From 6b4e82ed594d77fdc686107298823d83b2e3c19f Mon Sep 17 00:00:00 2001
From: Christian <christianpavilonis@outlook.com>
Date: Wed, 15 Jul 2026 12:04:27 -0500
Subject: [PATCH 1/2] Make auction creative rewriting optional

Allow operators to retain sanitizer-accepted external URLs in POST /auction adm while preserving mandatory server-side sanitization and the existing default behavior.
---
 CHANGELOG.md                                  |   1 +
 .../src/auction/endpoints.rs                  |   7 +-
 .../src/auction/formats.rs                    | 141 +++++++++++++++++-
 .../src/auction/orchestrator.rs               |   1 +
 .../src/auction_config_types.rs               |  22 +++
 .../trusted-server-core/src/config_payload.rs |  24 +++
 crates/trusted-server-core/src/proxy.rs       |  45 ++++++
 crates/trusted-server-core/src/settings.rs    |  35 +++++
 docs/guide/auction-orchestration.md           |  69 ++++++---
 docs/guide/configuration.md                   |  26 +++-
 docs/guide/creative-processing.md             |  54 +++++--
 trusted-server.example.toml                   |   4 +
 12 files changed, 382 insertions(+), 47 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5bc49c80b..fddc8009d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,6 +18,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Added the default-true `[auction].rewrite_creatives` option. Setting it to `false` preserves mandatory `/auction` creative sanitization while skipping first-party resource/click URL rewriting and creative TSJS injection.
 - Added Osano consent mirror integration docs and public enablement guidance.
 - Implemented basic authentication for configurable endpoint paths (#73)
 - Added integrations guide with example `testlight` integration
diff --git a/crates/trusted-server-core/src/auction/endpoints.rs b/crates/trusted-server-core/src/auction/endpoints.rs
index 825129b1a..e7d4f0de4 100644
--- a/crates/trusted-server-core/src/auction/endpoints.rs
+++ b/crates/trusted-server-core/src/auction/endpoints.rs
@@ -76,9 +76,10 @@ const MAX_AUCTION_BODY_SIZE: usize = 256 * 1024;
 /// ## Response
 ///
 /// Returns an `OpenRTB 2.x` response. Creative HTML is inlined in each bid's
-/// `adm` field after sanitisation and first-party URL rewriting. Response
-/// headers include `X-TS-EC` (the caller's Edge Cookie ID) and
-/// `X-TS-EC-Fresh` (a freshly generated ID for cookie renewal).
+/// `adm` field after mandatory server-side sanitization. First-party resource
+/// and click URL rewriting plus creative TSJS injection are enabled by default;
+/// setting [`auction.rewrite_creatives`][`crate::auction_config_types::AuctionConfig::rewrite_creatives`]
+/// to `false` skips only that rewrite pass.
 ///
 /// ## Scroll, refresh, and SPA navigation
 ///
diff --git a/crates/trusted-server-core/src/auction/formats.rs b/crates/trusted-server-core/src/auction/formats.rs
index 441828a18..71f9a290c 100644
--- a/crates/trusted-server-core/src/auction/formats.rs
+++ b/crates/trusted-server-core/src/auction/formats.rs
@@ -217,7 +217,8 @@ pub fn convert_tsjs_to_auction_request(
 
 /// Convert `OrchestrationResult` to `OpenRTB` response format.
 ///
-/// Returns rewritten creative HTML directly in the `adm` field for inline delivery.
+/// Always sanitizes creative HTML in the `adm` field and optionally rewrites it
+/// according to the auction configuration.
 ///
 /// # Errors
 ///
@@ -250,21 +251,34 @@ pub fn convert_to_openrtb_response(
         let width = to_openrtb_i32(bid.width, "width", &bid_context);
         let height = to_openrtb_i32(bid.height, "height", &bid_context);
 
-        // Process creative HTML if present - — sanitize dangerous markup first, then rewrite URLs.
+        // Process creative HTML if present — always sanitize dangerous markup first.
         let creative_html = if let Some(ref raw_creative) = bid.creative {
             let sanitized = creative::sanitize_creative_html(raw_creative);
-            let rewritten = creative::rewrite_creative_html(settings, &sanitized);
+            let sanitized_len = sanitized.len();
+            let rewrite_creatives = settings.auction.rewrite_creatives;
+            let processed = if rewrite_creatives {
+                creative::rewrite_creative_html(settings, &sanitized)
+            } else {
+                sanitized
+            };
+            let rewrite_mode = if rewrite_creatives {
+                "enabled"
+            } else {
+                "disabled"
+            };
 
             log::debug!(
-                "Processed creative for auction {} slot {} ({} → {} → {} bytes)",
+                "Processed creative for auction {} slot {} bidder {} (rewrite {}, raw {} bytes, sanitized {} bytes, output {} bytes)",
                 auction_request.id,
                 slot_id,
+                bid.bidder,
+                rewrite_mode,
                 raw_creative.len(),
-                sanitized.len(),
-                rewritten.len()
+                sanitized_len,
+                processed.len()
             );
 
-            rewritten
+            processed
         } else {
             // No creative provided (e.g., from mediation layer that returns iframe URLs)
             log::warn!(
@@ -445,6 +459,15 @@ mod tests {
         }
     }
 
+    fn make_complete_creative_bid() -> Bid {
+        let mut bid = make_bid("div-gpt-top", "appnexus", Some(2.75));
+        bid.creative = Some(
+            r#"<html><body><a href="https://advertiser.example.com/landing"><img src="https://cdn.example.com/ad.png" style="background-image:url(https://styles.example.com/bg.png)" onerror="auction-handler-marker()"></a><script>auction-script-marker</script></body></html>"#
+                .to_string(),
+        );
+        bid
+    }
+
     fn make_result(bid: Bid) -> OrchestrationResult {
         OrchestrationResult {
             provider_responses: vec![AuctionResponse {
@@ -466,6 +489,13 @@ mod tests {
             .expect("should parse JSON response")
     }
 
+    fn response_adm(response: Response<EdgeBody>) -> String {
+        response_json(response)["seatbid"][0]["bid"][0]["adm"]
+            .as_str()
+            .expect("should serialize adm as a string")
+            .to_string()
+    }
+
     fn make_banner_body(config: Option<JsonValue>) -> AdRequest {
         AdRequest {
             ad_units: vec![AdUnit {
@@ -932,6 +962,103 @@ mod tests {
         );
     }
 
+    #[test]
+    fn convert_to_openrtb_response_rewrites_sanitized_creative_by_default() {
+        let settings = make_settings();
+        let auction_request = make_auction_request();
+        let result = make_result(make_complete_creative_bid());
+
+        let response = convert_to_openrtb_response(&result, &settings, &auction_request, false)
+            .expect("should convert creative with rewriting enabled");
+        let adm = response_adm(response);
+
+        assert!(
+            adm.matches("/first-party/proxy?tsurl=").count() >= 2,
+            "should rewrite image and inline CSS URLs through the proxy: {adm}"
+        );
+        assert!(
+            adm.contains("/first-party/click?tsurl="),
+            "should rewrite click URLs: {adm}"
+        );
+        assert!(
+            adm.contains("data-tsclick"),
+            "should add the click guard attribute: {adm}"
+        );
+        assert!(
+            adm.contains("tsjs-unified.min.js"),
+            "should inject the unified creative runtime: {adm}"
+        );
+        assert!(
+            !adm.contains(r#"src="https://cdn.example.com/ad.png""#),
+            "should not retain the image URL as a direct attribute: {adm}"
+        );
+        assert!(
+            !adm.contains(r#"href="https://advertiser.example.com/landing""#),
+            "should not retain the click URL as a direct attribute: {adm}"
+        );
+        assert!(
+            !adm.contains("url(https://styles.example.com/bg.png)"),
+            "should not retain the CSS URL as a direct value: {adm}"
+        );
+        assert!(
+            !adm.contains("auction-script-marker"),
+            "should remove malicious script content before rewriting: {adm}"
+        );
+        assert!(
+            !adm.contains("auction-handler-marker") && !adm.contains("onerror"),
+            "should remove event handlers before rewriting: {adm}"
+        );
+    }
+
+    #[test]
+    fn convert_to_openrtb_response_can_skip_rewriting_but_not_sanitization() {
+        let mut settings = make_settings();
+        settings.auction.rewrite_creatives = false;
+        let auction_request = make_auction_request();
+        let result = make_result(make_complete_creative_bid());
+
+        let response = convert_to_openrtb_response(&result, &settings, &auction_request, false)
+            .expect("should convert creative with rewriting disabled");
+        let adm = response_adm(response);
+
+        assert!(
+            adm.contains(r#"src="https://cdn.example.com/ad.png""#),
+            "should retain the sanitizer-accepted image URL: {adm}"
+        );
+        assert!(
+            adm.contains(r#"href="https://advertiser.example.com/landing""#),
+            "should retain the sanitizer-accepted click URL: {adm}"
+        );
+        assert!(
+            adm.contains("url(https://styles.example.com/bg.png)"),
+            "should retain the sanitizer-accepted CSS URL: {adm}"
+        );
+        assert!(
+            !adm.contains("/first-party/proxy"),
+            "should not rewrite resource URLs: {adm}"
+        );
+        assert!(
+            !adm.contains("/first-party/click"),
+            "should not rewrite click URLs: {adm}"
+        );
+        assert!(
+            !adm.contains("data-tsclick"),
+            "should not add the click guard attribute: {adm}"
+        );
+        assert!(
+            !adm.contains("tsjs-unified.min.js"),
+            "should not inject the unified creative runtime: {adm}"
+        );
+        assert!(
+            !adm.contains("auction-script-marker"),
+            "should still remove malicious script content: {adm}"
+        );
+        assert!(
+            !adm.contains("auction-handler-marker") && !adm.contains("onerror"),
+            "should still remove event handlers: {adm}"
+        );
+    }
+
     #[test]
     fn convert_to_openrtb_response_serializes_missing_creative_as_empty_adm() {
         let settings = make_settings();
diff --git a/crates/trusted-server-core/src/auction/orchestrator.rs b/crates/trusted-server-core/src/auction/orchestrator.rs
index 4ef73e581..fb9255825 100644
--- a/crates/trusted-server-core/src/auction/orchestrator.rs
+++ b/crates/trusted-server-core/src/auction/orchestrator.rs
@@ -1818,6 +1818,7 @@ mod tests {
         futures::executor::block_on(async {
             let config = AuctionConfig {
                 enabled: true,
+                rewrite_creatives: true,
                 providers: vec![],
                 mediator: None,
                 timeout_ms: 2000,
diff --git a/crates/trusted-server-core/src/auction_config_types.rs b/crates/trusted-server-core/src/auction_config_types.rs
index 3bd747f64..f1d1a5cf0 100644
--- a/crates/trusted-server-core/src/auction_config_types.rs
+++ b/crates/trusted-server-core/src/auction_config_types.rs
@@ -11,6 +11,10 @@ pub struct AuctionConfig {
     #[serde(default)]
     pub enabled: bool,
 
+    /// Rewrite sanitized winning-bid creative HTML to first-party endpoints.
+    #[serde(default = "default_rewrite_creatives")]
+    pub rewrite_creatives: bool,
+
     /// Provider names that participate in bidding
     /// Simply list the provider names (e.g., ["prebid", "aps"])
     #[serde(default, deserialize_with = "crate::settings::vec_from_seq_or_map")]
@@ -41,6 +45,7 @@ impl Default for AuctionConfig {
     fn default() -> Self {
         Self {
             enabled: false,
+            rewrite_creatives: default_rewrite_creatives(),
             providers: Vec::new(),
             mediator: None,
             timeout_ms: default_timeout(),
@@ -54,6 +59,10 @@ fn default_timeout() -> u32 {
     2000
 }
 
+fn default_rewrite_creatives() -> bool {
+    true
+}
+
 fn default_creative_store() -> String {
     "creative_store".to_owned()
 }
@@ -79,3 +88,16 @@ impl AuctionConfig {
         self.mediator.is_some()
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn rewrite_creatives_defaults_to_true() {
+        assert!(
+            AuctionConfig::default().rewrite_creatives,
+            "should enable creative rewriting by default"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/config_payload.rs b/crates/trusted-server-core/src/config_payload.rs
index dd0b35337..58c185381 100644
--- a/crates/trusted-server-core/src/config_payload.rs
+++ b/crates/trusted-server-core/src/config_payload.rs
@@ -78,6 +78,30 @@ mod tests {
         );
     }
 
+    #[test]
+    fn legacy_blob_without_rewrite_creatives_preserves_rewriting() {
+        let mut data =
+            serde_json::to_value(test_settings()).expect("should serialize settings to JSON");
+        let auction = data
+            .get_mut("auction")
+            .and_then(serde_json::Value::as_object_mut)
+            .expect("should serialize auction settings as an object");
+        assert!(
+            auction.remove("rewrite_creatives").is_some(),
+            "should remove the newly serialized setting"
+        );
+        let envelope = BlobEnvelope::new(data, "2026-01-01T00:00:00Z".to_string());
+        let envelope_json = serde_json::to_string(&envelope).expect("should serialize envelope");
+
+        let reconstructed =
+            settings_from_config_blob(&envelope_json).expect("should reconstruct legacy settings");
+
+        assert!(
+            reconstructed.auction.rewrite_creatives,
+            "should enable creative rewriting for legacy blobs"
+        );
+    }
+
     #[test]
     fn strings_that_look_like_json_scalars_round_trip_as_strings() {
         let mut original = test_settings();
diff --git a/crates/trusted-server-core/src/proxy.rs b/crates/trusted-server-core/src/proxy.rs
index 9e03f4dbd..9bc71fb22 100644
--- a/crates/trusted-server-core/src/proxy.rs
+++ b/crates/trusted-server-core/src/proxy.rs
@@ -2882,6 +2882,51 @@ mod tests {
         assert_eq!(ct, "text/css; charset=utf-8");
     }
 
+    #[test]
+    fn auction_rewrite_setting_does_not_change_proxied_html_or_css_rewriting() {
+        let mut settings = create_test_settings();
+        settings.auction.rewrite_creatives = false;
+        let req = build_http_request(Method::GET, "https://edge.example/first-party/proxy");
+
+        let html = r#"<html><body><img src="https://cdn.example/ad.png"></body></html>"#;
+        let mut html_response = build_http_response(StatusCode::OK, EdgeBody::from(html));
+        html_response.headers_mut().insert(
+            header::CONTENT_TYPE,
+            HeaderValue::from_static("text/html; charset=utf-8"),
+        );
+        let html_output = finalize(
+            &settings,
+            &req,
+            "https://cdn.example/creative.html",
+            html_response,
+        )
+        .expect("should finalize proxied HTML");
+        let html_body = response_body_string(html_output);
+
+        let css = "body{background:url(https://cdn.example/bg.png)}";
+        let mut css_response = build_http_response(StatusCode::OK, EdgeBody::from(css));
+        css_response
+            .headers_mut()
+            .insert(header::CONTENT_TYPE, HeaderValue::from_static("text/css"));
+        let css_output = finalize(
+            &settings,
+            &req,
+            "https://cdn.example/creative.css",
+            css_response,
+        )
+        .expect("should finalize proxied CSS");
+        let css_body = response_body_string(css_output);
+
+        assert!(
+            html_body.contains("/first-party/proxy?tsurl="),
+            "should keep rewriting proxied HTML when auction rewriting is disabled: {html_body}"
+        );
+        assert!(
+            css_body.contains("/first-party/proxy?tsurl="),
+            "should keep rewriting proxied CSS when auction rewriting is disabled: {css_body}"
+        );
+    }
+
     #[test]
     fn html_response_rewrite_preserves_non_standard_port() {
         // Verify that HTML rewriting preserves non-standard ports in sub-resource URLs.
diff --git a/crates/trusted-server-core/src/settings.rs b/crates/trusted-server-core/src/settings.rs
index 03cc535c8..b177a23e7 100644
--- a/crates/trusted-server-core/src/settings.rs
+++ b/crates/trusted-server-core/src/settings.rs
@@ -4334,6 +4334,41 @@ origin_host_header_overide = "www.example.com""#,
         assert!(!rewrite.is_excluded(""));
     }
 
+    #[test]
+    fn test_auction_rewrite_creatives_defaults_to_true_when_omitted() {
+        let toml_str = crate_test_settings_str()
+            + r#"
+            [auction]
+            enabled = true
+            providers = []
+            "#;
+
+        let settings = Settings::from_toml(&toml_str).expect("should parse valid TOML");
+
+        assert!(
+            settings.auction.rewrite_creatives,
+            "should preserve creative rewriting when the setting is omitted"
+        );
+    }
+
+    #[test]
+    fn test_auction_rewrite_creatives_accepts_explicit_false() {
+        let toml_str = crate_test_settings_str()
+            + r#"
+            [auction]
+            enabled = true
+            providers = []
+            rewrite_creatives = false
+            "#;
+
+        let settings = Settings::from_toml(&toml_str).expect("should parse valid TOML");
+
+        assert!(
+            !settings.auction.rewrite_creatives,
+            "should disable creative rewriting when explicitly configured"
+        );
+    }
+
     #[test]
     fn test_auction_allowed_context_keys_defaults_to_empty() {
         let settings = create_test_settings();
diff --git a/docs/guide/auction-orchestration.md b/docs/guide/auction-orchestration.md
index d75958812..c6c82dac3 100644
--- a/docs/guide/auction-orchestration.md
+++ b/docs/guide/auction-orchestration.md
@@ -12,7 +12,7 @@ Key capabilities:
 - **Strategy-based winner selection** — Automatic strategy detection based on configuration
 - **Mediator support** — Optional external mediator for decoding encoded prices (e.g., APS) and applying unified floor pricing
 - **Provider abstraction** — Pluggable provider interface for adding new demand sources
-- **Creative rewriting** — Winning creatives automatically rewritten with first-party proxy URLs
+- **Creative rewriting** — Winning creatives are sanitized and rewritten with first-party proxy URLs by default
 
 ## System Flow (Prebid + APS)
 
@@ -147,7 +147,7 @@ sequenceDiagram
     Note over Client,Mock: Response Assembly
     activate TS
     activate Client
-    Orch->>Orch: Transform to OpenRTB response<br/>Generate iframe creatives<br/>Rewrite creative URLs<br/>Add orchestrator metadata
+    Orch->>Orch: Transform to OpenRTB response<br/>Sanitize creative HTML<br/>Optionally rewrite creative URLs<br/>Add orchestrator metadata
 
     Orch-->>TS: OpenRTB BidResponse
     Note right of Orch: { "id": "auction-response",<br/>  "seatbid": [{ "seat": "amazon-aps",<br/>    "bid": [{ "price": 2.50,<br/>      "adm": "<iframe src=\"/first-party/proxy?tsurl=...\">",<br/>      "w": 728, "h": 90 }] }] }<br/>  "ext": { "orchestrator": {<br/>    "strategy": "parallel_mediation",<br/>    "bidders": 2, "time_ms": 150 } }
@@ -160,8 +160,8 @@ sequenceDiagram
   %% === Creative Rendering ===
   rect rgb(239,246,255)
     Note over Client,Mock: Creative Rendering
-    Client->>Client: Inject winning creative<br/>Render iframe<br/>Load creative through proxy
-    Note right of Client: iframe src="/first-party/proxy?tsurl=...&tstoken=sig"<br/>Ensures first-party serving<br/>Maintains privacy & security
+    Client->>Client: Inject winning creative<br/>Render iframe<br/>Load creative resources
+    Note right of Client: Default: first-party proxy/click URLs<br/>rewrite_creatives=false: accepted external URLs remain direct
     deactivate Client
   end
 ```
@@ -193,9 +193,10 @@ AuctionOrchestrator.run_auction()
   ▼
 Convert OrchestrationResult → OpenRTB 2.x Response
   │
-  ├─ Rewrite creative HTML with first-party proxy URLs
+  ├─ Sanitize creative HTML
+  ├─[rewrite_creatives=true] Rewrite URLs and inject creative TSJS
   ├─ Add ext.orchestrator metadata
-  └─ Set EC ID response headers
+  └─ Set consent and optional EID response headers
 ```
 
 ### Key Components
@@ -340,7 +341,7 @@ Transforms auction requests into OpenRTB 2.x format and sends them to a Prebid S
 
 - Bids include decoded `price` (clear decimal CPM)
 - Creative HTML provided in `adm` field
-- Creative URLs rewritten to first-party proxy format
+- Winning creative URLs rewritten to first-party proxy format by default when the `/auction` response is assembled
 - Per-bidder timing (`responsetimemillis`), errors, and warnings always attached as response metadata
 - When `debug` is enabled, PBS debug payload and per-bid status (`bidstatus`) also included
 
@@ -553,9 +554,36 @@ EC identity is maintained with the `ts-ec` cookie; auction responses do not emit
 
 ## Creative Processing
 
-Winning creatives are processed through a streaming HTML rewriter (`lol_html`) before being returned. This rewrites external resource URLs to first-party proxy paths, maintaining privacy and enabling security controls.
+Winning creatives returned by `POST /auction` are always passed through the
+server-side sanitizer. By default, the sanitized HTML is then processed by an
+HTML rewriter (`lol_html`) that converts eligible external resource and click
+URLs to signed first-party paths, adds `data-tsclick`, rewrites inline CSS
+`url(...)` values, and injects the unified creative TSJS runtime when a `<body>`
+exists.
 
-**Elements rewritten:**
+```toml
+[auction]
+rewrite_creatives = true
+```
+
+| Setting           | Winning-bid `adm` behavior                                                                                                                                          |
+| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Omitted or `true` | Sanitize, rewrite eligible URLs, add click-guard attributes, and inject creative TSJS.                                                                              |
+| `false`           | Sanitize, then return sanitized but unre-written HTML. Accepted asset and click URLs remain direct, so the browser may contact third-party hosts without mediation. |
+
+Disabling rewriting does not disable or reverse sanitization. Scripts,
+stylesheets, style blocks, forms, event handlers, dangerous URL schemes, and
+other rejected content remain removed. It also removes the injected creative
+runtime and first-party proxy/click mediation from the resulting `adm`.
+Sanitizer-accepted hosts are not allowlisted or trusted merely because their
+URLs remain in the output.
+
+The setting applies only to the shared `POST /auction` response converter.
+HTML/CSS returned by `/first-party/proxy` continues to be rewritten. The
+separate debug-only `[debug].inject_adm_for_testing` publisher and page-bids
+path is unchanged and may include raw `adm` for non-production diagnostics.
+
+**Elements handled by the rewrite pass:**
 
 | Element                          | Attributes                  | Target                         |
 | -------------------------------- | --------------------------- | ------------------------------ |
@@ -568,7 +596,11 @@ Winning creatives are processed through a streaming HTML rewriter (`lol_html`) b
 | `<style>`, `[style]`             | `url()` references          | `/first-party/proxy?tsurl=...` |
 | SVG `<image>`, `<use>`           | `href`, `xlink:href`        | `/first-party/proxy?tsurl=...` |
 
-URLs that are relative, or use `data:`, `javascript:`, `blob:`, or `mailto:` schemes are left unchanged. Domains in the `rewrite.exclude_domains` config list (supports wildcards like `*.cloudflare.com`) are also skipped.
+The rewrite pass leaves relative URLs and non-network schemes unchanged. On the
+auction path, mandatory sanitization runs first and strips dangerous schemes,
+so only sanitizer-accepted values reach this pass. Domains in the
+`rewrite.exclude_domains` config list (supports wildcards like
+`*.cdn.example.com`) are also skipped.
 
 Each proxied URL includes a `tstoken` HMAC signature for tamper protection. See [Proxy Signing](/guide/proxy-signing) for details.
 
@@ -579,6 +611,7 @@ Each proxied URL includes a `tstoken` HMAC signature for tamper protection. See
 ```toml
 [auction]
 enabled = true
+rewrite_creatives = true
 providers = ["prebid", "aps"]
 mediator = "adserver_mock"    # Remove for parallel_only strategy
 timeout_ms = 2000
@@ -608,12 +641,13 @@ price_floor = 0.50
 
 #### `[auction]`
 
-| Field        | Type     | Default | Description                                                     |
-| ------------ | -------- | ------- | --------------------------------------------------------------- |
-| `enabled`    | bool     | `false` | Enable the auction system                                       |
-| `providers`  | string[] | `[]`    | Ordered list of provider names to call                          |
-| `mediator`   | string?  | `null`  | Provider name to use as mediator (enables `parallel_mediation`) |
-| `timeout_ms` | u32      | `2000`  | Overall auction timeout in milliseconds                         |
+| Field               | Type     | Default | Description                                                       |
+| ------------------- | -------- | ------- | ----------------------------------------------------------------- |
+| `enabled`           | bool     | `false` | Enable the auction system                                         |
+| `rewrite_creatives` | bool     | `true`  | Rewrite sanitized winning-bid `adm` through first-party endpoints |
+| `providers`         | string[] | `[]`    | Ordered list of provider names to call                            |
+| `mediator`          | string?  | `null`  | Provider name to use as mediator (enables `parallel_mediation`)   |
+| `timeout_ms`        | u32      | `2000`  | Overall auction timeout in milliseconds                           |
 
 #### `[integrations.prebid]`
 
@@ -669,6 +703,7 @@ All auction configuration can be overridden via environment variables:
 
 ```bash
 TRUSTED_SERVER__AUCTION__ENABLED=true
+TRUSTED_SERVER__AUCTION__REWRITE_CREATIVES=true
 TRUSTED_SERVER__AUCTION__PROVIDERS=prebid,aps
 TRUSTED_SERVER__AUCTION__MEDIATOR=adserver_mock
 TRUSTED_SERVER__AUCTION__TIMEOUT_MS=2000
@@ -703,7 +738,7 @@ The auction system logs at multiple levels throughout execution:
 | Level   | Examples                                                                              |
 | ------- | ------------------------------------------------------------------------------------- |
 | `info`  | Auction request received, provider launch, bid counts, winner selection, total timing |
-| `debug` | Skipped bids (encoded prices), creative rewrite sizes                                 |
+| `debug` | Skipped bids (encoded prices), creative processing mode and byte counts               |
 | `warn`  | Provider launch failures, parse failures, mediator bids without decoded prices        |
 
 ### Response Metadata
diff --git a/docs/guide/configuration.md b/docs/guide/configuration.md
index b975590c6..915f03996 100644
--- a/docs/guide/configuration.md
+++ b/docs/guide/configuration.md
@@ -1191,19 +1191,30 @@ Settings for the auction orchestrator that coordinates multiple bid providers.
 
 ### `[auction]`
 
-| Field            | Type          | Default            | Description                                                 |
-| ---------------- | ------------- | ------------------ | ----------------------------------------------------------- |
-| `enabled`        | Boolean       | `false`            | Enable the auction orchestrator                             |
-| `providers`      | Array[String] | `[]`               | Provider names that participate (e.g., `["prebid", "aps"]`) |
-| `mediator`       | String        | Optional           | Mediator provider name (runs parallel mediation when set)   |
-| `timeout_ms`     | Integer       | `2000`             | Auction timeout in milliseconds                             |
-| `creative_store` | String        | `"creative_store"` | Deprecated; creatives are now delivered inline              |
+| Field               | Type          | Default            | Description                                                       |
+| ------------------- | ------------- | ------------------ | ----------------------------------------------------------------- |
+| `enabled`           | Boolean       | `false`            | Enable the auction orchestrator                                   |
+| `rewrite_creatives` | Boolean       | `true`             | Rewrite sanitized winning-bid `adm` through first-party endpoints |
+| `providers`         | Array[String] | `[]`               | Provider names that participate (e.g., `["prebid", "aps"]`)       |
+| `mediator`          | String        | Optional           | Mediator provider name (runs parallel mediation when set)         |
+| `timeout_ms`        | Integer       | `2000`             | Auction timeout in milliseconds                                   |
+| `creative_store`    | String        | `"creative_store"` | Deprecated; creatives are now delivered inline                    |
+
+Creative markup returned by `POST /auction` is always server-sanitized. With
+`rewrite_creatives = true` (the default), eligible absolute or protocol-relative
+resource and click URLs not excluded by rewrite configuration are converted to
+signed first-party endpoints, and the creative TSJS runtime is injected when a
+`<body>` exists. Setting it to `false` returns sanitized but unre-written `adm`;
+accepted external URLs remain direct and are not host allowlisted by the
+sanitizer. The setting does not affect HTML or CSS fetched through
+`/first-party/proxy`. See [Creative Processing](/guide/creative-processing#auction-rewrite-control).
 
 **Example**:
 
 ```toml
 [auction]
 enabled = true
+rewrite_creatives = true
 providers = ["aps", "prebid"]
 timeout_ms = 2000
 
@@ -1221,6 +1232,7 @@ server_url = "https://prebid-server.example.com/openrtb2/auction"
 
 ```bash
 TRUSTED_SERVER__AUCTION__ENABLED=true
+TRUSTED_SERVER__AUCTION__REWRITE_CREATIVES=true
 TRUSTED_SERVER__AUCTION__PROVIDERS=aps,prebid
 TRUSTED_SERVER__AUCTION__PROVIDERS__0=aps
 TRUSTED_SERVER__AUCTION__PROVIDERS__1=prebid
diff --git a/docs/guide/creative-processing.md b/docs/guide/creative-processing.md
index 4280a2789..6df111a2f 100644
--- a/docs/guide/creative-processing.md
+++ b/docs/guide/creative-processing.md
@@ -1,10 +1,10 @@
 # Creative Processing
 
-Learn how Trusted Server automatically rewrites ad creative HTML and CSS to route all resources through first-party domains.
+Learn how Trusted Server rewrites ad creative HTML and CSS to route resources through first-party domains.
 
 ## Overview
 
-Creative processing transforms third-party ad creatives by rewriting URLs to go through your first-party domain. This provides:
+Creative processing has separate auction-response and proxied-response paths. When rewriting is enabled for a path, it transforms third-party ad creatives by rewriting URLs to go through your first-party domain. This provides:
 
 - **Privacy Control** - All resources load through your domain
 - **First-Party Context** - Cookies and storage use your domain
@@ -23,12 +23,12 @@ Creative processing transforms third-party ad creatives by rewriting URLs to go
 └──────────────────────────────────────────────────────┘
                         ↓
 ┌──────────────────────────────────────────────────────┐
-│  Trusted Server Processing                           │
-│  1. Parse HTML with streaming processor              │
-│  2. Detect absolute/protocol-relative URLs           │
-│  3. Generate signed proxy URLs                       │
-│  4. Rewrite in-place                                 │
-│  5. Inject TSJS library                              │
+│  Trusted Server Processing (rewrite-enabled)         │
+│  1. Sanitize first for POST /auction adm             │
+│  2. Parse HTML with streaming processor              │
+│  3. Detect absolute/protocol-relative URLs           │
+│  4. Generate signed proxy URLs                       │
+│  5. Rewrite in-place and inject TSJS                  │
 └──────────────────────────────────────────────────────┘
                         ↓
 ┌──────────────────────────────────────────────────────┐
@@ -41,16 +41,44 @@ Creative processing transforms third-party ad creatives by rewriting URLs to go
 
 ## Processing Triggers
 
-Creative processing is automatically triggered when:
+The creative rewriters are invoked by independent delivery paths:
 
-1. **Content-Type Header**: Response is `text/html` or `text/css`
-2. **Proxy Mode**: Request goes through `/first-party/proxy` (not streaming)
-3. **Integration Response**: Integration returns HTML content
+1. **Auction `adm`**: Winning-bid HTML returned by `POST /auction` is always sanitized, then rewritten by default. This pass is controlled by `[auction].rewrite_creatives`.
+2. **First-party proxy**: Non-streaming `text/html` and `text/css` responses fetched through `/first-party/proxy` are rewritten independently of the auction setting.
+3. **Integration processing**: Publisher HTML integrations use their own registration and configuration controls.
 
 ::: info Streaming Mode
-When `with_streaming()` is enabled in `ProxyRequestConfig`, HTML/CSS processing is **skipped** to preserve origin compression and reduce latency. Use for binary files, large responses, or when rewriting isn't needed.
+When `with_streaming()` is enabled in `ProxyRequestConfig`, proxied HTML/CSS processing is **skipped** to preserve origin compression and reduce latency. This does not change the `POST /auction` sanitizer or rewrite setting.
 :::
 
+## Auction Rewrite Control
+
+Use the default-true auction setting to control only the rewrite pass applied to
+winning-bid `adm` returned by `POST /auction`:
+
+```toml
+[auction]
+rewrite_creatives = true
+```
+
+| Setting           | `POST /auction` winning-bid `adm` behavior                                                                                                                                      |
+| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Omitted or `true` | Sanitize, rewrite eligible resource/CSS and click URLs to signed first-party endpoints, add `data-tsclick`, and inject the unified creative TSJS script when a `<body>` exists. |
+| `false`           | Sanitize, then return the sanitized HTML without rewriting. Sanitizer-accepted external resource, click, and inline CSS URLs remain direct.                                     |
+
+::: warning Sanitization remains mandatory
+Setting `rewrite_creatives = false` returns sanitized but unre-written HTML, not
+byte-for-byte upstream markup. It does not restore scripts, stylesheets, style
+blocks, forms, event handlers, or other content removed by sanitization.
+Sanitizer acceptance is not a host allowlist; ordinary accepted HTTP(S) URLs may
+cause the browser to contact external creative hosts directly.
+:::
+
+This setting does not affect HTML/CSS response rewriting under
+`/first-party/proxy`. It also does not change the separate debug-only
+`[debug].inject_adm_for_testing` publisher and page-bids path, which may include
+raw `adm` for non-production diagnostics.
+
 ## Rewritten Elements
 
 ### Images
diff --git a/trusted-server.example.toml b/trusted-server.example.toml
index 0951b781e..f758d1829 100644
--- a/trusted-server.example.toml
+++ b/trusted-server.example.toml
@@ -111,6 +111,10 @@ rewrite_script = true
 
 [auction]
 enabled = false
+# Defaults to true. Set false to return sanitized but unre-written winning-bid adm,
+# skipping proxy/click URL conversion and creative TSJS injection.
+# Sanitization is always applied and cannot be disabled by this setting.
+rewrite_creatives = true
 providers = []
 timeout_ms = 2000
 allowed_context_keys = []

From 6fcbee0d150ce61e7bd999cc895853d56120cba5 Mon Sep 17 00:00:00 2001
From: Christian <christianpavilonis@outlook.com>
Date: Fri, 17 Jul 2026 10:26:08 -0500
Subject: [PATCH 2/2] Address creative rewriting review feedback

---
 .../tests/config_env_overlay.rs               | 122 ++++++++++++++++++
 .../trusted-server-core/src/auction/README.md |  11 +-
 .../src/auction_config_types.rs               |  40 +++++-
 .../trusted-server-core/src/config_payload.rs |  55 +++++++-
 crates/trusted-server-core/src/creative.rs    |  56 +++++---
 docs/guide/auction-orchestration.md           |  10 +-
 docs/guide/cli.md                             |  10 +-
 docs/guide/configuration.md                   |  43 ++++--
 docs/guide/creative-processing.md             |   2 +-
 trusted-server.example.toml                   |   7 +-
 10 files changed, 310 insertions(+), 46 deletions(-)
 create mode 100644 crates/trusted-server-cli/tests/config_env_overlay.rs

diff --git a/crates/trusted-server-cli/tests/config_env_overlay.rs b/crates/trusted-server-cli/tests/config_env_overlay.rs
new file mode 100644
index 000000000..380ccb6b7
--- /dev/null
+++ b/crates/trusted-server-cli/tests/config_env_overlay.rs
@@ -0,0 +1,122 @@
+//! Regression coverage for typed app-config environment overlays.
+
+use std::fs;
+use std::process::{Command, Output};
+
+use tempfile::TempDir;
+use toml_edit::{DocumentMut, value};
+
+const LEGACY_CONFIG: &str = include_str!(
+    "../../trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml"
+);
+const MANIFEST: &str = r#"
+[app]
+name = "trusted-server"
+
+[adapters.axum.adapter]
+crate = "crates/trusted-server-adapter-axum"
+
+[adapters.axum.commands]
+build = "echo"
+deploy = "echo"
+serve = "echo"
+
+[stores.config]
+ids = ["trusted_server_config"]
+
+[stores.secrets]
+ids = ["trusted_server_secrets"]
+"#;
+const REWRITE_ENV: &str = "TRUSTED_SERVER__AUCTION__REWRITE_CREATIVES";
+
+struct MigratedProject {
+    directory: TempDir,
+    config_path: std::path::PathBuf,
+    manifest_path: std::path::PathBuf,
+}
+
+fn migrated_legacy_project() -> MigratedProject {
+    let directory = tempfile::tempdir().expect("should create temporary config directory");
+    let config_path = directory.path().join("trusted-server.toml");
+    let manifest_path = directory.path().join("edgezero.toml");
+    let mut document = LEGACY_CONFIG
+        .parse::<DocumentMut>()
+        .expect("should parse legacy integration config");
+    document["auction"]["rewrite_creatives"] = value(true);
+    fs::write(&config_path, document.to_string()).expect("should write migrated config");
+    fs::write(&manifest_path, MANIFEST).expect("should write test manifest");
+    MigratedProject {
+        directory,
+        config_path,
+        manifest_path,
+    }
+}
+
+fn validate_with_overlay(project: &MigratedProject, raw_value: &str) -> Output {
+    Command::new(env!("CARGO_BIN_EXE_ts"))
+        .args(["config", "validate", "--manifest"])
+        .arg(&project.manifest_path)
+        .arg("--app-config")
+        .arg(&project.config_path)
+        .env(REWRITE_ENV, raw_value)
+        .output()
+        .expect("should run ts config validate")
+}
+
+#[test]
+fn migrated_legacy_config_applies_rewrite_creatives_environment_override() {
+    let project = migrated_legacy_project();
+    let output = Command::new(env!("CARGO_BIN_EXE_ts"))
+        .args(["config", "push", "--adapter", "axum", "--manifest"])
+        .arg(&project.manifest_path)
+        .arg("--app-config")
+        .arg(&project.config_path)
+        .args(["--yes", "--no-diff"])
+        .env(REWRITE_ENV, "false")
+        .output()
+        .expect("should run ts config push");
+
+    assert!(
+        output.status.success(),
+        "valid boolean overlay should push successfully: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+
+    let local_store_path = project
+        .directory
+        .path()
+        .join(".edgezero/local-config-trusted_server_config.json");
+    let local_store: serde_json::Value = serde_json::from_str(
+        &fs::read_to_string(local_store_path).expect("should read pushed local config"),
+    )
+    .expect("should parse local config store");
+    let envelope_json = local_store
+        .as_object()
+        .and_then(|entries| entries.values().next())
+        .and_then(serde_json::Value::as_str)
+        .expect("should contain a blob envelope");
+    let envelope: serde_json::Value =
+        serde_json::from_str(envelope_json).expect("should parse blob envelope");
+
+    assert_eq!(
+        envelope["data"]["auction"]["rewrite_creatives"],
+        serde_json::Value::Bool(false),
+        "pushed config should contain the environment override"
+    );
+}
+
+#[test]
+fn migrated_legacy_config_rejects_invalid_rewrite_creatives_environment_override() {
+    let project = migrated_legacy_project();
+    let output = validate_with_overlay(&project, "not-a-boolean");
+    let stderr = String::from_utf8_lossy(&output.stderr);
+
+    assert!(
+        !output.status.success(),
+        "invalid boolean overlay should fail validation"
+    );
+    assert!(
+        stderr.contains(REWRITE_ENV) && stderr.contains("boolean"),
+        "error should identify the invalid boolean overlay: {stderr}"
+    );
+}
diff --git a/crates/trusted-server-core/src/auction/README.md b/crates/trusted-server-core/src/auction/README.md
index dcc9e1506..b7b8141d4 100644
--- a/crates/trusted-server-core/src/auction/README.md
+++ b/crates/trusted-server-core/src/auction/README.md
@@ -136,7 +136,8 @@ When a request arrives at the `/auction` endpoint, it goes through the following
 ┌──────────────────────────────────────────────────────────────────────┐
 │  11. Transform to OpenRTB Response (mod.rs:274-322)                  │
 │      - Build seatbid array (one per winning bid)                     │
-│      - Rewrite creative HTML for first-party proxy                   │
+│      - Always sanitize creative HTML                                 │
+│      - Rewrite creative HTML when enabled (default)                  │
 │      - Add orchestrator metadata (timing, strategy, bid count)       │
 └──────────────────────────────────────────────────────────────────────┘
                               │
@@ -248,7 +249,10 @@ The orchestrator collects all bids and creates an OpenRTB response:
 }
 ```
 
-Note that creative HTML is rewritten to use the first-party proxy (`/first-party/proxy`) for privacy and security.
+Creative HTML is always sanitized. By default, it is then rewritten to use the
+first-party proxy (`/first-party/proxy`) and the creative runtime is injected.
+Setting `[auction].rewrite_creatives = false` skips only that rewrite and
+injection pass.
 
 ## Route Registration & Endpoints
 
@@ -379,7 +383,8 @@ The `/auction` endpoint is the primary entry point for auctions:
 **Key Transformations:**
 - `adUnits[].code` → `seatbid[].bid[].impid` (slot identifier)
 - `mediaTypes.banner.sizes` → evaluated by providers, winning size in `bid.w` and `bid.h`
-- Creative HTML is rewritten to use `/first-party/proxy` URLs
+- Creative HTML is always sanitized, then rewritten to use `/first-party/proxy` URLs by default
+- `[auction].rewrite_creatives = false` skips rewriting and creative runtime injection, not sanitization
 - Multiple bids per slot become separate `seatbid` entries
 - Orchestrator metadata added in `ext.orchestrator`
 
diff --git a/crates/trusted-server-core/src/auction_config_types.rs b/crates/trusted-server-core/src/auction_config_types.rs
index f1d1a5cf0..eb93adbd1 100644
--- a/crates/trusted-server-core/src/auction_config_types.rs
+++ b/crates/trusted-server-core/src/auction_config_types.rs
@@ -12,7 +12,10 @@ pub struct AuctionConfig {
     pub enabled: bool,
 
     /// Rewrite sanitized winning-bid creative HTML to first-party endpoints.
-    #[serde(default = "default_rewrite_creatives")]
+    #[serde(
+        default = "default_rewrite_creatives",
+        skip_serializing_if = "is_default_rewrite_creatives"
+    )]
     pub rewrite_creatives: bool,
 
     /// Provider names that participate in bidding
@@ -63,6 +66,10 @@ fn default_rewrite_creatives() -> bool {
     true
 }
 
+fn is_default_rewrite_creatives(value: &bool) -> bool {
+    *value == default_rewrite_creatives()
+}
+
 fn default_creative_store() -> String {
     "creative_store".to_owned()
 }
@@ -95,9 +102,38 @@ mod tests {
 
     #[test]
     fn rewrite_creatives_defaults_to_true() {
+        let config: AuctionConfig =
+            serde_json::from_value(serde_json::json!({})).expect("should deserialize defaults");
+
         assert!(
-            AuctionConfig::default().rewrite_creatives,
+            config.rewrite_creatives,
             "should enable creative rewriting by default"
         );
     }
+
+    #[test]
+    fn default_rewrite_creatives_is_not_serialized() {
+        let serialized =
+            serde_json::to_value(AuctionConfig::default()).expect("should serialize defaults");
+
+        assert!(
+            serialized.get("rewrite_creatives").is_none(),
+            "should omit the default rewrite setting"
+        );
+    }
+
+    #[test]
+    fn disabled_rewrite_creatives_is_serialized() {
+        let config = AuctionConfig {
+            rewrite_creatives: false,
+            ..AuctionConfig::default()
+        };
+        let serialized = serde_json::to_value(config).expect("should serialize disabled rewriting");
+
+        assert_eq!(
+            serialized.get("rewrite_creatives"),
+            Some(&serde_json::Value::Bool(false)),
+            "should preserve an explicit rewrite opt-out"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/config_payload.rs b/crates/trusted-server-core/src/config_payload.rs
index 58c185381..f7ae531ea 100644
--- a/crates/trusted-server-core/src/config_payload.rs
+++ b/crates/trusted-server-core/src/config_payload.rs
@@ -46,6 +46,24 @@ mod tests {
     use super::*;
     use crate::redacted::Redacted;
     use crate::test_support::tests::crate_test_settings_str;
+    use serde::Deserialize;
+
+    #[derive(Deserialize)]
+    #[serde(deny_unknown_fields)]
+    struct LegacyAuctionConfig {
+        #[serde(rename = "enabled")]
+        _enabled: bool,
+        #[serde(rename = "providers")]
+        _providers: Vec<String>,
+        #[serde(rename = "mediator")]
+        _mediator: Option<String>,
+        #[serde(rename = "timeout_ms")]
+        _timeout_ms: u32,
+        #[serde(rename = "creative_store")]
+        _creative_store: String,
+        #[serde(rename = "allowed_context_keys")]
+        _allowed_context_keys: std::collections::HashSet<String>,
+    }
 
     fn test_settings() -> Settings {
         Settings::from_toml(&crate_test_settings_str()).expect("should parse test settings")
@@ -80,15 +98,15 @@ mod tests {
 
     #[test]
     fn legacy_blob_without_rewrite_creatives_preserves_rewriting() {
-        let mut data =
+        let data =
             serde_json::to_value(test_settings()).expect("should serialize settings to JSON");
         let auction = data
-            .get_mut("auction")
-            .and_then(serde_json::Value::as_object_mut)
+            .get("auction")
+            .and_then(serde_json::Value::as_object)
             .expect("should serialize auction settings as an object");
         assert!(
-            auction.remove("rewrite_creatives").is_some(),
-            "should remove the newly serialized setting"
+            !auction.contains_key("rewrite_creatives"),
+            "should omit the default rewrite setting from the payload"
         );
         let envelope = BlobEnvelope::new(data, "2026-01-01T00:00:00Z".to_string());
         let envelope_json = serde_json::to_string(&envelope).expect("should serialize envelope");
@@ -102,6 +120,33 @@ mod tests {
         );
     }
 
+    #[test]
+    fn default_auction_payload_is_accepted_by_legacy_schema() {
+        let data =
+            serde_json::to_value(test_settings()).expect("should serialize settings to JSON");
+        let auction = data
+            .get("auction")
+            .cloned()
+            .expect("should serialize auction settings");
+
+        serde_json::from_value::<LegacyAuctionConfig>(auction)
+            .expect("should deserialize the default payload with the legacy schema");
+    }
+
+    #[test]
+    fn disabled_rewrite_creatives_survives_blob_round_trip() {
+        let mut original = test_settings();
+        original.auction.rewrite_creatives = false;
+
+        let reconstructed = settings_from_config_blob(&envelope_json(&original))
+            .expect("should reconstruct disabled rewriting");
+
+        assert!(
+            !reconstructed.auction.rewrite_creatives,
+            "should preserve the explicit rewrite opt-out"
+        );
+    }
+
     #[test]
     fn strings_that_look_like_json_scalars_round_trip_as_strings() {
         let mut original = test_settings();
diff --git a/crates/trusted-server-core/src/creative.rs b/crates/trusted-server-core/src/creative.rs
index 63a6d93c9..584e53f8d 100644
--- a/crates/trusted-server-core/src/creative.rs
+++ b/crates/trusted-server-core/src/creative.rs
@@ -56,30 +56,21 @@ pub(super) fn to_abs(settings: &Settings, u: &str) -> Option<String> {
         return None;
     }
 
-    // Skip if excluded from rewrites in settings
-    if settings.rewrite.is_excluded(t) {
+    let lower = t.to_ascii_lowercase();
+    let absolute = if t.starts_with("//") {
+        format!("https:{t}")
+    } else if lower.starts_with("http://") || lower.starts_with("https://") {
+        t.to_owned()
+    } else {
         return None;
-    }
+    };
 
-    // Skip non-network schemes commonly found in creatives
-    let lower = t.to_ascii_lowercase();
-    if lower.starts_with("data:")
-        || lower.starts_with("javascript:")
-        || lower.starts_with("mailto:")
-        || lower.starts_with("tel:")
-        || lower.starts_with("blob:")
-        || lower.starts_with("about:")
-    {
+    // Match exclusions against the same absolute URL used for rewriting.
+    if settings.rewrite.is_excluded(&absolute) {
         return None;
     }
 
-    if t.starts_with("//") {
-        Some(format!("https:{t}"))
-    } else if lower.starts_with("http://") || lower.starts_with("https://") {
-        Some(t.to_owned())
-    } else {
-        None
-    }
+    Some(absolute)
 }
 
 // Helper: rewrite url(...) occurrences inside a CSS style string to first-party proxy.
@@ -1323,11 +1314,22 @@ mod tests {
             None
         );
 
+        assert_eq!(
+            to_abs(&settings, "//trusted-cdn.example.com/lib.js"),
+            None,
+            "should exclude a protocol-relative URL by exact domain"
+        );
+
         // Non-excluded domain should return Some
         assert_eq!(
             to_abs(&settings, "https://other-cdn.example.com/lib.js"),
             Some("https://other-cdn.example.com/lib.js".to_owned())
         );
+        assert_eq!(
+            to_abs(&settings, "//other-cdn.example.com/lib.js"),
+            Some("https://other-cdn.example.com/lib.js".to_owned()),
+            "should normalize a non-excluded protocol-relative URL"
+        );
     }
 
     #[test]
@@ -1343,6 +1345,16 @@ mod tests {
             to_abs(&settings, "https://cdnjs.cloudflare.com/lib.js"),
             None
         );
+        assert_eq!(
+            to_abs(&settings, "//cloudflare.com/cdn.js"),
+            None,
+            "should exclude a protocol-relative wildcard base domain"
+        );
+        assert_eq!(
+            to_abs(&settings, "//cdnjs.cloudflare.com/lib.js"),
+            None,
+            "should exclude a protocol-relative wildcard subdomain"
+        );
 
         // Should not exclude different domain
         assert_eq!(
@@ -1358,6 +1370,7 @@ mod tests {
 
         let html = r#"
             <img src="https://trusted-cdn.example.com/logo.png">
+            <img src="//trusted-cdn.example.com/protocol-relative.png">
             <img src="https://other-cdn.example.com/banner.jpg">
         "#;
 
@@ -1366,6 +1379,11 @@ mod tests {
         // Excluded domain should NOT be rewritten
         assert!(out.contains(r#"src="https://trusted-cdn.example.com/logo.png"#));
 
+        assert!(
+            out.contains(r#"src="//trusted-cdn.example.com/protocol-relative.png""#),
+            "excluded protocol-relative URL should remain direct: {out}"
+        );
+
         // Non-excluded domain SHOULD be rewritten
         assert!(out.contains("/first-party/proxy?tsurl="));
         assert!(out.contains("other-cdn.example.com"));
diff --git a/docs/guide/auction-orchestration.md b/docs/guide/auction-orchestration.md
index c6c82dac3..4b9a74340 100644
--- a/docs/guide/auction-orchestration.md
+++ b/docs/guide/auction-orchestration.md
@@ -699,7 +699,10 @@ timeout_ms = 500               # Mediator budget (called after providers)
 
 ### Environment Variable Overrides
 
-All auction configuration can be overridden via environment variables:
+The typed `ts config validate`, `ts config diff`, and `ts config push` flows can
+override auction values that already exist in the TOML. EdgeZero v0.0.4 does
+not create missing leaves, so existing configs must add
+`rewrite_creatives = true` before relying on its environment override.
 
 ```bash
 TRUSTED_SERVER__AUCTION__ENABLED=true
@@ -711,6 +714,11 @@ TRUSTED_SERVER__INTEGRATIONS__PREBID__SERVER_URL=https://pbs.example.com
 TRUSTED_SERVER__INTEGRATIONS__APS__PUB_ID=5128
 ```
 
+Before rolling back to a binary without `rewrite_creatives`, restore the value
+to `true`, push the default-compatible blob, and then roll back. See
+[Configuration](/guide/configuration#auction-configuration) for the complete
+migration and rollback sequence.
+
 ## Floor Prices
 
 Floor prices can be set per-slot in the auction request. The orchestrator enforces floors after winner selection:
diff --git a/docs/guide/cli.md b/docs/guide/cli.md
index 43053209a..b6829895e 100644
--- a/docs/guide/cli.md
+++ b/docs/guide/cli.md
@@ -63,9 +63,13 @@ Push Trusted Server config through EdgeZero:
 ts config push --adapter fastly
 ```
 
-`config validate` and `config push` use EdgeZero's typed app-config loader. By
-default that loader applies `TRUSTED_SERVER__...` environment overlays before
-validation and blob creation. Pass `--no-env` for file-only operation.
+`config validate`, `config diff`, and `config push` use EdgeZero's typed
+app-config loader. By default that loader applies `TRUSTED_SERVER__...`
+environment overlays before validation, comparison, and blob creation. EdgeZero
+v0.0.4 only overrides leaves already present in the TOML; add newly introduced
+fields to existing configs before relying on their overrides. Pass `--no-env`
+for file-only operation. See [Configuration](/guide/configuration#environment-variable-overrides-typed-cli)
+for migration and rollback guidance.
 
 `config push` publishes a single EdgeZero `BlobEnvelope` containing the validated
 Trusted Server settings JSON. This blob model is intentional because full
diff --git a/docs/guide/configuration.md b/docs/guide/configuration.md
index 915f03996..b7b32216a 100644
--- a/docs/guide/configuration.md
+++ b/docs/guide/configuration.md
@@ -7,7 +7,7 @@ Learn how to configure Trusted Server for your deployment.
 Trusted Server uses a flexible configuration system based on:
 
 1. **TOML Files** - `trusted-server.toml` for base configuration
-2. **Environment Variables** - Build-time overrides with `TRUSTED_SERVER__` prefix (baked into the binary by `build.rs`)
+2. **Environment Variables** - Typed CLI overrides with the `TRUSTED_SERVER__` prefix
 3. **Fastly Stores** - KV/Config/Secret stores for runtime data
 
 ## Quick Start
@@ -29,15 +29,18 @@ passphrase = "replace-with-32-plus-byte-random-secret"
 
 ### Environment Variable Overrides
 
-Override any setting at build time. Environment variables are merged into the
-config by `build.rs` and baked into the compiled binary — they are **not** read
-at runtime.
+Environment variables are merged into existing TOML values by the typed
+`ts config validate`, `ts config diff`, and `ts config push` flows. They are not
+read by the deployed application at request time.
 
 ```bash
 # Format: TRUSTED_SERVER__SECTION__FIELD
 export TRUSTED_SERVER__PUBLISHER__DOMAIN=publisher.com
 export TRUSTED_SERVER__PUBLISHER__ORIGIN_URL=https://origin.publisher.com
 export TRUSTED_SERVER__EC__PASSPHRASE=replace-with-32-plus-byte-random-secret
+
+ts config validate
+ts config push --adapter fastly
 ```
 
 ### Generate Secure Secrets
@@ -103,11 +106,18 @@ client_side_bidders = ["rubicon"]
 
 The sections below consolidate the full configuration reference on this page.
 
-## Environment Variable Overrides (Build-Time)
+## Environment Variable Overrides (Typed CLI)
 
 Environment variables with the `TRUSTED_SERVER__` prefix are merged into the
-base TOML configuration by `build.rs` at compile time. The resulting config is
-embedded in the binary. Changing an environment variable requires a rebuild.
+base TOML configuration by `ts config validate`, `ts config diff`, and
+`ts config push`. The resolved values are validated and, for `config push`,
+stored in the app-config blob. Changing an environment variable requires
+rerunning validation and pushing the resolved config, not rebuilding the binary.
+
+EdgeZero v0.0.4 only overrides leaves that already exist in the parsed TOML; it
+does not create missing fields. Add newly introduced defaulted fields to an
+existing config before relying on their environment overrides. Pass `--no-env`
+to use file values without the overlay.
 
 ### Format
 
@@ -1209,6 +1219,19 @@ accepted external URLs remain direct and are not host allowlisted by the
 sanitizer. The setting does not affect HTML or CSS fetched through
 `/first-party/proxy`. See [Creative Processing](/guide/creative-processing#auction-rewrite-control).
 
+::: warning Existing configs and rollback
+Configs created before `rewrite_creatives` was introduced must first add
+`rewrite_creatives = true` under `[auction]`. After adding the leaf, set
+`TRUSTED_SERVER__AUCTION__REWRITE_CREATIVES`, run `ts config validate`, and push
+the resolved config.
+
+The default `true` is omitted from stored JSON so older binaries can read the
+blob during rollback. An explicit `false` must remain serialized. Before rolling
+back to a binary without this field, remove the `false` environment override (or
+set the file value to `true`), push the resulting default-compatible blob, and
+only then roll back the binary.
+:::
+
 **Example**:
 
 ```toml
@@ -1416,10 +1439,12 @@ trusted-server.dev.toml      # Development overrides
 
 **Environment Variables Not Applied**:
 
-- Env vars are applied at **build time** only — rebuild after changing them
+- Run the override through `ts config validate`, `ts config diff`, or `ts config push`
+- Verify the target leaf already exists in `trusted-server.toml`; EdgeZero v0.0.4 does not create missing fields
 - Verify prefix: `TRUSTED_SERVER__`
 - Check separator: `__` (double underscore)
-- Confirm variable is exported: `echo $VARIABLE_NAME`
+- Confirm the variable is exported: `echo $VARIABLE_NAME`
+- Rerun `ts config push` after changing a deploy-time override
 - Try explicit string: `VARIABLE='value'` not `VARIABLE=value`
 
 ### Debug Configuration
diff --git a/docs/guide/creative-processing.md b/docs/guide/creative-processing.md
index 6df111a2f..4f40fbfa6 100644
--- a/docs/guide/creative-processing.md
+++ b/docs/guide/creative-processing.md
@@ -6,7 +6,7 @@ Learn how Trusted Server rewrites ad creative HTML and CSS to route resources th
 
 Creative processing has separate auction-response and proxied-response paths. When rewriting is enabled for a path, it transforms third-party ad creatives by rewriting URLs to go through your first-party domain. This provides:
 
-- **Privacy Control** - All resources load through your domain
+- **Privacy Control** - Eligible, non-excluded external resources load through your domain
 - **First-Party Context** - Cookies and storage use your domain
 - **EC ID Integration** - Automatic ID forwarding to trackers
 - **Security** - Validated, signed URLs prevent tampering
diff --git a/trusted-server.example.toml b/trusted-server.example.toml
index f758d1829..06963bedb 100644
--- a/trusted-server.example.toml
+++ b/trusted-server.example.toml
@@ -111,9 +111,10 @@ rewrite_script = true
 
 [auction]
 enabled = false
-# Defaults to true. Set false to return sanitized but unre-written winning-bid adm,
-# skipping proxy/click URL conversion and creative TSJS injection.
-# Sanitization is always applied and cannot be disabled by this setting.
+# Defaults to true. Keep this leaf present when using the EdgeZero v0.0.4
+# environment override. Set false to return sanitized but unre-written winning-bid
+# adm, skipping proxy/click URL conversion and creative TSJS injection.
+# Sanitization is always applied. Restore and push true before an older-binary rollback.
 rewrite_creatives = true
 providers = []
 timeout_ms = 2000