in
  [=auction config/per buyer cumulative timeouts=].
: <dfn>per buyer group limits</dfn>
:: Null or an [=ordered map=] whose [=map/keys=] are [=origins=] and whose [=map/values=] are
  {{unsigned short}}s.
  [=map/Keys=] are buyers and must be valid HTTPS origins. [=map/Values=] restrict the number of
  bidding interest groups for a particular buyer that can participate in an auction.
: <dfn>all buyers group limit</dfn>
:: An {{unsigned short}}, initially 65535.
  Limit on the number of bidding interest groups for all buyers without a limit specified in
  [=auction config/per buyer group limits=].
: <dfn>per buyer priority signals</dfn>
:: Null or an [=ordered map=] whose [=map/keys=] are [=origins=] and whose [=map/values=] are
  [=ordered maps=], whose [=map/keys=] are [=strings=] and whose [=map/values=] are {{double}}.
  Per-buyer sparse vector whose dot product with [=interest group/priority vector=] is used to
  calculate interest group priorities. No signal's key starts with "browserSignals.", which is
  reserved for values coming from the browser.
: <dfn>all buyers priority signals</dfn>
:: Null or an [=ordered map=] whose [=map/keys=] are [=strings=] and whose [=map/values=] are
  {{double}}.
  Merged with [=auction config/per buyer priority signals=] before calculating per-interest group
  priorities. In the case both have entries with the same key, the entry in
  `per_buyer_priority_signals` takes precedence. No signals key start with "browserSignals.", which
  is reserved for values coming from the browser.
: <dfn>component auctions</dfn>
:: A [=list=] of [=auction config=]s.
  Nested auctions whose results will also participate in a top level auction. Only the top level
  [=auction config=] can have component auctions.
: <dfn>seller experiment group id</dfn>
:: Null or an {{unsigned short}}, initially null.
  Optional identifier for an experiment group to support coordinated experiments with the seller's
  trusted server.
: <dfn>per buyer experiment group ids</dfn>
:: An [=ordered map=] whose [=map/keys=] are [=origins=] and whose [=map/values=] are
  {{unsigned short}}s.
  [=map/Keys=] are buyers and must be valid HTTPS origins. [=map/Values=] are identifiers for
  experiment groups, to support coordinated experiments with buyers' trusted servers.
: <dfn>all buyer experiment group id</dfn>
:: Null or an {{unsigned short}}, initially null.
  Optional identifier for an experiment group to support coordinated experiments with buyers'
  trusted servers for buyers without a specified experiment group.
: <dfn>pending promise count</dfn>
:: An integer, initially 0. The number of things that are pending that are needed to score
  everything. It includes waiting for {{Promise}}s [=auction config/auction signals=],
  [=auction config/per buyer signals=], [=auction config/per buyer currencies=],
  [=auction config/per buyer timeouts=], [=auction config/direct from seller signals header ad slot=],
  [=auction config/seller signals=], or {{AuctionAdConfig/additionalBids}} whose {{Promise}}s are not
  yet resolved.
: <dfn>config idl</dfn>
:: {{AuctionAdConfig}}.
: <dfn>resolve to config</dfn>
:: A [=boolean=] or a {{Promise}}, initially false.
  Whether the ad should be returned as a {{FencedFrameConfig}}, or otherwise as a [=urn uuid=].
: <dfn>seller currency</dfn>
:: A [=currency tag=]. Specifies the currency bids returned by `scoreAd()` are expected to use, and
  which reporting for this auction will agree on.
: <dfn>per buyer currencies</dfn>
:: A {{Promise}} or failure or an [=ordered map=] whose [=map/keys=] are [=origins=] and whose
  [=map/values=] are [=currency tags=]. Specifies the currency bids returned by `generateBid()` or
  `scoreAd()` in component auctions are expected to use. The initial value is an empty map.
: <dfn>all buyers currency</dfn>
:: A [=currency tag=]. Specifies the currency bids returned by `generateBid()` or `scoreAd()` in
  component auctions are expected to use if [=auction config/per buyer currencies=] does not specify
  a particular value.
: <dfn>direct from seller signals header ad slot</dfn>
:: Null, a [=string=], a {{Promise}}, or failure. Initially null.
: <dfn>auction nonce</dfn>
:: Null or a [=version 4 UUID=], initially null.
  A unique identifier associated with this and only this invocation of
  {{Window/navigator}}.{{Navigator/runAdAuction()}}. For
  multi-seller auctions, this ID is uniquely associated with all {{AuctionAdConfig/componentAuctions}}.
  This must come from a prior call to {{Window/navigator}}.{{Navigator/createAuctionNonce()}}. This
  is only required for auctions that provide additional bids, and each of those additional bids must
  use the same auction nonce to ensure that each of those additional bids was intended for this and
  only this auction.
: <dfn>expects additional bids</dfn>
:: A [=boolean=] or failure, initially false.
  Specifies whether some bids will be provided as signed exchanges. Sets to failure if the
  {{AuctionAdConfig/additionalBids}} {{Promise}} is [=rejected=].

</dl>

<div algorithm>
To <dfn>wait until configuration input promises resolve</dfn> given an [=auction config=] |auctionConfig|:
1. Wait until |auctionConfig|'s [=auction config/pending promise count=] is 0.
1. [=Assert=] |auctionConfig|'s [=auction config/auction signals=], [=auction config/seller signals=],
  [=auction config/per buyer signals=], [=auction config/per buyer currencies=],
  [=auction config/per buyer timeouts=], [=auction config/per buyer cumulative timeouts=], and
  [=auction config/direct from seller signals header ad slot=] are not {{Promise}}s, and
  [=auction config/expects additional bids=] is false.
1. If |auctionConfig|'s [=auction config/auction signals=], [=auction config/seller signals=],
  [=auction config/per buyer signals=], [=auction config/per buyer currencies=],
  [=auction config/per buyer timeouts=], [=auction config/per buyer cumulative timeouts=], or
  [=auction config/direct from seller signals header ad slot=] is failure, return failure.
1. Return.

</div>

<div algorithm>
To <dfn>recursively wait until configuration input promises resolve</dfn> given an [=auction config=]
|auctionConfig|:
1. [=list/For each=] |componentAuctionConfig| in |auctionConfig|'s [=auction config/component auctions=]:
  1. If the result of [=waiting until configuration input promises resolve=] given |componentAuctionConfig| is
    failure, return failure.
1. Return the result of [=waiting until configuration input promises resolve=] given |auctionConfig|.

</div>

<div algorithm>
To <dfn>handle an input promise in configuration</dfn> given an [=auction config=] |auctionConfig|,
a {{Promise}} |p|, and two sequences of steps, covering the parsing of the value and error-handling:
1. Increment |auctionConfig|'s [=auction config/pending promise count=].
1. Let |resolvedAndTypeChecked| be the promise representing performing the following steps
  [=upon fulfillment=] of |p| with |result|:
  1. Execute the steps to be run for parsing of the value given |result|.
  1. If no exception was [=exception/thrown=] in the previous step, then decrement |auctionConfig|'s
    [=auction config/pending promise count=].
1. [=Upon rejection=] of |resolvedAndTypeChecked|:
  1. Execute the steps for error-handling.
  1. Decrement |auctionConfig|'s [=auction config/pending promise count=].

</div>

<div algorithm>
  To <dfn>look up per-buyer currency</dfn> given an [=auction config=] |auctionConfig|, and an [=origin=] |buyer|:

  1. Let |perBuyerCurrency| be |auctionConfig|'s [=auction config/all buyers currency=]
  1. Assert: |auctionConfig|'s [=auction config/per buyer currencies=] is an [=ordered map=].
  1. If |auctionConfig|'s [=auction config/per buyer currencies=][|buyer|] [=map/exists=], then set
    |perBuyerCurrency| to |auctionConfig|'s [=auction config/per buyer currencies=][|buyer|].
  1. Return |perBuyerCurrency|
</div>

<h3 dfn-type=dfn>Per buyer bid generator</h3>

A per buyer bid generator is an [=ordered map=] whose [=map/keys=] are [=URLs=] representing
[=interest group/trusted bidding signals urls=], and whose [=map/values=] are
[=per signals url bid generators=].

<h3 dfn-type=dfn>Per signals url bid generator</h3>

A per signals url bid generator is an [=ordered map=] whose [=map/keys=] are [=origins=]
representing [=interest group/joining origins=], and whose [=map/values=] are [=lists=] of
[=interest groups=].


<h3 dfn-type=dfn>Previous win</h3>

The [=interest group=]'s auction win history, to allow on-device frequency capping.


<dl dfn-for="previous win">
: <dfn>time</dfn>
:: A [=moment=]. Approximate time the [=interest group=] won an auction.
: <dfn>ad json</dfn>
:: A [=string=]. A JSON serialized object corresponding to the ad that won the auction.

</dl>

<h3 dfn-type=dfn>Bid with currency</h3>
Numeric value of a bid and the currency it is in.

<dl dfn-for="bid with currency">
: <dfn>value</dfn>
:: A {{double}}. The value of the bid.
: <dfn>currency</dfn>
:: A [=currency tag=]. The currency the bid is in.

</dl>

<h3 dfn-type=dfn>Generated bid</h3>

A bid that needs to be scored by the seller. The bid is either the output of running a Protected
Audience `generateBid()` script, or an additional bid provided by the [:Ad-Auction-Additional-Bid:]
response headers.

<dl dfn-for="generated bid">
: <dfn>bid</dfn>
:: A [=bid with currency=]. If the [=bid with currency/value=] is zero or negative, then this
  [=interest group=] will not participate in the auction.
: <dfn>bid in seller currency</dfn>
:: A {{double}} or null. An equivalent of the original bid in seller's currency. This is either the
  original bid if the currency already matched, or a conversion provided by `scoreAd()`.
: <dfn>ad</dfn>
:: A [=string=]. JSON string to be passed to the scoring function.

  Issue: TODO: Check whether [=generated bid/ad descriptor=] can be moved to
  [=generated bid/bid ad=] to avoid duplication
  (<a href="https://github.com/WICG/turtledove/issues/667">WICG/turtledove#868</a>).
: <dfn>ad descriptor</dfn>
:: An [=ad descriptor=]. Render URL and size of the bid's ad.
: <dfn>ad component descriptors</dfn>
:: Null or a [=list=] of [=ad descriptors=]. Ad components associated with bid, if any. May have at
  most 20 [=list/items=]. Must be null if the interest group making this bid has a null
  [=interest group/ad components=] field.
: <dfn>ad cost</dfn>
:: Null or a {{double}}. Advertiser click or conversion cost passed from `generateBid()` to
  `reportWin()`. Negative values will be ignored and not passed. Will be
  [=round a value|stochastically rounded=] when passed.
: <dfn>modeling signals</dfn>
:: Null or an {{unsigned short}}. A 0-4095 integer (12-bits) passed to `reportWin()`, with noising.
: <dfn>interest group</dfn>
:: An [=interest group=], whose `generateBid()` invocation generated this bid, or specified by the
  additional bid.
: <dfn>bid ad</dfn>
:: The [=interest group ad=] within [=generated bid/interest group=] to display.
: <dfn>modified bid</dfn>
:: Null or a [=bid with currency=]. Being null for top level auction.
  The bid value a component auction's `scoreAd()` script returns.
: <dfn>bid duration</dfn>
:: A [=duration=] in milliseconds. How long it took to run `generateBid()`.
: <dfn>provided as additional bid</dfn>
:: A [=boolean=], initially false.

</dl>

<h3 dfn-type=dfn>Ad descriptor</h3>

The render URL and size of an ad.

<dl dfn-for="ad descriptor">
: <dfn>url</dfn>
:: A [=URL=], which will be rendered to display the [=ad creative=] if this bid wins the auction.
: <dfn>size</dfn>
:: Null or an [=ad size=], initially null.

</dl>

<h3 dfn-type=dfn>Ad size</h3>

Width and height of an ad.

<dl dfn-for="ad size">
: <dfn>width</dfn>
:: A {{double}}.
: <dfn>width units</dfn>
:: A [=string=]. Can only be one of "px" (pixel), "sh" (screen height), and "sw" (screen width).
: <dfn>height</dfn>
:: A {{double}}.
: <dfn>height units</dfn>
:: A [=string=]. Can only be one of "px" (pixel), "sh" (screen height), and "sw" (screen width).

</dl>

<h3 id=direct-from-seller-signals-section>Direct from seller signals</h3>

A <dfn>direct from seller signals key</dfn> is a [=struct=] with the following [=struct/items=]:

<dl dfn-for="direct from seller signals key">
  : <dfn>seller</dfn>
  :: An [=origin=]. Matches the origin that served the captured [:Ad-Auction-Signals:] header.
  : <dfn>ad slot</dfn>
  :: A [=string=]. Matches the `adSlot` key of the JSON dictionaries in the top-level array of the
    [:Ad-Auction-Signals:] value.
</dl>

A <dfn>direct from seller signals</dfn> is a [=struct=] with the following [=struct/items=]:

<dl dfn-for="direct from seller signals">
  : <dfn>auction signals</dfn>
  :: Null or a [=string=].
    Opaque JSON data passed to both buyers' and the seller's [=script runners=].
  : <dfn>seller signals</dfn>
  :: Null or a [=string=].
    Opaque JSON data passed to the seller's [=script runner=].
  : <dfn>per buyer signals</dfn>
  :: A [=map=] whose [=map/keys=] are [=origins=] and whose [=map/values=] are [=strings=].
    [=map/Keys=] are buyers and must be valid HTTPS origins. [=map/Values=] are opaque JSON data
    passed to corresponding buyer's [=script runner=].
</dl>

<h3 dfn-type=dfn>Score ad output</h3>

The output of running a Protected Audience `scoreAd()` script, is represented using the following type:
<pre class="idl">
dictionary ScoreAdOutput {
  required double desirability;
  double bid;
  DOMString bidCurrency;
  double incomingBidInSellerCurrency;
  boolean allowComponentAuction = false;
};
</pre>
Either a dictionary of this type, or a {{double}}, are handled as the return values.

The meanings of the fields are as follows:
<dl class=domintro>
  <dt>{{ScoreAdOutput/desirability}}
  <dd>Numeric score of the bid. Must be positive or the ad will be rejected. The winner of the auction
  is the bid which was given the highest score.
  <dt>{{ScoreAdOutput/bid}}
  <dd>Only relevant if this is a component auction.  If present, this will be passed to the top-level
  seller's `scoreAd()` and `reportResult()` methods instead of the original bid, if the ad wins the
  component auction and top-level auction, respectively.
  <dt>{{ScoreAdOutput/bidCurrency}}
  <dd>Only relevant if this is a component auction and {{ScoreAdOutput/bid}} is set. Specifies which
  currency the {{ScoreAdOutput/bid}} field is in.
  <dt>{{ScoreAdOutput/incomingBidInSellerCurrency}}
  <dd>Provides a conversion of the incoming bid to auction's seller currency. This is different from
  {{ScoreAdOutput/bid}} which is the bid the component auction itself produces.
  <dt>{{ScoreAdOutput/allowComponentAuction}}
  <dd>If the bid being scored is from a component auction and this value is not true, the bid is
  ignored. This field must be present and true both when the component seller scores a bid, and when
  that bid is being scored by the top-level auction.
</dl>

TODO: This also has an ad field, which should behave similar to the way {{ScoreAdOutput/bid}}
affects [=generated bid/modified bid=], and then affecting the adMetadata parameter to scoreAd.

<div algorithm>

To <dfn>process scoreAd output</dfn> given an [=ECMAScript/Completion Record=] |result|:
  1. If |result| is an an [=ECMAScript/abrupt completion=], return failure.
  1. If |result|.\[[Value]] is a [=Number=]:
    1. Let |checkedScore| be the result of [=converted to an IDL value|converting=]
      |result|.\[[Value]] to a {{double}}.
    1. If an exception was [=exception/thrown=] in the previous step, return failure.
    1. Let |resultIDL| be a new {{ScoreAdOutput}}.
    1. Set |resultIDL|'s {{ScoreAdOutput/desirability}} to |checkedScore|.
    1. Return |resultIDL|.
  1. Let |resultIDL| be the result of [=converted to an IDL value|converting=]
          |result|.\[[Value]] to a {{ScoreAdOutput}}.
  1. If an exception was [=exception/thrown=] in the previous step, return failure.
  1. If |resultIDL|["{{ScoreAdOutput/bidCurrency}}"] [=map/exists=] and result of
    [=checking whether a string is a valid currency tag=] applied to
    |resultIDL|["{{ScoreAdOutput/bidCurrency}}"] is false, then return failure.
  1. Return |resultIDL|.
</div>

<h3 dfn-type=dfn>Leading bid info</h3>

Information of the auction's leading bid so far when ranking scored bids.

<dl dfn-for="leading bid info">
: <dfn>top score</dfn>
:: A {{double}}, initially 0.0. The highest score so far.
: <dfn>top bids count</dfn>
:: An integer, initially 0. The number of bids with the same `top score`.
: <dfn>at most one top bid owner</dfn>
:: A [=boolean=], initially true. Whether all bids of `top score` are from the same interest
  group owner.
: <dfn>leading bid</dfn>
:: Null or a [=generated bid=]. The leading bid of the auction so far.
: <dfn>auction config</dfn>
:: An [=auction config=]. The auction config of the auction which generated this
  [=leading bid info/leading bid=].
: <dfn>second highest score</dfn>
:: A {{double}}, initially 0.0. The second highest score so far. If more than one bids tie with
  `top score`, this will be set to `top score`.
: <dfn>highest scoring other bids count</dfn>
:: An integer, initially 0. The number of bids with the same `second highest score`.
: <dfn>highest scoring other bid</dfn>
:: Null or a [=generated bid=]. The second highest scoring other bid.
: <dfn>highest scoring other bid owner</dfn>
:: Null or an [=origin=], initially null. The interest group owner that made bids with the
  `second highest score`. Set to null if there are more than one owners made bids with the
  `second highest score`.
: <dfn>top level seller</dfn>
:: Null or a [=string=]. The seller in the top level auction.  Only set for component auctions, null
  otherwise.
: <dfn>top level seller signals</dfn>
:: Null or a [=string=]. Signals from the seller in the top level auction, produced as the output
  of the top-level seller's `reportResult()` method.  Only set for component auctions,
  null otherwise.
: <dfn>component seller</dfn>
:: Null or a [=string=]. Seller in component auction which generated this
  [=leading bid info/leading bid=]. Only set the top level auction when component auctions are
  present, null otherwise.
: <dfn>bidding data version</dfn>
:: Null or an {{unsigned long}}.
  Data-Version value from the trusted bidding signals server's response(s). Will only be not null if
  the Data-Version header was provided and had a consistent value for all of the trusted bidding
  signals server responses used to construct the trustedBiddingSignals.
: <dfn>scoring data version</dfn>
:: Null or an {{unsigned long}}.
  Data-Version value from the trusted scoring signals server's response. Will only be not null if
  the Data-Version header was provided in the response headers from the trusted scoring signals
  server.
: <dfn>buyer reporting result</dfn>
:: Null or a [=reporting result=], initially null.
: <dfn>seller reporting result</dfn>
:: Null or a [=reporting result=], initially null.
: <dfn>component seller reporting result</dfn>
:: Null or a [=reporting result=], initially null.

</dl>

A <dfn>reporting result</dfn> is a [=struct=] with the following [=struct/items=]:

<dl dfn-for="reporting result">
  : <dfn>report url</dfn>
  :: Null or a [=URL=], initially null. Set by
     {{InterestGroupReportingScriptRunnerGlobalScope/sendReportTo(url)}}.

  : <dfn>reporting beacon map</dfn>
  :: Null or an [=ordered map=] whose [=map/keys=] are [=strings=] and whose [=map/values=] are
     [=URLs=], initially null. Set by
     {{InterestGroupReportingScriptRunnerGlobalScope/registerAdBeacon(map)}}.

  : <dfn>reporting macro map</dfn>
  :: Null or an [=ordered map=] whose [=map/keys=] are [=strings=] and whose [=map/values=] are
     [=strings=], initially null. Set by
     {{InterestGroupReportingScriptRunnerGlobalScope/registerAdMacro(name, value)}}.  
</dl>

# Privacy Considerations # {#privacy-considerations}

Protected Audience aims to advance the privacy of remarketing and custom audience
advertising on the web, so naturally privacy considerations are paramount to Protected Audience’s
design.  Partitioning data by site is the central mechanism to prevent joining a user’s identity
across sites:
- Interest group definitions come from just one site, the site that called
  {{Navigator/joinAdInterestGroup()}}.
- Bidding (`generateBid()`) and scoring (`scoreAd()`) scripts are exposed to interest group data
  from the joining site, and data from the site that will display the ad, but these scripts are run
  in strict isolation to prevent leaking this cross-site information.
- The browser can enforce that trusted bidding and scoring signals are fetched from servers
  complying with certain privacy requirements, e.g. not performing event-level logging.
- Ads are rendered in <{fencedframe}>s that isolate them from the surrounding page to prevent
  cross-site leakage.
- Reporting is strictly controlled by the browser to prevent cross-site leaks:  Inputs to
  event-level reporting functions, `reportWin()` and `reportResult()`, only contain limited
  cross-site information, e.g. the k-anonymous ad URL.  Event-level reporting is meant to be a
  temporary stepping stone to more private mechanisms like [Private Aggregation
  API](https://github.com/patcg-individual-drafts/private-aggregation-api).


# Security Considerations # {#security-considerations}

Protected Audience involves the browser running untrusted JavaScript downloaded from multiple
parties, so security concerns are top of mind. Fortunately Protected Audience is a highly
constrained API not attempting to be a general purpose execution environment. Execution of this
JavaScript is controlled and limited as follows:
- Protected Audience requires the origin of the scripts’ URLs to match that of the origin of the
  interest group owner, which is in turn required to match the origin of the context calling the
  {{Navigator/joinAdInterestGroup()}}.
- URL schemes are required to be HTTPS.
- Redirects are disallowed.
- Responses are required to contain the `Ad-Auction-Allowed: ?1` header.
- Fetches are uncredentialed.

Protected Audience has the browser pass in several “browserSignals” to the bidding script that give the script
unforgeable information about the context that the script is being executed in. This way bidders
and sellers have the choice to only participate in auctions where they are comfortable working with
the involved parties.

The [execution environment](#script-runners) available to these scripts is the absolute minimum necessary to calculate

a bid. It supports only ECMAScript. It does not support network, storage, timer, date, DOM,
Workers, postMessage, Navigator or Window APIs.

Protected Audience adds Permission-Policies to control access to the Protected Audience APIs to
give sites and embedders the ability to clamp down on use of the APIs as they see fit.