fix: resolve GPT shim auto-init race by using explicit activation

The server-injected inline script now calls __tsjs_installGptShim()
directly instead of relying on a module-scope auto-init check that
raced against the enable flag. This ensures the shim installs
regardless of script injection order.

Also fixes the vacuous disabled-gating test that reset state before
asserting, making it always pass.

Author: ChristianPavilonis

crates/common/src/integrations/gpt.rs

@@ -426,7 +426,14 @@ impl IntegrationHeadInjector for GptIntegration {
     }
 
     fn head_inserts(&self, _ctx: &IntegrationHtmlContext<'_>) -> Vec<String> {
-        vec!["<script>window.__tsjs_gpt_enabled=true;</script>".to_string()]
+        // Set the enable flag and explicitly call the activation function
+        // registered by the GPT shim module. The unified bundle's <script> tag
+        // is emitted before this inline script, so `__tsjs_installGptShim` is
+        // guaranteed to exist when this executes.
+        vec![
+            "<script>window.__tsjs_gpt_enabled=true;window.__tsjs_installGptShim&&window.__tsjs_installGptShim();</script>"
+                .to_string(),
+        ]
     }
 }
 
@@ -905,8 +912,9 @@ mod tests {
 
         assert_eq!(inserts.len(), 1, "should emit exactly one head insert");
         assert_eq!(
-            inserts[0], "<script>window.__tsjs_gpt_enabled=true;</script>",
-            "should set __tsjs_gpt_enabled flag for the client-side GPT shim"
+            inserts[0],
+            "<script>window.__tsjs_gpt_enabled=true;window.__tsjs_installGptShim&&window.__tsjs_installGptShim();</script>",
+            "should set the enable flag and call the GPT shim activation function"
         );
     }
 

crates/js/lib/src/integrations/gpt/index.ts

@@ -161,10 +161,14 @@ export function installGptShim(): boolean {
   return true;
 }
 
-// Self-initialise on import when the server-side GPT integration is enabled.
-// The trusted server injects `window.__tsjs_gpt_enabled = true` via an inline
-// script (IntegrationHeadInjector) so the shim stays dormant when the GPT proxy
-// routes are not registered.
-if (typeof window !== 'undefined' && (window as Record<string, unknown>).__tsjs_gpt_enabled) {
-  installGptShim();
+// Register the activation function on `window` so the server-injected inline
+// script can call it explicitly. The server emits:
+//   <script>window.__tsjs_gpt_enabled=true;
+//          window.__tsjs_installGptShim&&window.__tsjs_installGptShim();</script>
+// Because that inline <script> runs *after* the unified bundle has evaluated,
+// the function is guaranteed to be available by the time the inline script
+// executes. This avoids a race where the module-scope auto-init would check
+// `__tsjs_gpt_enabled` before the flag is set.
+if (typeof window !== 'undefined') {
+  (window as Record<string, unknown>).__tsjs_installGptShim = installGptShim;
 }

crates/js/lib/test/integrations/gpt/index.test.ts

@@ -180,31 +180,39 @@ describe('GPT shim – runtime gating', () => {
     resetGuardState();
     delete (window as GatedWindow).googletag;
     delete (window as GatedWindow).__tsjs_gpt_enabled;
+    delete (window as Record<string, unknown>).__tsjs_installGptShim;
   });
 
-  it('installs the shim when __tsjs_gpt_enabled is set', async () => {
-    win.__tsjs_gpt_enabled = true;
-
+  it('installs the shim when activation function is called (simulates server inline script)', async () => {
     const { installGptShim } = await import('../../../src/integrations/gpt/index');
 
-    // Explicitly call since the dynamic import may have already cached.
+    // Simulate what the server-injected inline script does:
+    // set the flag then call the activation function.
+    win.__tsjs_gpt_enabled = true;
     installGptShim();
 
     expect(isGuardInstalled()).toBe(true);
     expect(win.googletag).toBeDefined();
   });
 
-  it('does not install the shim when __tsjs_gpt_enabled is absent', async () => {
-    // No flag set — shim should stay dormant.
+  it('registers __tsjs_installGptShim on window after import', async () => {
+    vi.resetModules();
     await import('../../../src/integrations/gpt/index');
 
-    // Reset guard to verify the auto-init did NOT install.
-    resetGuardState();
-    delete win.googletag;
+    expect(typeof (window as Record<string, unknown>).__tsjs_installGptShim).toBe('function');
+  });
+
+  it('does not install the shim when only imported (no explicit activation)', async () => {
+    // Reset modules so the next dynamic import re-evaluates the module.
+    vi.resetModules();
+
+    // Import a fresh copy — the module should register the activation
+    // function on `window` but NOT call `installGptShim()` on its own.
+    await import('../../../src/integrations/gpt/index');
 
-    // Manually verify: calling installGptShim without the flag should still
-    // work (it's a direct call), but the *auto-init path* would not have run.
-    // The key assertion is that the guard is not installed after reset.
+    // Assert immediately — the guard must not be installed because the
+    // module only registers `__tsjs_installGptShim`, it does not auto-init.
     expect(isGuardInstalled()).toBe(false);
+    expect(win.googletag).toBeUndefined();
   });
 });