As publisher I want to host GPT script in publisher domain

[aram356]

Only proxy initial script

[ChristianPavilonis]

current pr proxies a few scripts because gpt.js loads additional scripts that do much of the heavy lifting.

GPT (Google Publisher Tags) uses a cascaded loading pattern:

1. gpt.js — thin bootstrap loader (~small)
2. pubads_impl.js — main implementation (~640 KB), loaded by gpt.js
3. pubads_impl_*.js — lazy sub-modules, loaded by pubads_impl.js
4. Auxiliary scripts — viewability, monitoring, etc.
   All of these are served from securepubads.g.doubleclick.net, and the critical detail is how gpt.js loads the next script in the cascade: it uses document.write() to synchronously inject a <script> tag directly into the HTML parser stream:
   // What gpt.js does internally:
   document.write('<script src="https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/.../pubads_impl.js"></script>');
   The Proxying Challenge
   The server-side proxy handles two things:
5. HTML attribute rewriting — rewrites the initial <script src="securepubads.g.doubleclick.net/tag/js/gpt.js"> in the publisher's HTML to <script src="publisher.com/integrations/gpt/script">
6. Script proxy endpoints — /integrations/gpt/script, /integrations/gpt/pagead/, /integrations/gpt/tag/ fetch from Google and serve the script bodies verbatim
   The problem: since the scripts are served verbatim (no content modification), gpt.js still has hardcoded references to securepubads.g.doubleclick.net inside the JavaScript code. When it executes, it calls document.write() with a URL pointing at Google's domain, which bypasses the proxy entirely.
   The Solution: Client-Side Script Guard
   Because server-side URL rewriting inside script bodies would be fragile (minified/obfuscated code, dynamic URL construction, frequent changes), the PR instead installs a client-side shim that monkey-patches six browser APIs to intercept every possible way GPT can set or insert a script URL:

Layer	Target	What GPT does
1	document.write / writeln	Primary path — gpt.js synchronously injects pubads_impl.js
2	HTMLScriptElement.prototype.src setter	Async fallback — script.src = url
3	setAttribute('src', ...)	Another way to set src
4	document.createElement('script')	Tags new scripts with instance-level descriptors
5	appendChild / insertBefore	Catches scripts at DOM insertion time
6	MutationObserver	Catches innerHTML, .append(), attribute mutations

All of these do the same thing — check if the URL hostname is securepubads.g.doubleclick.net and if so, swap the host to publisher.com/integrations/gpt/... preserving the path and query.