From ece42a022d904ed965f291a252d2c36c7e42ab25 Mon Sep 17 00:00:00 2001
From: Christian <christianpavilonis@outlook.com>
Date: Wed, 15 Jul 2026 21:10:41 -0500
Subject: [PATCH 1/9] Add first-class APS OpenRTB integration

---
 CHANGELOG.md                                  |    2 +
 TESTING.md                                    |    5 +-
 .../trusted-server-core/src/auction/README.md |   51 +-
 .../src/auction/formats.rs                    |  185 +-
 .../src/auction/orchestrator.rs               |  179 +-
 .../src/auction/telemetry.rs                  |    3 +
 .../trusted-server-core/src/auction/types.rs  |  138 +-
 .../src/creative_opportunities.rs             |   31 +-
 .../src/integrations/adserver_mock.rs         |  202 +-
 .../src/integrations/aps.rs                   | 2280 ++++-----
 .../src/integrations/mod.rs                   |    4 +
 .../src/integrations/prebid.rs                |   60 +-
 crates/trusted-server-core/src/openrtb.rs     |   14 +-
 crates/trusted-server-core/src/publisher.rs   | 4301 ++---------------
 .../README.md                                 |    1 +
 .../browser/tests/shared/aps-renderer.spec.ts |  614 +++
 .../configs/trusted-server.integration.toml   |    7 +-
 .../trusted-server-js/lib/src/core/auction.ts |   99 +-
 .../trusted-server-js/lib/src/core/request.ts |   10 +-
 .../trusted-server-js/lib/src/core/types.ts   |   42 +-
 .../lib/src/integrations/aps/render.ts        |  301 ++
 .../lib/src/integrations/gpt/index.ts         |   47 +-
 .../lib/test/core/auction.test.ts             |   94 +
 .../lib/test/core/request.test.ts             |  102 +
 .../lib/test/fixtures/aps-renderer-v1.json    |   18 +
 .../lib/test/integrations/aps/render.test.ts  |  295 ++
 .../lib/test/integrations/gpt/ad_init.test.ts |  189 +-
 docs/guide/auction-orchestration.md           |  150 +-
 docs/guide/configuration.md                   |    5 +-
 docs/guide/integrations/aps.md                |  454 +-
 docs/roadmap.md                               |   12 +-
 ...-15-aps-openrtb-first-class-integration.md |  897 ++++
 ...03-19-auction-orchestration-flow-design.md |    6 +
 ...-openrtb-first-class-integration-design.md |  839 ++++
 trusted-server.example.toml                   |    6 +-
 35 files changed, 5978 insertions(+), 5665 deletions(-)
 create mode 100644 crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts
 create mode 100644 crates/trusted-server-js/lib/src/integrations/aps/render.ts
 create mode 100644 crates/trusted-server-js/lib/test/fixtures/aps-renderer-v1.json
 create mode 100644 crates/trusted-server-js/lib/test/integrations/aps/render.test.ts
 create mode 100644 docs/superpowers/plans/2026-07-15-aps-openrtb-first-class-integration.md
 create mode 100644 docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5bc49c80b..28a4e4806 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- **Breaking** — Replaced the legacy APS contextual integration with APS OpenRTB at `/e/pb/bid`. APS configuration now uses canonical `account_id` (`pub_id` remains a compatibility alias), no longer requires APS-specific slot IDs, and defaults script creative eligibility off. Operators must update the endpoint, disable native APS demand for Trusted Server cohorts, and prepare GAM/Universal Creative targeting for `hb_bidder=aps` before rollout.
 - **Breaking** — `bid_param_zone_overrides` inner values must now be JSON objects; previously non-object or empty values (`"header" = "x"`, `"header" = {}`) were accepted and silently produced a dead rule at runtime. They now fail at startup with a configuration error. Operators upgrading should audit their `bid_param_zone_overrides` config for non-object zone entries.
 - **Breaking** — Sourcepoint browser module inclusion now requires explicit `[integrations.sourcepoint].enabled = true`; operators relying on the previous unconditional Sourcepoint module should enable the integration before upgrading.
 
@@ -18,6 +19,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Added typed APS renderer transport for direct auctions and GAM/Prebid Universal Creative, using a minimized one-bid envelope, a fragment-bound nonce, and an opaque sandboxed renderer endpoint.
 - Added Osano consent mirror integration docs and public enablement guidance.
 - Implemented basic authentication for configurable endpoint paths (#73)
 - Added integrations guide with example `testlight` integration
diff --git a/TESTING.md b/TESTING.md
index e1ac1c3a2..c4a8c43ea 100644
--- a/TESTING.md
+++ b/TESTING.md
@@ -131,8 +131,9 @@ INFO: Running 2 bidders in parallel
 INFO: Requesting bids from: prebid
 INFO: Prebid returned 2 bids (time: 120ms)
 INFO: Requesting bids from: aps
-INFO: APS (MOCK): returning 2 bids in 80ms
-INFO: GAM mediation: slot 'header-banner' won by 'amazon-aps' at $2.50 CPM
+INFO: APS requests bids for 2 impressions
+INFO: APS returns 2 accepted bids in 80ms
+INFO: GAM mediation: slot 'header-banner' won by 'aps' at $2.50 CPM
 ```
 
 ### Verify Provider Registration
diff --git a/crates/trusted-server-core/src/auction/README.md b/crates/trusted-server-core/src/auction/README.md
index dcc9e1506..fad3cb4d5 100644
--- a/crates/trusted-server-core/src/auction/README.md
+++ b/crates/trusted-server-core/src/auction/README.md
@@ -117,7 +117,7 @@ When a request arrives at the `/auction` endpoint, it goes through the following
                               ▼
 ┌──────────────────────────────────────────────────────────────────────┐
 │  9. Each Provider Processes Request                                  │
-│     - Transform AuctionRequest → Provider format (e.g., APS TAM)     │
+│     - Transform AuctionRequest → Provider OpenRTB request           │
 │     - Send HTTP request to provider endpoint                         │
 │     - Parse provider response                                        │
 │     - Transform → AuctionResponse with Bid[]                         │
@@ -188,30 +188,21 @@ AdSlot {
 
 #### 3. Provider Execution
 Each registered provider (APS, Prebid, etc.) receives the `AuctionRequest` and:
-- Transforms it to their specific format (e.g., APS TAM, OpenRTB)
+- Transforms it to the provider's OpenRTB request format
 - Makes HTTP request to their endpoint
 - Parses the response
 - Returns `AuctionResponse` with `Bid[]`
 
 For example, APS provider:
 ```rust
-// Transform AuctionRequest → ApsBidRequest
-let aps_request = ApsBidRequest {
-    pub_id: "5128",
-    slots: vec![
-        ApsSlot {
-            slot_id: "header-banner",
-            sizes: vec![[728, 90], [970, 250]],
-            slot_name: Some("header-banner"),
-        }
-    ],
-    page_url: Some("https://example.com"),
-    ua: Some("Mozilla/5.0..."),
-    timeout: Some(800),
-};
-
-// HTTP POST to http://localhost:6767/e/dtb/bid
-// Parse response → AuctionResponse
+// Transform AuctionRequest → APS OpenRTB request
+// - ext.account = configured account_id
+// - ext.sdk = { source: "prebid", version: "2.2.0" }
+// - banner slots become secure impressions with matching formats/floors
+// - existing consent, identity, device, and geo privacy gates apply
+
+// HTTP POST to https://web.ads.aps.amazon-adsystem.com/e/pb/bid
+// Parse decoded-price response → AuctionResponse with a typed renderer
 ```
 
 #### 4. Response Assembly
@@ -222,17 +213,29 @@ The orchestrator collects all bids and creates an OpenRTB response:
   "id": "auction-response",
   "seatbid": [
     {
-      "seat": "amazon-aps",
+      "seat": "aps",
       "bid": [
         {
-          "id": "amazon-aps-header-banner",
+          "id": "fictional-selected-bid-id",
           "impid": "header-banner",
           "price": 2.5,
-          "adm": "<iframe src=\"/first-party/proxy?tsurl=...\">",
           "w": 728,
           "h": 90,
-          "crid": "amazon-aps-creative",
-          "adomain": ["amazon.com"]
+          "ext": {
+            "trusted_server": {
+              "renderer": {
+                "type": "aps",
+                "version": 1,
+                "accountId": "example-account",
+                "bidId": "fictional-selected-bid-id",
+                "tagType": "iframe",
+                "creativeUrl": "https://creative.example/render",
+                "aaxResponse": "<base64 minimized one-bid envelope>",
+                "width": 728,
+                "height": 90
+              }
+            }
+          }
         }
       ]
     }
diff --git a/crates/trusted-server-core/src/auction/formats.rs b/crates/trusted-server-core/src/auction/formats.rs
index 441828a18..63f777a19 100644
--- a/crates/trusted-server-core/src/auction/formats.rs
+++ b/crates/trusted-server-core/src/auction/formats.rs
@@ -10,6 +10,7 @@ use http::{HeaderValue, Request, Response, StatusCode, header};
 use serde::Deserialize;
 use serde_json::Value as JsonValue;
 use std::collections::HashMap;
+use url::Url;
 use uuid::Uuid;
 
 use crate::auction::context::ContextValue;
@@ -19,7 +20,10 @@ use crate::creative;
 use crate::ec::eids::encode_eids_header;
 use crate::error::TrustedServerError;
 use crate::geo::GeoInfo;
-use crate::openrtb::{OpenRtbBid, OpenRtbResponse, ResponseExt, SeatBid, ToExt, to_openrtb_i32};
+use crate::openrtb::{
+    BidExt, BidTrustedServerExt, OpenRtbBid, OpenRtbResponse, ResponseExt, SeatBid, ToExt,
+    to_openrtb_i32,
+};
 use crate::platform::RuntimeServices;
 use crate::settings::Settings;
 
@@ -84,6 +88,33 @@ pub struct BannerUnit {
     pub sizes: Vec<Vec<u32>>,
 }
 
+const MAX_PUBLISHER_PAGE_URL_BYTES: usize = 8192;
+
+fn publisher_page_url(req: &Request<EdgeBody>, publisher_domain: &str) -> String {
+    let fallback = format!("https://{publisher_domain}");
+    let Some(candidate) = req
+        .headers()
+        .get(header::REFERER)
+        .and_then(|value| value.to_str().ok())
+        .filter(|value| value.len() <= MAX_PUBLISHER_PAGE_URL_BYTES)
+    else {
+        return fallback;
+    };
+    let Ok(parsed) = Url::parse(candidate) else {
+        return fallback;
+    };
+    if !matches!(parsed.scheme(), "http" | "https")
+        || !parsed
+            .host_str()
+            .is_some_and(|host| host.eq_ignore_ascii_case(publisher_domain))
+        || !parsed.username().is_empty()
+        || parsed.password().is_some()
+    {
+        return fallback;
+    }
+    parsed.to_string()
+}
+
 /// Convert tsjs/Prebid.js request format to internal [`AuctionRequest`].
 ///
 /// The `consent` parameter carries decoded consent signals extracted from the
@@ -194,12 +225,14 @@ pub fn convert_tsjs_to_auction_request(
         }
     }
 
+    let page_url = publisher_page_url(req, &settings.publisher.domain);
+
     Ok(AuctionRequest {
         id: Uuid::new_v4().to_string(),
         slots,
         publisher: PublisherInfo {
             domain: settings.publisher.domain.clone(),
-            page_url: Some(format!("https://{}", settings.publisher.domain)),
+            page_url: Some(page_url.clone()),
         },
         user: UserInfo {
             id: ec_id,
@@ -209,7 +242,7 @@ pub fn convert_tsjs_to_auction_request(
         device,
         site: Some(SiteInfo {
             domain: settings.publisher.domain.clone(),
-            page: format!("https://{}", settings.publisher.domain),
+            page: page_url,
         }),
         context,
     })
@@ -217,12 +250,12 @@ pub fn convert_tsjs_to_auction_request(
 
 /// Convert `OrchestrationResult` to `OpenRTB` response format.
 ///
-/// Returns rewritten creative HTML directly in the `adm` field for inline delivery.
+/// Returns rewritten ordinary creative HTML in `adm` or a typed renderer extension.
 ///
 /// # Errors
 ///
 /// Returns an error if:
-/// - A winning bid is missing a price
+/// - A winning bid is missing a price or render source
 /// - The response serialization fails
 pub fn convert_to_openrtb_response(
     result: &OrchestrationResult,
@@ -250,8 +283,9 @@ pub fn convert_to_openrtb_response(
         let width = to_openrtb_i32(bid.width, "width", &bid_context);
         let height = to_openrtb_i32(bid.height, "height", &bid_context);
 
-        // Process creative HTML if present - — sanitize dangerous markup first, then rewrite URLs.
-        let creative_html = if let Some(ref raw_creative) = bid.creative {
+        // Ordinary markup remains on the mandatory sanitize/rewrite path. A
+        // typed renderer is serialized separately and never enters the HTML sanitizer.
+        let (adm, ext) = if let Some(ref raw_creative) = bid.creative {
             let sanitized = creative::sanitize_creative_html(raw_creative);
             let rewritten = creative::rewrite_creative_html(settings, &sanitized);
 
@@ -264,26 +298,38 @@ pub fn convert_to_openrtb_response(
                 rewritten.len()
             );
 
-            rewritten
+            (Some(rewritten), None)
+        } else if let Some(renderer) = bid.renderer.as_ref() {
+            (
+                None,
+                BidExt {
+                    trusted_server: BidTrustedServerExt { renderer },
+                }
+                .to_ext(),
+            )
         } else {
-            // No creative provided (e.g., from mediation layer that returns iframe URLs)
-            log::warn!(
-                "No creative HTML for auction {} slot {} - mediation should have provided creative",
-                auction_request.id,
-                slot_id
-            );
-            String::new()
+            return Err(Report::new(TrustedServerError::Auction {
+                message: format!(
+                    "Winning bid for slot '{}' from '{}' has no render source",
+                    slot_id, bid.bidder
+                ),
+            }));
         };
 
         let openrtb_bid = OpenRtbBid {
-            id: Some(format!("{}-{}", bid.bidder, slot_id)),
+            id: bid
+                .bid_id
+                .clone()
+                .or_else(|| Some(format!("{}-{}", bid.bidder, slot_id))),
             impid: Some(slot_id.to_string()),
             price: Some(price),
-            adm: Some(creative_html),
-            crid: Some(format!("{}-creative", bid.bidder)),
+            adm,
+            adid: bid.ad_id.clone(),
+            crid: bid.creative_id.clone(),
             w: width,
             h: height,
             adomain: bid.adomain.clone().unwrap_or_default(),
+            ext,
             ..Default::default()
         };
 
@@ -365,7 +411,9 @@ pub fn convert_to_openrtb_response(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::auction::types::{AuctionResponse, Bid, BidStatus};
+    use crate::auction::types::{
+        ApsRendererV1, ApsTagType, AuctionResponse, Bid, BidRenderer, BidStatus,
+    };
     use crate::openrtb::{Eid, Uid};
     use crate::platform::test_support::noop_services;
     use crate::test_support::tests::create_test_settings;
@@ -437,7 +485,10 @@ mod tests {
             height: 250,
             nurl: None,
             burl: None,
+            bid_id: Some(format!("{bidder}-{slot_id}")),
             ad_id: None,
+            creative_id: Some(format!("{bidder}-creative")),
+            renderer: None,
             cache_id: None,
             cache_host: None,
             cache_path: None,
@@ -605,6 +656,45 @@ mod tests {
         );
     }
 
+    #[test]
+    fn publisher_page_url_accepts_only_same_publisher_http_urls() {
+        let request = Request::builder()
+            .uri("https://publisher.example.com/auction")
+            .header(
+                header::REFERER,
+                "https://publisher.example.com/article?id=1",
+            )
+            .body(EdgeBody::empty())
+            .expect("should build request");
+        assert_eq!(
+            publisher_page_url(&request, "publisher.example.com"),
+            "https://publisher.example.com/article?id=1"
+        );
+        assert_eq!(
+            publisher_page_url(&request, "Publisher.Example.Com"),
+            "https://publisher.example.com/article?id=1",
+            "DNS host comparison should be case-insensitive"
+        );
+
+        for candidate in [
+            "https://other.example/article",
+            "javascript:alert(1)",
+            "https://user:password@publisher.example.com/article",
+            "not a url",
+        ] {
+            let request = Request::builder()
+                .uri("https://publisher.example.com/auction")
+                .header(header::REFERER, candidate)
+                .body(EdgeBody::empty())
+                .expect("should build request");
+            assert_eq!(
+                publisher_page_url(&request, "publisher.example.com"),
+                "https://publisher.example.com",
+                "should reject {candidate}"
+            );
+        }
+    }
+
     #[test]
     fn convert_tsjs_to_auction_request_maps_banner_sizes_to_formats() {
         let settings = make_settings();
@@ -933,22 +1023,65 @@ mod tests {
     }
 
     #[test]
-    fn convert_to_openrtb_response_serializes_missing_creative_as_empty_adm() {
+    fn convert_to_openrtb_response_rejects_winner_without_render_source() {
         let settings = make_settings();
         let auction_request = make_auction_request();
         let mut bid = make_bid("div-gpt-top", "appnexus", Some(2.75));
         bid.creative = None;
         let result = make_result(bid);
 
-        let response = convert_to_openrtb_response(&result, &settings, &auction_request, false)
-            .expect("should convert bid without creative HTML");
+        let error = convert_to_openrtb_response(&result, &settings, &auction_request, false)
+            .expect_err("should reject bid without a render source");
 
-        assert_eq!(response.status(), StatusCode::OK, "should return OK");
+        assert!(
+            format!("{error:?}").contains("has no render source"),
+            "should explain the missing render source"
+        );
+    }
+
+    #[test]
+    fn convert_to_openrtb_response_emits_typed_aps_renderer_without_adm() {
+        let settings = make_settings();
+        let auction_request = make_auction_request();
+        let mut bid = make_bid("div-gpt-top", "aps", Some(2.75));
+        bid.creative = None;
+        bid.bid_id = Some("fictional-bid".to_string());
+        bid.ad_id = Some("fictional-ad".to_string());
+        bid.creative_id = Some("fictional-creative".to_string());
+        bid.renderer = Some(BidRenderer::Aps(ApsRendererV1 {
+            version: 1,
+            account_id: "example-account".to_string(),
+            bid_id: "fictional-bid".to_string(),
+            creative_id: Some("fictional-creative".to_string()),
+            tag_type: ApsTagType::Iframe,
+            creative_url: "https://creative.example/render".to_string(),
+            aax_response: "fictional-base64".to_string(),
+            width: 300,
+            height: 250,
+        }));
+        let result = make_result(bid);
+
+        let response = convert_to_openrtb_response(&result, &settings, &auction_request, false)
+            .expect("should convert APS renderer bid");
         let json = response_json(response);
+        let bid = json["seatbid"][0]["bid"][0]
+            .as_object()
+            .expect("should serialize bid object");
+
+        assert!(
+            !bid.contains_key("adm"),
+            "should omit adm for renderer bids"
+        );
+        assert_eq!(bid["id"], json!("fictional-bid"));
+        assert_eq!(bid["adid"], json!("fictional-ad"));
+        assert_eq!(bid["crid"], json!("fictional-creative"));
+        assert_eq!(
+            bid["ext"]["trusted_server"]["renderer"]["type"],
+            json!("aps")
+        );
         assert_eq!(
-            json["seatbid"][0]["bid"][0]["adm"],
-            json!(""),
-            "should serialize missing creative as empty adm"
+            bid["ext"]["trusted_server"]["renderer"]["bidId"],
+            json!("fictional-bid")
         );
     }
 
diff --git a/crates/trusted-server-core/src/auction/orchestrator.rs b/crates/trusted-server-core/src/auction/orchestrator.rs
index bf9ecad7b..3a6757ddf 100644
--- a/crates/trusted-server-core/src/auction/orchestrator.rs
+++ b/crates/trusted-server-core/src/auction/orchestrator.rs
@@ -381,16 +381,14 @@ impl AuctionOrchestrator {
                     message: format!("Mediator {} parse failed", mediator.provider_name()),
                 })?;
 
-            // Extract winning bids from mediator response
-            // Filter out bids without decoded prices - mediator should have decoded all prices
+            // Extract only mediator bids with comparable numeric prices.
             let winning = mediator_resp
                 .bids
                 .iter()
                 .filter_map(|bid| {
                     if bid.price.is_none() {
                         log::warn!(
-                            "Mediator '{}' returned bid for slot '{}' without decoded price - skipping. \
-                             Mediator should decode all prices including APS bids.",
+                            "Mediator '{}' returned bid for slot '{}' without a price - skipping",
                             mediator.provider_name(),
                             bid.slot_id
                         );
@@ -785,9 +783,7 @@ impl AuctionOrchestrator {
         Ok(responses)
     }
 
-    /// Select the best bid for each slot from all responses.
-    /// Note: Bids with None price (e.g., APS bids with encoded prices) are skipped
-    /// when no mediator is configured, as we cannot compare them without decoding.
+    /// Select the best decoded-price bid for each slot from all responses.
     fn select_winning_bids(
         &self,
         responses: &[AuctionResponse],
@@ -801,13 +797,11 @@ impl AuctionOrchestrator {
             }
 
             for bid in &response.bids {
-                // Skip bids without decoded prices (e.g., APS bids)
-                // These require mediation layer to decode
                 let bid_price = match bid.price {
                     Some(p) => p,
                     None => {
                         log::debug!(
-                            "Skipping bid for slot '{}' from '{}' - price requires mediation to decode",
+                            "Skipping bid for slot '{}' from '{}' without a comparable price",
                             bid.slot_id,
                             bid.bidder
                         );
@@ -842,30 +836,28 @@ impl AuctionOrchestrator {
         }
 
         let starting_count = winning_bids.len();
-        winning_bids.retain(|slot_id, bid| match (floor_prices.get(slot_id), bid.price) {
-            (Some(floor), Some(price)) if price >= *floor => true,
-            (Some(_), Some(_)) => {
-                log::info!(
-                    "Dropping winning bid below floor price for slot '{}'",
-                    slot_id
-                );
-                false
-            }
-            (_, None) => {
-                // Any caller that needs to keep an undecoded (encoded-price)
-                // bid must decode it *before* invoking this function — both
-                // `select_winning_bids` and the mediator path already do.
-                // Letting `None`-price bids through here would cause
-                // `winning_bids.len()` to overcount what `build_bid_map`
-                // downstream is willing to emit, so they get dropped instead.
-                log::debug!(
-                    "Dropping bid for slot '{}' - no decoded price (caller must decode before apply_floor_prices)",
-                    slot_id
-                );
-                false
-            }
-            (None, Some(_)) => true,
-        });
+        winning_bids.retain(
+            |slot_id, bid| match (floor_prices.get(slot_id), bid.price) {
+                (Some(floor), Some(price)) if price >= *floor => true,
+                (Some(_), Some(_)) => {
+                    log::info!(
+                        "Dropping winning bid below floor price for slot '{}'",
+                        slot_id
+                    );
+                    false
+                }
+                (_, None) => {
+                    // Every downstream response requires a comparable numeric price,
+                    // so bids without one are always dropped before delivery.
+                    log::debug!(
+                        "Dropping bid for slot '{}' without a comparable price",
+                        slot_id
+                    );
+                    false
+                }
+                (None, Some(_)) => true,
+            },
+        );
 
         if winning_bids.len() != starting_count {
             log::info!(
@@ -1485,8 +1477,8 @@ mod tests {
     use crate::auction::provider::AuctionProvider;
     use crate::auction::test_support::create_test_auction_context;
     use crate::auction::types::{
-        AdFormat, AdSlot, AuctionContext, AuctionRequest, AuctionResponse, Bid, BidStatus,
-        MediaType, PublisherInfo, UserInfo,
+        AdFormat, AdSlot, ApsRendererV1, ApsTagType, AuctionContext, AuctionRequest,
+        AuctionResponse, Bid, BidRenderer, BidStatus, MediaType, PublisherInfo, UserInfo,
     };
     use crate::error::TrustedServerError;
     use crate::platform::test_support::{
@@ -1688,6 +1680,44 @@ mod tests {
     /// the synchronous mediation path calls `parse_response_with_context`.
     struct CacheRestoringMediator;
 
+    fn auction_bid(bidder: &str, price: f64) -> Bid {
+        let renderer = (bidder == "aps").then(|| {
+            BidRenderer::Aps(ApsRendererV1 {
+                version: 1,
+                account_id: "example-account".to_string(),
+                bid_id: "aps-selected-bid".to_string(),
+                creative_id: None,
+                tag_type: ApsTagType::Iframe,
+                creative_url: "https://creative.example/render".to_string(),
+                aax_response: "fictional-base64".to_string(),
+                width: 300,
+                height: 250,
+            })
+        });
+        Bid {
+            slot_id: "slot-1".to_string(),
+            price: Some(price),
+            currency: "USD".to_string(),
+            creative: renderer
+                .is_none()
+                .then(|| "<div>ordinary</div>".to_string()),
+            adomain: None,
+            bidder: bidder.to_string(),
+            width: 300,
+            height: 250,
+            nurl: None,
+            burl: None,
+            bid_id: (bidder == "aps").then(|| "aps-selected-bid".to_string()),
+            ad_id: None,
+            creative_id: None,
+            renderer,
+            cache_id: None,
+            cache_host: None,
+            cache_path: None,
+            metadata: HashMap::new(),
+        }
+    }
+
     fn mediated_bid(nurl: Option<String>) -> Bid {
         Bid {
             slot_id: "header-banner".to_string(),
@@ -1700,7 +1730,10 @@ mod tests {
             height: 90,
             nurl: nurl.clone(),
             burl: nurl,
+            bid_id: None,
             ad_id: Some("creative-123".to_string()),
+            creative_id: None,
+            renderer: None,
             cache_id: Some("cache-abc".to_string()),
             cache_host: None,
             cache_path: None,
@@ -2039,7 +2072,10 @@ mod tests {
                 height: 250,
                 nurl: None,
                 burl: None,
+                bid_id: None,
                 ad_id: None,
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
@@ -2059,7 +2095,10 @@ mod tests {
                 height: 250,
                 nurl: None,
                 burl: None,
+                bid_id: None,
                 ad_id: None,
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
@@ -3127,14 +3166,42 @@ mod tests {
     }
 
     #[test]
-    fn test_apply_floor_prices_drops_bids_with_undecoded_price() {
-        // Bids that reach apply_floor_prices with `price=None` cannot have a
-        // floor compared against them — and they would not survive downstream
-        // (build_bid_map filters them) — so apply_floor_prices drops them so
-        // the count it reports matches what eventually ships to the client.
-        // Both production paths (select_winning_bids and the mediator filter)
-        // already decode/skip None prices before calling this function; this
-        // test pins the contract.
+    fn decoded_aps_bid_competes_directly_by_cpm() {
+        let orchestrator = AuctionOrchestrator::new(AuctionConfig::default());
+        let floor_prices = HashMap::new();
+        let response = |provider: &str, bid: Bid| AuctionResponse::success(provider, vec![bid], 1);
+
+        let aps_wins = orchestrator.select_winning_bids(
+            &[
+                response("aps", auction_bid("aps", 2.0)),
+                response("ordinary", auction_bid("ordinary", 1.0)),
+            ],
+            &floor_prices,
+        );
+        let winner = aps_wins.get("slot-1").expect("should select APS bid");
+        assert_eq!(winner.bidder, "aps");
+        assert!(winner.renderer.is_some());
+        assert!(winner.creative.is_none());
+
+        let ordinary_wins = orchestrator.select_winning_bids(
+            &[
+                response("aps", auction_bid("aps", 2.0)),
+                response("ordinary", auction_bid("ordinary", 3.0)),
+            ],
+            &floor_prices,
+        );
+        assert_eq!(
+            ordinary_wins
+                .get("slot-1")
+                .expect("should select ordinary bid")
+                .bidder,
+            "ordinary"
+        );
+    }
+
+    #[test]
+    fn test_apply_floor_prices_drops_bids_without_price() {
+        // Price-less bids cannot be compared or delivered and remain fail-closed.
         let orchestrator = AuctionOrchestrator::new(AuctionConfig::default());
         let mut floor_prices = HashMap::new();
         floor_prices.insert("slot-1".to_string(), 1.00);
@@ -3153,18 +3220,14 @@ mod tests {
                 height: 250,
                 nurl: None,
                 burl: None,
+                bid_id: None,
                 ad_id: None,
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
-                metadata: {
-                    let mut m = HashMap::new();
-                    m.insert(
-                        "amznbid".to_string(),
-                        serde_json::json!("encoded_price_data"),
-                    );
-                    m
-                },
+                metadata: HashMap::new(),
             },
         );
 
@@ -3176,15 +3239,13 @@ mod tests {
         );
         assert!(
             !filtered.contains_key("slot-1"),
-            "slot-1 should not survive when its bid has no decoded price"
+            "slot-1 should not survive when its bid has no price"
         );
     }
 
     #[test]
     fn test_apply_floor_prices_drops_decoded_aps_bid_below_floor() {
-        // After mediation decodes an APS bid, apply_floor_prices must enforce the
-        // slot floor on the resulting price=Some(x) value. This test simulates the
-        // state of a bid after mediator decoding: price is Some, amznbid is gone.
+        // APS supplies decoded price at the provider boundary, so normal floors apply.
         let orchestrator = AuctionOrchestrator::new(AuctionConfig::default());
         let mut floor_prices = HashMap::new();
         floor_prices.insert("atf".to_string(), 0.50);
@@ -3203,7 +3264,10 @@ mod tests {
                 height: 250,
                 nurl: None,
                 burl: None,
+                bid_id: None,
                 ad_id: None,
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
@@ -3239,7 +3303,10 @@ mod tests {
                 height: 250,
                 nurl: None,
                 burl: None,
+                bid_id: None,
                 ad_id: None,
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
diff --git a/crates/trusted-server-core/src/auction/telemetry.rs b/crates/trusted-server-core/src/auction/telemetry.rs
index d63445369..c252f5351 100644
--- a/crates/trusted-server-core/src/auction/telemetry.rs
+++ b/crates/trusted-server-core/src/auction/telemetry.rs
@@ -960,7 +960,10 @@ mod tests {
             height: 250,
             nurl: None,
             burl: None,
+            bid_id: None,
             ad_id: ad_id.map(str::to_owned),
+            creative_id: None,
+            renderer: None,
             cache_id: None,
             cache_host: None,
             cache_path: None,
diff --git a/crates/trusted-server-core/src/auction/types.rs b/crates/trusted-server-core/src/auction/types.rs
index 14c7713f8..a6ad61f3a 100644
--- a/crates/trusted-server-core/src/auction/types.rs
+++ b/crates/trusted-server-core/src/auction/types.rs
@@ -171,18 +171,71 @@ pub struct AuctionResponse {
     pub metadata: HashMap<String, serde_json::Value>,
 }
 
+/// APS creative tag type accepted by the Trusted Server renderer.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum ApsTagType {
+    /// APS loads the creative URL in a nested iframe.
+    Iframe,
+    /// APS fetches creative HTML and executes it in its nested renderer frame.
+    Script,
+}
+
+/// Version 1 APS renderer descriptor shared with browser clients.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ApsRendererV1 {
+    /// Renderer contract version.
+    pub version: u8,
+    /// APS account identifier used to initialize the fixed runner.
+    pub account_id: String,
+    /// Selected `OpenRTB` bid identifier.
+    pub bid_id: String,
+    /// Optional `OpenRTB` creative identifier.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub creative_id: Option<String>,
+    /// APS creative delivery mode.
+    pub tag_type: ApsTagType,
+    /// HTTPS creative URL consumed by the fixed APS runner.
+    pub creative_url: String,
+    /// Base64-encoded exact one-bid APS response envelope.
+    pub aax_response: String,
+    /// Creative width.
+    pub width: u32,
+    /// Creative height.
+    pub height: u32,
+}
+
+/// Typed browser renderer capability carried by a bid.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "type", rename_all = "lowercase")]
+pub enum BidRenderer {
+    /// APS renderer version 1.
+    Aps(ApsRendererV1),
+}
+
+impl BidRenderer {
+    /// Return the APS renderer descriptor.
+    #[must_use]
+    pub fn aps(&self) -> &ApsRendererV1 {
+        match self {
+            Self::Aps(renderer) => renderer,
+        }
+    }
+}
+
 /// Individual bid from a provider.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Bid {
     /// Slot this bid is for
     pub slot_id: String,
-    /// Bid price in CPM
-    /// None for APS bids where price is encoded and must be decoded by mediation layer
+    /// Bid price in CPM.
     pub price: Option<f64>,
     /// Currency code (e.g., "USD")
     pub currency: String,
-    /// Creative markup (HTML/VAST)
-    /// None when the bidder doesn't provide creative HTML (e.g., APS/TAM)
+    /// Creative markup (HTML/VAST).
+    ///
+    /// `None` when the bid uses a typed [`BidRenderer`] instead.
     pub creative: Option<String>,
     /// Advertiser domain
     pub adomain: Option<Vec<String>>,
@@ -196,8 +249,15 @@ pub struct Bid {
     pub nurl: Option<String>,
     /// Billing notification URL
     pub burl: Option<String>,
-    /// Ad ID from the bidder
+    /// `OpenRTB` bid identifier.
+    pub bid_id: Option<String>,
+    /// Ad ID from the bidder.
     pub ad_id: Option<String>,
+    /// Optional `OpenRTB` creative identifier.
+    pub creative_id: Option<String>,
+    /// Typed browser renderer capability.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub renderer: Option<BidRenderer>,
     /// Prebid Cache UUID for this bid.
     ///
     /// Populated from `ext.prebid.cache.bids.cacheId` in the PBS response.
@@ -214,8 +274,7 @@ pub struct Bid {
     /// Populated from the path of `ext.prebid.cache.bids.url`. Used as
     /// `hb_cache_path` targeting value. `None` when cache is absent.
     pub cache_path: Option<String>,
-    /// Provider-specific bid metadata
-    /// For APS bids, contains encoded price in "amznbid" field
+    /// Provider-specific bid metadata.
     pub metadata: HashMap<String, serde_json::Value>,
 }
 
@@ -338,7 +397,10 @@ mod tests {
             height: 250,
             nurl: None,
             burl: None,
+            bid_id: None,
             ad_id: None,
+            creative_id: None,
+            renderer: None,
             cache_id: None,
             cache_host: None,
             cache_path: None,
@@ -467,7 +529,10 @@ mod tests {
             height: 250,
             nurl: None,
             burl: None,
+            bid_id: None,
             ad_id: Some("bid-id".to_string()),
+            creative_id: None,
+            renderer: None,
             cache_id: Some("cache-uuid".to_string()),
             cache_host: Some("cache.example.com".to_string()),
             cache_path: Some("/pbc/v1/cache".to_string()),
@@ -492,6 +557,62 @@ mod tests {
         );
     }
 
+    #[test]
+    fn aps_renderer_serializes_to_versioned_camel_case_contract() {
+        let renderer = BidRenderer::Aps(ApsRendererV1 {
+            version: 1,
+            account_id: "example-account-id".to_string(),
+            bid_id: "fictional-bid-id".to_string(),
+            creative_id: Some("fictional-creative-id".to_string()),
+            tag_type: ApsTagType::Iframe,
+            creative_url: "https://creative.example/render".to_string(),
+            aax_response: "base64-data".to_string(),
+            width: 300,
+            height: 250,
+        });
+
+        let serialized = serde_json::to_value(&renderer).expect("should serialize renderer");
+
+        assert_eq!(
+            serialized,
+            json!({
+                "type": "aps",
+                "version": 1,
+                "accountId": "example-account-id",
+                "bidId": "fictional-bid-id",
+                "creativeId": "fictional-creative-id",
+                "tagType": "iframe",
+                "creativeUrl": "https://creative.example/render",
+                "aaxResponse": "base64-data",
+                "width": 300,
+                "height": 250
+            }),
+            "should match renderer wire contract"
+        );
+    }
+
+    #[test]
+    fn aps_renderer_omits_absent_creative_id() {
+        let renderer = BidRenderer::Aps(ApsRendererV1 {
+            version: 1,
+            account_id: "example-account-id".to_string(),
+            bid_id: "fictional-bid-id".to_string(),
+            creative_id: None,
+            tag_type: ApsTagType::Iframe,
+            creative_url: "https://creative.example/render".to_string(),
+            aax_response: "base64-data".to_string(),
+            width: 300,
+            height: 250,
+        });
+
+        let serialized = serde_json::to_value(&renderer).expect("should serialize renderer");
+
+        assert!(
+            serialized.get("creativeId").is_none(),
+            "should omit absent creative ID"
+        );
+    }
+
     #[test]
     fn media_type_defaults_to_banner() {
         assert_eq!(
@@ -514,7 +635,10 @@ mod tests {
             height: 250,
             nurl: None,
             burl: None,
+            bid_id: None,
             ad_id: Some("prebid-ad-id-abc".to_string()),
+            creative_id: None,
+            renderer: None,
             cache_id: None,
             cache_host: None,
             cache_path: None,
diff --git a/crates/trusted-server-core/src/creative_opportunities.rs b/crates/trusted-server-core/src/creative_opportunities.rs
index 9ce741f3f..d56fa6a45 100644
--- a/crates/trusted-server-core/src/creative_opportunities.rs
+++ b/crates/trusted-server-core/src/creative_opportunities.rs
@@ -275,8 +275,9 @@ impl CreativeOpportunitySlot {
 
     /// Converts this slot into an [`AdSlot`] ready for use in an auction request.
     ///
-    /// Provider-specific params (e.g., APS `slotID`, PBS bidder params) are wired
-    /// into the `bidders` map keyed by provider/bidder name.
+    /// Prebid Server bidder params are wired into the `bidders` map keyed by
+    /// bidder name. Legacy APS slot params are accepted in configuration but
+    /// intentionally ignored by the APS `OpenRTB` provider.
     ///
     /// When [`PrebidSlotParams::bidders`] is empty, a `trustedServer` entry is
     /// injected so [`PrebidAuctionProvider`] expands all `config.bidders`
@@ -285,12 +286,6 @@ impl CreativeOpportunitySlot {
     #[must_use]
     pub fn to_ad_slot(&self) -> AdSlot {
         let mut bidders: HashMap<String, serde_json::Value> = HashMap::new();
-        if let Some(ref aps) = self.providers.aps {
-            bidders.insert(
-                "aps".to_string(),
-                serde_json::json!({ "slotID": aps.slot_id }),
-            );
-        }
         if let Some(ref prebid) = self.providers.prebid {
             if prebid.bidders.is_empty() {
                 // No explicit per-bidder override: let the Prebid provider expand
@@ -364,7 +359,10 @@ impl CreativeOpportunityFormat {
 #[derive(Debug, Clone, Default, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
 pub struct SlotProviders {
-    /// Amazon Publisher Services (APS/TAM) slot parameters.
+    /// Legacy APS slot parameters, retained only for configuration compatibility.
+    ///
+    /// APS `OpenRTB` uses the canonical creative-opportunity slot ID and does not
+    /// forward this value to APS or Prebid Server.
     pub aps: Option<ApsSlotParams>,
     /// Prebid Server inline bidder parameters.
     ///
@@ -374,11 +372,11 @@ pub struct SlotProviders {
     pub prebid: Option<PrebidSlotParams>,
 }
 
-/// APS-specific parameters for a slot.
+/// Legacy APS-specific parameters retained for configuration compatibility.
 #[derive(Debug, Clone, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
 pub struct ApsSlotParams {
-    /// The APS slot ID string used when making TAM bid requests.
+    /// Deprecated legacy slot ID. APS `OpenRTB` ignores this value.
     pub slot_id: String,
 }
 
@@ -617,16 +615,15 @@ mod tests {
     }
 
     #[test]
-    fn to_ad_slot_wires_aps_params_into_bidders() {
+    fn to_ad_slot_ignores_legacy_aps_params() {
         let mut slot = make_slot("atf", vec!["/"]);
         slot.providers.aps = Some(ApsSlotParams {
-            slot_id: "aps-slot-atf".to_string(),
+            slot_id: "legacy-aps-slot-atf".to_string(),
         });
         let ad_slot = slot.to_ad_slot();
-        let aps_params = ad_slot.bidders.get("aps").expect("should have aps bidder");
-        assert_eq!(
-            aps_params.get("slotID").and_then(|v| v.as_str()),
-            Some("aps-slot-atf"),
+        assert!(
+            !ad_slot.bidders.contains_key("aps"),
+            "legacy APS params must not enable APS through Prebid Server"
         );
     }
 
diff --git a/crates/trusted-server-core/src/integrations/adserver_mock.rs b/crates/trusted-server-core/src/integrations/adserver_mock.rs
index 8fd3f9ddb..009ddd6ba 100644
--- a/crates/trusted-server-core/src/integrations/adserver_mock.rs
+++ b/crates/trusted-server-core/src/integrations/adserver_mock.rs
@@ -159,9 +159,7 @@ impl AdServerMockProvider {
 
     /// Build mediation request from auction request and bidder responses.
     ///
-    /// Handles both:
-    /// - Regular bids with decoded prices (price field set)
-    /// - APS-style bids with encoded prices (price=None, encoded price in metadata)
+    /// Only bids with decoded numeric prices are eligible for mediation.
     fn build_mediation_request(
         &self,
         request: &AuctionRequest,
@@ -175,14 +173,15 @@ impl AdServerMockProvider {
                 let bids: Vec<Json> = response
                     .bids
                     .iter()
-                    .map(|bid| {
-                        // Mocktioneer mediator always requires a numeric `price` field.
-                        // APS bids carry price as an opaque encoded string (`amznbid`)
-                        // that cannot be decoded client-side; use `bid.price` when set
-                        // (a real decoded value) or fall back to a mock floor price for
-                        // test/demo purposes.
-                        let price = bid.price.unwrap_or(1.50);
-                        json!({
+                    .filter_map(|bid| {
+                        let Some(price) = bid.price else {
+                            log::debug!(
+                                "adserver_mock: omitting bid for slot '{}' without decoded price",
+                                bid.slot_id
+                            );
+                            return None;
+                        };
+                        Some(json!({
                             "imp_id": bid.slot_id,
                             "price": price,
                             "adm": bid.creative,
@@ -190,7 +189,7 @@ impl AdServerMockProvider {
                             "h": bid.height,
                             "crid": format!("{}-creative", bid.bidder),
                             "adomain": bid.adomain,
-                        })
+                        }))
                     })
                     .collect();
 
@@ -254,7 +253,7 @@ impl AdServerMockProvider {
     }
 
     /// Parse `OpenRTB` response from mediation endpoint.
-    /// Mediation returns decoded prices for all bids (including APS bids that were encoded).
+    /// Mediation returns decoded prices for all selected bids.
     ///
     /// `bid_index` is the SSP-bid lookup built from the auction context's
     /// bidder responses. The mock mediator does not echo render/accounting
@@ -307,7 +306,11 @@ impl AdServerMockProvider {
                     slot_id,
                     price: bid["price"].as_f64(),
                     currency: "USD".to_string(),
-                    creative: bid["adm"].as_str().map(String::from),
+                    creative: if original.is_some_and(|bid| bid.renderer.is_some()) {
+                        None
+                    } else {
+                        bid["adm"].as_str().map(String::from)
+                    },
                     width,
                     height,
                     bidder: restored_bidder,
@@ -318,7 +321,10 @@ impl AdServerMockProvider {
                     }),
                     nurl: original.and_then(|b| b.nurl.clone()),
                     burl: original.and_then(|b| b.burl.clone()),
-                    ad_id: original.and_then(|b| b.ad_id.clone()),
+                    bid_id: original.and_then(|bid| bid.bid_id.clone()),
+                    ad_id: original.and_then(|bid| bid.ad_id.clone()),
+                    creative_id: original.and_then(|bid| bid.creative_id.clone()),
+                    renderer: original.and_then(|bid| bid.renderer.clone()),
                     cache_id: original.and_then(|b| b.cache_id.clone()),
                     cache_host: original.and_then(|b| b.cache_host.clone()),
                     cache_path: original.and_then(|b| b.cache_path.clone()),
@@ -614,6 +620,39 @@ mod tests {
         }
     }
 
+    fn aps_bid(bid_id: &str, price: f64) -> Bid {
+        Bid {
+            slot_id: "header-banner".to_string(),
+            price: Some(price),
+            currency: "USD".to_string(),
+            creative: None,
+            width: 728,
+            height: 90,
+            bidder: "aps".to_string(),
+            adomain: Some(vec!["advertiser.example".to_string()]),
+            nurl: None,
+            burl: None,
+            bid_id: Some(bid_id.to_string()),
+            ad_id: None,
+            creative_id: Some(format!("creative-{bid_id}")),
+            renderer: Some(BidRenderer::Aps(ApsRendererV1 {
+                version: 1,
+                account_id: "example-account".to_string(),
+                bid_id: bid_id.to_string(),
+                creative_id: Some(format!("creative-{bid_id}")),
+                tag_type: ApsTagType::Iframe,
+                creative_url: format!("https://creative.example/{bid_id}"),
+                aax_response: format!("fictional-{bid_id}-base64"),
+                width: 728,
+                height: 90,
+            })),
+            cache_id: None,
+            cache_host: None,
+            cache_path: None,
+            metadata: HashMap::new(),
+        }
+    }
+
     #[test]
     fn test_build_mediation_request() {
         let config = AdServerMockConfig {
@@ -629,7 +668,7 @@ mod tests {
 
         let bidder_responses = vec![
             AuctionResponse {
-                provider: "amazon-aps".to_string(),
+                provider: "aps".to_string(),
                 status: BidStatus::Success,
                 bids: vec![Bid {
                     slot_id: "header-banner".to_string(),
@@ -638,11 +677,14 @@ mod tests {
                     creative: Some("<div>APS Ad</div>".to_string()),
                     width: 728,
                     height: 90,
-                    bidder: "amazon-aps".to_string(),
-                    adomain: Some(vec!["amazon.com".to_string()]),
+                    bidder: "aps".to_string(),
+                    adomain: Some(vec!["advertiser.example".to_string()]),
                     nurl: None,
                     burl: None,
+                    bid_id: None,
                     ad_id: None,
+                    creative_id: None,
+                    renderer: None,
                     cache_id: None,
                     cache_host: None,
                     cache_path: None,
@@ -665,7 +707,10 @@ mod tests {
                     adomain: None,
                     nurl: Some("https://ssp.example/win?id=mock-bid-001".to_string()),
                     burl: Some("https://ssp.example/bill?id=mock-bid-001".to_string()),
+                    bid_id: None,
                     ad_id: Some("mock-bid-001".to_string()),
+                    creative_id: None,
+                    renderer: None,
                     cache_id: None,
                     cache_host: None,
                     cache_path: None,
@@ -784,7 +829,20 @@ mod tests {
                 height: 90,
                 nurl: Some("https://ssp.example/win".to_string()),
                 burl: Some("https://ssp.example/bill".to_string()),
+                bid_id: Some("source-bid-id".to_string()),
                 ad_id: Some("bid-impression-id".to_string()),
+                creative_id: Some("source-creative-id".to_string()),
+                renderer: Some(BidRenderer::Aps(ApsRendererV1 {
+                    version: 1,
+                    account_id: "example-account".to_string(),
+                    bid_id: "source-bid-id".to_string(),
+                    creative_id: Some("source-creative-id".to_string()),
+                    tag_type: ApsTagType::Iframe,
+                    creative_url: "https://creative.example/render".to_string(),
+                    aax_response: "fictional-base64".to_string(),
+                    width: 728,
+                    height: 90,
+                })),
                 cache_id: Some("cache-uuid".to_string()),
                 cache_host: Some("cache.example".to_string()),
                 cache_path: Some("/cache".to_string()),
@@ -812,11 +870,14 @@ mod tests {
             Some("https://ssp.example/bill"),
             "should restore burl"
         );
+        assert_eq!(bid.bid_id.as_deref(), Some("source-bid-id"));
         assert_eq!(
             bid.ad_id.as_deref(),
             Some("bid-impression-id"),
             "should restore ad_id"
         );
+        assert_eq!(bid.creative_id.as_deref(), Some("source-creative-id"));
+        assert!(bid.renderer.is_some(), "should restore typed renderer");
         assert_eq!(
             bid.cache_id.as_deref(),
             Some("cache-uuid"),
@@ -834,6 +895,79 @@ mod tests {
         );
     }
 
+    #[test]
+    fn reduced_aps_bid_avoids_mediation_index_renderer_collision() {
+        let provider = AdServerMockProvider::new(AdServerMockConfig::default());
+
+        // Document why APS must reduce before mediation: the mediator index is
+        // intentionally last-write-wins for identical provider/slot/bidder keys.
+        let unreduced = AuctionResponse::success(
+            "aps",
+            vec![aps_bid("selected", 2.0), aps_bid("losing-last", 1.0)],
+            1,
+        );
+        let collision_index = build_bid_index(&[unreduced]);
+        let key = (
+            "aps".to_string(),
+            "header-banner".to_string(),
+            "aps".to_string(),
+        );
+        assert_eq!(
+            collision_index
+                .get(&key)
+                .and_then(|bid| bid.bid_id.as_deref()),
+            Some("losing-last"),
+            "an unreduced response would restore the last candidate's renderer"
+        );
+
+        let reduced = AuctionResponse::success("aps", vec![aps_bid("selected", 2.0)], 1);
+        let mediation_request = provider
+            .build_mediation_request(
+                &create_test_auction_request(),
+                std::slice::from_ref(&reduced),
+            )
+            .expect("should build mediation request from reduced APS response");
+        assert_eq!(
+            mediation_request["ext"]["bidder_responses"][0]["bids"]
+                .as_array()
+                .map(Vec::len),
+            Some(1)
+        );
+
+        let reduced_index = build_bid_index(&[reduced]);
+        let mediated = provider.parse_mediation_response(
+            &json!({
+                "seatbid": [{
+                    "seat": "aps",
+                    "bid": [{
+                        "impid": "header-banner",
+                        "price": 2.0,
+                        "w": 728,
+                        "h": 90,
+                        "crid": "aps-creative"
+                    }]
+                }]
+            }),
+            2,
+            &reduced_index,
+        );
+        let winner = mediated
+            .bids
+            .first()
+            .expect("should restore mediated APS winner");
+        assert_eq!(winner.bid_id.as_deref(), Some("selected"));
+        assert_eq!(
+            winner
+                .renderer
+                .as_ref()
+                .expect("should restore APS renderer")
+                .aps()
+                .bid_id,
+            "selected"
+        );
+        assert!(winner.creative.is_none());
+    }
+
     #[test]
     fn test_parse_empty_mediation_response() {
         let config = AdServerMockConfig::default();
@@ -853,8 +987,8 @@ mod tests {
     }
 
     #[test]
-    fn test_mediation_request_handles_none_creative() {
-        // Test that bids without creative HTML (e.g., APS) are properly sent to mediation
+    fn test_mediation_request_handles_decoded_bid_without_creative() {
+        // Typed-renderer bids retain their decoded price when sent to mediation.
         let config = AdServerMockConfig::default();
         let provider = AdServerMockProvider::new(config);
 
@@ -885,29 +1019,28 @@ mod tests {
             context: HashMap::new(),
         };
 
-        // APS bid with encoded price (price=None, amznbid in metadata)
-        let mut aps_metadata = HashMap::new();
-        aps_metadata.insert("amznbid".to_string(), json!("encoded-price-value"));
-
         let bidder_responses = vec![AuctionResponse {
             provider: "aps".to_string(),
             status: BidStatus::Success,
             bids: vec![Bid {
                 slot_id: "slot-1".to_string(),
-                price: None, // APS bids have no decoded price
+                price: Some(1.75),
                 currency: "USD".to_string(),
-                creative: None, // APS doesn't provide creative
+                creative: None,
                 width: 300,
                 height: 250,
-                bidder: "amazon-aps".to_string(),
-                adomain: Some(vec!["amazon.com".to_string()]),
+                bidder: "aps".to_string(),
+                adomain: Some(vec!["advertiser.example".to_string()]),
                 nurl: None,
                 burl: None,
+                bid_id: None,
                 ad_id: None,
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
-                metadata: aps_metadata,
+                metadata: HashMap::new(),
             }],
             response_time_ms: 100,
             metadata: HashMap::new(),
@@ -920,20 +1053,16 @@ mod tests {
         // Verify the mediation request structure
         assert_eq!(mediation_req["id"], "test-auction");
 
-        // Check that the bid was included with encoded_price
         let bidder_resp = &mediation_req["ext"]["bidder_responses"][0];
         assert_eq!(bidder_resp["bidder"], "aps");
 
         let bid = &bidder_resp["bids"][0];
         assert_eq!(bid["imp_id"], "slot-1");
 
-        // APS bids have no decoded price (bid.price == None), so the mock floor
-        // price (1.50) is used.  Mocktioneer requires a numeric price field and
-        // does not accept an opaque encoded_price string.
         assert_eq!(
             bid["price"].as_f64(),
-            Some(1.50),
-            "APS bids with no decoded price should fall back to mock floor price 1.50"
+            Some(1.75),
+            "should preserve the decoded APS price"
         );
         // adm should be null (not a string)
         assert!(
@@ -1010,8 +1139,7 @@ mod tests {
 
     #[test]
     fn test_parse_mediation_response_with_missing_prices() {
-        // Test that mediator response with missing price fields returns None prices
-        // This tests the scenario where mediation failed to decode APS prices
+        // A malformed mediator response can still omit a selected bid price.
         let config = AdServerMockConfig::default();
         let provider = AdServerMockProvider::new(config);
 
diff --git a/crates/trusted-server-core/src/integrations/aps.rs b/crates/trusted-server-core/src/integrations/aps.rs
index 60c22265d..90b6c6db5 100644
--- a/crates/trusted-server-core/src/integrations/aps.rs
+++ b/crates/trusted-server-core/src/integrations/aps.rs
@@ -1,239 +1,162 @@
-//! Amazon Publisher Services (APS/TAM) integration.
-//!
-//! This module provides the APS auction provider for server-side bidding.
+//! Amazon Publisher Services (APS/TAM) `OpenRTB` integration.
+
+use std::collections::{BTreeMap, HashMap};
+use std::sync::Arc;
+use std::time::Duration;
 
 use async_trait::async_trait;
+use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64_STANDARD};
 use edgezero_core::body::Body as EdgeBody;
 use error_stack::{Report, ResultExt};
-use http::{Method, header};
+use http::{Method, StatusCode, header};
+use serde::de::{self, Visitor};
 use serde::{Deserialize, Serialize};
 use serde_json::{Value as Json, json};
-use std::collections::HashMap;
-use std::time::Duration;
-use validator::Validate;
+use url::Url;
+use validator::{Validate, ValidationError};
 
 use crate::auction::provider::AuctionProvider;
-use crate::auction::types::{AuctionContext, AuctionRequest, AuctionResponse, Bid, MediaType};
+use crate::auction::types::{
+    AdSlot, ApsRendererV1, ApsTagType, AuctionContext, AuctionRequest, AuctionResponse, Bid,
+    BidRenderer, MediaType,
+};
 use crate::error::TrustedServerError;
 use crate::integrations::{
+    IntegrationEndpoint, IntegrationProxy, IntegrationRegistration,
     UPSTREAM_RTB_MAX_RESPONSE_BYTES, collect_response_bounded,
     ensure_integration_backend_with_timeout, predict_integration_backend_name,
 };
+use crate::openrtb::{
+    Banner, Device, Format, Geo, Imp, OpenRtbRequest, Publisher, Regs, RegsExt, Site, ToExt, User,
+    UserExt, to_openrtb_i32,
+};
 use crate::platform::{
     PlatformHttpRequest, PlatformPendingRequest, PlatformResponse, RuntimeServices,
 };
-
-use crate::settings::IntegrationConfig;
-
-// ============================================================================
-// APS TAM API Types
-// ============================================================================
-
-/// APS TAM bid request format based on /e/dtb/bid endpoint.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct ApsBidRequest {
-    /// Publisher ID
-    #[serde(rename = "pubId")]
-    pub_id: String,
-
-    /// Slot configurations
-    slots: Vec<ApsSlot>,
-
-    /// Page URL
-    #[serde(rename = "pageUrl", skip_serializing_if = "Option::is_none")]
-    page_url: Option<String>,
-
-    /// User agent
-    #[serde(rename = "ua", skip_serializing_if = "Option::is_none")]
-    user_agent: Option<String>,
-
-    /// Timeout in milliseconds
-    #[serde(skip_serializing_if = "Option::is_none")]
-    timeout: Option<u32>,
-
-    /// GDPR consent information.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    gdpr: Option<ApsGdprConsent>,
-
-    /// US Privacy (CCPA) string.
-    #[serde(rename = "usPrivacy", skip_serializing_if = "Option::is_none")]
-    us_privacy: Option<String>,
-
-    /// GPP consent string.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    gpp: Option<String>,
-
-    /// GPP section IDs as comma-separated string.
-    #[serde(rename = "gppSid", skip_serializing_if = "Option::is_none")]
-    gpp_sid: Option<String>,
-}
-
-/// GDPR consent information for APS requests.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct ApsGdprConsent {
-    /// Whether GDPR applies to this request.
-    enabled: bool,
-    /// TCF v2 consent string.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    consent: Option<String>,
-}
-
-/// APS slot configuration.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct ApsSlot {
-    /// Slot identifier
-    #[serde(rename = "slotID")]
-    slot_id: String,
-
-    /// Ad sizes [[width, height], ...]
-    sizes: Vec<[u32; 2]>,
-
-    /// Slot name (optional)
-    #[serde(rename = "slotName", skip_serializing_if = "Option::is_none")]
-    slot_name: Option<String>,
-}
-
-/// APS TAM bid response format matching real Amazon API.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct ApsBidResponse {
-    /// Contextual wrapper containing all response data
-    contextual: ApsContextual,
+use crate::settings::{IntegrationConfig, Settings};
+
+const APS_INTEGRATION_ID: &str = "aps";
+const APS_RENDERER_ROUTE: &str = "/integrations/aps/renderer";
+const DEFAULT_CURRENCY: &str = "USD";
+const APS_SDK_SOURCE: &str = "prebid";
+const APS_SDK_VERSION: &str = "2.2.0";
+const MAX_ACCOUNT_ID_BYTES: usize = 1024;
+const MAX_CREATIVE_URL_BYTES: usize = 4096;
+const MAX_PAGE_URL_BYTES: usize = 8192;
+const MAX_RENDER_ENVELOPE_BYTES: usize = 256 * 1024;
+const APS_RENDERER_CSP: &str = "default-src 'none'; sandbox allow-forms allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-scripts allow-top-navigation-by-user-activation; script-src 'unsafe-inline' https:; connect-src https:; frame-src https:; img-src https: data:; media-src https: blob:; style-src 'unsafe-inline' https:; font-src https: data:;";
+
+const APS_RENDERER_DOCUMENT: &str = r#"<!doctype html>
+<meta charset="utf-8">
+<script>
+(function(){
+'use strict';
+var match=/^#tsaps=([A-Za-z0-9_-]{22,128})$/.exec(location.hash);
+var expected=match&&match[1];
+try{history.replaceState(null,'',location.pathname+location.search);}catch(_error){}
+if(!expected)return;
+function keys(value,expectedKeys){
+ if(!value||typeof value!=='object'||Array.isArray(value))return false;
+ var actual=Object.keys(value).sort();
+ return actual.length===expectedKeys.length&&actual.every(function(key,index){return key===expectedKeys[index];});
 }
-
-/// APS Contextual response containing slots and metadata.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct ApsContextual {
-    /// Array of slot responses (one per requested slot)
-    #[serde(default)]
-    slots: Vec<ApsSlotResponse>,
-
-    /// Event tracking host
-    #[serde(skip_serializing_if = "Option::is_none")]
-    host: Option<String>,
-
-    /// Response status ("ok", "error", etc.)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    status: Option<String>,
-
-    /// Client-side feature enablement flag
-    #[serde(skip_serializing_if = "Option::is_none")]
-    cfe: Option<bool>,
-
-    /// Event tracking enabled
-    #[serde(skip_serializing_if = "Option::is_none")]
-    ev: Option<bool>,
-
-    /// Client feature name (CSM script path)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    cfn: Option<String>,
-
-    /// Callback version
-    #[serde(skip_serializing_if = "Option::is_none")]
-    cb: Option<String>,
-
-    /// Campaign tracking URL
-    #[serde(skip_serializing_if = "Option::is_none")]
-    cmp: Option<String>,
+function validRenderer(renderer){
+ if(!keys(renderer,['aaxResponse','accountId','bidId','creativeId','creativeUrl','height','tagType','type','version','width'])&&
+    !keys(renderer,['aaxResponse','accountId','bidId','creativeUrl','height','tagType','type','version','width']))return false;
+ if(renderer.type!=='aps'||renderer.version!==1||typeof renderer.accountId!=='string'||!renderer.accountId||new TextEncoder().encode(renderer.accountId).length>1024)return false;
+ if(typeof renderer.bidId!=='string'||!renderer.bidId||!Number.isInteger(renderer.width)||renderer.width<=0||!Number.isInteger(renderer.height)||renderer.height<=0)return false;
+ if(Object.prototype.hasOwnProperty.call(renderer,'creativeId')&&(typeof renderer.creativeId!=='string'||!renderer.creativeId))return false;
+ if(renderer.tagType!=='iframe'&&renderer.tagType!=='script')return false;
+ if(typeof renderer.creativeUrl!=='string'||new TextEncoder().encode(renderer.creativeUrl).length>4096)return false;
+ if(typeof renderer.aaxResponse!=='string'||!renderer.aaxResponse||renderer.aaxResponse.length>349528)return false;
+ try{
+  var url=new URL(renderer.creativeUrl);
+  if(url.protocol!=='https:'||url.username||url.password||url.origin===location.origin)return false;
+  var binary=atob(renderer.aaxResponse);
+  if(binary.length>262144||btoa(binary)!==renderer.aaxResponse)return false;
+  var bytes=Uint8Array.from(binary,function(character){return character.charCodeAt(0);});
+  var decoded=JSON.parse(new TextDecoder('utf-8',{fatal:true}).decode(bytes));
+  if(!keys(decoded,['seatbid'])||!Array.isArray(decoded.seatbid)||decoded.seatbid.length!==1)return false;
+  var seat=decoded.seatbid[0];
+  if(!keys(seat,['bid'])||!Array.isArray(seat.bid)||seat.bid.length!==1)return false;
+  var bid=seat.bid[0];
+  if(!keys(bid,['ext','h','id','price','w'])||!keys(bid.ext,['creativeurl','tagtype']))return false;
+  return bid.id===renderer.bidId&&bid.w===renderer.width&&bid.h===renderer.height&&
+   bid.ext.creativeurl===renderer.creativeUrl&&bid.ext.tagtype===renderer.tagType&&
+   typeof bid.price==='number'&&Number.isFinite(bid.price)&&bid.price>=0;
+ }catch(_error){return false;}
 }
-
-/// Individual APS slot response matching real Amazon format.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct ApsSlotResponse {
-    /// Slot ID this response is for
-    #[serde(rename = "slotID")]
-    slot_id: String,
-
-    /// Creative size (e.g., "300x250")
-    size: String,
-
-    /// Creative ID
-    #[serde(skip_serializing_if = "Option::is_none")]
-    crid: Option<String>,
-
-    /// Media type ("d" for display, "v" for video)
-    #[serde(rename = "mediaType", skip_serializing_if = "Option::is_none")]
-    media_type: Option<String>,
-
-    /// Fill indicator flag ("1" = filled, "0" = no fill)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    fif: Option<String>,
-
-    /// List of targeting key names that are set on this slot
-    #[serde(default)]
-    targeting: Vec<String>,
-
-    /// List of metadata field names
-    #[serde(default)]
-    meta: Vec<String>,
-
-    // Targeting key-value pairs (returned as flat fields)
-    /// Amazon impression ID (unique identifier for this bid)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    amzniid: Option<String>,
-
-    /// Amazon encoded bid price
-    #[serde(skip_serializing_if = "Option::is_none")]
-    amznbid: Option<String>,
-
-    /// Amazon encoded price (alternative encoding)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    amznp: Option<String>,
-
-    /// Amazon size in `WxH` format (e.g., "300x250")
-    #[serde(skip_serializing_if = "Option::is_none")]
-    amznsz: Option<String>,
-
-    /// Amazon auction context type ("OPEN", "PRIVATE", etc.)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    amznactt: Option<String>,
+function receive(event){
+ if(event.source!==parent)return;
+ var message=event.data;
+ if(!keys(message,['nonce','renderer'])||message.nonce!==expected||!validRenderer(message.renderer))return;
+ removeEventListener('message',receive);
+ var acceptedNonce=expected;
+ expected='';
+ var renderer=message.renderer;
+ window._aps=window._aps instanceof Map?window._aps:new Map();
+ var account=window._aps.get(renderer.accountId);
+ if(!account){
+  account={queue:[],store:new Map([['listeners',new Map()]])};
+  window._aps.set(renderer.accountId,account);
+ }
+ account.queue.push(new CustomEvent('prebid/creative/render',{detail:{aaxResponse:renderer.aaxResponse,seatBidId:renderer.bidId}}));
+ var script=document.createElement('script');
+ script.src='https://client.aps.amazon-adsystem.com/prebid-creative.js';
+ script.onload=function(){parent.postMessage({message:'trusted-server/aps/renderer-ready',nonce:acceptedNonce},'*');};
+ script.onerror=function(){parent.postMessage({message:'trusted-server/aps/renderer-failed',nonce:acceptedNonce},'*');};
+ document.head.appendChild(script);
 }
+addEventListener('message',receive);
+})();
+</script>
+"#;
 
-// ============================================================================
-// Real APS Provider
-// ============================================================================
-
-/// Configuration for APS integration.
+/// Configuration for the APS `OpenRTB` integration.
 #[derive(Debug, Clone, Deserialize, Serialize, Validate)]
 pub struct ApsConfig {
-    /// Whether APS integration is enabled
+    /// Whether APS integration is enabled.
     #[serde(default = "default_enabled")]
     pub enabled: bool,
-
-    /// APS publisher ID (accepts both string and integer from config)
-    #[serde(deserialize_with = "deserialize_pub_id")]
-    pub pub_id: String,
-
-    /// APS API endpoint
+    /// APS account ID. `pub_id` remains a deserialization alias only.
+    #[serde(alias = "pub_id", deserialize_with = "deserialize_account_id")]
+    pub account_id: String,
+    /// APS `OpenRTB` endpoint.
     #[serde(default = "default_endpoint")]
-    #[validate(url)]
+    #[validate(custom(function = "validate_aps_endpoint"))]
     pub endpoint: String,
-
-    /// Timeout in milliseconds
+    /// Timeout in milliseconds.
     #[serde(default = "default_timeout_ms")]
     pub timeout_ms: u32,
+    /// Whether APS script creatives are eligible before winner selection.
+    #[serde(default)]
+    pub allow_script_creatives: bool,
 }
 
-/// Custom deserializer for `pub_id` that accepts both string and integer
-fn deserialize_pub_id<'de, D>(deserializer: D) -> Result<String, D::Error>
+fn deserialize_account_id<'de, D>(deserializer: D) -> Result<String, D::Error>
 where
     D: serde::Deserializer<'de>,
 {
-    use serde::de::{self, Visitor};
-    use std::fmt;
-
-    struct PubIdVisitor;
+    struct AccountIdVisitor;
 
-    impl<'de> Visitor<'de> for PubIdVisitor {
+    impl Visitor<'_> for AccountIdVisitor {
         type Value = String;
 
-        fn expecting(&self, formatter: &mut fmt::Formatter) -> fmt::Result {
-            formatter.write_str("a string or integer for pub_id")
+        fn expecting(&self, formatter: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+            formatter.write_str("a non-empty string or integer for account_id")
         }
 
         fn visit_str<E>(self, value: &str) -> Result<String, E>
         where
             E: de::Error,
         {
+            let value = value.trim();
+            if value.is_empty() {
+                return Err(E::custom("account_id must not be empty"));
+            }
+            if value.len() > MAX_ACCOUNT_ID_BYTES {
+                return Err(E::custom("account_id is too large"));
+            }
             Ok(value.to_string())
         }
 
@@ -241,7 +164,7 @@ where
         where
             E: de::Error,
         {
-            Ok(value)
+            self.visit_str(&value)
         }
 
         fn visit_i64<E>(self, value: i64) -> Result<String, E>
@@ -259,7 +182,19 @@ where
         }
     }
 
-    deserializer.deserialize_any(PubIdVisitor)
+    deserializer.deserialize_any(AccountIdVisitor)
+}
+
+fn validate_aps_endpoint(value: &str) -> Result<(), ValidationError> {
+    let parsed = Url::parse(value).map_err(|_| ValidationError::new("invalid_aps_endpoint"))?;
+    if parsed.scheme() != "https"
+        || parsed.host_str().is_none()
+        || !parsed.username().is_empty()
+        || parsed.password().is_some()
+    {
+        return Err(ValidationError::new("invalid_aps_endpoint"));
+    }
+    Ok(())
 }
 
 fn default_enabled() -> bool {
@@ -267,7 +202,7 @@ fn default_enabled() -> bool {
 }
 
 fn default_endpoint() -> String {
-    "https://aax.amazon-adsystem.com/e/dtb/bid".to_string()
+    "https://web.ads.aps.amazon-adsystem.com/e/pb/bid".to_string()
 }
 
 fn default_timeout_ms() -> u32 {
@@ -277,10 +212,11 @@ fn default_timeout_ms() -> u32 {
 impl Default for ApsConfig {
     fn default() -> Self {
         Self {
-            enabled: default_enabled(),
-            pub_id: String::new(),
+            enabled: false,
+            account_id: String::new(),
             endpoint: default_endpoint(),
             timeout_ms: default_timeout_ms(),
+            allow_script_creatives: false,
         }
     }
 }
@@ -291,314 +227,548 @@ impl IntegrationConfig for ApsConfig {
     }
 }
 
-/// Amazon APS auction provider.
+#[derive(Debug, Serialize)]
+struct ApsRequestExt<'a> {
+    account: &'a str,
+    sdk: ApsSdkExt,
+}
+
+impl ToExt for ApsRequestExt<'_> {}
+
+#[derive(Debug, Serialize)]
+struct ApsSdkExt {
+    source: &'static str,
+    version: &'static str,
+}
+
+struct ApsRendererInput<'a> {
+    bid_id: &'a str,
+    creative_id: Option<String>,
+    tag_type: ApsTagType,
+    creative_url: &'a str,
+    price: f64,
+    width: u32,
+    height: u32,
+}
+
+/// APS `OpenRTB` auction provider.
 pub struct ApsAuctionProvider {
     config: ApsConfig,
 }
 
 impl ApsAuctionProvider {
-    /// Create a new APS auction provider.
+    /// Create an APS provider from validated configuration.
     #[must_use]
     pub fn new(config: ApsConfig) -> Self {
         Self { config }
     }
 
-    /// Resolve the APS-specific slot ID for a slot.
-    ///
-    /// Uses the APS slot ID from `[slot.providers.aps]` if configured; falls
-    /// back to the creative-opportunity slot ID otherwise.
-    fn aps_slot_id(slot: &crate::auction::types::AdSlot) -> String {
-        slot.bidders
-            .get("aps")
-            .and_then(|p| p.get("slotID"))
-            .and_then(|v| v.as_str())
-            .unwrap_or(&slot.id)
-            .to_string()
+    fn build_regs(consent: Option<&crate::consent::ConsentContext>) -> Option<Regs> {
+        let consent = consent?;
+        let ext = RegsExt {
+            gdpr: Some(u8::from(consent.gdpr_applies)),
+            us_privacy: consent.raw_us_privacy.clone(),
+            gpp: consent.raw_gpp_string.clone(),
+            gpp_sid: consent.gpp_section_ids.clone(),
+        };
+        Some(Regs {
+            coppa: None,
+            gdpr: Some(consent.gdpr_applies),
+            us_privacy: ext.us_privacy.clone(),
+            gpp: ext.gpp.clone(),
+            gpp_sid: ext
+                .gpp_sid
+                .as_ref()
+                .map(|ids| ids.iter().map(|id| i32::from(*id)).collect())
+                .unwrap_or_default(),
+            ext: ext.to_ext(),
+        })
     }
 
-    /// Build the APS slot ID → creative-opportunity slot ID map for `request`.
-    ///
-    /// Derived from the [`AuctionRequest`] on every call so the mapping stays
-    /// request-scoped: the provider instance is shared across concurrent
-    /// auctions on non-Fastly adapters, and instance state would let
-    /// overlapping auctions overwrite or consume each other's maps.
-    fn build_slot_id_map(request: &AuctionRequest) -> HashMap<String, String> {
-        let mut slot_id_map: HashMap<String, String> = HashMap::new();
-        for slot in &request.slots {
-            let aps_slot_id = Self::aps_slot_id(slot);
-            // Last-write-wins: two slots configuring the same
-            // `[bidders.aps].slotID` would remap one slot's bids to the
-            // wrong creative slot. Log the collision so a misconfiguration
-            // is diagnosable, mirroring the build_bid_index collision log.
-            if let Some(previous_slot_id) = slot_id_map.insert(aps_slot_id.clone(), slot.id.clone())
-            {
-                log::debug!(
-                    "APS slot ID '{aps_slot_id}' maps to multiple creative slots \
-                     ('{previous_slot_id}' overwritten by '{}'); bids for this APS \
-                     slot will resolve to the last one",
-                    slot.id,
-                );
-            }
+    fn request_language(context: &AuctionContext<'_>) -> Option<String> {
+        context
+            .request
+            .headers()
+            .get(header::ACCEPT_LANGUAGE)
+            .and_then(|value| value.to_str().ok())
+            .and_then(|value| value.split(',').next())
+            .and_then(|value| value.split(';').next())
+            .and_then(|value| value.split('-').next())
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+            .map(str::to_string)
+    }
+
+    fn request_dnt(context: &AuctionContext<'_>) -> Option<bool> {
+        context
+            .request
+            .headers()
+            .get("DNT")
+            .and_then(|value| value.to_str().ok())
+            .is_some_and(|value| value.trim() == "1")
+            .then_some(true)
+    }
+
+    fn valid_http_url(value: &str) -> Option<String> {
+        if value.len() > MAX_PAGE_URL_BYTES {
+            return None;
+        }
+        let parsed = Url::parse(value).ok()?;
+        if !matches!(parsed.scheme(), "http" | "https")
+            || parsed.host_str().is_none()
+            || !parsed.username().is_empty()
+            || parsed.password().is_some()
+        {
+            return None;
         }
-        slot_id_map
+        Some(parsed.to_string())
     }
 
-    /// Convert unified `AuctionRequest` to APS TAM bid request format.
-    ///
-    /// Populates consent fields (GDPR, US Privacy, GPP) from the
-    /// [`ConsentContext`](crate::consent::ConsentContext) attached to the request.
-    ///
-    /// `timeout_ms` is the effective auction budget for this provider (already
-    /// capped by the orchestrator) — advertised to APS so it never expects more
-    /// time than the edge will actually wait.
-    fn to_aps_request(&self, request: &AuctionRequest, timeout_ms: u32) -> ApsBidRequest {
-        let slots: Vec<ApsSlot> = request
+    fn build_openrtb_request(
+        &self,
+        request: &AuctionRequest,
+        context: &AuctionContext<'_>,
+    ) -> OpenRtbRequest {
+        let imp = request
             .slots
             .iter()
-            .map(|slot| {
-                let aps_slot_id = Self::aps_slot_id(slot);
-
-                // Extract sizes from banner formats
-                let sizes: Vec<[u32; 2]> = slot
+            .filter_map(|slot| {
+                let slot_context = format!("slot '{}'", slot.id);
+                let formats: Vec<Format> = slot
                     .formats
                     .iter()
-                    .filter(|f| f.media_type == MediaType::Banner)
-                    .map(|f| [f.width, f.height])
+                    .filter(|format| format.media_type == MediaType::Banner)
+                    .filter_map(|format| {
+                        Some(Format {
+                            w: to_openrtb_i32(format.width, "format.w", &slot_context),
+                            h: to_openrtb_i32(format.height, "format.h", &slot_context),
+                            ..Default::default()
+                        })
+                        .filter(|format| format.w.is_some() && format.h.is_some())
+                    })
                     .collect();
-
-                ApsSlot {
-                    slot_id: aps_slot_id,
-                    sizes,
-                    slot_name: Some(slot.id.clone()),
-                }
+                let first = formats.first()?;
+                Some(Imp {
+                    id: Some(slot.id.clone()),
+                    banner: Some(Banner {
+                        format: formats.clone(),
+                        w: first.w,
+                        h: first.h,
+                        topframe: Some(false),
+                        ..Default::default()
+                    }),
+                    bidfloor: slot.floor_price,
+                    bidfloorcur: slot.floor_price.map(|_| DEFAULT_CURRENCY.to_string()),
+                    secure: Some(true),
+                    ..Default::default()
+                })
             })
             .collect();
 
-        // Build consent fields from ConsentContext
-        let consent_ctx = request.user.consent.as_ref();
-        let gdpr = consent_ctx.map(|ctx| ApsGdprConsent {
-            enabled: ctx.gdpr_applies,
-            consent: ctx.raw_tc_string.clone(),
-        });
-        let us_privacy = consent_ctx.and_then(|ctx| ctx.raw_us_privacy.clone());
-        let gpp = consent_ctx.and_then(|ctx| ctx.raw_gpp_string.clone());
-        let gpp_sid = consent_ctx.and_then(|ctx| {
-            ctx.gpp_section_ids.as_ref().map(|ids| {
-                ids.iter()
-                    .map(std::string::ToString::to_string)
-                    .collect::<Vec<_>>()
-                    .join(",")
-            })
+        let consent = request.user.consent.as_ref();
+        let raw_tc = consent.and_then(|value| value.raw_tc_string.clone());
+        let user = Some(User {
+            id: request.user.id.clone(),
+            consent: raw_tc.clone(),
+            ext: UserExt {
+                consent: raw_tc,
+                consented_providers_settings: None,
+                eids: request.user.eids.clone(),
+            }
+            .to_ext(),
+            ..Default::default()
         });
 
-        ApsBidRequest {
-            pub_id: self.config.pub_id.clone(),
-            slots,
-            page_url: request.publisher.page_url.clone(),
-            user_agent: request.device.as_ref().and_then(|d| d.user_agent.clone()),
-            timeout: Some(timeout_ms),
-            gdpr,
-            us_privacy,
-            gpp,
-            gpp_sid,
+        let language = Self::request_language(context);
+        let dnt = Self::request_dnt(context);
+        let device = request
+            .device
+            .as_ref()
+            .map(|device| Device {
+                ua: device.user_agent.clone(),
+                ip: device.ip.clone(),
+                geo: device.geo.as_ref().map(|geo| Geo {
+                    country: Some(geo.country.clone()),
+                    region: geo.region.clone(),
+                    city: Some(geo.city.clone()),
+                    metro: (geo.metro_code > 0).then(|| geo.metro_code.to_string()),
+                    r#type: Some(2),
+                    ..Default::default()
+                }),
+                dnt,
+                language: language.clone(),
+                ..Default::default()
+            })
+            .or_else(|| {
+                (dnt.is_some() || language.is_some()).then_some(Device {
+                    dnt,
+                    language,
+                    ..Default::default()
+                })
+            });
+
+        let page = request
+            .publisher
+            .page_url
+            .as_deref()
+            .and_then(Self::valid_http_url)
+            .unwrap_or_else(|| format!("https://{}", request.publisher.domain));
+        let referer = context
+            .request
+            .headers()
+            .get(header::REFERER)
+            .and_then(|value| value.to_str().ok())
+            .and_then(Self::valid_http_url)
+            .filter(|value| value != &page);
+
+        OpenRtbRequest {
+            id: Some(request.id.clone()),
+            imp,
+            site: Some(Site {
+                domain: Some(request.publisher.domain.clone()),
+                page: Some(page),
+                r#ref: referer,
+                publisher: Some(Publisher {
+                    domain: Some(request.publisher.domain.clone()),
+                    ..Default::default()
+                }),
+                ..Default::default()
+            }),
+            user,
+            device,
+            regs: Self::build_regs(consent),
+            tmax: to_openrtb_i32(context.timeout_ms, "tmax", "APS request"),
+            cur: vec![DEFAULT_CURRENCY.to_string()],
+            ext: ApsRequestExt {
+                account: &self.config.account_id,
+                sdk: ApsSdkExt {
+                    source: APS_SDK_SOURCE,
+                    version: APS_SDK_VERSION,
+                },
+            }
+            .to_ext(),
+            ..Default::default()
         }
     }
 
-    /// Parse size string (e.g., "300x250") into width and height.
-    fn parse_size(size: &str) -> Option<(u32, u32)> {
-        let parts: Vec<&str> = size.split('x').collect();
-        if parts.len() == 2
-            && let (Ok(w), Ok(h)) = (parts[0].parse::<u32>(), parts[1].parse::<u32>())
-        {
-            return Some((w, h));
-        }
-        None
+    fn compatible_dimensions(slot: &AdSlot, width: u32, height: u32) -> bool {
+        width > 0
+            && height > 0
+            && slot.formats.iter().any(|format| {
+                format.media_type == MediaType::Banner
+                    && format.width == width
+                    && format.height == height
+            })
     }
 
-    /// Parse a single APS slot response into unified Bid format.
-    ///
-    /// Note: Price is NOT decoded here. The encoded price is stored in metadata
-    /// and will be decoded by the mediation layer (mocktioneer). This simulates
-    /// real-world APS where only Amazon/GAM can decode the proprietary price encoding.
-    fn parse_aps_slot(&self, slot: &ApsSlotResponse) -> Result<Bid, ()> {
-        // Only process filled slots (fif == "1")
-        if slot.fif.as_deref() != Some("1") {
-            return Err(());
+    fn valid_creative_url(&self, value: &str, publisher_domain: &str) -> bool {
+        if value.len() > MAX_CREATIVE_URL_BYTES {
+            return false;
         }
+        let Ok(parsed) = Url::parse(value) else {
+            return false;
+        };
+        parsed.scheme() == "https"
+            && parsed
+                .host_str()
+                .is_some_and(|host| !host.eq_ignore_ascii_case(publisher_domain))
+            && parsed.username().is_empty()
+            && parsed.password().is_none()
+    }
 
-        // Verify we have an encoded price field
-        let encoded_price = slot.amznbid.as_ref().or(slot.amznp.as_ref());
-        if encoded_price.is_none() {
-            log::debug!(
-                "APS: slot '{}' has no encoded price, skipping",
-                slot.slot_id
-            );
-            return Err(());
+    fn build_renderer(&self, input: ApsRendererInput<'_>) -> Option<BidRenderer> {
+        let tag_type_value = match input.tag_type {
+            ApsTagType::Iframe => "iframe",
+            ApsTagType::Script => "script",
+        };
+        let envelope = json!({
+            "seatbid": [{
+                "bid": [{
+                    "id": input.bid_id,
+                    "price": input.price,
+                    "w": input.width,
+                    "h": input.height,
+                    "ext": {
+                        "creativeurl": input.creative_url,
+                        "tagtype": tag_type_value
+                    }
+                }]
+            }]
+        });
+        let serialized = serde_json::to_vec(&envelope).ok()?;
+        if serialized.len() > MAX_RENDER_ENVELOPE_BYTES {
+            return None;
         }
+        Some(BidRenderer::Aps(ApsRendererV1 {
+            version: 1,
+            account_id: self.config.account_id.clone(),
+            bid_id: input.bid_id.to_string(),
+            creative_id: input.creative_id,
+            tag_type: input.tag_type,
+            creative_url: input.creative_url.to_string(),
+            aax_response: BASE64_STANDARD.encode(serialized),
+            width: input.width,
+            height: input.height,
+        }))
+    }
 
-        // Parse size from "WxH" format
-        let (width, height) = match Self::parse_size(&slot.size) {
-            Some(dims) => dims,
-            None => {
-                log::debug!(
-                    "APS: slot '{}' has malformed size '{}', skipping",
-                    slot.slot_id,
-                    slot.size
-                );
-                return Err(());
-            }
-        };
+    fn increment_reason(reasons: &mut BTreeMap<String, u64>, reason: &'static str) {
+        *reasons.entry(reason.to_string()).or_default() += 1;
+    }
 
-        // Build metadata from targeting keys - includes encoded price for mediation
-        let mut metadata = HashMap::new();
-        if let Some(ref amzniid) = slot.amzniid {
-            metadata.insert("amzniid".to_string(), json!(amzniid));
-        }
-        if let Some(ref amznbid) = slot.amznbid {
-            metadata.insert("amznbid".to_string(), json!(amznbid));
-        }
-        if let Some(ref amznp) = slot.amznp {
-            metadata.insert("amznp".to_string(), json!(amznp));
+    fn parse_bid(
+        &self,
+        value: &Json,
+        slots: &HashMap<&str, &AdSlot>,
+        publisher_domain: &str,
+    ) -> Result<Bid, &'static str> {
+        let bid_id = value
+            .get("id")
+            .and_then(Json::as_str)
+            .filter(|value| !value.is_empty())
+            .ok_or("missing_render_source")?;
+        let slot_id = value
+            .get("impid")
+            .and_then(Json::as_str)
+            .ok_or("unknown_impid")?;
+        let slot = slots.get(slot_id).ok_or("unknown_impid")?;
+        let price = value
+            .get("price")
+            .and_then(Json::as_f64)
+            .filter(|price| price.is_finite() && *price >= 0.0)
+            .ok_or("invalid_price")?;
+        if value
+            .get("mtype")
+            .is_some_and(|mtype| mtype.as_i64() != Some(1))
+        {
+            return Err("unsupported_media_type");
         }
-        if let Some(ref amznsz) = slot.amznsz {
-            metadata.insert("amznsz".to_string(), json!(amznsz));
+        let width = value
+            .get("w")
+            .and_then(Json::as_u64)
+            .and_then(|value| u32::try_from(value).ok())
+            .ok_or("invalid_dimensions")?;
+        let height = value
+            .get("h")
+            .and_then(Json::as_u64)
+            .and_then(|value| u32::try_from(value).ok())
+            .ok_or("invalid_dimensions")?;
+        if !Self::compatible_dimensions(slot, width, height) {
+            return Err("invalid_dimensions");
         }
-        if let Some(ref amznactt) = slot.amznactt {
-            metadata.insert("amznactt".to_string(), json!(amznactt));
+        let ext = value
+            .get("ext")
+            .and_then(Json::as_object)
+            .ok_or("missing_render_source")?;
+        let creative_url = ext
+            .get("creativeurl")
+            .and_then(Json::as_str)
+            .ok_or("missing_render_source")?;
+        if !self.valid_creative_url(creative_url, publisher_domain) {
+            return Err("invalid_creative_url");
         }
+        let tag_type = match ext.get("tagtype").and_then(Json::as_str) {
+            Some("iframe") => ApsTagType::Iframe,
+            Some("script") if self.config.allow_script_creatives => ApsTagType::Script,
+            Some("script") => return Err("script_rendering_disabled"),
+            _ => return Err("unsupported_tagtype"),
+        };
+        let creative_id = value
+            .get("crid")
+            .and_then(Json::as_str)
+            .filter(|creative_id| !creative_id.is_empty())
+            .map(str::to_string);
+        let renderer = self
+            .build_renderer(ApsRendererInput {
+                bid_id,
+                creative_id: creative_id.clone(),
+                tag_type,
+                creative_url,
+                price,
+                width,
+                height,
+            })
+            .ok_or("render_payload_too_large")?;
+        let adomain = value
+            .get("adomain")
+            .and_then(Json::as_array)
+            .map(|domains| {
+                domains
+                    .iter()
+                    .filter_map(Json::as_str)
+                    .map(str::to_string)
+                    .collect()
+            });
 
-        // APS doesn't return creative HTML - only targeting keys
-        // The creative will be generated by the mediation layer
-        // Price is None - will be decoded by mediation layer from amznbid metadata
         Ok(Bid {
-            slot_id: slot.slot_id.clone(),
-            price: None, // Encoded price in metadata, decoded by mediation
-            currency: "USD".to_string(),
+            slot_id: slot_id.to_string(),
+            price: Some(price),
+            currency: DEFAULT_CURRENCY.to_string(),
             creative: None,
-            adomain: None, // APS doesn't provide adomain in response
-            bidder: "amazon-aps".to_string(),
+            adomain,
+            bidder: APS_INTEGRATION_ID.to_string(),
             width,
             height,
-            nurl: None, // Real APS uses client-side event tracking
+            nurl: None,
             burl: None,
-            ad_id: None,
+            bid_id: Some(bid_id.to_string()),
+            ad_id: value.get("adid").and_then(Json::as_str).map(str::to_string),
+            creative_id,
+            renderer: Some(renderer),
             cache_id: None,
             cache_host: None,
             cache_path: None,
-            metadata,
+            metadata: HashMap::new(),
         })
     }
 
-    /// Parse APS TAM response into unified `AuctionResponse`.
-    ///
-    /// `slot_map` is the request-scoped APS slot ID → creative-opportunity
-    /// slot ID mapping built by [`Self::build_slot_id_map`].
     fn parse_aps_response(
         &self,
-        json: &Json,
+        value: &Json,
         response_time_ms: u64,
-        slot_map: &HashMap<String, String>,
+        request: &AuctionRequest,
     ) -> AuctionResponse {
-        let mut bids = Vec::new();
-
-        // Try to parse as ApsBidResponse with contextual wrapper
-        if let Ok(aps_response) = serde_json::from_value::<ApsBidResponse>(json.clone()) {
-            log::debug!(
-                "APS: parsed contextual response with {} slots",
-                aps_response.contextual.slots.len()
-            );
+        if !value.is_object()
+            || value.get("contextual").is_some()
+            || value
+                .get("cur")
+                .is_some_and(|currency| !currency.is_string())
+            || value
+                .get("seatbid")
+                .is_some_and(|seatbids| !seatbids.is_array())
+        {
+            return AuctionResponse::error(APS_INTEGRATION_ID, response_time_ms)
+                .with_metadata("drop_reasons", json!({"unexpected_response_shape": 1}));
+        }
+        if value
+            .get("cur")
+            .and_then(Json::as_str)
+            .is_some_and(|currency| !currency.eq_ignore_ascii_case(DEFAULT_CURRENCY))
+        {
+            return AuctionResponse::no_bid(APS_INTEGRATION_ID, response_time_ms)
+                .with_metadata("drop_reasons", json!({"unsupported_currency": 1}));
+        }
 
-            for slot in aps_response.contextual.slots {
-                match self.parse_aps_slot(&slot) {
-                    Ok(mut bid) => {
-                        // Remap APS slot ID (e.g. "aps-slot-atf-sidebar") back to the
-                        // creative-opportunity slot ID (e.g. "atf_sidebar_ad") so the
-                        // mediator and bid_map can match by creative slot ID.
-                        if let Some(creative_id) = slot_map.get(&bid.slot_id) {
-                            bid.slot_id = creative_id.clone();
+        let slots: HashMap<&str, &AdSlot> = request
+            .slots
+            .iter()
+            .map(|slot| (slot.id.as_str(), slot))
+            .collect();
+        let seatbids = value.get("seatbid").and_then(Json::as_array);
+        let seatbid_count = seatbids.map_or(0, Vec::len);
+        let mut reasons = BTreeMap::new();
+        let mut selected: HashMap<String, Bid> = HashMap::new();
+        let mut dropped = 0_u64;
+
+        for seatbid in seatbids.into_iter().flatten() {
+            let Some(bids) = seatbid.get("bid").and_then(Json::as_array) else {
+                continue;
+            };
+            for value in bids {
+                match self.parse_bid(value, &slots, &request.publisher.domain) {
+                    Ok(candidate) => {
+                        let replace = selected.get(&candidate.slot_id).is_none_or(|current| {
+                            let candidate_price = candidate.price.unwrap_or_default();
+                            let current_price = current.price.unwrap_or_default();
+                            candidate_price > current_price
+                                || (candidate_price == current_price
+                                    && candidate.bid_id.as_deref().unwrap_or_default()
+                                        < current.bid_id.as_deref().unwrap_or_default())
+                        });
+                        if replace {
+                            if selected
+                                .insert(candidate.slot_id.clone(), candidate)
+                                .is_some()
+                            {
+                                dropped += 1;
+                            }
+                        } else {
+                            dropped += 1;
                         }
-                        let encoded_price = bid
-                            .metadata
-                            .get("amznbid")
-                            .and_then(|v| v.as_str())
-                            .unwrap_or("unknown");
-                        log::debug!(
-                            "APS: parsed bid for slot '{}' with encoded price (to be decoded by mediation)",
-                            bid.slot_id,
-                        );
-                        log::trace!(
-                            "APS: slot '{}' encoded price: {}",
-                            bid.slot_id,
-                            encoded_price
-                        );
-                        bids.push(bid);
                     }
-                    Err(_) => {
-                        log::debug!("APS: skipped slot (no fill or invalid)");
+                    Err(reason) => {
+                        dropped += 1;
+                        Self::increment_reason(&mut reasons, reason);
                     }
                 }
             }
-        } else {
-            log::warn!("APS: failed to parse response as contextual format");
         }
 
-        if bids.is_empty() {
-            AuctionResponse::no_bid("aps", response_time_ms)
-        } else {
-            AuctionResponse::success("aps", bids, response_time_ms)
+        if seatbid_count == 0 {
+            Self::increment_reason(&mut reasons, "empty_seatbid");
         }
+        let accepted = selected.len();
+        let metadata = [
+            ("seatbid_count".to_string(), json!(seatbid_count)),
+            ("accepted_bid_count".to_string(), json!(accepted)),
+            ("dropped_bid_count".to_string(), json!(dropped)),
+            ("drop_reasons".to_string(), json!(reasons)),
+        ];
+        let mut response = if selected.is_empty() {
+            AuctionResponse::no_bid(APS_INTEGRATION_ID, response_time_ms)
+        } else {
+            AuctionResponse::success(
+                APS_INTEGRATION_ID,
+                selected.into_values().collect(),
+                response_time_ms,
+            )
+        };
+        response.metadata.extend(metadata);
+        response
     }
 
-    /// Shared parse path for both trait entry points.
-    ///
-    /// # Errors
-    ///
-    /// Returns an error when the response body cannot be read or is not valid JSON.
     async fn parse_response_inner(
         &self,
         response: PlatformResponse,
         response_time_ms: u64,
-        slot_map: &HashMap<String, String>,
+        request: Option<&AuctionRequest>,
     ) -> Result<AuctionResponse, Report<TrustedServerError>> {
         let response = response.response;
-
-        // Check status code
+        if response.status() == StatusCode::NO_CONTENT {
+            return Ok(AuctionResponse::no_bid(
+                APS_INTEGRATION_ID,
+                response_time_ms,
+            ));
+        }
         if !response.status().is_success() {
-            log::warn!("APS returned non-success status: {}", response.status());
-            return Ok(AuctionResponse::error("aps", response_time_ms));
+            log::warn!("APS returns a non-success status");
+            return Ok(AuctionResponse::error(APS_INTEGRATION_ID, response_time_ms));
         }
-
-        // Parse response body — collect_response_bounded caps memory from misbehaving providers.
-        let body_bytes =
-            collect_response_bounded(response.into_body(), UPSTREAM_RTB_MAX_RESPONSE_BYTES, "aps")
-                .await
-                .change_context(TrustedServerError::Auction {
-                    message: "Failed to read APS response body".to_string(),
-                })?;
-        let response_json: Json =
-            serde_json::from_slice(&body_bytes).change_context(TrustedServerError::Auction {
-                message: "Failed to parse APS response JSON".to_string(),
-            })?;
-
-        log::trace!("APS: received response: {:?}", response_json);
-
-        // Transform to unified format
-        let auction_response = self.parse_aps_response(&response_json, response_time_ms, slot_map);
-
+        let body = collect_response_bounded(
+            response.into_body(),
+            UPSTREAM_RTB_MAX_RESPONSE_BYTES,
+            APS_INTEGRATION_ID,
+        )
+        .await
+        .change_context(TrustedServerError::Auction {
+            message: "Failed to read APS response body".to_string(),
+        })?;
+        log::trace!("APS response body: {}", String::from_utf8_lossy(&body));
+        let value: Json = match serde_json::from_slice(&body) {
+            Ok(value) => value,
+            Err(error) => {
+                log::warn!("Failed to parse APS response JSON: {error}");
+                return Ok(AuctionResponse::error(APS_INTEGRATION_ID, response_time_ms)
+                    .with_metadata("drop_reasons", json!({"unexpected_response_shape": 1})));
+            }
+        };
+        let Some(request) = request else {
+            return Ok(AuctionResponse::error(APS_INTEGRATION_ID, response_time_ms));
+        };
+        let parsed = self.parse_aps_response(&value, response_time_ms, request);
         log::info!(
-            "APS returned {} bids in {}ms",
-            auction_response.bids.len(),
+            "APS returns {} accepted bids in {}ms",
+            parsed.bids.len(),
             response_time_ms
         );
-
-        Ok(auction_response)
+        Ok(parsed)
     }
 }
 
 #[async_trait(?Send)]
 impl AuctionProvider for ApsAuctionProvider {
     fn provider_name(&self) -> &'static str {
-        "aps"
+        APS_INTEGRATION_ID
     }
 
     async fn request_bids(
@@ -606,67 +776,42 @@ impl AuctionProvider for ApsAuctionProvider {
         request: &AuctionRequest,
         context: &AuctionContext<'_>,
     ) -> Result<PlatformPendingRequest, Report<TrustedServerError>> {
-        log::info!(
-            "APS: requesting bids for {} slots (pub_id: {})",
-            request.slots.len(),
-            self.config.pub_id
-        );
-
-        // Transform to APS format. `context.timeout_ms` is the effective budget
-        // the orchestrator granted this provider — the payload must advertise
-        // the same deadline the edge backend enforces below. The APS-slot-ID →
-        // creative-slot-ID remapping is rebuilt from the request in
-        // `parse_response_with_context`, keeping it request-scoped.
-        let aps_request = self.to_aps_request(request, context.timeout_ms);
-
-        // Serialize to JSON
-        let aps_json =
-            serde_json::to_value(&aps_request).change_context(TrustedServerError::Auction {
-                message: "Failed to serialize APS bid request".to_string(),
-            })?;
-
-        log::trace!("APS: sending bid request: {:?}", aps_json);
-
-        // Create HTTP POST request
-        let aps_body =
-            serde_json::to_vec(&aps_json).change_context(TrustedServerError::Auction {
-                message: "Failed to serialize APS request body".to_string(),
-            })?;
-        let aps_req = http::Request::builder()
+        let openrtb = self.build_openrtb_request(request, context);
+        if openrtb.imp.is_empty() {
+            return Err(Report::new(TrustedServerError::Auction {
+                message: "No valid APS impressions after filtering".to_string(),
+            }));
+        }
+        log::info!("APS requests bids for {} impressions", openrtb.imp.len());
+        log::trace!("APS request body: {openrtb:?}");
+        let body = serde_json::to_vec(&openrtb).change_context(TrustedServerError::Auction {
+            message: "Failed to serialize APS OpenRTB request".to_string(),
+        })?;
+        let request = http::Request::builder()
             .method(Method::POST)
             .uri(&self.config.endpoint)
             .header(header::CONTENT_TYPE, "application/json")
-            .body(EdgeBody::from(aps_body))
+            .body(EdgeBody::from(body))
             .change_context(TrustedServerError::Auction {
                 message: "Failed to build APS request".to_string(),
             })?;
-
-        // Uses context.timeout_ms (auction-scoped) rather than the 15 s fixed
-        // timeout in ensure_integration_backend, which is for proxy endpoints.
-        // Send request asynchronously with auction-scoped timeout
-        let backend_name = ensure_integration_backend_with_timeout(
+        let backend = ensure_integration_backend_with_timeout(
             context.services,
             &self.config.endpoint,
-            "aps",
+            APS_INTEGRATION_ID,
             Duration::from_millis(u64::from(context.timeout_ms)),
         )
         .change_context(TrustedServerError::Auction {
-            message: format!(
-                "Failed to resolve backend for APS endpoint: {}",
-                self.config.endpoint
-            ),
+            message: "Failed to resolve APS backend".to_string(),
         })?;
-
-        let pending = context
+        context
             .services
             .http_client()
-            .send_async(PlatformHttpRequest::new(aps_req, backend_name))
+            .send_async(PlatformHttpRequest::new(request, backend))
             .await
             .change_context(TrustedServerError::Auction {
-                message: "Failed to send async request to APS".to_string(),
-            })?;
-
-        Ok(pending)
+                message: "Failed to send APS request".to_string(),
+            })
     }
 
     async fn parse_response(
@@ -674,11 +819,7 @@ impl AuctionProvider for ApsAuctionProvider {
         response: PlatformResponse,
         response_time_ms: u64,
     ) -> Result<AuctionResponse, Report<TrustedServerError>> {
-        // No auction request available — bids keep their raw APS slot IDs. The
-        // orchestrator always calls [`Self::parse_response_with_context`], so
-        // this path only serves callers outside the orchestration flow.
-        log::debug!("APS: parsing without request context — slot ID remapping unavailable");
-        self.parse_response_inner(response, response_time_ms, &HashMap::new())
+        self.parse_response_inner(response, response_time_ms, None)
             .await
     }
 
@@ -689,17 +830,12 @@ impl AuctionProvider for ApsAuctionProvider {
         request: &AuctionRequest,
         _context: &AuctionContext<'_>,
     ) -> Result<AuctionResponse, Report<TrustedServerError>> {
-        // Rebuild the APS-slot-ID → creative-slot-ID map from the auction
-        // request so overlapping auctions on shared provider instances cannot
-        // overwrite or consume each other's mappings.
-        let slot_map = Self::build_slot_id_map(request);
-        self.parse_response_inner(response, response_time_ms, &slot_map)
+        self.parse_response_inner(response, response_time_ms, Some(request))
             .await
     }
 
     fn supports_media_type(&self, media_type: &MediaType) -> bool {
-        // APS supports banner and video formats
-        matches!(media_type, MediaType::Banner | MediaType::Video)
+        matches!(media_type, MediaType::Banner)
     }
 
     fn timeout_ms(&self) -> u32 {
@@ -714,717 +850,671 @@ impl AuctionProvider for ApsAuctionProvider {
         predict_integration_backend_name(
             services,
             &self.config.endpoint,
-            "aps",
+            APS_INTEGRATION_ID,
             Duration::from_millis(u64::from(timeout_ms)),
         )
-        .inspect_err(|e| {
-            log::error!(
-                "Failed to predict backend name for APS endpoint '{}': {e:?}",
-                self.config.endpoint
-            );
-        })
+        .inspect_err(|error| log::error!("Failed to predict APS backend name: {error:?}"))
         .ok()
     }
 }
 
-// ============================================================================
-// Provider Auto-Registration
-// ============================================================================
+#[derive(Debug)]
+struct ApsRendererIntegration;
 
-use crate::settings::Settings;
-use std::sync::Arc;
+#[async_trait(?Send)]
+impl IntegrationProxy for ApsRendererIntegration {
+    fn integration_name(&self) -> &'static str {
+        APS_INTEGRATION_ID
+    }
 
-/// Auto-register APS provider based on settings configuration.
+    fn routes(&self) -> Vec<IntegrationEndpoint> {
+        vec![IntegrationEndpoint::get(APS_RENDERER_ROUTE)]
+    }
+
+    async fn handle(
+        &self,
+        _settings: &Settings,
+        _services: &RuntimeServices,
+        request: http::Request<EdgeBody>,
+    ) -> Result<http::Response<EdgeBody>, Report<TrustedServerError>> {
+        if request.method() != Method::GET || request.uri().path() != APS_RENDERER_ROUTE {
+            return http::Response::builder()
+                .status(StatusCode::NOT_FOUND)
+                .body(EdgeBody::from("Not Found"))
+                .change_context(TrustedServerError::Integration {
+                    integration: APS_INTEGRATION_ID.to_string(),
+                    message: "Failed to build APS not-found response".to_string(),
+                });
+        }
+        http::Response::builder()
+            .status(StatusCode::OK)
+            .header(header::CONTENT_TYPE, "text/html; charset=utf-8")
+            .header("x-content-type-options", "nosniff")
+            .header("referrer-policy", "no-referrer")
+            .header(header::CONTENT_SECURITY_POLICY, APS_RENDERER_CSP)
+            .body(EdgeBody::from(APS_RENDERER_DOCUMENT))
+            .change_context(TrustedServerError::Integration {
+                integration: APS_INTEGRATION_ID.to_string(),
+                message: "Failed to build APS renderer response".to_string(),
+            })
+    }
+}
+
+/// Register the APS static renderer endpoint when APS is enabled.
+///
+/// # Errors
 ///
-/// Returns the APS provider if enabled in settings.
+/// Returns an error when enabled APS configuration is invalid.
+pub fn register(
+    settings: &Settings,
+) -> Result<Option<IntegrationRegistration>, Report<TrustedServerError>> {
+    let Some(_config) = settings.integration_config::<ApsConfig>(APS_INTEGRATION_ID)? else {
+        return Ok(None);
+    };
+    let integration = Arc::new(ApsRendererIntegration);
+    Ok(Some(
+        IntegrationRegistration::builder(APS_INTEGRATION_ID)
+            .with_proxy(integration)
+            .without_js()
+            .build(),
+    ))
+}
+
+/// Register the APS auction provider when enabled.
 ///
 /// # Errors
 ///
-/// Returns an error when the APS provider is enabled with invalid
-/// configuration.
+/// Returns an error when enabled APS configuration is invalid.
 pub fn register_providers(
     settings: &Settings,
 ) -> Result<Vec<Arc<dyn AuctionProvider>>, Report<TrustedServerError>> {
-    let mut providers: Vec<Arc<dyn AuctionProvider>> = Vec::new();
-
-    // Check for real APS provider configuration
-    match settings.integration_config::<ApsConfig>("aps") {
-        Ok(Some(config)) => {
-            log::info!(
-                "Registering real APS provider (pub_id: {}, endpoint: {})",
-                config.pub_id,
-                config.endpoint
-            );
-            providers.push(Arc::new(ApsAuctionProvider::new(config)));
-        }
-        Ok(None) => {
-            log::debug!("APS integration config found but is disabled");
-        }
-        Err(e) => {
-            return Err(e);
-        }
-    }
-
-    Ok(providers)
+    let Some(config) = settings.integration_config::<ApsConfig>(APS_INTEGRATION_ID)? else {
+        return Ok(Vec::new());
+    };
+    log::info!("Registering APS OpenRTB provider");
+    Ok(vec![Arc::new(ApsAuctionProvider::new(config))])
 }
 
-// ============================================================================
-// Tests
-// ============================================================================
-
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::auction::types::*;
+    use crate::auction::types::{
+        AdFormat, AdSlot, AuctionContext, AuctionRequest, BidStatus, DeviceInfo, PublisherInfo,
+        UserInfo,
+    };
+    use crate::consent::ConsentContext;
+    use crate::openrtb::{Eid, Uid};
+    use crate::platform::GeoInfo;
+    use crate::platform::test_support::noop_services;
+    use crate::test_support::tests::create_test_settings;
+    use serde_json::json;
+
+    fn config() -> ApsConfig {
+        ApsConfig {
+            enabled: true,
+            account_id: "example-account-id".to_string(),
+            endpoint: default_endpoint(),
+            timeout_ms: 800,
+            allow_script_creatives: false,
+        }
+    }
 
-    fn create_test_auction_request() -> AuctionRequest {
+    fn request() -> AuctionRequest {
         AuctionRequest {
-            id: "test-auction-123".to_string(),
-            slots: vec![
-                AdSlot {
-                    id: "header-banner".to_string(),
-                    formats: vec![
-                        AdFormat {
-                            media_type: MediaType::Banner,
-                            width: 728,
-                            height: 90,
-                        },
-                        AdFormat {
-                            media_type: MediaType::Banner,
-                            width: 970,
-                            height: 250,
-                        },
-                    ],
-                    floor_price: Some(1.50),
-                    targeting: HashMap::new(),
-                    bidders: HashMap::new(),
-                },
-                AdSlot {
-                    id: "sidebar".to_string(),
-                    formats: vec![AdFormat {
-                        media_type: MediaType::Banner,
-                        width: 300,
-                        height: 250,
-                    }],
-                    floor_price: Some(1.00),
-                    targeting: HashMap::new(),
-                    bidders: HashMap::new(),
-                },
-            ],
+            id: "fictional-auction".to_string(),
+            slots: vec![AdSlot {
+                id: "fictional-slot".to_string(),
+                formats: vec![AdFormat {
+                    media_type: MediaType::Banner,
+                    width: 300,
+                    height: 250,
+                }],
+                floor_price: Some(1.0),
+                targeting: HashMap::new(),
+                bidders: HashMap::new(),
+            }],
             publisher: PublisherInfo {
-                domain: "test.com".to_string(),
-                page_url: Some("https://test.com/article".to_string()),
+                domain: "publisher.example".to_string(),
+                page_url: Some("https://publisher.example/article".to_string()),
             },
             user: UserInfo {
-                id: Some("user-123".to_string()),
+                id: Some("fictional-user".to_string()),
                 consent: None,
                 eids: None,
             },
-            device: Some(DeviceInfo {
-                user_agent: Some("Mozilla/5.0".to_string()),
-                ip: Some("192.168.1.1".to_string()),
-                geo: None,
-            }),
+            device: None,
             site: None,
             context: HashMap::new(),
         }
     }
 
-    #[test]
-    fn test_aps_request_transformation() {
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
-            timeout_ms: 800,
-        };
+    fn bid(id: &str, price: f64, tagtype: &str) -> Json {
+        json!({
+            "id": id,
+            "impid": "fictional-slot",
+            "price": price,
+            "w": 300,
+            "h": 250,
+            "crid": "fictional-creative",
+            "adomain": ["advertiser.example"],
+            "ext": {
+                "creativeurl": "https://creative.example/render",
+                "tagtype": tagtype,
+                "unknown": "discarded"
+            },
+            "adm": "<script>discarded</script>",
+            "nurl": "https://notice.example/win"
+        })
+    }
 
-        let provider = ApsAuctionProvider::new(config);
-        let auction_request = create_test_auction_request();
-        let aps_request = provider.to_aps_request(&auction_request, 800);
+    #[test]
+    fn config_accepts_canonical_alias_and_integer_ids() {
+        let canonical: ApsConfig = serde_json::from_value(json!({
+            "account_id": "  example-account  "
+        }))
+        .expect("should parse canonical account ID");
+        let alias: ApsConfig =
+            serde_json::from_value(json!({"pub_id": 1234})).expect("should parse legacy alias");
+        assert_eq!(canonical.account_id, "example-account");
+        assert_eq!(alias.account_id, "1234");
+        assert!(!canonical.enabled);
+        assert!(!canonical.allow_script_creatives);
+        assert!(canonical.endpoint.ends_with("/e/pb/bid"));
+    }
 
-        // Verify basic fields
-        assert_eq!(aps_request.pub_id, "5128");
-        assert_eq!(aps_request.slots.len(), 2);
-        assert_eq!(
-            aps_request.page_url,
-            Some("https://test.com/article".to_string())
+    #[test]
+    fn config_rejects_blank_duplicate_and_unsafe_endpoint() {
+        assert!(serde_json::from_value::<ApsConfig>(json!({"account_id": "   "})).is_err());
+        assert!(
+            serde_json::from_value::<ApsConfig>(
+                json!({"account_id": "x".repeat(MAX_ACCOUNT_ID_BYTES + 1)})
+            )
+            .is_err()
+        );
+        assert!(
+            serde_json::from_value::<ApsConfig>(json!({
+                "account_id": "one",
+                "pub_id": "two"
+            }))
+            .is_err()
         );
-        assert_eq!(aps_request.user_agent, Some("Mozilla/5.0".to_string()));
-        assert_eq!(aps_request.timeout, Some(800));
-
-        // Verify first slot
-        let slot1 = &aps_request.slots[0];
-        assert_eq!(slot1.slot_id, "header-banner");
-        assert_eq!(slot1.sizes.len(), 2);
-        assert_eq!(slot1.sizes[0], [728, 90]);
-        assert_eq!(slot1.sizes[1], [970, 250]);
-
-        // Verify second slot
-        let slot2 = &aps_request.slots[1];
-        assert_eq!(slot2.slot_id, "sidebar");
-        assert_eq!(slot2.sizes.len(), 1);
-        assert_eq!(slot2.sizes[0], [300, 250]);
+        for endpoint in [
+            "http://aps.example/e/pb/bid",
+            "https://",
+            "https://user:password@aps.example/e/pb/bid",
+        ] {
+            let parsed: ApsConfig = serde_json::from_value(json!({
+                "account_id": "example-account",
+                "endpoint": endpoint
+            }))
+            .expect("should deserialize before validation");
+            assert!(parsed.validate().is_err(), "should reject {endpoint}");
+        }
     }
 
     #[test]
-    fn aps_slot_id_from_bidders_map_used_in_request_and_remapped_in_response() {
-        use serde_json::json;
-
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: default_endpoint(),
-            timeout_ms: 800,
-        };
-        let provider = ApsAuctionProvider::new(config);
-
-        let mut bidders = HashMap::new();
-        bidders.insert(
-            "aps".to_string(),
-            json!({ "slotID": "aps-slot-atf-sidebar" }),
-        );
-        let request = AuctionRequest {
-            id: "test".to_string(),
-            slots: vec![AdSlot {
-                id: "atf_sidebar_ad".to_string(),
-                formats: vec![AdFormat {
-                    media_type: MediaType::Banner,
-                    width: 300,
-                    height: 250,
-                }],
-                floor_price: None,
-                targeting: HashMap::new(),
-                bidders,
+    fn builds_aps_openrtb_request_with_explicit_privacy_policy() {
+        let provider = ApsAuctionProvider::new(config());
+        let mut auction_request = request();
+        auction_request.user.consent = Some(ConsentContext {
+            gdpr_applies: true,
+            raw_tc_string: Some("fictional-tcf".to_string()),
+            raw_us_privacy: Some("1YNN".to_string()),
+            raw_gpp_string: Some("fictional-gpp".to_string()),
+            gpp_section_ids: Some(vec![2, 6]),
+            ..Default::default()
+        });
+        auction_request.user.eids = Some(vec![Eid {
+            source: "identity.example".to_string(),
+            uids: vec![Uid {
+                id: "fictional-uid".to_string(),
+                atype: Some(1),
+                ext: None,
             }],
-            publisher: PublisherInfo {
-                domain: "example.com".to_string(),
-                page_url: None,
+        }]);
+        auction_request.slots[0].formats.extend([
+            AdFormat {
+                media_type: MediaType::Video,
+                width: 640,
+                height: 480,
             },
-            user: UserInfo {
-                id: Some("user-1".to_string()),
-                consent: None,
-                eids: None,
+            AdFormat {
+                media_type: MediaType::Banner,
+                width: u32::MAX,
+                height: 90,
             },
-            device: None,
-            site: None,
-            context: HashMap::new(),
+            AdFormat {
+                media_type: MediaType::Banner,
+                width: 728,
+                height: 90,
+            },
+        ]);
+        auction_request.device = Some(DeviceInfo {
+            user_agent: Some("Fictional Browser".to_string()),
+            ip: Some("192.0.2.10".to_string()),
+            geo: Some(GeoInfo {
+                city: "Example City".to_string(),
+                country: "US".to_string(),
+                continent: "NA".to_string(),
+                latitude: 12.34,
+                longitude: 56.78,
+                metro_code: 501,
+                region: Some("CA".to_string()),
+                asn: None,
+            }),
+        });
+        let settings = create_test_settings();
+        let services = noop_services();
+        let downstream = http::Request::builder()
+            .uri("https://publisher.example/auction")
+            .header("DNT", "1")
+            .header(header::ACCEPT_LANGUAGE, "en-US,en;q=0.9")
+            .header(header::REFERER, "https://referrer.example/article")
+            .body(EdgeBody::empty())
+            .expect("should build downstream request");
+        let context = AuctionContext {
+            settings: &settings,
+            request: &downstream,
+            timeout_ms: 321,
+            provider_responses: None,
+            services: &services,
         };
 
-        let aps_request = provider.to_aps_request(&request, 800);
+        let openrtb = provider.build_openrtb_request(&auction_request, &context);
+        let serialized = serde_json::to_value(openrtb).expect("should serialize request");
+
+        assert_eq!(serialized["id"], "fictional-auction");
+        assert_eq!(serialized["tmax"], 321);
+        assert_eq!(serialized["cur"], json!(["USD"]));
+        assert_eq!(serialized["ext"]["account"], "example-account-id");
         assert_eq!(
-            aps_request.slots[0].slot_id, "aps-slot-atf-sidebar",
-            "should send configured APS slot ID to APS"
+            serialized["ext"]["sdk"],
+            json!({"source": "prebid", "version": "2.2.0"})
         );
-        let slot_id_map = ApsAuctionProvider::build_slot_id_map(&request);
+        assert_eq!(serialized["imp"][0]["id"], "fictional-slot");
+        assert_eq!(serialized["imp"][0]["banner"]["w"], 300);
+        assert_eq!(serialized["imp"][0]["banner"]["h"], 250);
+        assert_eq!(serialized["imp"][0]["banner"]["topframe"], 0);
         assert_eq!(
-            slot_id_map.get("aps-slot-atf-sidebar").map(String::as_str),
-            Some("atf_sidebar_ad"),
-            "should build reverse map from APS slot ID to creative slot ID"
+            serialized["imp"][0]["banner"]["format"]
+                .as_array()
+                .map(Vec::len),
+            Some(2)
+        );
+        assert_eq!(serialized["imp"][0]["banner"]["format"][1]["w"], 728);
+        assert_eq!(serialized["imp"][0]["bidfloor"], 1.0);
+        assert_eq!(serialized["imp"][0]["bidfloorcur"], "USD");
+        assert_eq!(serialized["imp"][0]["secure"], 1);
+        assert_eq!(serialized["site"]["domain"], "publisher.example");
+        assert_eq!(
+            serialized["site"]["page"],
+            "https://publisher.example/article"
         );
-
-        let aps_response = json!({
-            "contextual": {
-                "slots": [{
-                    "slotID": "aps-slot-atf-sidebar",
-                    "size": "300x250",
-                    "fif": "1",
-                    "amznbid": "1gtm3q",
-                    "meta": ["slotID"]
-                }]
-            }
-        });
-
-        let response = provider.parse_aps_response(&aps_response, 100, &slot_id_map);
-        assert_eq!(response.bids.len(), 1, "should parse one bid");
         assert_eq!(
-            response.bids[0].slot_id, "atf_sidebar_ad",
-            "bid slot_id should be remapped to creative slot ID"
+            serialized["site"]["ref"],
+            "https://referrer.example/article"
         );
+        assert_eq!(
+            serialized["site"]["publisher"]["domain"],
+            "publisher.example"
+        );
+        assert_eq!(serialized["device"]["ua"], "Fictional Browser");
+        assert_eq!(serialized["device"]["ip"], "192.0.2.10");
+        assert_eq!(serialized["device"]["dnt"], 1);
+        assert_eq!(serialized["device"]["language"], "en");
+        assert_eq!(serialized["device"]["geo"]["country"], "US");
+        assert!(serialized["device"]["geo"].get("lat").is_none());
+        assert!(serialized["device"]["geo"].get("lon").is_none());
+        assert_eq!(serialized["user"]["id"], "fictional-user");
+        assert_eq!(serialized["user"]["consent"], "fictional-tcf");
+        assert_eq!(serialized["user"]["ext"]["consent"], "fictional-tcf");
+        assert_eq!(
+            serialized["user"]["ext"]["eids"][0]["source"],
+            "identity.example"
+        );
+        assert_eq!(serialized["regs"]["gdpr"], 1);
+        assert_eq!(serialized["regs"]["us_privacy"], "1YNN");
+        assert_eq!(serialized["regs"]["gpp"], "fictional-gpp");
+        assert_eq!(serialized["regs"]["gpp_sid"], json!([2, 6]));
+        assert!(serialized["regs"].get("coppa").is_none());
+        assert!(serialized["ext"].get("prebid").is_none());
+        assert!(serialized["ext"].get("trusted_server").is_none());
+        assert!(serialized["imp"][0].get("ext").is_none());
     }
 
     #[test]
-    fn test_aps_response_parsing_success() {
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
-            timeout_ms: 800,
-        };
-
-        let provider = ApsAuctionProvider::new(config);
-
-        // Test APS response in real contextual format
-        let aps_response = json!({
-            "contextual": {
-                "slots": [
-                    {
-                        "slotID": "header-banner",
-                        "size": "728x90",
-                        "crid": "test-crid-123",
-                        "mediaType": "d",
-                        "fif": "1",
-                        "targeting": ["amzniid", "amznbid", "amznp", "amznsz", "amznactt"],
-                        "meta": ["slotID", "mediaType", "size"],
-                        "amzniid": "test-impression-id",
-                        "amznbid": "1kt0jk0",  // Proprietary Amazon encoding (not decodable)
-                        "amznp": "1kt0jk0",
-                        "amznsz": "728x90",
-                        "amznactt": "OPEN"
-                    },
-                    {
-                        "slotID": "sidebar",
-                        "size": "300x250",
-                        "crid": "test-crid-456",
-                        "mediaType": "d",
-                        "fif": "1",
-                        "targeting": ["amzniid", "amznbid", "amznp", "amznsz", "amznactt"],
-                        "meta": ["slotID", "mediaType", "size"],
-                        "amzniid": "test-impression-id-2",
-                        "amznbid": "ewpurk",  // Proprietary Amazon encoding (not decodable)
-                        "amznp": "ewpurk",
-                        "amznsz": "300x250",
-                        "amznactt": "OPEN"
-                    }
-                ],
-                "host": "https://aax-events.amazon-adsystem.com",
-                "status": "ok",
-                "cfe": true,
-                "ev": true,
-                "cb": "6"
-            }
-        });
-
-        let auction_response = provider.parse_aps_response(&aps_response, 150, &HashMap::new());
-
-        // Verify response
-        assert_eq!(auction_response.provider, "aps");
-        assert_eq!(auction_response.status, BidStatus::Success);
-        assert_eq!(auction_response.bids.len(), 2);
-        assert_eq!(auction_response.response_time_ms, 150);
-
-        // Verify first bid - price is None (encoded, to be decoded by mediation)
-        let bid1 = &auction_response.bids[0];
-        assert_eq!(bid1.slot_id, "header-banner");
-        assert_eq!(bid1.price, None); // Price is NOT decoded - it's in metadata for mediation
-        assert_eq!(bid1.width, 728);
-        assert_eq!(bid1.height, 90);
-        assert_eq!(bid1.currency, "USD");
-        assert_eq!(bid1.bidder, "amazon-aps");
-        assert_eq!(bid1.adomain, None);
-        assert!(bid1.metadata.contains_key("amzniid"));
-        assert!(bid1.metadata.contains_key("amznbid")); // Encoded price stored here
-
-        // Verify second bid
-        let bid2 = &auction_response.bids[1];
-        assert_eq!(bid2.slot_id, "sidebar");
-        assert_eq!(bid2.price, None); // Price is NOT decoded
-        assert_eq!(bid2.width, 300);
-        assert_eq!(bid2.height, 250);
-        assert!(bid2.metadata.contains_key("amznbid")); // Encoded price in metadata
+    fn parses_bid_and_builds_exact_minimized_envelope() {
+        let provider = ApsAuctionProvider::new(config());
+        let response = provider.parse_aps_response(
+            &json!({"cur": "USD", "seatbid": [{"seat": 42, "bid": [bid("fictional-selected-bid-id", 1.23, "iframe")]}], "ext": {"userSyncs": []}}),
+            12,
+            &request(),
+        );
+        assert_eq!(response.bids.len(), 1);
+        let parsed = &response.bids[0];
+        assert_eq!(parsed.bidder, "aps");
+        assert_eq!(parsed.price, Some(1.23));
+        assert!(parsed.creative.is_none());
+        assert!(parsed.nurl.is_none());
+        let renderer = parsed
+            .renderer
+            .as_ref()
+            .expect("should include renderer")
+            .aps();
+        let decoded = BASE64_STANDARD
+            .decode(&renderer.aax_response)
+            .expect("should decode renderer response");
+        let decoded: Json =
+            serde_json::from_slice(&decoded).expect("should parse renderer response");
+        let fixture: Json = serde_json::from_str(include_str!(
+            "../../../trusted-server-js/lib/test/fixtures/aps-renderer-v1.json"
+        ))
+        .expect("should parse shared APS renderer fixture");
+        assert_eq!(decoded, fixture);
     }
 
     #[test]
-    fn test_aps_response_parsing_no_bid() {
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
-            timeout_ms: 800,
-        };
-
-        let provider = ApsAuctionProvider::new(config);
-
-        // Empty contextual response
-        let aps_response = json!({
-            "contextual": {
-                "slots": [],
-                "status": "ok"
-            }
-        });
-
-        let auction_response = provider.parse_aps_response(&aps_response, 100, &HashMap::new());
-
-        assert_eq!(auction_response.provider, "aps");
-        assert_eq!(auction_response.status, BidStatus::NoBid);
-        assert_eq!(auction_response.bids.len(), 0);
+    fn empty_creative_id_is_omitted_from_renderer() {
+        let provider = ApsAuctionProvider::new(config());
+        let mut input = bid("bid-with-empty-crid", 1.23, "iframe");
+        input["crid"] = json!("");
+        let response =
+            provider.parse_aps_response(&json!({"seatbid": [{"bid": [input]}]}), 12, &request());
+        let bid = response.bids.first().expect("should accept renderer bid");
+        assert!(bid.creative_id.is_none());
+        assert!(
+            bid.renderer
+                .as_ref()
+                .expect("should retain renderer")
+                .aps()
+                .creative_id
+                .is_none()
+        );
     }
 
     #[test]
-    fn test_aps_response_parsing_invalid_bids() {
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
-            timeout_ms: 800,
-        };
-
-        let provider = ApsAuctionProvider::new(config);
-
-        // Response with invalid slots (not filled, zero price)
-        let aps_response = json!({
-            "contextual": {
-                "slots": [
-                    {
-                        "slotID": "header-banner",
-                        "size": "728x90",
-                        "fif": "0",  // Not filled
-                        "targeting": [],
-                        "meta": []
-                    },
-                    {
-                        "slotID": "sidebar",
-                        "size": "300x250",
-                        "fif": "1",
-                        "targeting": [],
-                        "meta": []
-                        // Missing price encoding - will decode to 0.0
-                    }
-                ],
-                "status": "ok"
-            }
-        });
-
-        let auction_response = provider.parse_aps_response(&aps_response, 100, &HashMap::new());
-
-        // Should return no-bid since all slots are invalid
-        assert_eq!(auction_response.status, BidStatus::NoBid);
-        assert_eq!(auction_response.bids.len(), 0);
+    fn rejects_wrong_typed_response_level_fields() {
+        let provider = ApsAuctionProvider::new(config());
+        for value in [
+            json!({"cur": ["USD"], "seatbid": []}),
+            json!({"cur": "USD", "seatbid": "invalid"}),
+            json!({"contextual": {"slots": []}}),
+        ] {
+            let response = provider.parse_aps_response(&value, 12, &request());
+            assert!(response.bids.is_empty());
+            assert_eq!(
+                response.metadata["drop_reasons"]["unexpected_response_shape"],
+                1
+            );
+        }
     }
 
     #[test]
-    fn test_aps_slot_parsing() {
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
-            timeout_ms: 800,
-        };
-
-        let provider = ApsAuctionProvider::new(config);
-
-        let aps_slot = ApsSlotResponse {
-            slot_id: "test-slot".to_string(),
-            size: "728x90".to_string(),
-            crid: Some("crid-123".to_string()),
-            media_type: Some("d".to_string()),
-            fif: Some("1".to_string()),
-            targeting: vec!["amzniid".to_string(), "amznbid".to_string()],
-            meta: vec!["slotID".to_string()],
-            amzniid: Some("impression-id-123".to_string()),
-            amznbid: Some("1c7d4ow".to_string()), // Encoded price (to be decoded by mediation)
-            amznp: Some("1c7d4ow".to_string()),
-            amznsz: Some("728x90".to_string()),
-            amznactt: Some("OPEN".to_string()),
-        };
-
-        let bid = provider
-            .parse_aps_slot(&aps_slot)
-            .expect("should parse slot");
-
-        assert_eq!(bid.slot_id, "test-slot");
-        assert_eq!(bid.price, None); // Price NOT decoded - stored in metadata for mediation
-        assert_eq!(bid.width, 728);
-        assert_eq!(bid.height, 90);
-        assert_eq!(bid.currency, "USD");
-        assert_eq!(bid.bidder, "amazon-aps");
-        assert_eq!(bid.adomain, None);
-        assert_eq!(bid.nurl, None); // Real APS uses client-side tracking
-        assert_eq!(bid.burl, None);
-        assert!(bid.metadata.contains_key("amzniid"));
-        assert!(bid.metadata.contains_key("amznbid")); // Encoded price here
-        assert!(bid.metadata.contains_key("amznsz"));
+    fn malformed_json_is_a_safe_shape_error() {
+        let provider = ApsAuctionProvider::new(config());
+        let platform_response = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::OK)
+                .body(EdgeBody::from(b"{not-json".to_vec()))
+                .expect("should build malformed APS response"),
+        );
+        let auction_request = request();
+        let response = futures::executor::block_on(provider.parse_response_inner(
+            platform_response,
+            12,
+            Some(&auction_request),
+        ))
+        .expect("should convert malformed JSON into a safe auction response");
+
+        assert!(response.bids.is_empty());
+        assert_eq!(
+            response.metadata["drop_reasons"]["unexpected_response_shape"],
+            1
+        );
     }
 
     #[test]
-    fn test_provider_metadata() {
-        let config = ApsConfig::default();
-        let provider = ApsAuctionProvider::new(config);
-
-        assert_eq!(provider.provider_name(), "aps");
-        assert!(!provider.is_enabled()); // Default is disabled
-        assert_eq!(provider.timeout_ms(), 800);
-        assert!(provider.supports_media_type(&MediaType::Banner));
-        assert!(provider.supports_media_type(&MediaType::Video));
-        assert!(!provider.supports_media_type(&MediaType::Native));
+    fn no_content_and_empty_responses_are_no_bids() {
+        let provider = ApsAuctionProvider::new(config());
+        let platform_response = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::NO_CONTENT)
+                .body(EdgeBody::empty())
+                .expect("should build empty APS response"),
+        );
+        let auction_request = request();
+        let no_content = futures::executor::block_on(provider.parse_response_inner(
+            platform_response,
+            12,
+            Some(&auction_request),
+        ))
+        .expect("should parse 204 as no bid");
+        assert_eq!(no_content.status, BidStatus::NoBid);
+
+        for value in [json!({}), json!({"seatbid": []})] {
+            let empty = provider.parse_aps_response(&value, 12, &auction_request);
+            assert_eq!(empty.status, BidStatus::NoBid);
+            assert_eq!(empty.metadata["drop_reasons"]["empty_seatbid"], 1);
+        }
     }
 
     #[test]
-    fn aps_payload_timeout_uses_effective_auction_budget_not_provider_config() {
-        // Provider config says 1000ms but the auction budget grants only 500ms —
-        // the payload must advertise the tighter effective deadline.
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: default_endpoint(),
-            timeout_ms: 1000,
-        };
-        let provider = ApsAuctionProvider::new(config);
-        let request = create_test_auction_request();
-
-        let aps_request = provider.to_aps_request(&request, 500);
+    fn unsupported_currency_is_a_no_bid() {
+        let provider = ApsAuctionProvider::new(config());
+        let response = provider.parse_aps_response(
+            &json!({"cur": "EUR", "seatbid": [{"bid": [bid("eur-bid", 1.0, "iframe")]}]}),
+            12,
+            &request(),
+        );
+        assert_eq!(response.status, BidStatus::NoBid);
+        assert_eq!(response.metadata["drop_reasons"]["unsupported_currency"], 1);
+    }
 
+    #[test]
+    fn malformed_sibling_does_not_suppress_valid_bid() {
+        let provider = ApsAuctionProvider::new(config());
+        let response = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": ["malformed", bid("valid", 1.0, "iframe")]}]}),
+            12,
+            &request(),
+        );
+        assert_eq!(response.bids.len(), 1);
+        assert_eq!(response.bids[0].bid_id.as_deref(), Some("valid"));
         assert_eq!(
-            aps_request.timeout,
-            Some(500),
-            "should advertise the effective auction budget, not the provider config timeout"
+            response.metadata["drop_reasons"]["missing_render_source"],
+            1
         );
     }
 
     #[test]
-    fn test_aps_request_includes_consent_fields() {
-        use crate::consent::ConsentContext;
-
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: default_endpoint(),
-            timeout_ms: 800,
-        };
-        let provider = ApsAuctionProvider::new(config);
-
-        let mut request = create_test_auction_request();
-        request.user.consent = Some(ConsentContext {
-            raw_tc_string: Some("BOEFEAyOEFEAyAHABDENAI4AAAB9vABAASA".to_string()),
-            gdpr_applies: true,
-            raw_us_privacy: Some("1YNN".to_string()),
-            raw_gpp_string: Some("DBACNYA~CPXxRfAPXxRfA".to_string()),
-            gpp_section_ids: Some(vec![2, 6]),
-            ..Default::default()
-        });
-
-        let aps_request = provider.to_aps_request(&request, 800);
+    fn enabled_script_bid_keeps_typed_renderer() {
+        let mut enabled = config();
+        enabled.allow_script_creatives = true;
+        let provider = ApsAuctionProvider::new(enabled);
+        let response = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": [bid("script", 1.0, "script")]}]}),
+            12,
+            &request(),
+        );
+        let renderer = response.bids[0]
+            .renderer
+            .as_ref()
+            .expect("should keep script renderer")
+            .aps();
+        assert_eq!(renderer.tag_type, ApsTagType::Script);
+    }
 
-        // Verify GDPR consent
-        let gdpr = aps_request.gdpr.expect("should have gdpr");
-        assert!(gdpr.enabled);
+    #[test]
+    fn disabled_script_cannot_suppress_lower_iframe_bid() {
+        let provider = ApsAuctionProvider::new(config());
+        let response = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": [bid("script-high", 4.0, "script"), bid("iframe-low", 1.0, "iframe")]}]}),
+            12,
+            &request(),
+        );
+        assert_eq!(response.bids.len(), 1);
+        assert_eq!(response.bids[0].bid_id.as_deref(), Some("iframe-low"));
         assert_eq!(
-            gdpr.consent.as_deref(),
-            Some("BOEFEAyOEFEAyAHABDENAI4AAAB9vABAASA")
+            response.metadata["drop_reasons"]["script_rendering_disabled"],
+            1
         );
-
-        // Verify US Privacy
-        assert_eq!(aps_request.us_privacy.as_deref(), Some("1YNN"));
-
-        // Verify GPP
-        assert_eq!(aps_request.gpp.as_deref(), Some("DBACNYA~CPXxRfAPXxRfA"));
-        assert_eq!(aps_request.gpp_sid.as_deref(), Some("2,6"));
     }
 
     #[test]
-    fn test_aps_request_no_consent() {
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: default_endpoint(),
-            timeout_ms: 800,
-        };
-        let provider = ApsAuctionProvider::new(config);
-        let request = create_test_auction_request(); // consent is None
-
-        let aps_request = provider.to_aps_request(&request, 800);
-
-        assert!(aps_request.gdpr.is_none());
-        assert!(aps_request.us_privacy.is_none());
-        assert!(aps_request.gpp.is_none());
-        assert!(aps_request.gpp_sid.is_none());
+    fn reduces_candidates_by_price_then_bid_id() {
+        let provider = ApsAuctionProvider::new(config());
+        let response = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": [bid("bid-z", 2.0, "iframe"), bid("bid-a", 2.0, "iframe")]}]}),
+            12,
+            &request(),
+        );
+        assert_eq!(response.bids.len(), 1);
+        assert_eq!(response.bids[0].bid_id.as_deref(), Some("bid-a"));
     }
 
     #[test]
-    fn test_aps_request_consent_serialization() {
-        use crate::consent::ConsentContext;
-
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: default_endpoint(),
-            timeout_ms: 800,
-        };
-        let provider = ApsAuctionProvider::new(config);
-
-        let mut request = create_test_auction_request();
-        request.user.consent = Some(ConsentContext {
-            raw_tc_string: Some("BOE".to_string()),
-            gdpr_applies: true,
-            ..Default::default()
-        });
-
-        let aps_request = provider.to_aps_request(&request, 800);
-        let json = serde_json::to_value(&aps_request).expect("should serialize");
-
-        // GDPR fields present
-        assert_eq!(json["gdpr"]["enabled"], true);
-        assert_eq!(json["gdpr"]["consent"], "BOE");
-
-        // Absent fields should not appear (skip_serializing_if)
-        assert!(json.get("usPrivacy").is_none());
-        assert!(json.get("gpp").is_none());
-        assert!(json.get("gppSid").is_none());
+    fn safe_drops_missing_renderer_and_invalid_dimensions() {
+        let provider = ApsAuctionProvider::new(config());
+        let mut invalid = bid("invalid", 1.0, "iframe");
+        invalid
+            .as_object_mut()
+            .expect("should be object")
+            .remove("w");
+        let response = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": [
+                {"id": "fixture", "impid": "fictional-slot", "price": 1.0, "w": 300, "h": 250, "ext": {"bidder": "aps"}},
+                invalid
+            ]}]}),
+            12,
+            &request(),
+        );
+        assert!(response.bids.is_empty());
+        assert_eq!(
+            response.metadata["drop_reasons"]["missing_render_source"],
+            1
+        );
+        assert_eq!(response.metadata["drop_reasons"]["invalid_dimensions"], 1);
     }
 
     #[test]
-    fn test_aps_bids_have_no_creative_and_no_decoded_price() {
-        // APS doesn't provide creative HTML - it only provides targeting keys
-        // APS doesn't decode prices - only mediation layer can decode them
-        // The creative will be generated by the mediation layer (e.g., GAM or ad server)
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
-            timeout_ms: 800,
-        };
-
-        let provider = ApsAuctionProvider::new(config);
-
-        let aps_slot = ApsSlotResponse {
-            slot_id: "test-slot".to_string(),
-            size: "300x250".to_string(),
-            crid: Some("test-creative".to_string()),
-            media_type: Some("d".to_string()),
-            fif: Some("1".to_string()),
-            targeting: vec!["amzniid".to_string(), "amznbid".to_string()],
-            meta: vec!["slotID".to_string()],
-            amzniid: Some("imp-123".to_string()),
-            amznbid: Some("encoded-price".to_string()),
-            amznp: Some("encoded-price-alt".to_string()),
-            amznsz: Some("300x250".to_string()),
-            amznactt: Some("OPEN".to_string()),
-        };
-
-        let bid = provider.parse_aps_slot(&aps_slot).expect("should parse");
+    fn rejects_publisher_origin_and_non_https_creative_urls() {
+        let provider = ApsAuctionProvider::new(config());
+        for creative_url in [
+            "https://publisher.example/render",
+            "http://creative.example/render",
+            "https://user:password@creative.example/render",
+        ] {
+            let mut invalid = bid("invalid-url", 1.0, "iframe");
+            invalid["ext"]["creativeurl"] = json!(creative_url);
+            let response = provider.parse_aps_response(
+                &json!({"seatbid": [{"bid": [invalid]}]}),
+                12,
+                &request(),
+            );
+            assert!(response.bids.is_empty(), "should reject {creative_url}");
+            assert_eq!(response.metadata["drop_reasons"]["invalid_creative_url"], 1);
+        }
 
-        // Key assertions:
-        // 1. creative should be None for APS bids
-        assert_eq!(bid.creative, None, "APS bids should not have creative HTML");
-        // 2. price should be None (encoded price in metadata, decoded by mediation)
-        assert_eq!(bid.price, None, "APS bids should not have decoded price");
+        let mut uppercase_publisher = request();
+        uppercase_publisher.publisher.domain = "Creative.Example".to_string();
+        let response = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": [bid("same-origin", 1.0, "iframe")]}]}),
+            12,
+            &uppercase_publisher,
+        );
+        assert!(response.bids.is_empty());
+        assert_eq!(response.metadata["drop_reasons"]["invalid_creative_url"], 1);
+    }
 
-        // Verify targeting keys are in metadata (includes encoded price)
-        assert!(bid.metadata.contains_key("amzniid"));
-        assert!(bid.metadata.contains_key("amznbid")); // Encoded price
+    #[test]
+    fn registers_and_serves_only_static_renderer_route() {
+        let integration = ApsRendererIntegration;
+        let routes = integration.routes();
+        assert_eq!(routes.len(), 1, "should register one route");
+        assert_eq!(routes[0].method, Method::GET);
+        assert_eq!(routes[0].path, APS_RENDERER_ROUTE);
+
+        let settings = create_test_settings();
+        let services = noop_services();
+        let request = http::Request::builder()
+            .method(Method::GET)
+            .uri(APS_RENDERER_ROUTE)
+            .body(EdgeBody::empty())
+            .expect("should build renderer request");
+        let response =
+            futures::executor::block_on(integration.handle(&settings, &services, request))
+                .expect("should serve renderer");
+        assert_eq!(response.status(), StatusCode::OK);
         assert_eq!(
-            bid.metadata.get("amzniid").and_then(|v| v.as_str()),
-            Some("imp-123")
+            response.headers()[header::CONTENT_TYPE],
+            "text/html; charset=utf-8"
         );
+        assert_eq!(response.headers()["x-content-type-options"], "nosniff");
+        assert_eq!(response.headers()["referrer-policy"], "no-referrer");
         assert_eq!(
-            bid.metadata.get("amznbid").and_then(|v| v.as_str()),
-            Some("encoded-price")
+            response.headers()[header::CONTENT_SECURITY_POLICY],
+            APS_RENDERER_CSP
         );
-    }
 
-    fn single_slot_request(
-        auction_id: &str,
-        aps_slot_id: &str,
-        creative_id: &str,
-    ) -> AuctionRequest {
-        let mut bidders = HashMap::new();
-        bidders.insert("aps".to_string(), json!({ "slotID": aps_slot_id }));
-        AuctionRequest {
-            id: auction_id.to_string(),
-            slots: vec![AdSlot {
-                id: creative_id.to_string(),
-                formats: vec![AdFormat {
-                    media_type: MediaType::Banner,
-                    width: 300,
-                    height: 250,
-                }],
-                floor_price: None,
-                targeting: HashMap::new(),
-                bidders,
-            }],
-            publisher: PublisherInfo {
-                domain: "example.com".to_string(),
-                page_url: None,
-            },
-            user: UserInfo {
-                id: None,
-                consent: None,
-                eids: None,
-            },
-            device: None,
-            site: None,
-            context: HashMap::new(),
-        }
+        let post = http::Request::builder()
+            .method(Method::POST)
+            .uri(APS_RENDERER_ROUTE)
+            .body(EdgeBody::empty())
+            .expect("should build method rejection request");
+        let response = futures::executor::block_on(integration.handle(&settings, &services, post))
+            .expect("should reject unsupported method");
+        assert_eq!(response.status(), StatusCode::NOT_FOUND);
     }
 
-    fn aps_platform_response(aps_slot_id: &str) -> PlatformResponse {
-        let body = json!({
-            "contextual": {
-                "slots": [{
-                    "slotID": aps_slot_id,
-                    "size": "300x250",
-                    "fif": "1",
-                    "amznbid": "1gtm3q",
-                    "meta": ["slotID"]
-                }]
-            }
-        });
-        let response = http::Response::builder()
-            .status(200)
-            .body(EdgeBody::from(
-                serde_json::to_vec(&body).expect("should serialize APS response body"),
-            ))
-            .expect("should build APS platform response");
-        PlatformResponse::new(response)
+    #[test]
+    fn enabled_config_registers_renderer_proxy() {
+        let mut settings = create_test_settings();
+        settings
+            .integrations
+            .insert_config(
+                APS_INTEGRATION_ID,
+                &json!({"enabled": true, "account_id": "example-account"}),
+            )
+            .expect("should insert APS config");
+
+        let registration = register(&settings)
+            .expect("should register APS")
+            .expect("should return enabled registration");
+
+        assert_eq!(registration.integration_id, APS_INTEGRATION_ID);
+        assert_eq!(registration.proxies.len(), 1);
+        assert!(registration.js_disabled);
     }
 
     #[test]
-    fn concurrent_auctions_parse_out_of_order_with_correct_slot_remapping() {
-        // Regression: the reverse slot map used to live on the shared provider
-        // instance, so a second auction's request_bids overwrote the first
-        // auction's map and out-of-order parses remapped bids to the wrong
-        // creative slot. The map is now derived from each parse's own request.
-        let provider = ApsAuctionProvider::new(ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: default_endpoint(),
-            timeout_ms: 800,
-        });
-
-        let request_a = single_slot_request("auction-a", "aps-slot-a", "creative_a");
-        let request_b = single_slot_request("auction-b", "aps-slot-b", "creative_b");
-
-        let settings = crate::test_support::tests::create_test_settings();
-        let http_request = http::Request::builder()
-            .uri("https://example.com/")
-            .body(EdgeBody::empty())
-            .expect("should build test request");
-        let context = crate::auction::test_support::create_test_auction_context(
-            &settings,
-            &http_request,
-            800,
+    fn renderer_document_is_static_and_nonce_bound() {
+        assert!(APS_RENDERER_DOCUMENT.contains("^#tsaps="));
+        assert!(APS_RENDERER_DOCUMENT.contains("event.source!==parent"));
+        assert!(APS_RENDERER_DOCUMENT.contains("message.nonce!==expected"));
+        assert!(APS_RENDERER_DOCUMENT.contains("prebid/creative/render"));
+        assert!(APS_RENDERER_DOCUMENT.contains("window._aps instanceof Map"));
+        assert!(APS_RENDERER_DOCUMENT.contains("store:new Map([['listeners',new Map()]])"));
+        assert!(APS_RENDERER_DOCUMENT.contains("account.queue.push(new CustomEvent"));
+        assert!(
+            APS_RENDERER_DOCUMENT.contains("trusted-server/aps/renderer-ready")
+                && APS_RENDERER_DOCUMENT.contains("trusted-server/aps/renderer-failed")
         );
-
-        futures::executor::block_on(async {
-            // Parse auction B's response first, then auction A's — the reverse
-            // of dispatch order — each against its own request.
-            let response_b = provider
-                .parse_response_with_context(
-                    aps_platform_response("aps-slot-b"),
-                    100,
-                    &request_b,
-                    &context,
-                )
-                .await
-                .expect("should parse auction B response");
-            let response_a = provider
-                .parse_response_with_context(
-                    aps_platform_response("aps-slot-a"),
-                    100,
-                    &request_a,
-                    &context,
-                )
-                .await
-                .expect("should parse auction A response");
-
-            assert_eq!(
-                response_b.bids[0].slot_id, "creative_b",
-                "auction B bid should remap to auction B's creative slot"
-            );
-            assert_eq!(
-                response_a.bids[0].slot_id, "creative_a",
-                "auction A bid should remap to auction A's creative slot despite parsing last"
-            );
-        });
+        assert!(!APS_RENDERER_DOCUMENT.contains("window.apstag"));
+        assert!(
+            APS_RENDERER_DOCUMENT
+                .contains("https://client.aps.amazon-adsystem.com/prebid-creative.js")
+        );
+        assert!(!APS_RENDERER_DOCUMENT.contains("<script src="));
+        let queue_index = APS_RENDERER_DOCUMENT
+            .find("account.queue.push(new CustomEvent")
+            .expect("should queue render event");
+        let runner_index = APS_RENDERER_DOCUMENT
+            .find("document.head.appendChild(script)")
+            .expect("should dynamically load the APS runner");
+        assert!(queue_index < runner_index);
+        assert!(!APS_RENDERER_DOCUMENT.contains("allow-same-origin"));
+        assert!(APS_RENDERER_CSP.contains("default-src 'none'"));
+        assert!(APS_RENDERER_CSP.contains("sandbox allow-forms"));
+        assert!(!APS_RENDERER_CSP.contains("allow-same-origin"));
     }
 }
diff --git a/crates/trusted-server-core/src/integrations/mod.rs b/crates/trusted-server-core/src/integrations/mod.rs
index bf6d63216..7bfaf27df 100644
--- a/crates/trusted-server-core/src/integrations/mod.rs
+++ b/crates/trusted-server-core/src/integrations/mod.rs
@@ -288,6 +288,10 @@ pub(crate) struct IntegrationBuilder {
 
 pub(crate) fn builders() -> &'static [IntegrationBuilder] {
     &[
+        IntegrationBuilder {
+            id: "aps",
+            build: aps::register,
+        },
         IntegrationBuilder {
             id: "prebid",
             build: prebid::register,
diff --git a/crates/trusted-server-core/src/integrations/prebid.rs b/crates/trusted-server-core/src/integrations/prebid.rs
index 051ce17b8..f2e6e62e4 100644
--- a/crates/trusted-server-core/src/integrations/prebid.rs
+++ b/crates/trusted-server-core/src/integrations/prebid.rs
@@ -1558,13 +1558,27 @@ impl PrebidAuctionProvider {
                 let mut expanded: HashMap<String, Json> = HashMap::new();
                 let mut direct: Vec<(String, Json)> = Vec::new();
                 for (name, params) in &slot.bidders {
+                    if name == "aps" {
+                        // Trusted Server APS is a separate OpenRTB provider. Never
+                        // send native APS demand through PBS for the same cohort.
+                        continue;
+                    }
                     if name == TRUSTED_SERVER_BIDDER {
+<<<<<<< HEAD
                         expanded.extend(expand_trusted_server_bidders(&self.config.bidders, params));
                     } else if self.config.bidders.iter().any(|b| b == name) {
                         direct.push((name.clone(), params.clone()));
                     } else if name != "aps" {
                         // `aps` is intentionally handled by its own provider. Any
                         // other unrecognized key is likely a misconfiguration (a
+=======
+                        bidder.extend(expand_trusted_server_bidders(&self.config.bidders, params));
+                        bidder.remove("aps");
+                    } else if self.config.bidders.iter().any(|b| b == name) {
+                        bidder.insert(name.clone(), params.clone());
+                    } else {
+                        // Any other unrecognized key is likely a misconfiguration (a
+>>>>>>> 161dafa4 (Add first-class APS OpenRTB integration)
                         // slot bidder absent from `config.bidders`) that silently
                         // yields an empty bidder map and a stored-request no-bid —
                         // log it so the drop is diagnosable.
@@ -2233,10 +2247,15 @@ impl PrebidAuctionProvider {
         // not an ad ID, so it is not used as a fallback: surfacing it as `ad_id`
         // (which is exposed raw in the debug bid) would mislead any consumer that
         // treats `ad_id` as a creative identifier. Absent `adid`, `ad_id` is None.
+        let bid_id = bid_obj.get("id").and_then(|v| v.as_str()).map(String::from);
         let ad_id = bid_obj
             .get("adid")
             .and_then(|v| v.as_str())
             .map(String::from);
+        let creative_id = bid_obj
+            .get("crid")
+            .and_then(|v| v.as_str())
+            .map(String::from);
 
         let adomain = bid_obj
             .get("adomain")
@@ -2301,7 +2320,10 @@ impl PrebidAuctionProvider {
             height,
             nurl,
             burl,
+            bid_id,
             ad_id,
+            creative_id,
+            renderer: None,
             cache_id,
             cache_host,
             cache_path,
@@ -6935,13 +6957,15 @@ bidders = ["kargo", "triplelift"]
 
     #[test]
     fn to_openrtb_skips_aps_key_from_slot_bidders_in_pbs_request() {
+        let mut config = base_config();
+        config.bidders.push("aps".to_string());
         let slot = make_slot(
             "atf_sidebar_ad",
             HashMap::from([("aps".to_string(), json!({"slotID": "aps-slot-atf-sidebar"}))]),
         );
         let request = make_auction_request(vec![slot]);
 
-        let ortb = call_to_openrtb(base_config(), &request);
+        let ortb = call_to_openrtb(config, &request);
         let ext = ortb.imp[0].ext.as_ref().expect("should have imp ext");
         let prebid = ext.get("prebid").expect("should have prebid in ext");
 
@@ -6951,6 +6975,29 @@ bidders = ["kargo", "triplelift"]
         );
     }
 
+    #[test]
+    fn trusted_server_expansion_never_enables_aps_through_pbs() {
+        let mut config = base_config();
+        config.bidders = vec!["kargo".to_string(), "aps".to_string()];
+        let slot = make_ts_slot(
+            "in_content_ad",
+            &json!({
+                "kargo": {"placementId": "client_123"},
+                "aps": {"slotID": "legacy-aps-slot"}
+            }),
+            None,
+        );
+        let request = make_auction_request(vec![slot]);
+
+        let ortb = call_to_openrtb(config, &request);
+        let bidder = &ortb.imp[0].ext.as_ref().expect("should have imp ext")["prebid"]["bidder"];
+        assert_eq!(bidder["kargo"]["placementId"], "client_123");
+        assert!(
+            bidder.get("aps").is_none(),
+            "Trusted Server APS cohorts must not also send APS through PBS"
+        );
+    }
+
     #[test]
     fn register_rejects_invalid_bid_param_override_rule() {
         let toml = format!(
@@ -7199,6 +7246,7 @@ set = { networkId = 42 }
             "id": "bid-impression-id",
             "impid": "atf_sidebar_ad",
             "adid": "bidder-ad-id-abc",
+            "crid": "bidder-creative-id-abc",
             "price": 1.0,
             "w": 300,
             "h": 250,
@@ -7217,11 +7265,21 @@ set = { networkId = 42 }
         let bid = provider
             .parse_bid(&bid_json, "appnexus")
             .expect("should parse bid");
+        assert_eq!(
+            bid.bid_id.as_deref(),
+            Some("bid-impression-id"),
+            "should preserve OpenRTB id separately"
+        );
         assert_eq!(
             bid.ad_id.as_deref(),
             Some("bidder-ad-id-abc"),
             "should keep ad_id from adid field"
         );
+        assert_eq!(
+            bid.creative_id.as_deref(),
+            Some("bidder-creative-id-abc"),
+            "should preserve OpenRTB crid separately"
+        );
         assert_eq!(
             bid.cache_id.as_deref(),
             Some("cache-uuid-xyz"),
diff --git a/crates/trusted-server-core/src/openrtb.rs b/crates/trusted-server-core/src/openrtb.rs
index 65237ce0e..9b7533505 100644
--- a/crates/trusted-server-core/src/openrtb.rs
+++ b/crates/trusted-server-core/src/openrtb.rs
@@ -1,7 +1,7 @@
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 
-use crate::auction::types::OrchestratorExt;
+use crate::auction::types::{BidRenderer, OrchestratorExt};
 
 pub type OpenRtbRequest = trusted_server_openrtb::BidRequest;
 pub type OpenRtbResponse = trusted_server_openrtb::BidResponse;
@@ -171,6 +171,18 @@ pub struct ImpStoredRequest {
     pub id: String,
 }
 
+#[derive(Debug, Serialize)]
+pub struct BidExt<'a> {
+    pub trusted_server: BidTrustedServerExt<'a>,
+}
+
+impl ToExt for BidExt<'_> {}
+
+#[derive(Debug, Serialize)]
+pub struct BidTrustedServerExt<'a> {
+    pub renderer: &'a BidRenderer,
+}
+
 #[derive(Debug, Serialize)]
 pub struct ResponseExt {
     pub orchestrator: OrchestratorExt,
diff --git a/crates/trusted-server-core/src/publisher.rs b/crates/trusted-server-core/src/publisher.rs
index 600441f95..b834f148d 100644
--- a/crates/trusted-server-core/src/publisher.rs
+++ b/crates/trusted-server-core/src/publisher.rs
@@ -18,20 +18,13 @@
 //! into any [`Write`] (a `Vec<u8>` for buffered routes, a streaming writer for
 //! the streaming route). It is not a content-rewriting concern.
 
-use std::borrow::Cow;
 use std::io::Write;
 use std::sync::{Arc, Mutex};
 use std::time::Duration;
 
-use brotli::Decompressor;
-use brotli::enc::BrotliEncoderParams;
-use brotli::enc::writer::CompressorWriter;
 use cookie::CookieJar;
 use edgezero_core::body::Body as EdgeBody;
 use error_stack::{Report, ResultExt};
-use flate2::read::ZlibDecoder;
-use flate2::write::{GzEncoder, ZlibEncoder};
-use futures::StreamExt as _;
 use http::{HeaderValue, Method, Request, Response, StatusCode, Uri, header};
 
 use crate::auction::endpoints::{
@@ -60,132 +53,19 @@ use crate::platform::{GeoInfo, PlatformBackendSpec, PlatformHttpRequest, Runtime
 use crate::price_bucket::{PriceGranularity, price_bucket};
 use crate::rsc_flight::RscFlightUrlRewriter;
 use crate::settings::Settings;
-use crate::streaming_processor::{
-    BodyStreamDecoder, BodyStreamEncoder, Compression, GzipDecodeReader, PipelineConfig,
-    STREAM_CHUNK_SIZE, StreamProcessor, StreamingPipeline,
-};
+use crate::streaming_processor::{Compression, PipelineConfig, StreamProcessor, StreamingPipeline};
 use crate::streaming_replacer::create_url_replacer;
 
 const SUPPORTED_ENCODING_VALUES: [&str; 3] = ["gzip", "deflate", "br"];
 const DEFAULT_PUBLISHER_FIRST_BYTE_TIMEOUT: Duration = Duration::from_secs(15);
 
-fn body_as_reader(
-    body: EdgeBody,
-) -> Result<std::io::Cursor<bytes::Bytes>, Report<TrustedServerError>> {
-    let bytes = body.into_bytes().ok_or_else(|| {
-        Report::new(TrustedServerError::Proxy {
-            message: "streaming body cannot be processed by sync publisher pipeline".to_string(),
-        })
-    })?;
-    Ok(std::io::Cursor::new(bytes))
-}
-
-struct BodyChunkSource {
-    body: Option<EdgeBody>,
-    chunk_size: usize,
-    max_bytes: usize,
-    bytes_seen: usize,
-    once_offset: usize,
-}
-
-impl BodyChunkSource {
-    fn new(body: EdgeBody, chunk_size: usize) -> Self {
-        Self {
-            body: Some(body),
-            chunk_size,
-            max_bytes: usize::MAX,
-            bytes_seen: 0,
-            once_offset: 0,
-        }
-    }
-
-    fn with_max_bytes(mut self, max_bytes: usize) -> Self {
-        self.max_bytes = max_bytes;
-        self
-    }
-
-    async fn next_chunk(&mut self) -> Result<Option<bytes::Bytes>, Report<TrustedServerError>> {
-        // The body is polled in place (never moved out across an await) so a
-        // cancelled `next_chunk` future leaves the source resumable instead of
-        // silently reporting end-of-stream on the next call.
-        let pulled = match &mut self.body {
-            None => Ok(None),
-            Some(EdgeBody::Once(bytes)) => {
-                let end = (self.once_offset + self.chunk_size).min(bytes.len());
-                if self.once_offset >= end {
-                    Ok(None)
-                } else {
-                    let chunk = bytes.slice(self.once_offset..end);
-                    self.once_offset = end;
-                    Ok(Some(chunk))
-                }
-            }
-            Some(EdgeBody::Stream(stream)) => match stream.next().await {
-                Some(Ok(chunk)) => Ok(Some(chunk)),
-                Some(Err(err)) => Err(Report::new(TrustedServerError::Proxy {
-                    message: format!("Failed to read publisher origin body stream: {err}"),
-                })),
-                None => Ok(None),
-            },
-        };
-
-        let chunk = match pulled {
-            Ok(Some(chunk)) => chunk,
-            Ok(None) => {
-                self.body = None;
-                return Ok(None);
-            }
-            Err(err) => {
-                self.body = None;
-                return Err(err);
-            }
-        };
-
-        self.bytes_seen = self.bytes_seen.checked_add(chunk.len()).ok_or_else(|| {
-            Report::new(TrustedServerError::Proxy {
-                message: "publisher origin body byte count overflowed".to_string(),
-            })
-        })?;
-        if self.bytes_seen > self.max_bytes {
-            return Err(Report::new(TrustedServerError::Proxy {
-                message: format!(
-                    "publisher origin body exceeded {}-byte streaming limit",
-                    self.max_bytes
-                ),
-            }));
-        }
-
-        Ok(Some(chunk))
-    }
-}
-
-fn process_and_encode_chunk<P: StreamProcessor>(
-    processor: &mut P,
-    encoder: &mut BodyStreamEncoder,
-    chunk: &[u8],
-    is_last: bool,
-    process_error: &str,
-) -> Result<Option<bytes::Bytes>, Report<TrustedServerError>> {
-    let processed =
-        processor
-            .process_chunk(chunk, is_last)
-            .change_context(TrustedServerError::Proxy {
-                message: process_error.to_string(),
-            })?;
-    if processed.is_empty() {
-        return Ok(None);
-    }
-    let encoded = encoder.encode_chunk(processed)?;
-    if encoded.is_empty() {
-        return Ok(None);
-    }
-    Ok(Some(bytes::Bytes::from(encoded)))
-}
+/// Read buffer size for streaming body processing and brotli internal buffers.
+/// Both the `Decompressor` and `CompressorWriter` use this value so all
+/// brotli I/O layers operate on consistently-sized chunks.
+const STREAM_CHUNK_SIZE: usize = 8192;
 
-// By-value signature so `map_err(publisher_stream_error)` works directly.
-#[allow(clippy::needless_pass_by_value)]
-fn publisher_stream_error(err: Report<TrustedServerError>) -> std::io::Error {
-    std::io::Error::other(format!("{err:?}"))
+fn body_as_reader(body: EdgeBody) -> std::io::Cursor<bytes::Bytes> {
+    std::io::Cursor::new(body.into_bytes().unwrap_or_default())
 }
 
 fn not_found_response() -> Response<EdgeBody> {
@@ -353,55 +233,6 @@ struct ProcessResponseParams<'a> {
     ad_bids_state: &'a Arc<Mutex<Option<String>>>,
 }
 
-struct PublisherBodyProcessor {
-    inner: Box<dyn StreamProcessor>,
-}
-
-impl PublisherBodyProcessor {
-    fn new(
-        params: &OwnedProcessResponseParams,
-        settings: &Settings,
-        integration_registry: &IntegrationRegistry,
-    ) -> Result<Self, Report<TrustedServerError>> {
-        let is_html = is_html_content_type(&params.content_type);
-        let is_rsc_flight =
-            content_type_contains_ascii_case_insensitive(&params.content_type, "text/x-component");
-        let inner: Box<dyn StreamProcessor> = if is_html {
-            Box::new(create_html_stream_processor(
-                &params.origin_host,
-                &params.request_host,
-                &params.request_scheme,
-                settings,
-                integration_registry,
-                params.ad_slots_script.as_deref().map(str::to_string),
-                Arc::clone(&params.ad_bids_state),
-            )?)
-        } else if is_rsc_flight {
-            Box::new(RscFlightUrlRewriter::new(
-                &params.origin_host,
-                &params.origin_url,
-                &params.request_host,
-                &params.request_scheme,
-            ))
-        } else {
-            Box::new(create_url_replacer(
-                &params.origin_host,
-                &params.origin_url,
-                &params.request_host,
-                &params.request_scheme,
-            ))
-        };
-
-        Ok(Self { inner })
-    }
-}
-
-impl StreamProcessor for PublisherBodyProcessor {
-    fn process_chunk(&mut self, chunk: &[u8], is_last: bool) -> Result<Vec<u8>, std::io::Error> {
-        self.inner.process_chunk(chunk, is_last)
-    }
-}
-
 /// Process response body through the streaming pipeline.
 ///
 /// Selects the appropriate processor based on content type (HTML rewriter,
@@ -434,13 +265,6 @@ fn process_response_streaming<W: Write>(
         output_compression: compression,
         chunk_size: 8192,
     };
-    // Bound how much decoded gzip output may sit in the heap at once, using the
-    // same ceiling the buffered writer enforces on the rewritten output: a gzip
-    // bomb is then rejected mid-decode instead of materializing its full
-    // expansion first. The bound is per-step, so a large honest body still
-    // streams through and only the buffered writer judges the total — otherwise
-    // gzip would reject bodies the identity, deflate and brotli paths accept.
-    let max_pending_decoded_bytes = params.settings.publisher.max_buffered_body_bytes;
 
     if is_html {
         let processor = create_html_stream_processor(
@@ -452,9 +276,7 @@ fn process_response_streaming<W: Write>(
             params.ad_slots_script.map(str::to_string),
             params.ad_bids_state.clone(),
         )?;
-        StreamingPipeline::new(config, processor)
-            .with_max_pending_decoded_bytes(max_pending_decoded_bytes)
-            .process(body_as_reader(body)?, output)?;
+        StreamingPipeline::new(config, processor).process(body_as_reader(body), output)?;
     } else if is_rsc_flight {
         // RSC Flight responses are length-prefixed (T rows). A naive string replacement will
         // corrupt the stream by changing byte lengths without updating the prefixes.
@@ -464,9 +286,7 @@ fn process_response_streaming<W: Write>(
             params.request_host,
             params.request_scheme,
         );
-        StreamingPipeline::new(config, processor)
-            .with_max_pending_decoded_bytes(max_pending_decoded_bytes)
-            .process(body_as_reader(body)?, output)?;
+        StreamingPipeline::new(config, processor).process(body_as_reader(body), output)?;
     } else {
         let replacer = create_url_replacer(
             params.origin_host,
@@ -474,446 +294,12 @@ fn process_response_streaming<W: Write>(
             params.request_host,
             params.request_scheme,
         );
-        StreamingPipeline::new(config, replacer)
-            .with_max_pending_decoded_bytes(max_pending_decoded_bytes)
-            .process(body_as_reader(body)?, output)?;
-    }
-
-    Ok(())
-}
-
-async fn process_response_streaming_async<W: Write>(
-    body: EdgeBody,
-    output: &mut W,
-    params: &OwnedProcessResponseParams,
-    settings: &Settings,
-    integration_registry: &IntegrationRegistry,
-) -> Result<(), Report<TrustedServerError>> {
-    log::debug!(
-        "process_response_streaming_async: content_type={}, content_encoding={}",
-        params.content_type,
-        params.content_encoding
-    );
-
-    let compression = Compression::from_content_encoding(&params.content_encoding);
-    let mut processor = PublisherBodyProcessor::new(params, settings, integration_registry)?;
-    process_body_chunks_async(
-        body,
-        output,
-        &mut processor,
-        compression,
-        settings.publisher.max_buffered_body_bytes,
-    )
-    .await
-}
-
-/// Pull, decode, process, and encode the next chunk of a no-hold pipeline.
-///
-/// Returns `Ok(None)` when the source is exhausted; the caller must then emit
-/// [`passthrough_finish_segments`]. Shared by the write-sink driver
-/// ([`process_body_chunks_async`]) and the lazy publisher body stream so the
-/// two no-hold paths cannot drift apart.
-async fn passthrough_step<P: StreamProcessor>(
-    source: &mut BodyChunkSource,
-    decoder: &mut BodyStreamDecoder,
-    encoder: &mut BodyStreamEncoder,
-    processor: &mut P,
-) -> Result<Option<Vec<bytes::Bytes>>, Report<TrustedServerError>> {
-    let Some(raw_chunk) = source.next_chunk().await? else {
-        return Ok(None);
-    };
-    let decoded = decoder.decode_chunk(raw_chunk)?;
-    if decoded.is_empty() {
-        return Ok(Some(Vec::new()));
-    }
-    let mut segments = Vec::new();
-    if let Some(encoded) = process_and_encode_chunk(
-        processor,
-        encoder,
-        &decoded,
-        false,
-        "Failed to process chunk",
-    )? {
-        segments.push(encoded);
-    }
-    Ok(Some(segments))
-}
-
-async fn process_body_chunks_async<W: Write, P: StreamProcessor>(
-    body: EdgeBody,
-    writer: &mut W,
-    processor: &mut P,
-    compression: Compression,
-    max_body_bytes: usize,
-) -> Result<(), Report<TrustedServerError>> {
-    let mut decoder = BodyStreamDecoder::new(compression, max_body_bytes);
-    let mut encoder = BodyStreamEncoder::new(compression);
-    let mut source = BodyChunkSource::new(body, STREAM_CHUNK_SIZE).with_max_bytes(max_body_bytes);
-
-    while let Some(segments) =
-        passthrough_step(&mut source, &mut decoder, &mut encoder, processor).await?
-    {
-        for encoded in segments {
-            write_encoded_segment(writer, &encoded)?;
-        }
-    }
-
-    for encoded in passthrough_finish_segments(processor, &mut decoder, &mut encoder)? {
-        write_encoded_segment(writer, &encoded)?;
+        StreamingPipeline::new(config, replacer).process(body_as_reader(body), output)?;
     }
-    writer.flush().change_context(TrustedServerError::Proxy {
-        message: "Failed to flush output".to_string(),
-    })?;
 
     Ok(())
 }
 
-/// Write one encoded output segment produced by the chunk pipeline.
-fn write_encoded_segment<W: Write>(
-    writer: &mut W,
-    encoded: &[u8],
-) -> Result<(), Report<TrustedServerError>> {
-    writer
-        .write_all(encoded)
-        .change_context(TrustedServerError::Proxy {
-            message: "Failed to write encoded chunk".to_string(),
-        })
-}
-
-/// Finalize a no-hold chunk pipeline: drain the decoder tail through the
-/// processor, signal end-of-stream to the processor, and emit the encoder
-/// trailer. Returns the encoded segments for the caller to emit.
-fn passthrough_finish_segments<P: StreamProcessor>(
-    processor: &mut P,
-    decoder: &mut BodyStreamDecoder,
-    encoder: &mut BodyStreamEncoder,
-) -> Result<Vec<bytes::Bytes>, Report<TrustedServerError>> {
-    let mut segments = Vec::new();
-    let decoded_tail = decoder.finish()?;
-    if !decoded_tail.is_empty()
-        && let Some(encoded) = process_and_encode_chunk(
-            processor,
-            encoder,
-            &decoded_tail,
-            false,
-            "Failed to process decoded tail",
-        )?
-    {
-        segments.push(encoded);
-    }
-    if let Some(encoded) = process_and_encode_chunk(
-        processor,
-        encoder,
-        &[],
-        true,
-        "Failed to finalize processor",
-    )? {
-        segments.push(encoded);
-    }
-    let trailer = encoder.finish()?;
-    if !trailer.is_empty() {
-        segments.push(bytes::Bytes::from(trailer));
-    }
-    Ok(segments)
-}
-
-/// Owns a [`DispatchedAuction`] and logs if it is dropped uncollected.
-///
-/// The lazy publisher body stream can be dropped at any await point — a
-/// client disconnect aborts the transfer mid-body, or the response may never
-/// be polled at all. Async telemetry cannot run in `Drop`, so the loss is
-/// surfaced in logs; the abandoned-auction telemetry event is only emitted on
-/// error paths that can still await (see [`abandon_hold_auction`]).
-struct DispatchedAuctionGuard {
-    dispatched: Option<DispatchedAuction>,
-    /// Stays `true` from dispatch until collection (or telemetry-emitting
-    /// abandonment) reaches a terminal result. [`Self::take`] removes the
-    /// dispatched auction to hand it to the async collector but deliberately
-    /// leaves the guard armed, so a drop *while collection is still pending* —
-    /// a client disconnect at the collection await point — still logs the
-    /// loss. [`Self::disarm`] clears it only once collection has completed.
-    armed: bool,
-}
-
-impl DispatchedAuctionGuard {
-    fn new(dispatched: DispatchedAuction) -> Self {
-        Self {
-            dispatched: Some(dispatched),
-            armed: true,
-        }
-    }
-
-    /// Remove the dispatched auction to begin collection. The guard stays armed
-    /// until [`Self::disarm`] is called, so a drop before collection reaches a
-    /// terminal result is still reported.
-    fn take(&mut self) -> Option<DispatchedAuction> {
-        self.dispatched.take()
-    }
-
-    /// Disarm the drop warning once collection (or telemetry-emitting
-    /// abandonment) has reached a terminal result.
-    fn disarm(&mut self) {
-        self.armed = false;
-    }
-}
-
-impl Drop for DispatchedAuctionGuard {
-    fn drop(&mut self) {
-        if self.armed {
-            log::warn!(
-                "Dispatched server-side auction dropped without collection; SSP bid responses discarded (publisher body stream aborted or never polled)"
-            );
-        }
-    }
-}
-
-/// Mutable auction-hold state threaded through the streaming hold pipeline.
-struct AuctionHoldState {
-    hold: Option<BodyCloseHoldBuffer>,
-    dispatched: DispatchedAuctionGuard,
-    telemetry: AuctionTelemetryCarry,
-}
-
-impl AuctionHoldState {
-    fn new(dispatched: DispatchedAuctionGuard, telemetry: AuctionTelemetryCarry) -> Self {
-        Self {
-            hold: Some(BodyCloseHoldBuffer::new()),
-            dispatched,
-            telemetry,
-        }
-    }
-}
-
-/// Abandon the in-flight auction (if still pending) with the given telemetry
-/// reason. No-op once the auction has been collected or already abandoned.
-async fn abandon_hold_auction(
-    state: &mut AuctionHoldState,
-    services: &RuntimeServices,
-    reason: &'static str,
-) {
-    if let Some(dispatched) = state.dispatched.take() {
-        emit_abandoned_auction(
-            services,
-            state.telemetry.observation.take(),
-            dispatched,
-            reason,
-        )
-        .await;
-        // Abandonment with telemetry is a terminal result, so the drop warning
-        // is no longer warranted. (A drop *during* the emit above still fires
-        // it, since the guard stays armed until here.)
-        state.dispatched.disarm();
-    }
-}
-
-/// Output of a single close-body hold step, split at the auction-collection
-/// barrier.
-///
-/// `ready` is the prefix the caller must emit *before* collecting the auction,
-/// so a small page whose `</body>` lands in the first source chunk still
-/// streams its document prefix immediately instead of stalling behind the
-/// auction. `close_found` signals that `</body` was seen: the caller emits
-/// `ready`, then awaits [`hold_collect_close_tail`] to collect the auction and
-/// emit the held closing tail.
-struct HoldStepSegments {
-    ready: Vec<bytes::Bytes>,
-    close_found: bool,
-}
-
-/// Feed one decoded chunk through the close-body hold and processor.
-///
-/// Returns the ready prefix for the caller to emit — written to a client stream
-/// by [`body_close_hold_loop_stream`], yielded from the lazy body by
-/// [`publisher_response_into_streaming_response`]. Both async hold paths share
-/// this function so their behavior cannot drift apart.
-///
-/// This step never awaits auction collection: it processes only the bytes the
-/// hold buffer releases as ready and reports whether `</body` was seen. Holding
-/// the collection out of this step is what lets callers emit the prefix before
-/// the auction resolves. On processing failure the pending auction is abandoned
-/// before the error is returned.
-async fn hold_step_decoded_chunk<P: StreamProcessor>(
-    processor: &mut P,
-    encoder: &mut BodyStreamEncoder,
-    chunk: &[u8],
-    state: &mut AuctionHoldState,
-    collect_refs: &AuctionCollectDeps<'_>,
-) -> Result<HoldStepSegments, Report<TrustedServerError>> {
-    let mut ready = Vec::new();
-    let bytes: Cow<'_, [u8]> = match state.hold.as_mut() {
-        // Once the hold has been released the chunk streams straight through,
-        // borrowed rather than copied.
-        None => Cow::Borrowed(chunk),
-        Some(hold_buffer) => Cow::Owned(hold_buffer.push(chunk)),
-    };
-    match process_and_encode_chunk(processor, encoder, &bytes, false, "Failed to process chunk") {
-        Ok(Some(encoded)) => ready.push(encoded),
-        Ok(None) => {}
-        Err(err) => {
-            abandon_hold_auction(state, collect_refs.services, "stream_process_error").await;
-            return Err(err);
-        }
-    }
-    let close_found = state
-        .hold
-        .as_ref()
-        .is_some_and(BodyCloseHoldBuffer::found_close);
-    Ok(HoldStepSegments { ready, close_found })
-}
-
-/// Collect the dispatched auction and process the held `</body>` tail.
-///
-/// Call only after [`hold_step_decoded_chunk`] (or
-/// [`hold_finish_ready_segments`]) reports `close_found` and the ready prefix
-/// has already been emitted:
-/// collecting here — after the prefix streams — is what keeps the auction
-/// riding alongside transfer instead of blocking it. Collection runs before the
-/// tail is processed so `lol_html` sees live bids at the injection point.
-async fn hold_collect_close_tail<P: StreamProcessor>(
-    processor: &mut P,
-    encoder: &mut BodyStreamEncoder,
-    state: &mut AuctionHoldState,
-    collect_refs: &AuctionCollectDeps<'_>,
-) -> Result<Vec<bytes::Bytes>, Report<TrustedServerError>> {
-    let mut segments = Vec::new();
-    let dispatched = state
-        .dispatched
-        .take()
-        .expect("should have dispatched auction to collect");
-    collect_stream_auction(dispatched, state.telemetry.take(), collect_refs).await;
-    // Collection reached a terminal result; disarm only now so a drop while the
-    // collect await above was still pending is reported.
-    state.dispatched.disarm();
-
-    let held = state
-        .hold
-        .take()
-        .expect("should have close-body hold buffer")
-        .finish();
-    if let Some(encoded) = process_and_encode_chunk(
-        processor,
-        encoder,
-        &held,
-        false,
-        "Failed to process held body close",
-    )? {
-        segments.push(encoded);
-    }
-    Ok(segments)
-}
-
-/// Pull and decode the next chunk of the close-body hold pipeline, feeding it
-/// through [`hold_step_decoded_chunk`].
-///
-/// Returns `Ok(None)` when the source is exhausted; the caller must then emit
-/// [`hold_finish_ready_segments`] followed by [`hold_finish_tail_segments`]. On
-/// read or decode failure the pending auction is
-/// abandoned before the error is returned. Shared by the write-sink driver
-/// ([`body_close_hold_loop_stream`]) and the lazy publisher body stream so
-/// the two hold paths cannot drift apart.
-async fn hold_step_next_chunk<P: StreamProcessor>(
-    source: &mut BodyChunkSource,
-    decoder: &mut BodyStreamDecoder,
-    encoder: &mut BodyStreamEncoder,
-    processor: &mut P,
-    state: &mut AuctionHoldState,
-    collect_refs: &AuctionCollectDeps<'_>,
-) -> Result<Option<HoldStepSegments>, Report<TrustedServerError>> {
-    let raw_chunk = match source.next_chunk().await {
-        Ok(Some(chunk)) => chunk,
-        Ok(None) => return Ok(None),
-        Err(err) => {
-            abandon_hold_auction(state, collect_refs.services, "stream_read_error").await;
-            return Err(err);
-        }
-    };
-    let decoded = match decoder.decode_chunk(raw_chunk) {
-        Ok(decoded) => decoded,
-        Err(err) => {
-            abandon_hold_auction(state, collect_refs.services, "stream_decode_error").await;
-            return Err(err);
-        }
-    };
-    if decoded.is_empty() {
-        return Ok(Some(HoldStepSegments {
-            ready: Vec::new(),
-            close_found: false,
-        }));
-    }
-    hold_step_decoded_chunk(processor, encoder, &decoded, state, collect_refs)
-        .await
-        .map(Some)
-}
-
-/// Drain the decoder tail at end of the origin stream, returning the prefix the
-/// caller must emit before [`hold_finish_tail_segments`].
-///
-/// A codec can hold document bytes back until its own finalization — the gzip
-/// decoder releases the remainder of the final member at `finish()` — and that
-/// remainder may be the whole document for a small page. Returning it ahead of
-/// collection keeps the invariant the mid-stream path already has: only the
-/// closing `</body>` tail waits for the auction, never renderable content.
-///
-/// On decoder failure the pending auction is abandoned before the error is
-/// returned.
-async fn hold_finish_ready_segments<P: StreamProcessor>(
-    processor: &mut P,
-    decoder: &mut BodyStreamDecoder,
-    encoder: &mut BodyStreamEncoder,
-    state: &mut AuctionHoldState,
-    collect_refs: &AuctionCollectDeps<'_>,
-) -> Result<Vec<bytes::Bytes>, Report<TrustedServerError>> {
-    let decoded_tail = match decoder.finish() {
-        Ok(decoded_tail) => decoded_tail,
-        Err(err) => {
-            abandon_hold_auction(state, collect_refs.services, "stream_decode_error").await;
-            return Err(err);
-        }
-    };
-    if decoded_tail.is_empty() {
-        return Ok(Vec::new());
-    }
-    let step =
-        hold_step_decoded_chunk(processor, encoder, &decoded_tail, state, collect_refs).await?;
-    Ok(step.ready)
-}
-
-/// Finalize the close-body hold pipeline after [`hold_finish_ready_segments`].
-///
-/// Collects the auction if the close-body tag never streamed, processes the held
-/// tail plus the processor's final chunk, and emits the encoder trailer. Returns
-/// the encoded segments for the caller to emit.
-async fn hold_finish_tail_segments<P: StreamProcessor>(
-    processor: &mut P,
-    encoder: &mut BodyStreamEncoder,
-    state: &mut AuctionHoldState,
-    collect_refs: &AuctionCollectDeps<'_>,
-) -> Result<Vec<bytes::Bytes>, Report<TrustedServerError>> {
-    let mut segments = Vec::new();
-
-    // If the hold is still armed the auction was never collected mid-stream:
-    // `</body>` arrived only in the decoder tail, or the document had none at
-    // all. Collect now and flush the held remainder before finalizing.
-    if state.hold.is_some() {
-        segments.extend(hold_collect_close_tail(processor, encoder, state, collect_refs).await?);
-    }
-
-    if let Some(encoded) = process_and_encode_chunk(
-        processor,
-        encoder,
-        &[],
-        true,
-        "Failed to finalize processor",
-    )? {
-        segments.push(encoded);
-    }
-    let trailer = encoder.finish()?;
-    if !trailer.is_empty() {
-        segments.push(bytes::Bytes::from(trailer));
-    }
-    Ok(segments)
-}
-
 /// Create a unified HTML stream processor.
 ///
 /// Builds the config via [`HtmlProcessorConfig::from_settings`] and then
@@ -952,23 +338,22 @@ fn create_html_stream_processor(
 /// Result of publisher request handling, indicating whether the response body
 /// should be streamed or has already been buffered.
 pub enum PublisherResponse {
-    /// Response returned unmodified, ready to send via `send_to_client()`.
-    ///
-    /// On streaming adapters the unmodified body may still be a live
-    /// [`EdgeBody::Stream`] (the origin fetch requested streaming before the
-    /// response was classified); it passes through to the client untouched.
+    /// Response is fully buffered and ready to send via `send_to_client()`.
     Buffered(Response<EdgeBody>),
     /// Response headers are ready for a streaming response. Covers processable
     /// content on any status (2xx or non-2xx — e.g., branded 404/500 HTML and
     /// error JSON still get URL rewriting) where the encoding is supported.
     /// Post-processors run inside the streaming processor, so processable HTML
-    /// is streamed regardless of whether any are registered.
+    /// is streamed regardless of whether any are registered. The caller must:
+    /// 1. Call `finalize_response()` on the response
+    /// 2. Call `response.stream_to_client()` to get a `StreamingBody`
+    /// 3. Call `stream_publisher_body()` with the body and streaming writer
+    /// 4. Call `StreamingBody::finish()`
     ///
-    /// Adapters with platform streaming support preserve `body` as
-    /// [`EdgeBody::Stream`] and attach a lazy processed stream via
-    /// [`publisher_response_into_streaming_response`]. Buffered adapters use
-    /// [`buffer_publisher_response_async`] and are bounded by
-    /// `settings.publisher.max_buffered_body_bytes`.
+    /// **Interim (PR 15):** `body` has already been fully materialised into
+    /// WASM heap by the platform HTTP client.  `stream_publisher_body` reads
+    /// from an in-memory buffer, not a live origin stream.  The origin-side
+    /// peak is bounded by `MAX_PLATFORM_RESPONSE_BODY_BYTES`.
     Stream {
         /// Response with all headers set (EC ID, cookies, etc.)
         /// but body not yet written. `Content-Length` already removed.
@@ -983,9 +368,12 @@ pub enum PublisherResponse {
     /// `finalize_response()` and `send_to_client()` are applied at the outer
     /// response-dispatch level, not in this arm.
     ///
-    /// `Content-Length` is preserved — the body is unmodified. Streaming
-    /// adapters reattach the origin body directly so non-processable 2xx bodies
-    /// can pass through without materializing in WASM memory.
+    /// `Content-Length` is preserved — the body is unmodified.
+    ///
+    /// **Interim (PR 15):** `body` has been fully materialised into WASM heap.
+    /// Previously, binary assets streamed lazily from origin with no WASM
+    /// buffering.  This path is now bounded by `MAX_PLATFORM_RESPONSE_BODY_BYTES`;
+    /// assets exceeding that limit return an error instead of exhausting heap.
     PassThrough {
         /// Response with all headers set but body not yet written.
         response: Response<EdgeBody>,
@@ -1082,7 +470,7 @@ pub struct OwnedProcessResponseParams {
 /// statuses (204, 304) carry no body but may advertise the `GET` representation's
 /// length, so they skip the buffer and length rewrite.
 ///
-/// Buffered adapters (Axum, Cloudflare, Spin, and non-streaming fallbacks) call
+/// Every adapter (Axum, Cloudflare, Spin, and the Fastly `EdgeZero` path) calls
 /// this: it drives
 /// [`stream_publisher_body_async`], which awaits
 /// [`AuctionOrchestrator::collect_dispatched_auction`], writes the winning bids
@@ -1101,41 +489,23 @@ pub async fn buffer_publisher_response_async(
     services: &RuntimeServices,
 ) -> Result<Response<EdgeBody>, Report<crate::error::TrustedServerError>> {
     match publisher_response {
-        PublisherResponse::Buffered(mut response) => {
-            // A buffered-unmodified response can carry an origin body (a stream
-            // on streaming-capable adapters). A bodiless response (HEAD, 204,
-            // 205, 304) must stay bodiless, so drop the body and correct its
-            // framing (204/205 Content-Length; HEAD/304 preserved), matching
-            // the streaming finalizer.
-            if !response_carries_body(method, response.status()) {
-                make_response_bodiless(&mut response);
-            }
-            Ok(response)
-        }
+        PublisherResponse::Buffered(response) => Ok(response),
         PublisherResponse::Stream {
             mut response,
             body,
             mut params,
         } => {
             if !response_carries_body(method, response.status()) {
-                if let Some(dispatched) = params.dispatched_auction.take() {
-                    // A bodiless response (HEAD navigation, 304) has no
+                if params.dispatched_auction.is_some() {
+                    // A bodiless response (HEAD navigation, 204/304) has no
                     // `</body>` to inject bids into, so the dispatched SSP
-                    // requests are wasted. Emit a terminal abandonment event so
-                    // the SSP work and quota consumption stay observable instead
-                    // of vanishing, matching the streaming finalizer.
+                    // requests are wasted — surface it for quota observability,
+                    // matching the pass-through / buffered-unmodified arms.
                     log::warn!(
                         "Server-side auction dispatched but response is bodiless (method: {}, status: {}); in-flight SSP bid requests will not be collected",
                         method,
                         response.status(),
                     );
-                    emit_abandoned_auction(
-                        services,
-                        params.auction_observation.take(),
-                        dispatched,
-                        "bodiless_response",
-                    )
-                    .await;
                 }
                 return Ok(response);
             }
@@ -1165,313 +535,37 @@ pub async fn buffer_publisher_response_async(
     }
 }
 
-/// Convert a [`PublisherResponse`] into a response that preserves streaming
-/// bodies where possible.
-///
-/// Buffered adapters should keep using [`buffer_publisher_response_async`].
-/// Fastly uses this helper before the entry point commits headers, allowing the
-/// response body to be pulled lazily by `stream_to_client()`.
+/// Returns `true` when a buffered publisher response should carry a body and a
+/// recomputed `Content-Length`.
 ///
-/// # Errors
+/// `HEAD` responses and bodiless statuses (204, 304) carry no body; rewriting
+/// their `Content-Length` to the (empty) buffered length would mislead clients
+/// and caches, so the origin metadata is preserved instead.
+fn response_carries_body(method: &Method, status: StatusCode) -> bool {
+    *method != Method::HEAD
+        && status != StatusCode::NO_CONTENT
+        && status != StatusCode::NOT_MODIFIED
+}
+
+/// A [`Write`] sink that buffers into a `Vec<u8>` but fails once the configured
+/// byte limit would be exceeded.
 ///
-/// Returns an error if processor construction fails before the streaming body
-/// is created; a dispatched auction is abandoned with `processor_init_error`
-/// telemetry first, matching the buffered finalizer.
-pub async fn publisher_response_into_streaming_response(
-    publisher_response: PublisherResponse,
-    method: &Method,
-    settings: Arc<Settings>,
-    integration_registry: &IntegrationRegistry,
-    orchestrator: Arc<AuctionOrchestrator>,
-    services: RuntimeServices,
-) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
-    match publisher_response {
-        PublisherResponse::Buffered(mut response) => {
-            // Fastly requests the origin body as a stream before the response is
-            // classified, so a buffered-unmodified response can still hold an
-            // `EdgeBody::Stream`. A bodiless response (HEAD, 204, 205, 304) must
-            // stay bodiless — `send_edgezero_response` streams any
-            // `EdgeBody::Stream` to the client — so drop the body and correct
-            // its framing (204/205 Content-Length; HEAD/304 preserved).
-            if !response_carries_body(method, response.status()) {
-                make_response_bodiless(&mut response);
-            }
-            Ok(response)
-        }
-        PublisherResponse::PassThrough { mut response, body } => {
-            if response_carries_body(method, response.status()) {
-                *response.body_mut() = body;
-            }
-            Ok(response)
-        }
-        PublisherResponse::Stream {
-            mut response,
-            body,
-            mut params,
-        } => {
-            if !response_carries_body(method, response.status()) {
-                if let Some(dispatched) = params.dispatched_auction.take() {
-                    // A bodiless response (HEAD navigation, 304) has no
-                    // `</body>` to inject bids into, so the dispatched SSP
-                    // requests are wasted. Emit a terminal abandonment event so
-                    // the SSP work and quota consumption stay observable instead
-                    // of vanishing, matching the processor-init-error path and
-                    // the buffered finalizer.
-                    log::warn!(
-                        "Server-side auction dispatched but response is bodiless (method: {}, status: {}); in-flight SSP bid requests will not be collected",
-                        method,
-                        response.status(),
-                    );
-                    emit_abandoned_auction(
-                        &services,
-                        params.auction_observation.take(),
-                        dispatched,
-                        "bodiless_response",
-                    )
-                    .await;
-                }
-                return Ok(response);
-            }
-
-            response.headers_mut().remove(header::CONTENT_LENGTH);
-            let mut params = *params;
-            let mut processor =
-                match PublisherBodyProcessor::new(&params, &settings, integration_registry) {
-                    Ok(processor) => processor,
-                    Err(err) => {
-                        // Parity with the buffered finalizer: a processor
-                        // construction failure abandons the dispatched auction
-                        // with telemetry instead of dropping the in-flight SSP
-                        // responses silently.
-                        if let Some(dispatched) = params.dispatched_auction.take() {
-                            emit_abandoned_auction(
-                                &services,
-                                params.auction_observation.take(),
-                                dispatched,
-                                "processor_init_error",
-                            )
-                            .await;
-                        }
-                        return Err(err);
-                    }
-                };
-            // The guard is created before the lazy stream so an auction whose
-            // response body is dropped unpolled still logs the loss.
-            let dispatched_auction = params.dispatched_auction.take().map(|dispatched| {
-                let telemetry = AuctionTelemetryCarry {
-                    observation: params.auction_observation.take(),
-                    auction_request: params.auction_request.take(),
-                };
-                (DispatchedAuctionGuard::new(dispatched), telemetry)
-            });
-            let stream = async_stream::try_stream! {
-                let compression = Compression::from_content_encoding(&params.content_encoding);
-                let max_body_bytes = settings.publisher.max_buffered_body_bytes;
-                let mut decoder = BodyStreamDecoder::new(compression, max_body_bytes);
-                let mut encoder = BodyStreamEncoder::new(compression);
-                let mut source = BodyChunkSource::new(body, STREAM_CHUNK_SIZE)
-                    .with_max_bytes(max_body_bytes);
-
-                // HTML rides the close-body hold so bids land before `</body>`;
-                // non-HTML has no injection point, so its auction is collected
-                // before any byte streams (matching the buffered finalizer).
-                let mut hold_auction = None;
-                if let Some((mut guard, telemetry)) = dispatched_auction {
-                    if is_html_content_type(&params.content_type) {
-                        hold_auction = Some((guard, telemetry));
-                    } else if let Some(dispatched) = guard.take() {
-                        collect_non_html_auction(
-                            dispatched,
-                            telemetry,
-                            &params,
-                            &orchestrator,
-                            &services,
-                            &settings,
-                        )
-                        .await;
-                        // Collection reached a terminal result; disarm only now
-                        // so a drop while the collect await above was still
-                        // pending is reported.
-                        guard.disarm();
-                    }
-                }
-
-                if let Some((guard, telemetry)) = hold_auction {
-                    let mut state = AuctionHoldState::new(guard, telemetry);
-                    let collect_refs = AuctionCollectDeps {
-                        price_granularity: params.price_granularity,
-                        ad_bids_state: &params.ad_bids_state,
-                        orchestrator: &orchestrator,
-                        services: &services,
-                        settings: &settings,
-                        request_origin: request_origin(
-                            &params.request_scheme,
-                            &params.request_host,
-                        ),
-                    };
-
-                    while let Some(step) = hold_step_next_chunk(
-                        &mut source,
-                        &mut decoder,
-                        &mut encoder,
-                        &mut processor,
-                        &mut state,
-                        &collect_refs,
-                    )
-                    .await
-                    .map_err(publisher_stream_error)?
-                    {
-                        // Emit the ready prefix before collecting the auction so
-                        // the client receives the document up to `</body>` while
-                        // the auction rides alongside transfer.
-                        for encoded in step.ready {
-                            yield encoded;
-                        }
-                        if step.close_found {
-                            for encoded in hold_collect_close_tail(
-                                &mut processor,
-                                &mut encoder,
-                                &mut state,
-                                &collect_refs,
-                            )
-                            .await
-                            .map_err(publisher_stream_error)?
-                            {
-                                yield encoded;
-                            }
-                        }
-                    }
-
-                    // Whatever the decoder released at finalization is emitted
-                    // before collection, for the same reason as the mid-stream
-                    // prefix above: a small compressed page can surface its
-                    // whole document here.
-                    for encoded in hold_finish_ready_segments(
-                        &mut processor,
-                        &mut decoder,
-                        &mut encoder,
-                        &mut state,
-                        &collect_refs,
-                    )
-                    .await
-                    .map_err(publisher_stream_error)?
-                    {
-                        yield encoded;
-                    }
-                    for encoded in hold_finish_tail_segments(
-                        &mut processor,
-                        &mut encoder,
-                        &mut state,
-                        &collect_refs,
-                    )
-                    .await
-                    .map_err(publisher_stream_error)?
-                    {
-                        yield encoded;
-                    }
-                } else {
-                    while let Some(segments) = passthrough_step(
-                        &mut source,
-                        &mut decoder,
-                        &mut encoder,
-                        &mut processor,
-                    )
-                    .await
-                    .map_err(publisher_stream_error)?
-                    {
-                        for encoded in segments {
-                            yield encoded;
-                        }
-                    }
-                    for encoded in
-                        passthrough_finish_segments(&mut processor, &mut decoder, &mut encoder)
-                            .map_err(publisher_stream_error)?
-                    {
-                        yield encoded;
-                    }
-                }
-            };
-            *response.body_mut() = EdgeBody::from_stream::<_, std::io::Error>(stream);
-            Ok(response)
-        }
-    }
-}
-
-/// Returns `true` when a buffered publisher response should carry a body and a
-/// recomputed `Content-Length`.
-///
-/// `HEAD` responses and bodiless statuses (204, 205, 304) carry no body;
-/// rewriting their `Content-Length` to the (empty) buffered length — or
-/// streaming an origin body for them at all — would mislead clients and caches
-/// and violate HTTP framing, so the origin metadata is preserved and the body
-/// is dropped instead.
-fn response_carries_body(method: &Method, status: StatusCode) -> bool {
-    *method != Method::HEAD
-        && status != StatusCode::NO_CONTENT
-        && status != StatusCode::RESET_CONTENT
-        && status != StatusCode::NOT_MODIFIED
-}
-
-/// Drop a bodiless response's body and correct its framing headers.
-///
-/// The response keeps no body, and its `Content-Length` is corrected where the
-/// origin's value would be invalid for the now-empty message:
-/// - **204 No Content**: RFC 9110 §8.6 forbids `Content-Length`; remove it.
-/// - **205 Reset Content**: the reset response carries nothing, so a nonzero
-///   origin length is wrong (RFC 9110 §15.4.6); normalize it to `0`.
-/// - **HEAD and 304 Not Modified**: `Content-Length` legitimately advertises
-///   the `GET` representation length, so it is preserved untouched.
-///
-/// The normalized 204/205 responses also drop chunked-framing metadata the
-/// adapters would otherwise copy verbatim: RFC 9112 §6.1 forbids
-/// `Transfer-Encoding` on a 204, and keeping it on a 205 alongside the
-/// `Content-Length: 0` inserted above would advertise two conflicting framings.
-/// `Trailer` describes fields that only a chunked body can carry, so it goes
-/// with it. `HEAD` and 304 keep both for the same reason they keep
-/// `Content-Length`: the fields describe the `GET` representation, not this
-/// message.
-fn make_response_bodiless(response: &mut Response<EdgeBody>) {
-    *response.body_mut() = EdgeBody::empty();
-    match response.status() {
-        StatusCode::NO_CONTENT => {
-            response.headers_mut().remove(header::CONTENT_LENGTH);
-            remove_chunked_framing_headers(response.headers_mut());
-        }
-        StatusCode::RESET_CONTENT => {
-            response
-                .headers_mut()
-                .insert(header::CONTENT_LENGTH, HeaderValue::from(0_u64));
-            remove_chunked_framing_headers(response.headers_mut());
-        }
-        _ => {}
-    }
-}
-
-/// Remove the framing fields that only apply to a message with a chunked body.
-fn remove_chunked_framing_headers(headers: &mut header::HeaderMap) {
-    headers.remove(header::TRANSFER_ENCODING);
-    headers.remove(header::TRAILER);
-}
-
-/// A [`Write`] sink that buffers into a `Vec<u8>` but fails once the configured
-/// byte limit would be exceeded.
-///
-/// Used to bound in-WASM-heap buffering of decoded/re-written publisher bodies.
-/// A highly-compressible origin response can sit under the platform raw-body cap
-/// yet expand past a safe heap size after decode and post-processing; this writer
-/// turns that into a recoverable error instead of an out-of-memory abort.
-pub struct BoundedWriter {
-    inner: Vec<u8>,
-    limit: usize,
-}
-
-impl BoundedWriter {
-    /// Creates a writer that accepts at most `limit` bytes before erroring.
-    #[must_use]
-    pub fn new(limit: usize) -> Self {
-        Self {
-            inner: Vec::new(),
-            limit,
+/// Used to bound in-WASM-heap buffering of decoded/re-written publisher bodies.
+/// A highly-compressible origin response can sit under the platform raw-body cap
+/// yet expand past a safe heap size after decode and post-processing; this writer
+/// turns that into a recoverable error instead of an out-of-memory abort.
+pub struct BoundedWriter {
+    inner: Vec<u8>,
+    limit: usize,
+}
+
+impl BoundedWriter {
+    /// Creates a writer that accepts at most `limit` bytes before erroring.
+    #[must_use]
+    pub fn new(limit: usize) -> Self {
+        Self {
+            inner: Vec::new(),
+            limit,
         }
     }
 
@@ -1563,18 +657,7 @@ pub async fn stream_publisher_body_async<W: Write>(
     services: &RuntimeServices,
 ) -> Result<(), Report<TrustedServerError>> {
     let Some(dispatched) = params.dispatched_auction.take() else {
-        if body.is_stream() {
-            return process_response_streaming_async(
-                body,
-                output,
-                params,
-                settings,
-                integration_registry,
-            )
-            .await;
-        }
-
-        // No auction and already-buffered body — keep the existing sync pipeline.
+        // No auction — use the existing sync pipeline unchanged.
         return stream_publisher_body(body, output, params, settings, integration_registry);
     };
     let telemetry = AuctionTelemetryCarry {
@@ -1587,25 +670,35 @@ pub async fn stream_publisher_body_async<W: Write>(
     if !is_html {
         // Non-HTML: collect auction first, then stream.  There is no </body>
         // to hold, so delaying the entire body until collection is acceptable.
-        collect_non_html_auction(
-            dispatched,
-            telemetry,
-            params,
-            orchestrator,
-            services,
-            settings,
-        )
-        .await;
-        if body.is_stream() {
-            return process_response_streaming_async(
-                body,
-                output,
-                params,
-                settings,
-                integration_registry,
+        let placeholder = mediator_placeholder_request();
+        let result = orchestrator
+            .collect_dispatched_auction(
+                dispatched,
+                services,
+                &make_collect_context(settings, services, &placeholder),
             )
             .await;
+        if let (Some(observation), Some(auction_request)) =
+            (telemetry.observation, telemetry.auction_request.as_ref())
+        {
+            emit_auction_events_best_effort_lazy(services, || {
+                build_auction_events(
+                    observation,
+                    AuctionTerminalOutcome::Completed {
+                        request: auction_request,
+                        result: &result,
+                    },
+                )
+            })
+            .await;
         }
+
+        write_bids_to_state(
+            &result.winning_bids,
+            params.price_granularity,
+            &params.ad_bids_state,
+            settings.debug.inject_adm_for_testing,
+        );
         return stream_publisher_body(body, output, params, settings, integration_registry);
     }
 
@@ -1643,14 +736,11 @@ pub async fn stream_publisher_body_async<W: Write>(
         AuctionCollectCtx {
             dispatched,
             telemetry,
-            deps: AuctionCollectDeps {
-                price_granularity: params.price_granularity,
-                ad_bids_state: &params.ad_bids_state,
-                orchestrator,
-                services,
-                settings,
-                request_origin: request_origin(&params.request_scheme, &params.request_host),
-            },
+            price_granularity: params.price_granularity,
+            ad_bids_state: &params.ad_bids_state,
+            orchestrator,
+            services,
+            settings,
         },
     )
     .await
@@ -1754,38 +844,18 @@ pub(crate) fn should_run_server_side_ad_stack(
 }
 
 /// Write winning bids from an auction result into the shared `ad_bids_state` lock.
-/// Build the request origin (`scheme://host`, where `host` includes any port)
-/// used to emit absolute first-party URLs in inline creatives. Returns an empty
-/// string when the scheme or host is unknown, so callers fall back to the
-/// configured publisher domain.
-fn request_origin(scheme: &str, host: &str) -> String {
-    if scheme.is_empty() || host.is_empty() {
-        String::new()
-    } else {
-        format!("{scheme}://{host}")
-    }
-}
-
 pub(crate) fn write_bids_to_state(
     winning_bids: &std::collections::HashMap<String, Bid>,
     price_granularity: PriceGranularity,
     ad_bids_state: &Arc<Mutex<Option<String>>>,
-    settings: &Settings,
-    request_origin: &str,
-    include_debug_bid: bool,
+    inject_adm: bool,
 ) {
     log::debug!(
         "write_bids_to_state: {} winning bid(s): [{}]",
         winning_bids.len(),
         winning_bids.keys().cloned().collect::<Vec<_>>().join(", ")
     );
-    let bid_map = build_bid_map(
-        winning_bids,
-        price_granularity,
-        settings,
-        request_origin,
-        include_debug_bid,
-    );
+    let bid_map = build_bid_map(winning_bids, price_granularity, inject_adm);
     let bids_script = build_bids_script(&bid_map);
     *ad_bids_state.lock().expect("should lock bid state") = Some(bids_script);
 }
@@ -1986,26 +1056,15 @@ impl AuctionTelemetryCarry {
     }
 }
 
-/// Bundles the auction-collection state passed through the streaming helpers.
+/// Bundles the auction-collection dependencies passed through the streaming helpers.
 struct AuctionCollectCtx<'a> {
     dispatched: DispatchedAuction,
     telemetry: AuctionTelemetryCarry,
-    deps: AuctionCollectDeps<'a>,
-}
-
-/// Borrowed dependencies of the auction collect step.
-///
-/// Split from the per-auction state above because `dispatched` and `telemetry`
-/// are moved out at collect time while these stay live for the rest of the
-/// streaming loop.
-struct AuctionCollectDeps<'a> {
     price_granularity: PriceGranularity,
     ad_bids_state: &'a Arc<Mutex<Option<String>>>,
     orchestrator: &'a AuctionOrchestrator,
     services: &'a RuntimeServices,
     settings: &'a Settings,
-    /// Trusted request origin (`scheme://host`) for absolute inline creative URLs.
-    request_origin: String,
 }
 
 /// Run the close-body hold loop for HTML bodies, collecting the auction before
@@ -2017,31 +1076,17 @@ async fn stream_html_with_auction_hold<W: Write, P: StreamProcessor>(
     compression: Compression,
     ctx: AuctionCollectCtx<'_>,
 ) -> Result<(), Report<TrustedServerError>> {
-    if body.is_stream() {
-        let max_body_bytes = ctx.deps.settings.publisher.max_buffered_body_bytes;
-        return body_close_hold_loop_stream(
-            body,
-            output,
-            processor,
-            compression,
-            ctx,
-            max_body_bytes,
-        )
-        .await;
-    }
+    use brotli::Decompressor;
+    use brotli::enc::BrotliEncoderParams;
+    use brotli::enc::writer::CompressorWriter;
+    use flate2::read::{GzDecoder, ZlibDecoder};
+    use flate2::write::{GzEncoder, ZlibEncoder};
 
-    // Bound the gzip decode budget to the same ceiling the buffered writer
-    // enforces, matching the streaming arm above and the no-hold buffered path.
-    let max_body_bytes = ctx.deps.settings.publisher.max_buffered_body_bytes;
-    let body = body_as_reader(body)?;
+    let body = body_as_reader(body);
     match compression {
         Compression::None => body_close_hold_loop(body, output, processor, ctx).await,
         Compression::Gzip => {
-            // `GzipDecodeReader` decodes concatenated gzip members (RFC 1952)
-            // and bounds decoded output, unlike `flate2::read::GzDecoder`, which
-            // silently drops every member after the first — dropping trailing
-            // markup (potentially including `</body>`) on buffered adapters.
-            let decoder = GzipDecodeReader::new(body, max_body_bytes);
+            let decoder = GzDecoder::new(body);
             let mut encoder = GzEncoder::new(&mut *output, flate2::Compression::default());
             body_close_hold_loop(decoder, &mut encoder, processor, ctx).await?;
             encoder.finish().change_context(TrustedServerError::Proxy {
@@ -2074,83 +1119,6 @@ async fn stream_html_with_auction_hold<W: Write, P: StreamProcessor>(
     }
 }
 
-/// Async-pull variant of [`body_close_hold_loop`] for live origin streams.
-///
-/// Shares [`hold_step_next_chunk`] and the finish stages with the
-/// lazy streaming body built by [`publisher_response_into_streaming_response`],
-/// so the two async hold paths cannot drift apart.
-///
-/// No production caller reaches this today: it is only entered through
-/// [`buffer_publisher_response_async`], and the buffered adapters (Axum,
-/// Cloudflare, Spin) never produce `Body::Stream` because the publisher fetch
-/// is gated on `supports_streaming_responses()`. It is groundwork for those
-/// adapters' streaming cutover; Fastly uses the lazy stream instead.
-async fn body_close_hold_loop_stream<W: Write, P: StreamProcessor>(
-    body: EdgeBody,
-    writer: &mut W,
-    processor: &mut P,
-    compression: Compression,
-    ctx: AuctionCollectCtx<'_>,
-    max_body_bytes: usize,
-) -> Result<(), Report<TrustedServerError>> {
-    let AuctionCollectCtx {
-        dispatched,
-        telemetry,
-        deps: collect_refs,
-    } = ctx;
-    let mut decoder = BodyStreamDecoder::new(compression, max_body_bytes);
-    let mut encoder = BodyStreamEncoder::new(compression);
-    let mut source = BodyChunkSource::new(body, STREAM_CHUNK_SIZE).with_max_bytes(max_body_bytes);
-    let mut state = AuctionHoldState::new(DispatchedAuctionGuard::new(dispatched), telemetry);
-
-    while let Some(step) = hold_step_next_chunk(
-        &mut source,
-        &mut decoder,
-        &mut encoder,
-        processor,
-        &mut state,
-        &collect_refs,
-    )
-    .await?
-    {
-        // Write the ready prefix before collecting the auction, matching the
-        // lazy Fastly stream: only the held `</body>` tail waits on collection.
-        for encoded in step.ready {
-            write_encoded_segment(writer, &encoded)?;
-        }
-        if step.close_found {
-            for encoded in
-                hold_collect_close_tail(processor, &mut encoder, &mut state, &collect_refs).await?
-            {
-                write_encoded_segment(writer, &encoded)?;
-            }
-        }
-    }
-
-    // Write the decoder-finalized prefix before collection, matching the lazy
-    // Fastly stream: only the held `</body>` tail waits on the auction.
-    for encoded in hold_finish_ready_segments(
-        processor,
-        &mut decoder,
-        &mut encoder,
-        &mut state,
-        &collect_refs,
-    )
-    .await?
-    {
-        write_encoded_segment(writer, &encoded)?;
-    }
-    for encoded in
-        hold_finish_tail_segments(processor, &mut encoder, &mut state, &collect_refs).await?
-    {
-        write_encoded_segment(writer, &encoded)?;
-    }
-    writer.flush().change_context(TrustedServerError::Proxy {
-        message: "Failed to flush output".to_string(),
-    })?;
-    Ok(())
-}
-
 const BODY_CLOSE_PREFIX: &[u8] = b"</body";
 
 struct BodyCloseHoldBuffer {
@@ -2220,7 +1188,11 @@ async fn body_close_hold_loop<R: std::io::Read, W: Write, P: StreamProcessor>(
     let AuctionCollectCtx {
         dispatched,
         mut telemetry,
-        deps,
+        price_granularity,
+        ad_bids_state,
+        orchestrator,
+        services,
+        settings,
     } = ctx;
     let mut buffer = vec![0u8; STREAM_CHUNK_SIZE];
     let mut hold = Some(BodyCloseHoldBuffer::new());
@@ -2233,7 +1205,16 @@ async fn body_close_hold_loop<R: std::io::Read, W: Write, P: StreamProcessor>(
                     let dispatched = dispatched
                         .take()
                         .expect("should have dispatched auction to collect");
-                    collect_stream_auction(dispatched, telemetry.take(), &deps).await;
+                    collect_stream_auction(
+                        dispatched,
+                        telemetry.take(),
+                        price_granularity,
+                        ad_bids_state,
+                        orchestrator,
+                        services,
+                        settings,
+                    )
+                    .await;
 
                     let held = hold.finish();
                     write_processed_chunk(
@@ -2273,7 +1254,7 @@ async fn body_close_hold_loop<R: std::io::Read, W: Write, P: StreamProcessor>(
                     ) {
                         if let Some(dispatched) = dispatched.take() {
                             emit_abandoned_auction(
-                                deps.services,
+                                services,
                                 telemetry.observation.take(),
                                 dispatched,
                                 "stream_process_error",
@@ -2287,7 +1268,16 @@ async fn body_close_hold_loop<R: std::io::Read, W: Write, P: StreamProcessor>(
                         let dispatched = dispatched
                             .take()
                             .expect("should have dispatched auction to collect");
-                        collect_stream_auction(dispatched, telemetry.take(), &deps).await;
+                        collect_stream_auction(
+                            dispatched,
+                            telemetry.take(),
+                            price_granularity,
+                            ad_bids_state,
+                            orchestrator,
+                            services,
+                            settings,
+                        )
+                        .await;
 
                         let held = hold
                             .take()
@@ -2316,7 +1306,7 @@ async fn body_close_hold_loop<R: std::io::Read, W: Write, P: StreamProcessor>(
             Err(e) => {
                 if let Some(dispatched) = dispatched.take() {
                     emit_abandoned_auction(
-                        deps.services,
+                        services,
                         telemetry.observation.take(),
                         dispatched,
                         "stream_read_error",
@@ -2361,65 +1351,15 @@ async fn emit_abandoned_auction(
     .await;
 }
 
-/// Collect a dispatched auction before a non-HTML body streams: there is no
-/// `</body>` to inject into, so bids are written to state up front and the
-/// auction telemetry completes immediately.
-async fn collect_non_html_auction(
+async fn collect_stream_auction(
     dispatched: DispatchedAuction,
     telemetry: AuctionTelemetryCarry,
-    params: &OwnedProcessResponseParams,
+    price_granularity: PriceGranularity,
+    ad_bids_state: &Arc<Mutex<Option<String>>>,
     orchestrator: &AuctionOrchestrator,
     services: &RuntimeServices,
     settings: &Settings,
 ) {
-    let placeholder = mediator_placeholder_request();
-    let result = orchestrator
-        .collect_dispatched_auction(
-            dispatched,
-            services,
-            &make_collect_context(settings, services, &placeholder),
-        )
-        .await;
-    if let (Some(observation), Some(auction_request)) =
-        (telemetry.observation, telemetry.auction_request.as_ref())
-    {
-        emit_auction_events_best_effort_lazy(services, || {
-            build_auction_events(
-                observation,
-                AuctionTerminalOutcome::Completed {
-                    request: auction_request,
-                    result: &result,
-                },
-            )
-        })
-        .await;
-    }
-    write_bids_to_state(
-        &result.winning_bids,
-        params.price_granularity,
-        &params.ad_bids_state,
-        settings,
-        &request_origin(&params.request_scheme, &params.request_host),
-        settings.debug.inject_adm_for_testing,
-    );
-}
-
-// Private orchestration helper called only from `body_close_hold_loop`.
-// `dispatched` and `telemetry` are moved per collect, so they stay by value
-// while the rest of the context is borrowed.
-async fn collect_stream_auction(
-    dispatched: DispatchedAuction,
-    telemetry: AuctionTelemetryCarry,
-    deps: &AuctionCollectDeps<'_>,
-) {
-    let AuctionCollectDeps {
-        price_granularity,
-        ad_bids_state,
-        orchestrator,
-        services,
-        settings,
-        request_origin,
-    } = deps;
     log::info!("body_close_hold_loop: collecting dispatched auction before held body tail");
     let placeholder = mediator_placeholder_request();
     let collect_ctx = make_collect_context(settings, services, &placeholder);
@@ -2446,10 +1386,8 @@ async fn collect_stream_auction(
     );
     write_bids_to_state(
         &result.winning_bids,
-        *price_granularity,
+        price_granularity,
         ad_bids_state,
-        settings,
-        request_origin,
         settings.debug.inject_adm_for_testing,
     );
 
@@ -2580,7 +1518,6 @@ pub async fn handle_publisher_request(
             certificate_check: settings.proxy.certificate_check,
             first_byte_timeout: DEFAULT_PUBLISHER_FIRST_BYTE_TIMEOUT,
             between_bytes_timeout: DEFAULT_PUBLISHER_FIRST_BYTE_TIMEOUT,
-            discriminator: None,
         })
         .change_context(TrustedServerError::Proxy {
             message: "backend registration failed".to_string(),
@@ -2672,14 +1609,9 @@ pub async fn handle_publisher_request(
     let mut dispatched_auction = if matched_slots.is_empty() {
         None
     } else {
-        // Telemetry attribution must use the same publisher identity as the
-        // outbound bid request. On the navigation path `request_host` is the
-        // trusted-server edge host, so using it here would attribute navigation
-        // rows to the edge/staging domain while `/auction` rows (built from
-        // `AuctionRequest::publisher.domain`) use the configured domain.
         let observation = AuctionObservationContext::from_parts(
             AuctionSource::InitialNavigation,
-            &settings.publisher.domain,
+            request_host,
             &request_path,
             matched_slots.len(),
             ec_context,
@@ -2695,7 +1627,6 @@ pub async fn handle_publisher_request(
                 ec_id,
                 &consent_context,
                 &request_info,
-                &settings.publisher.domain,
                 req.headers()
                     .get("user-agent")
                     .and_then(|v| v.to_str().ok()),
@@ -2819,17 +1750,11 @@ pub async fn handle_publisher_request(
 
     // SSP requests are already racing through the platform HTTP client, so
     // origin TTFB tracks origin latency rather than the auction timeout.
-    //
-    // Streaming is gated on the capability (unlike the asset-proxy path, which
-    // sets the flag unconditionally and tolerates buffered fallback): adapters
-    // without streaming support may reject the flag outright rather than
-    // silently buffering, which would fail every publisher fetch.
-    let mut platform_request = PlatformHttpRequest::new(req, backend_name);
-    if services.http_client().supports_streaming_responses() {
-        platform_request = platform_request.with_stream_response();
-    }
-
-    let mut response = match services.http_client().send(platform_request).await {
+    let mut response = match services
+        .http_client()
+        .send(PlatformHttpRequest::new(req, backend_name))
+        .await
+    {
         Ok(platform_response) => platform_response.response,
         Err(err) => {
             if let Some(dispatched) = dispatched_auction.take() {
@@ -3082,7 +2007,6 @@ pub(crate) fn build_auction_request(
     ec_id: Option<&str>,
     consent_context: &crate::consent::ConsentContext,
     request_info: &crate::http_util::RequestInfo,
-    publisher_domain: &str,
     user_agent: Option<&str>,
 ) -> AuctionRequest {
     let slots = slots_ctx
@@ -3090,13 +2014,9 @@ pub(crate) fn build_auction_request(
         .iter()
         .map(crate::creative_opportunities::CreativeOpportunitySlot::to_ad_slot)
         .collect();
-    // Advertise the configured publisher domain (not the incoming edge `Host`)
-    // so SSPs, injected creatives, and brand-safety pixels see the publisher's
-    // own origin. On the SSAT proxy path `request_info.host` is the trusted
-    // server edge host, which must not leak into the bid request.
     let page_url = format!(
         "{}://{}{}",
-        request_info.scheme, publisher_domain, slots_ctx.request_path
+        request_info.scheme, request_info.host, slots_ctx.request_path
     );
     let ec_id = ec_id.filter(|id| !id.is_empty());
     let request_id = ec_id.map_or_else(
@@ -3107,7 +2027,7 @@ pub(crate) fn build_auction_request(
         id: request_id,
         slots,
         publisher: PublisherInfo {
-            domain: publisher_domain.to_owned(),
+            domain: request_info.host.clone(),
             page_url: Some(page_url.clone()),
         },
         user: UserInfo {
@@ -3121,7 +2041,7 @@ pub(crate) fn build_auction_request(
             geo: None,
         }),
         site: Some(SiteInfo {
-            domain: publisher_domain.to_owned(),
+            domain: request_info.host.clone(),
             page: page_url,
         }),
         context: std::collections::HashMap::new(),
@@ -3163,20 +2083,8 @@ fn html_escape_for_script(s: &str) -> String {
 pub(crate) fn build_bid_map(
     winning_bids: &std::collections::HashMap<String, Bid>,
     granularity: crate::price_bucket::PriceGranularity,
-    settings: &Settings,
-    request_origin: &str,
-    include_debug_bid: bool,
+    include_adm: bool,
 ) -> serde_json::Map<String, serde_json::Value> {
-    // Inline creatives render in a foreign origin (PUC's srcdoc under GAM), so
-    // their proxy/click URLs must be absolute against the origin the visitor is
-    // actually on — scheme, host, and port. Fall back to the configured publisher
-    // domain only when the request origin is unknown (e.g. an empty host on a
-    // non-navigation path), where no inline render is expected anyway.
-    let base_origin = if request_origin.is_empty() {
-        format!("https://{}", settings.publisher.domain)
-    } else {
-        request_origin.to_owned()
-    };
     winning_bids
         .iter()
         .filter_map(|(slot_id, bid)| {
@@ -3188,21 +2096,17 @@ pub(crate) fn build_bid_map(
                     "hb_bidder".to_string(),
                     serde_json::Value::String(bid.bidder.clone()),
                 );
-                // Winning creative dimensions — the bridge sizes the inline
-                // render from these, falling back to the first configured slot
-                // format only when absent, which mis-sizes a multi-size slot.
-                // Omit a zero dimension (missing OpenRTB w/h parse to 0) so the
-                // bridge falls back rather than sizing the frame to 0.
-                if bid.width > 0 {
-                    obj.insert("w".to_string(), serde_json::Value::from(bid.width));
-                }
-                if bid.height > 0 {
-                    obj.insert("h".to_string(), serde_json::Value::from(bid.height));
-                }
-                // hb_adid: use PBS Cache UUID when present — the Prebid Universal Creative uses
-                // this as the cache lookup key, NOT the OpenRTB bid ID (bid.ad_id). Fall back to
-                // bid.ad_id for APS and other non-PBS providers.
-                let hb_adid = bid.cache_id.as_deref().or(bid.ad_id.as_deref());
+                // PBS Cache remains highest priority. APS uses the selected bid ID
+                // carried by its typed renderer; other providers retain the ad-ID fallback.
+                let renderer_bid_id = bid
+                    .renderer
+                    .as_ref()
+                    .map(|renderer| renderer.aps().bid_id.as_str());
+                let hb_adid = bid
+                    .cache_id
+                    .as_deref()
+                    .or(renderer_bid_id)
+                    .or(bid.ad_id.as_deref());
                 if let Some(id) = hb_adid {
                     obj.insert(
                         "hb_adid".to_string(),
@@ -3225,60 +2129,24 @@ pub(crate) fn build_bid_map(
                         serde_json::Value::String(path.clone()),
                     );
                 }
-                // Win/billing notification URLs, fired verbatim by the bridge.
-                // Per OpenRTB these are the canonical carriers of
-                // `${AUCTION_PRICE}`, so expand it from the same winning CPM used
-                // for the creative below — an unexpanded macro would report an
-                // unresolved clearing price to the SSP, and some reject such
-                // notifications outright.
                 if let Some(ref nurl) = bid.nurl {
-                    let nurl = crate::creative::expand_auction_price_macro(nurl, cpm);
-                    obj.insert("nurl".to_string(), serde_json::Value::String(nurl));
+                    obj.insert("nurl".to_string(), serde_json::Value::String(nurl.clone()));
                 }
                 if let Some(ref burl) = bid.burl {
-                    let burl = crate::creative::expand_auction_price_macro(burl, cpm);
-                    obj.insert("burl".to_string(), serde_json::Value::String(burl));
+                    obj.insert("burl".to_string(), serde_json::Value::String(burl.clone()));
                 }
-                // Always include the winning creative so the pbRender bridge can
-                // render it locally when GAM serves the Prebid Universal Creative
-                // — no PBS Cache round trip. The `hb_cache_*` coordinates above
-                // remain as the fallback for an absent `adm`.
-                //
-                // Sanitize dangerous markup first, then rewrite URLs to
-                // first-party proxies — the same creative-processing boundary as
-                // the `/auction` path (see `auction::formats`), except the inline
-                // variant. Unlike `/auction`, this `adm` is rendered by the Prebid
-                // Universal Creative inside GAM's iframe (`f.srcdoc = d.ad`), a
-                // foreign origin where root-relative `/first-party/…` URLs resolve
-                // against GAM and 404. `rewrite_inline_creative_html` emits
-                // absolute first-party URLs and omits the tsjs bundle injection.
-                // `sanitize_creative_html` also enforces the 1 MiB creative cap,
-                // returning an empty string for oversized or unparseable markup —
-                // in which case the entry is omitted and the bridge falls back to
-                // the PBS Cache coordinates.
-                if let Some(ref raw_creative) = bid.creative {
-                    // Resolve ${AUCTION_PRICE} from the exact winning CPM BEFORE
-                    // sanitizing, rewriting, and signing — URL rewriting would
-                    // otherwise encode the literal macro into the signed proxy/click
-                    // URL, and signing would lock that wrong value.
-                    let priced = crate::creative::expand_auction_price_macro(raw_creative, cpm);
-                    let sanitized = crate::creative::sanitize_creative_html(&priced);
-                    let adm = crate::creative::rewrite_inline_creative_html(
-                        settings,
-                        &base_origin,
-                        &sanitized,
+                if let Some(ref renderer) = bid.renderer {
+                    obj.insert(
+                        "renderer".to_string(),
+                        serde_json::to_value(renderer).expect("should serialize typed renderer"),
                     );
-                    if !adm.is_empty() {
-                        obj.insert("adm".to_string(), serde_json::Value::String(adm));
-                    }
                 }
-                // Verbose per-bid debug blob only under the testing flag; also
-                // doubles as the client-side gate for the direct GAM-replace path.
-                // Deliberately mirrors the bidder-supplied `creative`/`nurl`/`burl`
-                // verbatim, macros unexpanded: this blob is diagnostic — nothing
-                // renders or fires from it — and showing what the bidder actually
-                // sent is the point.
-                if include_debug_bid {
+                // Include raw creative markup only for explicit debug injection.
+                // The pbRender bridge can use it while PBS Cache is unavailable.
+                if include_adm {
+                    if let Some(ref adm) = bid.creative {
+                        obj.insert("adm".to_string(), serde_json::Value::String(adm.clone()));
+                    }
                     obj.insert(
                         "debug_bid".to_string(),
                         serde_json::json!({
@@ -3292,7 +2160,9 @@ pub(crate) fn build_bid_map(
                             "height": bid.height,
                             "nurl": bid.nurl,
                             "burl": bid.burl,
+                            "bid_id": bid.bid_id,
                             "ad_id": bid.ad_id,
+                            "creative_id": bid.creative_id,
                             "cache_id": bid.cache_id,
                             "cache_host": bid.cache_host,
                             "cache_path": bid.cache_path,
@@ -3501,12 +2371,6 @@ pub async fn handle_page_bids(
         return Ok(response);
     };
 
-    // Trusted request origin for absolute inline creative URLs — derived from the
-    // origin the visitor is actually on (scheme, host, port), not the configured
-    // publisher domain, which cannot carry a port and may differ by subdomain.
-    let request_info = RequestInfo::from_request(&req, services.client_info());
-    let page_bids_request_origin = request_origin(&request_info.scheme, &request_info.host);
-
     // CSRF-style gate: refuse cross-site invocations before any auction work.
     if !page_bids_request_allowed(&req) {
         log::debug!(
@@ -3580,11 +2444,9 @@ pub async fn handle_page_bids(
     let winning_bids = if matched_slots.is_empty() {
         std::collections::HashMap::new()
     } else {
-        // Same publisher identity as the outbound bid request — see the
-        // matching note on the initial-navigation observation above.
         let observation = AuctionObservationContext::from_parts(
             AuctionSource::SpaNavigation,
-            &settings.publisher.domain,
+            &request_info.host,
             &path_param,
             matched_slots.len(),
             ec_context,
@@ -3599,7 +2461,6 @@ pub async fn handle_page_bids(
                 ec_id,
                 consent_context,
                 &request_info,
-                &settings.publisher.domain,
                 req.headers()
                     .get("user-agent")
                     .and_then(|v| v.to_str().ok()),
@@ -3694,8 +2555,6 @@ pub async fn handle_page_bids(
     let bid_map = build_bid_map(
         &winning_bids,
         co_config.price_granularity,
-        settings,
-        &page_bids_request_origin,
         settings.debug.inject_adm_for_testing,
     );
 
@@ -3734,7 +2593,6 @@ pub async fn handle_page_bids(
 
 #[cfg(test)]
 mod tests {
-    use std::future::Future as _;
     use std::io::{self, Read as _, Write as _};
     use std::sync::atomic::{AtomicUsize, Ordering};
 
@@ -3750,7 +2608,6 @@ mod tests {
     use crate::integrations::IntegrationRegistry;
     use crate::platform::test_support::{
         StubHttpClient, build_services_with_http_client, noop_services,
-        noop_services_with_telemetry_sink,
     };
     use crate::test_support::tests::create_test_settings;
     use edgezero_core::body::Body as EdgeBody;
@@ -3981,24 +2838,6 @@ mod tests {
         output
     }
 
-    fn deflate_encode(input: &[u8]) -> Vec<u8> {
-        let mut encoder =
-            flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::default());
-        encoder
-            .write_all(input)
-            .expect("should write deflate test input");
-        encoder.finish().expect("should finish deflate encoding")
-    }
-
-    fn deflate_decode(input: &[u8]) -> Vec<u8> {
-        let mut decoder = flate2::read::ZlibDecoder::new(input);
-        let mut output = Vec::new();
-        decoder
-            .read_to_end(&mut output)
-            .expect("should decode deflate test output");
-        output
-    }
-
     fn brotli_encode(input: &[u8]) -> Vec<u8> {
         let mut encoder = CompressorWriter::new(Vec::new(), 4096, 5, 22);
         encoder
@@ -4227,63 +3066,6 @@ mod tests {
         );
     }
 
-    #[tokio::test]
-    async fn publisher_origin_fetch_leaves_stream_response_disabled_when_unsupported() {
-        let settings = create_test_settings();
-        let stub = Arc::new(StubHttpClient::new());
-        stub.push_response_with_headers(
-            200,
-            b"<html><body>origin</body></html>".to_vec(),
-            vec![("content-type", "text/html; charset=utf-8")],
-        );
-        let services = build_services_with_http_client(
-            Arc::clone(&stub) as Arc<dyn crate::platform::PlatformHttpClient>
-        );
-        let req = HttpRequest::builder()
-            .method(Method::GET)
-            .uri("https://publisher.example/page")
-            .header(header::HOST, "publisher.example")
-            .body(EdgeBody::empty())
-            .expect("should build request");
-
-        let _ = run_publisher_proxy(&settings, &services, req).await;
-
-        assert_eq!(
-            stub.recorded_stream_response_flags(),
-            vec![false],
-            "publisher origin fetch must not request streams when the platform does not support them"
-        );
-    }
-
-    #[tokio::test]
-    async fn publisher_origin_fetch_sets_stream_response_when_supported() {
-        let settings = create_test_settings();
-        let stub = Arc::new(StubHttpClient::new());
-        stub.set_streaming_responses_supported(true);
-        stub.push_response_with_headers(
-            200,
-            b"<html><body>origin</body></html>".to_vec(),
-            vec![("content-type", "text/html; charset=utf-8")],
-        );
-        let services = build_services_with_http_client(
-            Arc::clone(&stub) as Arc<dyn crate::platform::PlatformHttpClient>
-        );
-        let req = HttpRequest::builder()
-            .method(Method::GET)
-            .uri("https://publisher.example/page")
-            .header(header::HOST, "publisher.example")
-            .body(EdgeBody::empty())
-            .expect("should build request");
-
-        let _ = run_publisher_proxy(&settings, &services, req).await;
-
-        assert_eq!(
-            stub.recorded_stream_response_flags(),
-            vec![true],
-            "publisher origin fetch should request streams when the platform supports them"
-        );
-    }
-
     #[tokio::test]
     async fn handle_publisher_request_does_not_self_generate_ec() {
         // EC generation is the adapter's real-browser-gated responsibility. This
@@ -4360,44 +3142,12 @@ mod tests {
             !super::response_carries_body(&Method::GET, StatusCode::NO_CONTENT),
             "204 responses must not get a recomputed Content-Length"
         );
-        assert!(
-            !super::response_carries_body(&Method::GET, StatusCode::RESET_CONTENT),
-            "205 responses must not get a recomputed Content-Length"
-        );
         assert!(
             !super::response_carries_body(&Method::GET, StatusCode::NOT_MODIFIED),
             "304 responses must not get a recomputed Content-Length"
         );
     }
 
-    #[test]
-    fn dispatched_auction_guard_stays_armed_until_collection_completes() {
-        // `take()` hands the dispatched auction to the async collector, but the
-        // guard must stay armed across the collection await so a drop while
-        // collection is still pending (a client disconnect at the await point)
-        // still logs the loss. Only `disarm()` — called once collection reaches
-        // a terminal result — clears the warning.
-        let mut guard = DispatchedAuctionGuard::new(DispatchedAuction::empty_for_test(
-            test_auction_request(),
-            10,
-        ));
-        assert!(guard.armed, "a freshly dispatched guard should be armed");
-
-        let _dispatched = guard
-            .take()
-            .expect("guard should yield the dispatched auction for collection");
-        assert!(
-            guard.armed,
-            "guard must stay armed across the collection await so a drop mid-collection is reported"
-        );
-
-        guard.disarm();
-        assert!(
-            !guard.armed,
-            "guard must disarm once collection reaches a terminal result"
-        );
-    }
-
     fn response_body_string(response: http::Response<EdgeBody>) -> String {
         String::from_utf8(
             response
@@ -4531,14 +3281,11 @@ mod tests {
                 observation: None,
                 auction_request: None,
             },
-            deps: AuctionCollectDeps {
-                price_granularity: PriceGranularity::default(),
-                ad_bids_state: &ad_bids_state,
-                orchestrator: &orchestrator,
-                services: &services,
-                settings: &settings,
-                request_origin: String::new(),
-            },
+            price_granularity: PriceGranularity::default(),
+            ad_bids_state: &ad_bids_state,
+            orchestrator: &orchestrator,
+            services: &services,
+            settings: &settings,
         };
         let mut output = Vec::new();
 
@@ -4558,90 +3305,6 @@ mod tests {
         );
     }
 
-    #[tokio::test]
-    async fn hold_step_yields_ready_prefix_before_collecting_auction() {
-        // A small page whose `</body>` lands in the first source chunk must
-        // still stream its document prefix immediately. `hold_step_decoded_chunk`
-        // reports the ready prefix and `close_found` without collecting; only
-        // `hold_collect_close_tail` awaits collection. Regression guard for the
-        // #849 FCP objective: the prefix must become ready while collection
-        // remains pending.
-        let settings = create_test_settings();
-        let services = noop_services();
-        let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
-        let ad_bids_state = Arc::new(Mutex::new(None));
-        let mut state = AuctionHoldState::new(
-            DispatchedAuctionGuard::new(DispatchedAuction::empty_for_test(
-                test_auction_request(),
-                500,
-            )),
-            AuctionTelemetryCarry {
-                observation: None,
-                auction_request: None,
-            },
-        );
-        let collect_refs = AuctionCollectDeps {
-            price_granularity: PriceGranularity::default(),
-            ad_bids_state: &ad_bids_state,
-            orchestrator: &orchestrator,
-            services: &services,
-            settings: &settings,
-            request_origin: String::new(),
-        };
-        // Passthrough processor: the ordering contract is about collection, not
-        // HTML rewriting, so keep the emitted bytes verbatim.
-        let mut processor = RecordingProcessor {
-            read_count: Arc::new(AtomicUsize::new(0)),
-            body_close_processed_at: Arc::new(AtomicUsize::new(0)),
-        };
-        let mut encoder = BodyStreamEncoder::new(Compression::None);
-
-        let step = hold_step_decoded_chunk(
-            &mut processor,
-            &mut encoder,
-            b"<html><body>painted</body></html>",
-            &mut state,
-            &collect_refs,
-        )
-        .await
-        .expect("hold step should succeed");
-
-        assert!(
-            step.close_found,
-            "</body> in the first chunk must be detected"
-        );
-        let ready: Vec<u8> = step.ready.iter().flat_map(|b| b.to_vec()).collect();
-        assert_eq!(
-            std::str::from_utf8(&ready).expect("ready prefix should be utf8"),
-            "<html><body>painted",
-            "the prefix up to </body> must be ready before collection"
-        );
-        assert!(
-            ad_bids_state
-                .lock()
-                .expect("should lock bid state")
-                .is_none(),
-            "auction must not be collected while the ready prefix is emitted"
-        );
-
-        let tail = hold_collect_close_tail(&mut processor, &mut encoder, &mut state, &collect_refs)
-            .await
-            .expect("collect should succeed");
-        let tail_bytes: Vec<u8> = tail.iter().flat_map(|b| b.to_vec()).collect();
-        assert_eq!(
-            std::str::from_utf8(&tail_bytes).expect("held tail should be utf8"),
-            "</body></html>",
-            "the held close tail must be emitted after collection"
-        );
-        assert!(
-            ad_bids_state
-                .lock()
-                .expect("should lock bid state")
-                .is_some(),
-            "collection must run when the held tail is emitted"
-        );
-    }
-
     #[test]
     fn body_close_hold_buffer_holds_close_body_tail_in_single_chunk() {
         let mut hold = BodyCloseHoldBuffer::new();
@@ -5330,1621 +3993,151 @@ mod tests {
     }
 
     #[test]
-    fn stream_publisher_body_rejects_stream_body_in_sync_path() {
+    fn stream_publisher_body_treats_mixed_case_html_as_html() {
         let settings = create_test_settings();
         let registry =
             IntegrationRegistry::new(&settings).expect("should create integration registry");
+        let bids_script =
+            r#"<script>(window.tsjs=window.tsjs||{}).bids=JSON.parse("{}");</script>"#;
+        let state = Arc::new(Mutex::new(Some(bids_script.to_string())));
         let params = OwnedProcessResponseParams {
             content_encoding: String::new(),
             origin_host: "origin.example.com".to_string(),
             origin_url: "https://origin.example.com".to_string(),
             request_host: "proxy.example.com".to_string(),
             request_scheme: "https".to_string(),
-            content_type: "text/html; charset=utf-8".to_string(),
-            ad_slots_script: None,
-            ad_bids_state: Arc::new(Mutex::new(None)),
+            content_type: "Text/HTML; Charset=utf-8".to_string(),
+            ad_slots_script: Some(
+                r#"<script>(window.tsjs=window.tsjs||{}).adSlots=JSON.parse("[]");</script>"#
+                    .to_string(),
+            ),
+            ad_bids_state: state,
             auction_observation: None,
             auction_request: None,
             dispatched_auction: None,
             price_granularity: crate::price_bucket::PriceGranularity::default(),
         };
-        let body = EdgeBody::from_stream(futures::stream::iter(vec![Ok::<_, io::Error>(
-            bytes::Bytes::from_static(b"<html><body>live</body></html>"),
-        )]));
         let mut output = Vec::new();
 
-        let err = stream_publisher_body(body, &mut output, &params, &settings, &registry)
-            .expect_err("should reject stream body in sync path");
+        stream_publisher_body(
+            EdgeBody::from(b"<html><head></head><body>content</body></html>".to_vec()),
+            &mut output,
+            &params,
+            &settings,
+            &registry,
+        )
+        .expect("should process mixed-case HTML content type");
 
+        let html = String::from_utf8(output).expect("should be valid UTF-8");
+        assert!(
+            html.contains(".adSlots=JSON.parse"),
+            "mixed-case HTML must use the HTML processor and inject ad slots. Got: {html}"
+        );
         assert!(
-            format!("{err:?}").contains("streaming body"),
-            "should explain that Body::Stream is not supported by the sync path: {err:?}"
+            html.contains(".bids=JSON.parse"),
+            "mixed-case HTML must use the HTML processor and inject bids. Got: {html}"
         );
     }
 
+    /// Mid-stream decoder failure must surface as an error. The adapter
+    /// relies on this: once headers are committed, it logs and drops the
+    /// `StreamingBody` so the client sees a truncated response. If a decode
+    /// failure silently emitted bytes, the client would see a malformed
+    /// document instead.
     #[test]
-    fn body_chunk_source_yields_once_body_in_chunks() {
-        futures::executor::block_on(async {
-            let body = EdgeBody::from_bytes(bytes::Bytes::from_static(b"abcdef"));
-            let mut source = BodyChunkSource::new(body, 3).with_max_bytes(16);
+    fn stream_publisher_body_surfaces_mid_stream_decode_error() {
+        let settings = create_test_settings();
+        let registry =
+            IntegrationRegistry::new(&settings).expect("should create integration registry");
 
-            assert_eq!(
-                source.next_chunk().await.expect("should read").as_deref(),
-                Some(&b"abc"[..]),
-                "should yield the first chunk"
-            );
-            assert_eq!(
-                source.next_chunk().await.expect("should read").as_deref(),
-                Some(&b"def"[..]),
-                "should yield the second chunk"
-            );
-            assert!(
-                source.next_chunk().await.expect("should read").is_none(),
-                "should end after buffered bytes are exhausted"
-            );
-        });
-    }
+        // Claim gzip encoding but feed non-gzip bytes. The GzDecoder will
+        // error as soon as it tries to read the gzip header.
+        let params = OwnedProcessResponseParams {
+            content_encoding: "gzip".to_string(),
+            origin_host: "origin.example.com".to_string(),
+            origin_url: "https://origin.example.com".to_string(),
+            request_host: "proxy.example.com".to_string(),
+            request_scheme: "https".to_string(),
+            content_type: "text/html".to_string(),
+            ad_slots_script: None,
+            ad_bids_state: Arc::new(Mutex::new(None)),
+            auction_observation: None,
+            auction_request: None,
+            dispatched_auction: None,
+            price_granularity: crate::price_bucket::PriceGranularity::default(),
+        };
 
-    #[test]
-    fn body_chunk_source_preserves_stream_chunks() {
-        futures::executor::block_on(async {
-            let body = EdgeBody::stream(futures::stream::iter(vec![
-                bytes::Bytes::from_static(b"first"),
-                bytes::Bytes::from_static(b"second"),
-            ]));
-            let mut source = BodyChunkSource::new(body, 3).with_max_bytes(16);
+        let bogus_body = EdgeBody::from(b"<html>not gzip</html>".to_vec());
+        let mut output = Vec::new();
+        let result = stream_publisher_body(bogus_body, &mut output, &params, &settings, &registry);
 
-            assert_eq!(
-                source.next_chunk().await.expect("should read").as_deref(),
-                Some(&b"first"[..]),
-                "stream chunks should pass through without re-chunking"
-            );
-            assert_eq!(
-                source.next_chunk().await.expect("should read").as_deref(),
-                Some(&b"second"[..]),
-                "stream chunks should preserve upstream boundaries"
-            );
-            assert!(
-                source.next_chunk().await.expect("should read").is_none(),
-                "should end after stream is exhausted"
-            );
-        });
+        assert!(
+            result.is_err(),
+            "decoding bogus gzip as gzip should return Err so the adapter can drop the stream"
+        );
     }
 
+    /// Pass-through dispatch contract: the adapter treats `PublisherResponse::PassThrough`
+    /// by reattaching the origin body unchanged and letting Fastly emit it.
+    /// Simulate that step and assert byte identity plus Content-Length
+    /// preservation. Distinct from `pass_through_preserves_body_and_content_length`
+    /// which only tests the header preservation; this one walks the full
+    /// take-then-reattach pattern the adapter uses.
     #[test]
-    fn body_chunk_source_enforces_cumulative_raw_cap() {
-        futures::executor::block_on(async {
-            let body = EdgeBody::stream(futures::stream::iter(vec![
-                bytes::Bytes::from_static(b"1234"),
-                bytes::Bytes::from_static(b"5678"),
-            ]));
-            let mut source = BodyChunkSource::new(body, STREAM_CHUNK_SIZE).with_max_bytes(6);
+    fn publisher_response_pass_through_reattach_preserves_bytes() {
+        // Simulate a 2xx image/png response: Body::from(bytes), take_body(),
+        // then set_body(body). `classify_response_route` already picks
+        // PassThrough for this combination; this covers the adapter's
+        // reattachment half of the contract.
+        let image_bytes: Vec<u8> = (0..=127).cycle().take(2048).collect();
 
-            assert!(
-                source
-                    .next_chunk()
-                    .await
-                    .expect("first chunk should pass")
-                    .is_some(),
-                "first chunk should stay under cap"
-            );
-            let err = source
-                .next_chunk()
-                .await
-                .expect_err("second chunk should exceed cap");
+        let mut response = Response::builder()
+            .status(StatusCode::OK)
+            .header(header::CONTENT_TYPE, "image/png")
+            .header(header::CONTENT_LENGTH, image_bytes.len() as u64)
+            .body(EdgeBody::from(image_bytes.clone()))
+            .expect("should build test response");
 
-            assert!(
-                format!("{err:?}").contains("publisher origin body exceeded"),
-                "should report cumulative cap: {err:?}"
-            );
-        });
+        // Mirror adapter: take body, then reattach.
+        let body = std::mem::replace(response.body_mut(), EdgeBody::empty());
+        *response.body_mut() = body;
+
+        assert_eq!(
+            response
+                .headers()
+                .get(header::CONTENT_LENGTH)
+                .and_then(|v| v.to_str().ok())
+                .expect("content-length should survive"),
+            "2048"
+        );
+        let (_, final_body) = response.into_parts();
+        let round_trip = final_body.into_bytes().unwrap_or_default();
+        assert_eq!(
+            round_trip, image_bytes,
+            "pass-through reattach must preserve bytes exactly"
+        );
     }
 
+    /// Streaming dispatch contract: HTML with a registered post-processor still
+    /// routes through `Stream`, and the shared processor pipeline still applies
+    /// the post-processor rewrite.
     #[test]
-    fn stream_publisher_body_async_processes_stream_without_auction() {
-        futures::executor::block_on(async {
-            let settings = create_test_settings();
-            let registry =
-                IntegrationRegistry::new(&settings).expect("should create integration registry");
-            let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
-            let services = noop_services();
-            let mut params = OwnedProcessResponseParams {
-                content_encoding: String::new(),
-                origin_host: "origin.example.com".to_string(),
-                origin_url: "https://origin.example.com".to_string(),
-                request_host: "proxy.example.com".to_string(),
-                request_scheme: "https".to_string(),
-                content_type: "text/css".to_string(),
-                ad_slots_script: None,
-                ad_bids_state: Arc::new(Mutex::new(None)),
-                auction_observation: None,
-                auction_request: None,
-                dispatched_auction: None,
-                price_granularity: crate::price_bucket::PriceGranularity::default(),
-            };
-            let body = EdgeBody::stream(futures::stream::iter(vec![
-                bytes::Bytes::from_static(b"body{background:url('https://origin.example.com/"),
-                bytes::Bytes::from_static(b"asset.png')}"),
-            ]));
-            let mut output = Vec::new();
-
-            stream_publisher_body_async(
-                body,
-                &mut output,
-                &mut params,
-                &settings,
-                &registry,
-                &orchestrator,
-                &services,
+    fn streaming_html_with_post_processors_rewrites_body() {
+        // Configure nextjs so a post-processor is registered.
+        let mut settings = create_test_settings();
+        settings
+            .integrations
+            .insert_config(
+                "nextjs",
+                &serde_json::json!({
+                    "enabled": true,
+                    "rewrite_attributes": ["href", "link", "url"],
+                }),
             )
-            .await
-            .expect("stream body should process on async path");
+            .expect("should update nextjs config");
 
-            let css = String::from_utf8(output).expect("should be valid UTF-8");
-            assert!(
-                css.contains("proxy.example.com"),
-                "should rewrite origin host while streaming. Got: {css}"
-            );
-            assert!(
-                !css.contains("origin.example.com"),
-                "should not leave origin host after rewrite. Got: {css}"
-            );
-        });
-    }
-
-    #[test]
-    fn stream_publisher_body_async_processes_gzip_stream_without_auction() {
-        futures::executor::block_on(async {
-            let settings = create_test_settings();
-            let registry =
-                IntegrationRegistry::new(&settings).expect("should create integration registry");
-            let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
-            let services = noop_services();
-            let mut params = OwnedProcessResponseParams {
-                content_encoding: "gzip".to_string(),
-                origin_host: "origin.example.com".to_string(),
-                origin_url: "https://origin.example.com".to_string(),
-                request_host: "proxy.example.com".to_string(),
-                request_scheme: "https".to_string(),
-                content_type: "text/css".to_string(),
-                ad_slots_script: None,
-                ad_bids_state: Arc::new(Mutex::new(None)),
-                auction_observation: None,
-                auction_request: None,
-                dispatched_auction: None,
-                price_granularity: crate::price_bucket::PriceGranularity::default(),
-            };
-            let compressed =
-                gzip_encode(b"body{background:url('https://origin.example.com/asset.png')}");
-            let split_at = compressed.len() / 2;
-            let body = EdgeBody::stream(futures::stream::iter(vec![
-                bytes::Bytes::copy_from_slice(&compressed[..split_at]),
-                bytes::Bytes::copy_from_slice(&compressed[split_at..]),
-            ]));
-            let mut output = Vec::new();
-
-            stream_publisher_body_async(
-                body,
-                &mut output,
-                &mut params,
-                &settings,
-                &registry,
-                &orchestrator,
-                &services,
-            )
-            .await
-            .expect("gzip stream body should process on async path");
-
-            let css = String::from_utf8(gzip_decode(&output)).expect("should be valid UTF-8");
-            assert!(
-                css.contains("proxy.example.com"),
-                "should rewrite origin host while streaming gzip. Got: {css}"
-            );
-            assert!(
-                !css.contains("origin.example.com"),
-                "should not leave origin host after gzip rewrite. Got: {css}"
-            );
-        });
-    }
-
-    #[test]
-    fn stream_publisher_body_async_processes_deflate_stream_without_auction() {
-        futures::executor::block_on(async {
-            let settings = create_test_settings();
-            let registry =
-                IntegrationRegistry::new(&settings).expect("should create integration registry");
-            let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
-            let services = noop_services();
-            let mut params = OwnedProcessResponseParams {
-                content_encoding: "deflate".to_string(),
-                origin_host: "origin.example.com".to_string(),
-                origin_url: "https://origin.example.com".to_string(),
-                request_host: "proxy.example.com".to_string(),
-                request_scheme: "https".to_string(),
-                content_type: "text/css".to_string(),
-                ad_slots_script: None,
-                ad_bids_state: Arc::new(Mutex::new(None)),
-                auction_observation: None,
-                auction_request: None,
-                dispatched_auction: None,
-                price_granularity: crate::price_bucket::PriceGranularity::default(),
-            };
-            let compressed =
-                deflate_encode(b"body{background:url('https://origin.example.com/asset.png')}");
-            let split_at = compressed.len() / 2;
-            let body = EdgeBody::stream(futures::stream::iter(vec![
-                bytes::Bytes::copy_from_slice(&compressed[..split_at]),
-                bytes::Bytes::copy_from_slice(&compressed[split_at..]),
-            ]));
-            let mut output = Vec::new();
-
-            stream_publisher_body_async(
-                body,
-                &mut output,
-                &mut params,
-                &settings,
-                &registry,
-                &orchestrator,
-                &services,
-            )
-            .await
-            .expect("deflate stream body should process on async path");
-
-            let css = String::from_utf8(deflate_decode(&output)).expect("should be valid UTF-8");
-            assert!(
-                css.contains("proxy.example.com"),
-                "should rewrite origin host while streaming deflate. Got: {css}"
-            );
-            assert!(
-                !css.contains("origin.example.com"),
-                "should not leave origin host after deflate rewrite. Got: {css}"
-            );
-        });
-    }
-
-    #[test]
-    fn stream_publisher_body_async_processes_brotli_stream_without_auction() {
-        futures::executor::block_on(async {
-            let settings = create_test_settings();
-            let registry =
-                IntegrationRegistry::new(&settings).expect("should create integration registry");
-            let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
-            let services = noop_services();
-            let mut params = OwnedProcessResponseParams {
-                content_encoding: "br".to_string(),
-                origin_host: "origin.example.com".to_string(),
-                origin_url: "https://origin.example.com".to_string(),
-                request_host: "proxy.example.com".to_string(),
-                request_scheme: "https".to_string(),
-                content_type: "text/css".to_string(),
-                ad_slots_script: None,
-                ad_bids_state: Arc::new(Mutex::new(None)),
-                auction_observation: None,
-                auction_request: None,
-                dispatched_auction: None,
-                price_granularity: crate::price_bucket::PriceGranularity::default(),
-            };
-            let compressed =
-                brotli_encode(b"body{background:url('https://origin.example.com/asset.png')}");
-            let split_at = compressed.len() / 2;
-            let body = EdgeBody::stream(futures::stream::iter(vec![
-                bytes::Bytes::copy_from_slice(&compressed[..split_at]),
-                bytes::Bytes::copy_from_slice(&compressed[split_at..]),
-            ]));
-            let mut output = Vec::new();
-
-            stream_publisher_body_async(
-                body,
-                &mut output,
-                &mut params,
-                &settings,
-                &registry,
-                &orchestrator,
-                &services,
-            )
-            .await
-            .expect("brotli stream body should process on async path");
-
-            let css = String::from_utf8(brotli_decode(&output)).expect("should be valid UTF-8");
-            assert!(
-                css.contains("proxy.example.com"),
-                "should rewrite origin host while streaming brotli. Got: {css}"
-            );
-            assert!(
-                !css.contains("origin.example.com"),
-                "should not leave origin host after brotli rewrite. Got: {css}"
-            );
-        });
-    }
-
-    #[test]
-    fn stream_publisher_body_async_rejects_truncated_brotli_stream() {
-        futures::executor::block_on(async {
-            let settings = create_test_settings();
-            let registry =
-                IntegrationRegistry::new(&settings).expect("should create integration registry");
-            let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
-            let services = noop_services();
-            let mut params = OwnedProcessResponseParams {
-                content_encoding: "br".to_string(),
-                origin_host: "origin.example.com".to_string(),
-                origin_url: "https://origin.example.com".to_string(),
-                request_host: "proxy.example.com".to_string(),
-                request_scheme: "https".to_string(),
-                content_type: "text/css".to_string(),
-                ad_slots_script: None,
-                ad_bids_state: Arc::new(Mutex::new(None)),
-                auction_observation: None,
-                auction_request: None,
-                dispatched_auction: None,
-                price_granularity: crate::price_bucket::PriceGranularity::default(),
-            };
-            let compressed =
-                brotli_encode(b"body{background:url('https://origin.example.com/asset.png')}");
-            let truncated = &compressed[..compressed.len() - 3];
-            let body =
-                EdgeBody::stream(futures::stream::iter(vec![bytes::Bytes::copy_from_slice(
-                    truncated,
-                )]));
-            let mut output = Vec::new();
-
-            let err = stream_publisher_body_async(
-                body,
-                &mut output,
-                &mut params,
-                &settings,
-                &registry,
-                &orchestrator,
-                &services,
-            )
-            .await
-            .expect_err("truncated brotli stream must fail instead of truncating silently");
-
-            assert!(
-                format!("{err:?}").contains("brotli"),
-                "should surface the brotli finalization failure: {err:?}"
-            );
-        });
-    }
-
-    fn non_html_stream_params(content_encoding: &str) -> OwnedProcessResponseParams {
-        OwnedProcessResponseParams {
-            content_encoding: content_encoding.to_string(),
-            origin_host: "origin.example.com".to_string(),
-            origin_url: "https://origin.example.com".to_string(),
-            request_host: "proxy.example.com".to_string(),
-            request_scheme: "https".to_string(),
-            content_type: "text/css".to_string(),
-            ad_slots_script: None,
-            ad_bids_state: Arc::new(Mutex::new(None)),
-            auction_observation: None,
-            auction_request: None,
-            dispatched_auction: None,
-            price_granularity: crate::price_bucket::PriceGranularity::default(),
-        }
-    }
-
-    #[test]
-    fn stream_publisher_body_async_rejects_truncated_gzip_stream() {
-        futures::executor::block_on(async {
-            let settings = create_test_settings();
-            let registry =
-                IntegrationRegistry::new(&settings).expect("should create integration registry");
-            let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
-            let services = noop_services();
-            let mut params = non_html_stream_params("gzip");
-            let compressed =
-                gzip_encode(b"body{background:url('https://origin.example.com/asset.png')}");
-            let truncated = &compressed[..compressed.len() - 3];
-            let body =
-                EdgeBody::stream(futures::stream::iter(vec![bytes::Bytes::copy_from_slice(
-                    truncated,
-                )]));
-            let mut output = Vec::new();
-
-            let err = stream_publisher_body_async(
-                body,
-                &mut output,
-                &mut params,
-                &settings,
-                &registry,
-                &orchestrator,
-                &services,
-            )
-            .await
-            .expect_err("truncated gzip stream must fail instead of truncating silently");
-
-            assert!(
-                format!("{err:?}").contains("gzip"),
-                "should surface the gzip finalization failure: {err:?}"
-            );
-        });
-    }
-
-    #[test]
-    fn stream_publisher_body_async_rejects_truncated_deflate_stream() {
-        futures::executor::block_on(async {
-            let settings = create_test_settings();
-            let registry =
-                IntegrationRegistry::new(&settings).expect("should create integration registry");
-            let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
-            let services = noop_services();
-            let mut params = non_html_stream_params("deflate");
-            let compressed =
-                deflate_encode(b"body{background:url('https://origin.example.com/asset.png')}");
-            // Cut into the deflate data itself, not just the adler32 trailer.
-            let truncated = &compressed[..compressed.len() / 2];
-            let body =
-                EdgeBody::stream(futures::stream::iter(vec![bytes::Bytes::copy_from_slice(
-                    truncated,
-                )]));
-            let mut output = Vec::new();
-
-            let err = stream_publisher_body_async(
-                body,
-                &mut output,
-                &mut params,
-                &settings,
-                &registry,
-                &orchestrator,
-                &services,
-            )
-            .await
-            .expect_err("truncated deflate stream must fail instead of truncating silently");
-
-            assert!(
-                format!("{err:?}").contains("deflate"),
-                "should surface the deflate finalization failure: {err:?}"
-            );
-        });
-    }
-
-    #[test]
-    fn stream_publisher_body_async_enforces_decoded_byte_cap() {
-        futures::executor::block_on(async {
-            let mut settings = create_test_settings();
-            // Raw compressed input stays tiny (well under the cap); only the
-            // decoded expansion exceeds it — the decompression-bomb case the
-            // raw-byte cap alone cannot catch.
-            settings.publisher.max_buffered_body_bytes = 1024;
-            let registry =
-                IntegrationRegistry::new(&settings).expect("should create integration registry");
-            let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
-            let services = noop_services();
-            let mut params = non_html_stream_params("gzip");
-            let compressed = gzip_encode(&vec![b'a'; 64 * 1024]);
-            assert!(
-                compressed.len() < 1024,
-                "test precondition: compressed input must stay under the raw cap"
-            );
-            let body =
-                EdgeBody::stream(futures::stream::iter(vec![bytes::Bytes::from(compressed)]));
-            let mut output = Vec::new();
-
-            let err = stream_publisher_body_async(
-                body,
-                &mut output,
-                &mut params,
-                &settings,
-                &registry,
-                &orchestrator,
-                &services,
-            )
-            .await
-            .expect_err("decoded expansion past the cap must fail");
-
-            assert!(
-                format!("{err:?}").contains("decoded size exceeded"),
-                "should report the cumulative decoded cap: {err:?}"
-            );
-        });
-    }
-
-    #[test]
-    fn body_chunk_source_resumes_after_cancelled_poll() {
-        futures::executor::block_on(async {
-            let mut pending_once = true;
-            let mut yielded = false;
-            let stream = futures::stream::poll_fn(move |cx| {
-                if pending_once {
-                    pending_once = false;
-                    cx.waker().wake_by_ref();
-                    return std::task::Poll::Pending;
-                }
-                if yielded {
-                    return std::task::Poll::Ready(None);
-                }
-                yielded = true;
-                std::task::Poll::Ready(Some(Ok::<_, io::Error>(bytes::Bytes::from_static(
-                    b"chunk",
-                ))))
-            });
-            let body = EdgeBody::from_stream(stream);
-            let mut source = BodyChunkSource::new(body, STREAM_CHUNK_SIZE);
-
-            {
-                // Poll the pull future once (Pending), then drop it —
-                // simulating a cancelled await (select/timeout wrapper).
-                let mut pull = Box::pin(source.next_chunk());
-                let waker = futures::task::noop_waker();
-                let mut context = std::task::Context::from_waker(&waker);
-                assert!(
-                    pull.as_mut().poll(&mut context).is_pending(),
-                    "first poll should be pending"
-                );
-            }
-
-            let chunk = source
-                .next_chunk()
-                .await
-                .expect("should read after cancelled poll");
-            assert_eq!(
-                chunk.as_deref(),
-                Some(&b"chunk"[..]),
-                "cancelled pull must not lose the origin stream"
-            );
-        });
-    }
-
-    #[test]
-    fn stream_publisher_body_async_processes_stream_with_auction_hold() {
-        futures::executor::block_on(async {
-            let settings = create_test_settings();
-            let registry =
-                IntegrationRegistry::new(&settings).expect("should create integration registry");
-            let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
-            let services = noop_services();
-            let state = Arc::new(Mutex::new(None));
-            let mut params = OwnedProcessResponseParams {
-                content_encoding: String::new(),
-                origin_host: "origin.example.com".to_string(),
-                origin_url: "https://origin.example.com".to_string(),
-                request_host: "proxy.example.com".to_string(),
-                request_scheme: "https".to_string(),
-                content_type: "text/html; charset=utf-8".to_string(),
-                ad_slots_script: Some(
-                    r#"<script>(window.tsjs=window.tsjs||{}).adSlots=JSON.parse("[]");</script>"#
-                        .to_string(),
-                ),
-                ad_bids_state: state,
-                auction_observation: None,
-                auction_request: Some(test_auction_request()),
-                dispatched_auction: Some(DispatchedAuction::empty_for_test(
-                    test_auction_request(),
-                    10,
-                )),
-                price_granularity: crate::price_bucket::PriceGranularity::default(),
-            };
-            let body = EdgeBody::stream(futures::stream::iter(vec![
-                bytes::Bytes::from_static(b"<html><head></head><body>hello"),
-                bytes::Bytes::from_static(b"</body></html>"),
-            ]));
-            let mut output = Vec::new();
-
-            stream_publisher_body_async(
-                body,
-                &mut output,
-                &mut params,
-                &settings,
-                &registry,
-                &orchestrator,
-                &services,
-            )
-            .await
-            .expect("stream body with auction should process on async path");
-
-            let html = String::from_utf8(output).expect("should be valid UTF-8");
-            assert!(
-                html.contains("hello"),
-                "should preserve streamed HTML content. Got: {html}"
-            );
-            assert!(
-                html.contains(".adSlots=JSON.parse"),
-                "should still inject ad slots. Got: {html}"
-            );
-            assert!(
-                html.contains(".bids=JSON.parse"),
-                "should collect auction and inject bids before body close. Got: {html}"
-            );
-        });
-    }
-
-    #[test]
-    fn stream_publisher_body_async_auction_hold_decodes_multi_member_gzip_buffered() {
-        futures::executor::block_on(async {
-            let settings = create_test_settings();
-            let registry =
-                IntegrationRegistry::new(&settings).expect("should create integration registry");
-            let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
-            let services = noop_services();
-            let state = Arc::new(Mutex::new(None));
-            let mut params = OwnedProcessResponseParams {
-                content_encoding: "gzip".to_string(),
-                origin_host: "origin.example.com".to_string(),
-                origin_url: "https://origin.example.com".to_string(),
-                request_host: "proxy.example.com".to_string(),
-                request_scheme: "https".to_string(),
-                content_type: "text/html; charset=utf-8".to_string(),
-                ad_slots_script: Some(
-                    r#"<script>(window.tsjs=window.tsjs||{}).adSlots=JSON.parse("[]");</script>"#
-                        .to_string(),
-                ),
-                ad_bids_state: state,
-                auction_observation: None,
-                auction_request: Some(test_auction_request()),
-                dispatched_auction: Some(DispatchedAuction::empty_for_test(
-                    test_auction_request(),
-                    10,
-                )),
-                price_granularity: crate::price_bucket::PriceGranularity::default(),
-            };
-            // The `</body>` that triggers bid injection lives in the SECOND gzip
-            // member. `flate2::read::GzDecoder` decodes only the first member, so
-            // this buffered `Body::Once` body (the non-stream auction arm) proves
-            // the multi-member decoder now reads every member.
-            let mut compressed = gzip_encode(b"<html><head></head><body>hello");
-            compressed.extend(gzip_encode(b"</body></html>"));
-            let body = EdgeBody::from(compressed);
-            let mut output = Vec::new();
-
-            stream_publisher_body_async(
-                body,
-                &mut output,
-                &mut params,
-                &settings,
-                &registry,
-                &orchestrator,
-                &services,
-            )
-            .await
-            .expect("buffered multi-member gzip auction body should process");
-
-            let html = String::from_utf8(gzip_decode(&output)).expect("should be valid UTF-8");
-            assert!(
-                html.contains("hello"),
-                "should decode the first gzip member. Got: {html}"
-            );
-            assert!(
-                html.contains("</body></html>"),
-                "should decode the second gzip member that a single-member decoder drops. Got: {html}"
-            );
-            assert!(
-                html.contains(".bids=JSON.parse"),
-                "should inject bids before the </body> carried in the second member. Got: {html}"
-            );
-        });
-    }
-
-    #[test]
-    fn stream_publisher_body_async_processes_non_html_stream_after_auction_collect() {
-        futures::executor::block_on(async {
-            let settings = create_test_settings();
-            let registry =
-                IntegrationRegistry::new(&settings).expect("should create integration registry");
-            let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
-            let services = noop_services();
-            let mut params = OwnedProcessResponseParams {
-                content_encoding: String::new(),
-                origin_host: "origin.example.com".to_string(),
-                origin_url: "https://origin.example.com".to_string(),
-                request_host: "proxy.example.com".to_string(),
-                request_scheme: "https".to_string(),
-                content_type: "text/css".to_string(),
-                ad_slots_script: None,
-                ad_bids_state: Arc::new(Mutex::new(None)),
-                auction_observation: None,
-                auction_request: Some(test_auction_request()),
-                dispatched_auction: Some(DispatchedAuction::empty_for_test(
-                    test_auction_request(),
-                    10,
-                )),
-                price_granularity: crate::price_bucket::PriceGranularity::default(),
-            };
-            let body = EdgeBody::stream(futures::stream::iter(vec![bytes::Bytes::from_static(
-                b"body{background:url('https://origin.example.com/asset.png')}",
-            )]));
-            let mut output = Vec::new();
-
-            stream_publisher_body_async(
-                body,
-                &mut output,
-                &mut params,
-                &settings,
-                &registry,
-                &orchestrator,
-                &services,
-            )
-            .await
-            .expect("non-html stream body should process after auction collection");
-
-            let css = String::from_utf8(output).expect("should be valid UTF-8");
-            assert!(
-                css.contains("proxy.example.com"),
-                "should rewrite non-html stream after auction collection. Got: {css}"
-            );
-            assert!(
-                !css.contains("origin.example.com"),
-                "should not leave origin host after rewrite. Got: {css}"
-            );
-        });
-    }
-
-    fn drain_streaming_finalize_body(content_encoding: &str, body: EdgeBody) -> Vec<u8> {
-        let settings = Arc::new(create_test_settings());
-        let registry = Arc::new(
-            IntegrationRegistry::new(&settings).expect("should create integration registry"),
-        );
-        let orchestrator = Arc::new(AuctionOrchestrator::new(settings.auction.clone()));
-        let services = noop_services();
-        let response = Response::builder()
-            .status(StatusCode::OK)
-            .header(header::CONTENT_TYPE, "text/css")
-            .body(EdgeBody::empty())
-            .expect("should build response");
-        let params = OwnedProcessResponseParams {
-            content_encoding: content_encoding.to_string(),
-            origin_host: "origin.example.com".to_string(),
-            origin_url: "https://origin.example.com".to_string(),
-            request_host: "proxy.example.com".to_string(),
-            request_scheme: "https".to_string(),
-            content_type: "text/css".to_string(),
-            ad_slots_script: None,
-            ad_bids_state: Arc::new(Mutex::new(None)),
-            auction_observation: None,
-            auction_request: None,
-            dispatched_auction: None,
-            price_granularity: crate::price_bucket::PriceGranularity::default(),
-        };
-        let publisher_response = PublisherResponse::Stream {
-            response,
-            body,
-            params: Box::new(params),
-        };
-
-        let response = futures::executor::block_on(publisher_response_into_streaming_response(
-            publisher_response,
-            &Method::GET,
-            Arc::clone(&settings),
-            registry.as_ref(),
-            orchestrator,
-            services,
-        ))
-        .expect("should build streaming response");
-
-        assert!(
-            matches!(response.body(), EdgeBody::Stream(_)),
-            "streaming finalize should keep a lazy Body::Stream"
-        );
-
-        futures::executor::block_on(
-            response
-                .into_body()
-                .into_bytes_bounded(settings.publisher.max_buffered_body_bytes),
-        )
-        .expect("streaming body should drain")
-        .to_vec()
-    }
-
-    #[test]
-    fn publisher_response_streaming_finalize_keeps_stream_body_lazy() {
-        let body_bytes = drain_streaming_finalize_body(
-            "",
-            EdgeBody::stream(futures::stream::iter(vec![bytes::Bytes::from_static(
-                b"body{background:url('https://origin.example.com/asset.png')}",
-            )])),
-        );
-        let css = String::from_utf8(body_bytes).expect("should be valid UTF-8");
-        assert!(
-            css.contains("proxy.example.com"),
-            "streaming response body should still run publisher rewriting. Got: {css}"
-        );
-        assert!(
-            !css.contains("origin.example.com"),
-            "streaming response body should not leave origin URLs unrewritten. Got: {css}"
-        );
-    }
-
-    /// An origin body stream that yields `chunk` once and then stays `Pending`
-    /// forever without ever signalling EOF — modelling an origin that has sent
-    /// the document head but not yet finished the response.
-    fn origin_chunk_then_pending(chunk: bytes::Bytes) -> EdgeBody {
-        let mut sent = false;
-        EdgeBody::from_stream(futures::stream::poll_fn(move |_cx| {
-            if sent {
-                return std::task::Poll::Pending;
-            }
-            sent = true;
-            std::task::Poll::Ready(Some(Ok::<_, io::Error>(chunk.clone())))
-        }))
-    }
-
-    /// Poll a lazy `Body::Stream` exactly once and return the first emitted
-    /// chunk. Panics if the first poll is `Pending` (nothing emitted before the
-    /// origin would need its next chunk) or the stream ends.
-    fn first_lazy_body_chunk(body: EdgeBody) -> bytes::Bytes {
-        let mut stream = body
-            .into_stream()
-            .expect("streaming finalize should keep a lazy Body::Stream");
-        let waker = futures::task::noop_waker();
-        let mut cx = std::task::Context::from_waker(&waker);
-        let next = futures::StreamExt::next(&mut stream);
-        let mut next = std::pin::pin!(next);
-        match std::future::Future::poll(next.as_mut(), &mut cx) {
-            std::task::Poll::Ready(Some(Ok(bytes))) => bytes,
-            std::task::Poll::Ready(other) => {
-                panic!("first poll must emit a chunk, got Ready({other:?})")
-            }
-            std::task::Poll::Pending => {
-                panic!("first poll must emit rewritten content before origin EOF, got Pending")
-            }
-        }
-    }
-
-    fn streaming_finalize_response(params: OwnedProcessResponseParams, body: EdgeBody) -> EdgeBody {
-        let settings = Arc::new(create_test_settings());
-        let registry = Arc::new(
-            IntegrationRegistry::new(&settings).expect("should create integration registry"),
-        );
-        let orchestrator = Arc::new(AuctionOrchestrator::new(settings.auction.clone()));
-        let services = noop_services();
-        let response = Response::builder()
-            .status(StatusCode::OK)
-            .header(header::CONTENT_TYPE, &params.content_type)
-            .body(EdgeBody::empty())
-            .expect("should build response");
-        let publisher_response = PublisherResponse::Stream {
-            response,
-            body,
-            params: Box::new(params),
-        };
-        futures::executor::block_on(publisher_response_into_streaming_response(
-            publisher_response,
-            &Method::GET,
-            Arc::clone(&settings),
-            registry.as_ref(),
-            orchestrator,
-            services,
-        ))
-        .expect("should build streaming response")
-        .into_body()
-    }
-
-    fn html_stream_params(
-        content_encoding: &str,
-        dispatched_auction: Option<DispatchedAuction>,
-    ) -> OwnedProcessResponseParams {
-        OwnedProcessResponseParams {
-            content_encoding: content_encoding.to_string(),
-            origin_host: "origin.example.com".to_string(),
-            origin_url: "https://origin.example.com".to_string(),
-            request_host: "proxy.example.com".to_string(),
-            request_scheme: "https".to_string(),
-            content_type: "text/html; charset=utf-8".to_string(),
-            ad_slots_script: Some(
-                r#"<script>(window.tsjs=window.tsjs||{}).adSlots=JSON.parse("[]");</script>"#
-                    .to_string(),
-            ),
-            ad_bids_state: Arc::new(Mutex::new(None)),
-            auction_observation: None,
-            auction_request: dispatched_auction.as_ref().map(|_| test_auction_request()),
-            dispatched_auction,
-            price_granularity: crate::price_bucket::PriceGranularity::default(),
-        }
-    }
-
-    #[test]
-    fn streaming_finalize_emits_compressed_html_before_origin_eof() {
-        // The FCP regression from #849: the lazy body must emit its first
-        // rewritten, browser-decodable chunk as soon as the origin delivers one
-        // block — not buffer the whole (compressed) response until EOF. The
-        // origin here sends one gzip member and then stays Pending; the first
-        // poll must still yield gzip bytes that decode to the streamed content.
-        // The page exceeds the deflate decoder's internal output buffer so the
-        // first decoded block flushes downstream before the (never-arriving)
-        // EOF, exactly as a real page does.
-        let mut page = b"<html><head></head><body>".to_vec();
-        for i in 0..4000 {
-            page.extend(format!("<p>hello world paragraph {i}</p>").bytes());
-        }
-        let params = html_stream_params("gzip", None);
-        let body = streaming_finalize_response(
-            params,
-            origin_chunk_then_pending(bytes::Bytes::from(gzip_encode(&page))),
-        );
-
-        let first = first_lazy_body_chunk(body);
-        assert!(
-            !first.is_empty(),
-            "first emitted gzip chunk must not be empty"
-        );
-
-        // Decode the flushed (not finished) gzip prefix the way a browser would
-        // decode bytes received so far while the response is still open.
-        let mut decoder = flate2::write::MultiGzDecoder::new(Vec::new());
-        decoder
-            .write_all(&first)
-            .expect("first chunk must be valid gzip");
-        decoder.flush().expect("should flush gzip decoder");
-        let decoded = String::from_utf8(decoder.get_ref().clone()).expect("should be valid UTF-8");
-        assert!(
-            decoded.contains("hello world"),
-            "first poll must emit decodable streamed content before EOF. Got: {decoded}"
-        );
-    }
-
-    #[test]
-    fn streaming_finalize_auction_hold_emits_prefix_before_origin_eof() {
-        // The auction-hold path must stream the document prefix (up to the held
-        // `</body>` tail) before the origin finishes and before the auction is
-        // collected — otherwise the hold reintroduces the FCP regression. The
-        // origin sends the head/body prefix (no `</body>`) then stays Pending.
-        let page = b"<html><head></head><body><p>hello</p><p>more streamed content here</p>";
-        let params = html_stream_params(
-            "",
-            Some(DispatchedAuction::empty_for_test(
-                test_auction_request(),
-                10,
-            )),
-        );
-        let body = streaming_finalize_response(
-            params,
-            origin_chunk_then_pending(bytes::Bytes::from(&page[..])),
-        );
-
-        let first = first_lazy_body_chunk(body);
-        let html = String::from_utf8(first.to_vec()).expect("should be valid UTF-8");
-        assert!(
-            html.contains("hello"),
-            "auction-hold path must stream the prefix before EOF. Got: {html}"
-        );
-        assert!(
-            html.contains(".adSlots=JSON.parse"),
-            "prefix must carry the injected (rewritten) head before EOF. Got: {html}"
-        );
-        assert!(
-            !html.contains(".bids=JSON.parse"),
-            "bids inject only at </body> after collection, which the first poll must not wait for. Got: {html}"
-        );
-    }
-
-    #[test]
-    fn streaming_finalize_auction_hold_emits_small_compressed_page_before_collection() {
-        // A small gzip page arrives as one origin chunk whose whole expansion
-        // fits inside `flate2`'s internal decode buffer, and its `</body>` lands
-        // in that same chunk. Both stages that could withhold it must not: the
-        // decoder sync-flushes per source chunk instead of holding output until
-        // its own finalization, and the finish path emits the decoder tail
-        // before awaiting collection. Otherwise the client holds committed
-        // headers and an empty body until the auction resolves.
-        let page = b"<html><head></head><body><p>small compressed page</p></body></html>";
-        let params = html_stream_params(
-            "gzip",
-            Some(DispatchedAuction::empty_for_test(
-                test_auction_request(),
-                500,
-            )),
-        );
-        let body = streaming_finalize_response(
-            params,
-            origin_chunk_then_pending(bytes::Bytes::from(gzip_encode(page))),
-        );
-
-        let first = first_lazy_body_chunk(body);
-        // Decode the flushed (not finished) prefix the way a browser decodes the
-        // bytes received while the response is still open.
-        let mut decoder = flate2::write::MultiGzDecoder::new(Vec::new());
-        decoder
-            .write_all(&first)
-            .expect("first chunk must be valid gzip");
-        decoder.flush().expect("should flush gzip decoder");
-        let decoded = String::from_utf8(decoder.get_ref().clone()).expect("should be valid UTF-8");
-
-        assert!(
-            decoded.contains("small compressed page"),
-            "first poll must emit the decoded document prefix of a small gzip page. Got: {decoded}"
-        );
-        assert!(
-            !decoded.contains(".bids=JSON.parse"),
-            "bids inject only at </body> after collection, which the first poll must not wait for. Got: {decoded}"
-        );
-    }
-
-    // (method, status, expected Content-Length, expected Transfer-Encoding)
-    // after bodiless normalization. 204 forbids Content-Length (removed); 205
-    // must advertise a zero-length body; HEAD and 304 legitimately advertise the
-    // GET representation length. Chunked framing is stripped from 204 (forbidden
-    // by RFC 9112 §6.1) and 205 (would conflict with the inserted
-    // `Content-Length: 0`), but preserved for HEAD and 304, whose message length
-    // is fixed by the header section regardless of framing fields
-    // (RFC 9112 §6.3, rule 1).
-    const BODILESS_FRAMING_CASES: [(Method, StatusCode, Option<&str>, Option<&str>); 4] = [
-        (Method::HEAD, StatusCode::OK, Some("42"), Some("chunked")),
-        (Method::GET, StatusCode::NO_CONTENT, None, None),
-        (Method::GET, StatusCode::RESET_CONTENT, Some("0"), None),
-        (
-            Method::GET,
-            StatusCode::NOT_MODIFIED,
-            Some("42"),
-            Some("chunked"),
-        ),
-    ];
-
-    /// Assert the framing fields left on a normalized bodiless response.
-    fn assert_bodiless_framing(
-        response: &Response<EdgeBody>,
-        method: &Method,
-        status: StatusCode,
-        expected_length: Option<&str>,
-        expected_transfer_encoding: Option<&str>,
-    ) {
-        let header_value = |name: header::HeaderName| {
-            response
-                .headers()
-                .get(name)
-                .and_then(|value| value.to_str().ok())
-                .map(str::to_owned)
-        };
-        assert_eq!(
-            header_value(header::CONTENT_LENGTH).as_deref(),
-            expected_length,
-            "bodiless {method} {status} must carry the corrected Content-Length"
-        );
-        assert_eq!(
-            header_value(header::TRANSFER_ENCODING).as_deref(),
-            expected_transfer_encoding,
-            "bodiless {method} {status} must carry the corrected Transfer-Encoding"
-        );
-        assert_eq!(
-            header_value(header::TRAILER).as_deref(),
-            // `Trailer` only describes fields a chunked body can carry, so it
-            // survives exactly where chunked framing does.
-            expected_transfer_encoding.map(|_| "expires"),
-            "bodiless {method} {status} must drop Trailer with its chunked framing"
-        );
-    }
-
-    #[test]
-    fn publisher_response_streaming_finalize_normalizes_bodiless_framing() {
-        // Fastly requests the origin body as a stream before classification, so
-        // a buffered-unmodified response can hold an `EdgeBody::Stream`. The
-        // adapter streams any `EdgeBody::Stream` to the client, so bodiless
-        // responses must carry no body and correct framing per status.
-        let settings = Arc::new(create_test_settings());
-        let registry = Arc::new(
-            IntegrationRegistry::new(&settings).expect("should create integration registry"),
-        );
-        let orchestrator = Arc::new(AuctionOrchestrator::new(settings.auction.clone()));
-
-        for (method, status, expected_length, expected_transfer_encoding) in BODILESS_FRAMING_CASES
-        {
-            let response = Response::builder()
-                .status(status)
-                .header(header::CONTENT_LENGTH, "42")
-                .header(header::TRANSFER_ENCODING, "chunked")
-                .header(header::TRAILER, "expires")
-                .body(EdgeBody::stream(futures::stream::iter(vec![
-                    bytes::Bytes::from_static(b"origin body bytes that must not reach the client"),
-                ])))
-                .expect("should build response");
-            let publisher_response = PublisherResponse::Buffered(response);
-
-            let response = futures::executor::block_on(publisher_response_into_streaming_response(
-                publisher_response,
-                &method,
-                Arc::clone(&settings),
-                registry.as_ref(),
-                Arc::clone(&orchestrator),
-                noop_services(),
-            ))
-            .expect("should finalize buffered response");
-
-            assert!(
-                !matches!(response.body(), EdgeBody::Stream(_)),
-                "bodiless {method} {status} must not carry a streaming body"
-            );
-            assert_bodiless_framing(
-                &response,
-                &method,
-                status,
-                expected_length,
-                expected_transfer_encoding,
-            );
-
-            let drained = futures::executor::block_on(
-                response
-                    .into_body()
-                    .into_bytes_bounded(settings.publisher.max_buffered_body_bytes),
-            )
-            .expect("body should drain")
-            .to_vec();
-            assert!(
-                drained.is_empty(),
-                "bodiless {method} {status} must deliver zero body bytes, got {} bytes",
-                drained.len()
-            );
-        }
-    }
-
-    #[test]
-    fn buffer_publisher_response_normalizes_bodiless_framing() {
-        // The buffered finalizer (Axum/Cloudflare/Spin) must correct bodiless
-        // framing identically to the streaming finalizer.
-        let settings = create_test_settings();
-        let registry =
-            IntegrationRegistry::new(&settings).expect("should create integration registry");
-        let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
-        let services = noop_services();
-
-        for (method, status, expected_length, expected_transfer_encoding) in BODILESS_FRAMING_CASES
-        {
-            let response = Response::builder()
-                .status(status)
-                .header(header::CONTENT_LENGTH, "42")
-                .header(header::TRANSFER_ENCODING, "chunked")
-                .header(header::TRAILER, "expires")
-                .body(EdgeBody::from(
-                    b"origin body bytes that must not reach the client".to_vec(),
-                ))
-                .expect("should build response");
-            let publisher_response = PublisherResponse::Buffered(response);
-
-            let response = futures::executor::block_on(buffer_publisher_response_async(
-                publisher_response,
-                &method,
-                &settings,
-                &registry,
-                &orchestrator,
-                &services,
-            ))
-            .expect("should finalize buffered response");
-
-            assert_bodiless_framing(
-                &response,
-                &method,
-                status,
-                expected_length,
-                expected_transfer_encoding,
-            );
-
-            let drained = futures::executor::block_on(
-                response
-                    .into_body()
-                    .into_bytes_bounded(settings.publisher.max_buffered_body_bytes),
-            )
-            .expect("body should drain")
-            .to_vec();
-            assert!(
-                drained.is_empty(),
-                "bodiless {method} {status} must deliver zero body bytes, got {} bytes",
-                drained.len()
-            );
-        }
-    }
-
-    #[derive(Default)]
-    struct RecordingTelemetrySink {
-        batches: Mutex<Vec<crate::auction::telemetry::AuctionEventBatch>>,
-    }
-
-    #[async_trait::async_trait(?Send)]
-    impl crate::auction::telemetry::AuctionTelemetrySink for RecordingTelemetrySink {
-        async fn emit_auction_events(
-            &self,
-            _services: &RuntimeServices,
-            batch: crate::auction::telemetry::AuctionEventBatch,
-        ) -> Result<(), Report<TrustedServerError>> {
-            self.batches
-                .lock()
-                .expect("should lock telemetry batches")
-                .push(batch);
-            Ok(())
-        }
-    }
-
-    #[test]
-    fn finalizers_emit_abandoned_auction_for_bodiless_dispatched_response() {
-        // A conditional navigation can dispatch an auction and receive a
-        // processable HTML 304 that classification routes to Stream. The
-        // bodiless response has no `</body>` to inject into, so the dispatched
-        // auction is never collected — but both finalizers must still emit a
-        // terminal abandonment event so the SSP work and quota consumption stay
-        // observable instead of vanishing silently.
-        let settings = Arc::new(create_test_settings());
-        let registry =
-            IntegrationRegistry::new(&settings).expect("should create integration registry");
-        let orchestrator = Arc::new(AuctionOrchestrator::new(settings.auction.clone()));
-
-        let make_params = || {
-            let ec_context =
-                EcContext::new_for_test(None, crate::consent::types::ConsentContext::default());
-            OwnedProcessResponseParams {
-                content_encoding: String::new(),
-                origin_host: "origin.example.com".to_string(),
-                origin_url: "https://origin.example.com".to_string(),
-                request_host: "proxy.example.com".to_string(),
-                request_scheme: "https".to_string(),
-                content_type: "text/html; charset=utf-8".to_string(),
-                ad_slots_script: None,
-                ad_bids_state: Arc::new(Mutex::new(None)),
-                auction_observation: Some(AuctionObservationContext::from_parts(
-                    AuctionSource::SpaNavigation,
-                    "proxy.example.com",
-                    "/article",
-                    1,
-                    &ec_context,
-                )),
-                auction_request: Some(test_auction_request()),
-                dispatched_auction: Some(DispatchedAuction::empty_for_test(
-                    test_auction_request(),
-                    10,
-                )),
-                price_granularity: PriceGranularity::default(),
-            }
-        };
-        let make_stream_response = || PublisherResponse::Stream {
-            response: Response::builder()
-                .status(StatusCode::NOT_MODIFIED)
-                .header(header::CONTENT_TYPE, "text/html; charset=utf-8")
-                .body(EdgeBody::empty())
-                .expect("should build 304 response"),
-            body: EdgeBody::stream(futures::stream::iter(vec![bytes::Bytes::from_static(
-                b"<html></html>",
-            )])),
-            params: Box::new(make_params()),
-        };
-
-        fn assert_bodiless_abandoned(sink: &RecordingTelemetrySink) {
-            let batches = sink.batches.lock().expect("should lock telemetry batches");
-            assert_eq!(
-                batches.len(),
-                1,
-                "bodiless dispatched response should emit exactly one terminal batch"
-            );
-            let reasons: Vec<String> = batches[0]
-                .rows()
-                .iter()
-                .filter_map(|row| row.terminal_reason.clone())
-                .collect();
-            assert!(
-                reasons.iter().any(|reason| reason == "bodiless_response"),
-                "abandonment must carry the bodiless_response reason, got {reasons:?}"
-            );
-        }
-
-        // Streaming finalizer (Fastly).
-        let streaming_sink = Arc::new(RecordingTelemetrySink::default());
-        let response = futures::executor::block_on(publisher_response_into_streaming_response(
-            make_stream_response(),
-            &Method::GET,
-            Arc::clone(&settings),
-            &registry,
-            Arc::clone(&orchestrator),
-            noop_services_with_telemetry_sink(Arc::clone(&streaming_sink) as _),
-        ))
-        .expect("streaming finalize should succeed");
-        assert_eq!(response.status(), StatusCode::NOT_MODIFIED);
-        assert_bodiless_abandoned(&streaming_sink);
-
-        // Buffered finalizer (Axum/Cloudflare/Spin).
-        let buffered_sink = Arc::new(RecordingTelemetrySink::default());
-        let buffered_services = noop_services_with_telemetry_sink(Arc::clone(&buffered_sink) as _);
-        let response = futures::executor::block_on(buffer_publisher_response_async(
-            make_stream_response(),
-            &Method::GET,
-            settings.as_ref(),
-            &registry,
-            orchestrator.as_ref(),
-            &buffered_services,
-        ))
-        .expect("buffered finalize should succeed");
-        assert_eq!(response.status(), StatusCode::NOT_MODIFIED);
-        assert_bodiless_abandoned(&buffered_sink);
-    }
-
-    #[test]
-    fn publisher_response_streaming_finalize_processes_gzip_stream() {
-        let compressed =
-            gzip_encode(b"body{background:url('https://origin.example.com/asset.png')}");
-        let split_at = compressed.len() / 2;
-        let output = drain_streaming_finalize_body(
-            "gzip",
-            EdgeBody::stream(futures::stream::iter(vec![
-                bytes::Bytes::copy_from_slice(&compressed[..split_at]),
-                bytes::Bytes::copy_from_slice(&compressed[split_at..]),
-            ])),
-        );
-
-        let css = String::from_utf8(gzip_decode(&output)).expect("should be valid UTF-8");
-        assert!(
-            css.contains("proxy.example.com"),
-            "streaming response finalize should rewrite gzip body. Got: {css}"
-        );
-        assert!(
-            !css.contains("origin.example.com"),
-            "streaming response finalize should not leave gzip origin URLs. Got: {css}"
-        );
-    }
-
-    #[test]
-    fn publisher_response_streaming_finalize_processes_deflate_stream() {
-        let compressed =
-            deflate_encode(b"body{background:url('https://origin.example.com/asset.png')}");
-        let split_at = compressed.len() / 2;
-        let output = drain_streaming_finalize_body(
-            "deflate",
-            EdgeBody::stream(futures::stream::iter(vec![
-                bytes::Bytes::copy_from_slice(&compressed[..split_at]),
-                bytes::Bytes::copy_from_slice(&compressed[split_at..]),
-            ])),
-        );
-
-        let css = String::from_utf8(deflate_decode(&output)).expect("should be valid UTF-8");
-        assert!(
-            css.contains("proxy.example.com"),
-            "streaming response finalize should rewrite deflate body. Got: {css}"
-        );
-        assert!(
-            !css.contains("origin.example.com"),
-            "streaming response finalize should not leave deflate origin URLs. Got: {css}"
-        );
-    }
-
-    #[test]
-    fn publisher_response_streaming_finalize_processes_brotli_stream() {
-        let compressed =
-            brotli_encode(b"body{background:url('https://origin.example.com/asset.png')}");
-        let split_at = compressed.len() / 2;
-        let output = drain_streaming_finalize_body(
-            "br",
-            EdgeBody::stream(futures::stream::iter(vec![
-                bytes::Bytes::copy_from_slice(&compressed[..split_at]),
-                bytes::Bytes::copy_from_slice(&compressed[split_at..]),
-            ])),
-        );
-
-        let css = String::from_utf8(brotli_decode(&output)).expect("should be valid UTF-8");
-        assert!(
-            css.contains("proxy.example.com"),
-            "streaming response finalize should rewrite brotli body. Got: {css}"
-        );
-        assert!(
-            !css.contains("origin.example.com"),
-            "streaming response finalize should not leave brotli origin URLs. Got: {css}"
-        );
-    }
-
-    #[test]
-    fn publisher_response_streaming_finalize_holds_auction_and_keeps_gzip_tail() {
-        let settings = Arc::new(create_test_settings());
-        let registry = Arc::new(
-            IntegrationRegistry::new(&settings).expect("should create integration registry"),
-        );
-        let orchestrator = Arc::new(AuctionOrchestrator::new(settings.auction.clone()));
-        let services = noop_services();
-        let response = Response::builder()
-            .status(StatusCode::OK)
-            .header(header::CONTENT_TYPE, "text/html; charset=utf-8")
-            .body(EdgeBody::empty())
-            .expect("should build response");
-        // The trailing content after `</body>` must exceed the flate2 write
-        // decoder's 32 KiB internal output buffer: the close-body tag then
-        // surfaces (and releases the auction hold) mid-stream, while the
-        // trailing markup only surfaces at decoder finalization. This guards
-        // against the EOF decoded tail being dropped once the hold is gone.
-        let trailing_comment = format!("<!-- {} -->", "trailing-content ".repeat(3 * 1024));
-        let page = format!("<html><head></head><body>hello</body>{trailing_comment}</html>");
-        let compressed = gzip_encode(page.as_bytes());
-        let chunks: Vec<bytes::Bytes> = compressed
-            .chunks(STREAM_CHUNK_SIZE)
-            .map(bytes::Bytes::copy_from_slice)
-            .collect();
-        let params = OwnedProcessResponseParams {
-            content_encoding: "gzip".to_string(),
-            origin_host: "origin.example.com".to_string(),
-            origin_url: "https://origin.example.com".to_string(),
-            request_host: "proxy.example.com".to_string(),
-            request_scheme: "https".to_string(),
-            content_type: "text/html; charset=utf-8".to_string(),
-            ad_slots_script: Some(
-                r#"<script>(window.tsjs=window.tsjs||{}).adSlots=JSON.parse("[]");</script>"#
-                    .to_string(),
-            ),
-            ad_bids_state: Arc::new(Mutex::new(None)),
-            auction_observation: None,
-            auction_request: Some(test_auction_request()),
-            dispatched_auction: Some(DispatchedAuction::empty_for_test(
-                test_auction_request(),
-                10,
-            )),
-            price_granularity: crate::price_bucket::PriceGranularity::default(),
-        };
-        let publisher_response = PublisherResponse::Stream {
-            response,
-            body: EdgeBody::stream(futures::stream::iter(chunks)),
-            params: Box::new(params),
-        };
-
-        let response = futures::executor::block_on(publisher_response_into_streaming_response(
-            publisher_response,
-            &Method::GET,
-            Arc::clone(&settings),
-            registry.as_ref(),
-            orchestrator,
-            services,
-        ))
-        .expect("should build streaming response");
-
-        let output = futures::executor::block_on(
-            response
-                .into_body()
-                .into_bytes_bounded(settings.publisher.max_buffered_body_bytes),
-        )
-        .expect("streaming body should drain")
-        .to_vec();
-
-        let html = String::from_utf8(gzip_decode(&output)).expect("should be valid UTF-8");
-        assert!(
-            html.contains(".bids=JSON.parse"),
-            "should collect the held auction and inject bids. Got tail: {}",
-            &html[html.len().saturating_sub(200)..]
-        );
-        assert!(
-            html.contains("trailing-content"),
-            "should preserve content after the close-body tag"
-        );
-        assert!(
-            html.trim_end().ends_with("</html>"),
-            "should not drop the decoded tail once the auction hold is released. Got tail: {}",
-            &html[html.len().saturating_sub(200)..]
-        );
-    }
-
-    #[test]
-    fn stream_publisher_body_treats_mixed_case_html_as_html() {
-        let settings = create_test_settings();
-        let registry =
-            IntegrationRegistry::new(&settings).expect("should create integration registry");
-        let bids_script =
-            r#"<script>(window.tsjs=window.tsjs||{}).bids=JSON.parse("{}");</script>"#;
-        let state = Arc::new(Mutex::new(Some(bids_script.to_string())));
-        let params = OwnedProcessResponseParams {
-            content_encoding: String::new(),
-            origin_host: "origin.example.com".to_string(),
-            origin_url: "https://origin.example.com".to_string(),
-            request_host: "proxy.example.com".to_string(),
-            request_scheme: "https".to_string(),
-            content_type: "Text/HTML; Charset=utf-8".to_string(),
-            ad_slots_script: Some(
-                r#"<script>(window.tsjs=window.tsjs||{}).adSlots=JSON.parse("[]");</script>"#
-                    .to_string(),
-            ),
-            ad_bids_state: state,
-            auction_observation: None,
-            auction_request: None,
-            dispatched_auction: None,
-            price_granularity: crate::price_bucket::PriceGranularity::default(),
-        };
-        let mut output = Vec::new();
-
-        stream_publisher_body(
-            EdgeBody::from(b"<html><head></head><body>content</body></html>".to_vec()),
-            &mut output,
-            &params,
-            &settings,
-            &registry,
-        )
-        .expect("should process mixed-case HTML content type");
-
-        let html = String::from_utf8(output).expect("should be valid UTF-8");
-        assert!(
-            html.contains(".adSlots=JSON.parse"),
-            "mixed-case HTML must use the HTML processor and inject ad slots. Got: {html}"
-        );
-        assert!(
-            html.contains(".bids=JSON.parse"),
-            "mixed-case HTML must use the HTML processor and inject bids. Got: {html}"
-        );
-    }
-
-    /// Mid-stream decoder failure must surface as an error. The adapter
-    /// relies on this: once headers are committed, it logs and drops the
-    /// `StreamingBody` so the client sees a truncated response. If a decode
-    /// failure silently emitted bytes, the client would see a malformed
-    /// document instead.
-    #[test]
-    fn stream_publisher_body_surfaces_mid_stream_decode_error() {
-        let settings = create_test_settings();
-        let registry =
-            IntegrationRegistry::new(&settings).expect("should create integration registry");
-
-        // Claim gzip encoding but feed non-gzip bytes. The GzDecoder will
-        // error as soon as it tries to read the gzip header.
-        let params = OwnedProcessResponseParams {
-            content_encoding: "gzip".to_string(),
-            origin_host: "origin.example.com".to_string(),
-            origin_url: "https://origin.example.com".to_string(),
-            request_host: "proxy.example.com".to_string(),
-            request_scheme: "https".to_string(),
-            content_type: "text/html".to_string(),
-            ad_slots_script: None,
-            ad_bids_state: Arc::new(Mutex::new(None)),
-            auction_observation: None,
-            auction_request: None,
-            dispatched_auction: None,
-            price_granularity: crate::price_bucket::PriceGranularity::default(),
-        };
-
-        let bogus_body = EdgeBody::from(b"<html>not gzip</html>".to_vec());
-        let mut output = Vec::new();
-        let result = stream_publisher_body(bogus_body, &mut output, &params, &settings, &registry);
-
-        assert!(
-            result.is_err(),
-            "decoding bogus gzip as gzip should return Err so the adapter can drop the stream"
-        );
-    }
-
-    /// Pass-through dispatch contract: the adapter treats `PublisherResponse::PassThrough`
-    /// by reattaching the origin body unchanged and letting Fastly emit it.
-    /// Simulate that step and assert byte identity plus Content-Length
-    /// preservation. Distinct from `pass_through_preserves_body_and_content_length`
-    /// which only tests the header preservation; this one walks the full
-    /// take-then-reattach pattern the adapter uses.
-    #[test]
-    fn publisher_response_pass_through_reattach_preserves_bytes() {
-        // Simulate a 2xx image/png response: Body::from(bytes), take_body(),
-        // then set_body(body). `classify_response_route` already picks
-        // PassThrough for this combination; this covers the adapter's
-        // reattachment half of the contract.
-        let image_bytes: Vec<u8> = (0..=127).cycle().take(2048).collect();
-
-        let mut response = Response::builder()
-            .status(StatusCode::OK)
-            .header(header::CONTENT_TYPE, "image/png")
-            .header(header::CONTENT_LENGTH, image_bytes.len() as u64)
-            .body(EdgeBody::from(image_bytes.clone()))
-            .expect("should build test response");
-
-        // Mirror adapter: take body, then reattach.
-        let body = std::mem::replace(response.body_mut(), EdgeBody::empty());
-        *response.body_mut() = body;
-
-        assert_eq!(
-            response
-                .headers()
-                .get(header::CONTENT_LENGTH)
-                .and_then(|v| v.to_str().ok())
-                .expect("content-length should survive"),
-            "2048"
-        );
-        let (_, final_body) = response.into_parts();
-        let round_trip = final_body.into_bytes().unwrap_or_default();
-        assert_eq!(
-            round_trip, image_bytes,
-            "pass-through reattach must preserve bytes exactly"
-        );
-    }
-
-    /// Streaming dispatch contract: HTML with a registered post-processor still
-    /// routes through `Stream`, and the shared processor pipeline still applies
-    /// the post-processor rewrite.
-    #[test]
-    fn streaming_html_with_post_processors_rewrites_body() {
-        // Configure nextjs so a post-processor is registered.
-        let mut settings = create_test_settings();
-        settings
-            .integrations
-            .insert_config(
-                "nextjs",
-                &serde_json::json!({
-                    "enabled": true,
-                    "rewrite_attributes": ["href", "link", "url"],
-                }),
-            )
-            .expect("should update nextjs config");
-
-        let registry =
-            IntegrationRegistry::new(&settings).expect("should create integration registry");
+        let registry =
+            IntegrationRegistry::new(&settings).expect("should create integration registry");
 
         assert!(
             registry.has_html_post_processors(),
@@ -7068,23 +4261,15 @@ mod tests {
             MatchedSlotsContext, build_ad_slots_script, build_auction_request, build_bid_map,
             build_bids_script, html_escape_for_script,
         };
-        use crate::auction::types::{Bid, MediaType};
+        use crate::auction::types::{ApsRendererV1, ApsTagType, Bid, BidRenderer, MediaType};
         use crate::consent::ConsentContext;
         use crate::creative_opportunities::{
             CreativeOpportunitiesConfig, CreativeOpportunityFormat, CreativeOpportunitySlot,
         };
         use crate::http_util::RequestInfo;
         use crate::price_bucket::PriceGranularity;
-        use crate::settings::Settings;
         use std::collections::HashMap;
 
-        // Default settings are enough for the creative boundary: the sanitize
-        // pass needs no config, and `rewrite_creative_html` only signs URLs it
-        // actually rewrites (none of these fixtures carry proxyable URLs).
-        fn test_settings() -> Settings {
-            Settings::default()
-        }
-
         fn make_config() -> CreativeOpportunitiesConfig {
             CreativeOpportunitiesConfig {
                 gam_network_id: "21765378893".to_string(),
@@ -7133,7 +4318,10 @@ mod tests {
                 height: 250,
                 nurl: Some(nurl.to_string()),
                 burl: Some(burl.to_string()),
+                bid_id: None,
                 ad_id: Some(ad_id.to_string()),
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
@@ -7184,466 +4372,134 @@ mod tests {
                     1.50,
                     "kargo",
                     "abc123",
-                    "https://ssp/win",
-                    "https://ssp/bill",
-                ),
-            );
-            let map = build_bid_map(
-                &winning_bids,
-                PriceGranularity::Dense,
-                &test_settings(),
-                "",
-                false,
-            );
-            let entry = map.get("atf_sidebar_ad").expect("should have bid entry");
-            let obj = entry.as_object().expect("should be object");
-            assert_eq!(
-                obj.get("hb_pb").and_then(|v| v.as_str()),
-                Some("1.50"),
-                "should bucket price with dense granularity"
-            );
-            assert_eq!(
-                obj.get("hb_bidder").and_then(|v| v.as_str()),
-                Some("kargo"),
-                "should include bidder"
-            );
-            assert_eq!(
-                obj.get("hb_adid").and_then(|v| v.as_str()),
-                Some("abc123"),
-                "should fall back to ad_id when no cache_id present"
-            );
-            assert_eq!(
-                obj.get("nurl").and_then(|v| v.as_str()),
-                Some("https://ssp/win"),
-                "should include nurl"
-            );
-            assert_eq!(
-                obj.get("burl").and_then(|v| v.as_str()),
-                Some("https://ssp/bill"),
-                "should include burl"
-            );
-        }
-
-        #[test]
-        fn bid_map_omits_zero_creative_dimensions() {
-            // Missing OpenRTB w/h parse to 0. Emitting w:0/h:0 would make the
-            // bridge (which nullish-coalesces) size the frame to 0 instead of
-            // falling back to the slot format, so a zero dimension must be omitted.
-            let mut winning_bids = HashMap::new();
-            let mut bid = make_bid(
-                "atf_sidebar_ad",
-                1.50,
-                "kargo",
-                "abc123",
-                "https://ssp/win",
-                "https://ssp/bill",
-            );
-            bid.width = 0;
-            bid.height = 0;
-            winning_bids.insert("atf_sidebar_ad".to_string(), bid);
-            let map = build_bid_map(
-                &winning_bids,
-                PriceGranularity::Dense,
-                &test_settings(),
-                "",
-                false,
-            );
-            let obj = map
-                .get("atf_sidebar_ad")
-                .expect("should have bid entry")
-                .as_object()
-                .expect("should be object");
-            assert!(obj.get("w").is_none(), "should omit zero width");
-            assert!(obj.get("h").is_none(), "should omit zero height");
-        }
-
-        #[test]
-        fn bid_map_includes_winning_creative_dimensions() {
-            // The bridge sizes the inline render from these dimensions; without
-            // them it falls back to the first configured slot format, which
-            // mis-sizes a multi-size slot whose winner is not the first format.
-            let mut winning_bids = HashMap::new();
-            let mut bid = make_bid(
-                "atf_sidebar_ad",
-                1.50,
-                "kargo",
-                "abc123",
-                "https://ssp/win",
-                "https://ssp/bill",
-            );
-            bid.width = 300;
-            bid.height = 600;
-            winning_bids.insert("atf_sidebar_ad".to_string(), bid);
-            let map = build_bid_map(
-                &winning_bids,
-                PriceGranularity::Dense,
-                &test_settings(),
-                "",
-                false,
-            );
-            let obj = map
-                .get("atf_sidebar_ad")
-                .expect("should have bid entry")
-                .as_object()
-                .expect("should be object");
-            assert_eq!(
-                obj.get("w").and_then(serde_json::Value::as_u64),
-                Some(300),
-                "should include winning creative width"
-            );
-            assert_eq!(
-                obj.get("h").and_then(serde_json::Value::as_u64),
-                Some(600),
-                "should include winning creative height"
-            );
-        }
-
-        #[test]
-        fn client_bid_map_includes_adm_and_omits_debug_bid_by_default() {
-            let mut winning_bids = HashMap::new();
-            let mut bid = make_bid(
-                "atf_sidebar_ad",
-                1.50,
-                "kargo",
-                "abc123",
-                "https://ssp/win",
-                "https://ssp/bill",
-            );
-            bid.creative = Some("<div>Creative</div>".to_string());
-            winning_bids.insert("atf_sidebar_ad".to_string(), bid);
-
-            // Production path (include_debug_bid = false): the creative is always
-            // included so the bridge can render it locally, but the verbose
-            // debug_bid blob is not.
-            let map = build_bid_map(
-                &winning_bids,
-                PriceGranularity::Dense,
-                &test_settings(),
-                "",
-                false,
-            );
-            let obj = map
-                .get("atf_sidebar_ad")
-                .expect("should have bid entry")
-                .as_object()
-                .expect("should be object");
-
-            assert_eq!(
-                obj.get("adm").and_then(|v| v.as_str()),
-                Some("<div>Creative</div>"),
-                "should include creative markup for local rendering by default"
-            );
-            assert!(
-                obj.get("debug_bid").is_none(),
-                "should omit the debug_bid blob when debug injection is disabled"
-            );
-        }
-
-        #[test]
-        fn build_bid_map_sanitizes_hostile_adm() {
-            // The inline-adm path must run the same creative-processing boundary
-            // as the `/auction` path (sanitize → rewrite) before the creative
-            // reaches window.tsjs.bids, so hostile executable markup never lands
-            // in the client-facing `adm` for the Prebid Universal Creative to run.
-            let mut winning_bids = HashMap::new();
-            let mut bid = make_bid(
-                "atf_sidebar_ad",
-                1.50,
-                "kargo",
-                "abc123",
-                "https://ssp/win",
-                "https://ssp/bill",
-            );
-            bid.creative = Some(
-                "<div onclick=\"steal()\"><script>alert(1)</script>\
-                 <a href=\"javascript:evil()\">x</a></div>"
-                    .to_string(),
-            );
-            winning_bids.insert("atf_sidebar_ad".to_string(), bid);
-
-            let map = build_bid_map(
-                &winning_bids,
-                PriceGranularity::Dense,
-                &test_settings(),
-                "",
-                false,
-            );
-            let adm = map
-                .get("atf_sidebar_ad")
-                .and_then(|v| v.as_object())
-                .and_then(|o| o.get("adm"))
-                .and_then(|v| v.as_str())
-                .expect("should include a sanitized adm");
-
-            assert!(
-                !adm.contains("<script"),
-                "should strip <script> elements from the inline adm"
-            );
-            assert!(
-                !adm.contains("alert(1)"),
-                "should strip inline script bodies from the inline adm"
-            );
-            assert!(
-                !adm.contains("onclick"),
-                "should strip on* event-handler attributes from the inline adm"
-            );
-            assert!(
-                !adm.contains("javascript:"),
-                "should strip javascript: URIs from the inline adm"
-            );
-        }
-
-        #[test]
-        fn build_bid_map_omits_oversized_adm() {
-            // Creatives larger than the sanitize pass's 1 MiB cap are rejected
-            // (empty result), so the inline `adm` is omitted and the pbRender
-            // bridge falls back to the PBS Cache coordinates instead of shipping
-            // an unbounded creative to the client.
-            let mut winning_bids = HashMap::new();
-            let mut bid = make_bid(
-                "atf_sidebar_ad",
-                1.50,
-                "kargo",
-                "abc123",
-                "https://ssp/win",
-                "https://ssp/bill",
-            );
-            bid.creative = Some(format!("<div>{}</div>", "a".repeat(1024 * 1024 + 1)));
-            winning_bids.insert("atf_sidebar_ad".to_string(), bid);
-
-            let map = build_bid_map(
-                &winning_bids,
-                PriceGranularity::Dense,
-                &test_settings(),
-                "",
-                false,
-            );
-            let obj = map
-                .get("atf_sidebar_ad")
-                .and_then(|v| v.as_object())
-                .expect("should have a bid entry");
-            assert!(
-                obj.get("adm").is_none(),
-                "should omit the inline adm when the creative exceeds the 1 MiB cap"
-            );
-        }
-
-        #[test]
-        fn build_bid_map_rewrites_inline_adm_to_absolute_first_party_urls() {
-            // The inline `adm` is rendered by the Prebid Universal Creative inside
-            // GAM's iframe (`f.srcdoc = d.ad`), a foreign origin. Proxied URLs must
-            // therefore be emitted **absolute** against the publisher domain — a
-            // root-relative `/first-party/proxy` would resolve against GAM and 404.
-            // The tsjs bundle must NOT be injected into that foreign-origin iframe.
-            let mut settings = test_settings();
-            settings.publisher.domain = "example.com".to_string();
-
-            let mut winning_bids = HashMap::new();
-            let mut bid = make_bid(
-                "atf_sidebar_ad",
-                1.50,
-                "examplessp",
-                "abc123",
-                "https://ssp.example.com/win",
-                "https://ssp.example.com/bill",
+                    "https://ssp/win",
+                    "https://ssp/bill",
+                ),
             );
-            bid.creative = Some(
-                "<html><body><img src=\"https://cdn.example.com/pixel.png\"></body></html>"
-                    .to_string(),
+            let map = build_bid_map(&winning_bids, PriceGranularity::Dense, false);
+            let entry = map.get("atf_sidebar_ad").expect("should have bid entry");
+            let obj = entry.as_object().expect("should be object");
+            assert_eq!(
+                obj.get("hb_pb").and_then(|v| v.as_str()),
+                Some("1.50"),
+                "should bucket price with dense granularity"
             );
-            winning_bids.insert("atf_sidebar_ad".to_string(), bid);
-
-            let map = build_bid_map(&winning_bids, PriceGranularity::Dense, &settings, "", false);
-            let adm = map
-                .get("atf_sidebar_ad")
-                .and_then(|v| v.as_object())
-                .and_then(|o| o.get("adm"))
-                .and_then(|v| v.as_str())
-                .expect("should include a rewritten adm");
-
-            assert!(
-                adm.contains("https://example.com/first-party/proxy?tsurl="),
-                "should emit an absolute first-party proxy URL for the foreign-origin render context, got: {adm}"
+            assert_eq!(
+                obj.get("hb_bidder").and_then(|v| v.as_str()),
+                Some("kargo"),
+                "should include bidder"
             );
-            assert!(
-                !adm.contains("src=\"/first-party/proxy"),
-                "should not emit a root-relative proxy URL that 404s under GAM's origin, got: {adm}"
+            assert_eq!(
+                obj.get("hb_adid").and_then(|v| v.as_str()),
+                Some("abc123"),
+                "should fall back to ad_id when no cache_id present"
             );
-            assert!(
-                !adm.contains("https://cdn.example.com/pixel.png"),
-                "should proxy the original absolute CDN URL, got: {adm}"
+            assert_eq!(
+                obj.get("nurl").and_then(|v| v.as_str()),
+                Some("https://ssp/win"),
+                "should include nurl"
             );
-            assert!(
-                !adm.contains("/static/tsjs="),
-                "should not inject the tsjs bundle into a foreign-origin creative iframe, got: {adm}"
+            assert_eq!(
+                obj.get("burl").and_then(|v| v.as_str()),
+                Some("https://ssp/bill"),
+                "should include burl"
             );
         }
 
         #[test]
-        fn build_bid_map_uses_request_origin_for_inline_urls() {
-            // The inline adm's absolute first-party URLs must resolve against the
-            // origin the visitor is on (here an HTTP dev host with a port), not the
-            // configured publisher domain.
-            let mut settings = test_settings();
-            settings.publisher.domain = "example.com".to_string();
+        fn bid_map_exposes_aps_renderer_and_selected_bid_id_without_debug_adm() {
+            let mut bid = make_bid("atf_sidebar_ad", 1.50, "aps", "fallback-ad", "", "");
+            bid.bid_id = Some("selected-bid".to_string());
+            bid.renderer = Some(BidRenderer::Aps(ApsRendererV1 {
+                version: 1,
+                account_id: "example-account".to_string(),
+                bid_id: "selected-bid".to_string(),
+                creative_id: None,
+                tag_type: ApsTagType::Iframe,
+                creative_url: "https://creative.example/render".to_string(),
+                aax_response: "fictional-base64</script>".to_string(),
+                width: 300,
+                height: 250,
+            }));
+            bid.nurl = None;
+            bid.burl = None;
+            let winning_bids = HashMap::from([("atf_sidebar_ad".to_string(), bid)]);
 
-            let mut winning_bids = HashMap::new();
-            let mut bid = make_bid(
-                "atf_sidebar_ad",
-                1.50,
-                "examplessp",
-                "abc123",
-                "https://ssp.example.com/win",
-                "https://ssp.example.com/bill",
-            );
-            bid.creative = Some(
-                "<html><body><img src=\"https://cdn.example.com/pixel.png\"></body></html>"
-                    .to_string(),
-            );
-            winning_bids.insert("atf_sidebar_ad".to_string(), bid);
+            let map = build_bid_map(&winning_bids, PriceGranularity::Dense, false);
+            let obj = map["atf_sidebar_ad"]
+                .as_object()
+                .expect("should include APS bid");
 
-            let map = build_bid_map(
-                &winning_bids,
-                PriceGranularity::Dense,
-                &settings,
-                "http://localhost:7676",
-                false,
-            );
-            let adm = map
-                .get("atf_sidebar_ad")
-                .and_then(|v| v.as_object())
-                .and_then(|o| o.get("adm"))
-                .and_then(|v| v.as_str())
-                .expect("should include a rewritten adm");
+            assert_eq!(obj["hb_bidder"], "aps");
+            assert_eq!(obj["hb_adid"], "selected-bid");
+            assert_eq!(obj["renderer"]["type"], "aps");
+            assert_eq!(obj["renderer"]["bidId"], "selected-bid");
+            assert!(obj.get("adm").is_none());
+            assert!(obj.get("nurl").is_none());
+            assert!(obj.get("burl").is_none());
+            assert!(obj.get("metadata").is_none());
 
-            assert!(
-                adm.contains("http://localhost:7676/first-party/proxy?tsurl="),
-                "should emit URLs against the request origin, got: {adm}"
-            );
-            assert!(
-                !adm.contains("https://example.com/first-party/proxy"),
-                "must not fall back to the configured publisher domain, got: {adm}"
-            );
+            let script = build_bids_script(&map);
+            assert!(!script.contains("</script></script>"));
+            assert!(script.contains("\\u003C/script\\u003E"));
         }
 
         #[test]
-        fn build_bid_map_expands_auction_price_macro_before_rewrite() {
-            // ${AUCTION_PRICE} must be resolved to the clearing price before the
-            // creative is rewritten and signed. Otherwise URL rewriting encodes the
-            // literal macro (`%24%7BAUCTION_PRICE%7D`) into the signed proxy/click
-            // URL, so trackers receive an encoded macro instead of the price and the
-            // signature locks the wrong value.
-            let mut settings = test_settings();
-            settings.publisher.domain = "example.com".to_string();
-
+        fn client_bid_map_omits_adm_by_default() {
             let mut winning_bids = HashMap::new();
             let mut bid = make_bid(
                 "atf_sidebar_ad",
                 1.50,
-                "examplessp",
+                "kargo",
                 "abc123",
-                "https://ssp.example.com/win",
-                "https://ssp.example.com/bill",
-            );
-            bid.creative = Some(
-                "<html><body>\
-                 <a href=\"https://ads.example.com/click?p=${AUCTION_PRICE}\">go</a>\
-                 </body></html>"
-                    .to_string(),
+                "https://ssp/win",
+                "https://ssp/bill",
             );
+            bid.creative = Some("<div>Creative</div>".to_string());
             winning_bids.insert("atf_sidebar_ad".to_string(), bid);
 
-            let map = build_bid_map(&winning_bids, PriceGranularity::Dense, &settings, "", false);
-            let adm = map
+            let map = build_bid_map(&winning_bids, PriceGranularity::Dense, false);
+            let obj = map
                 .get("atf_sidebar_ad")
-                .and_then(|v| v.as_object())
-                .and_then(|o| o.get("adm"))
-                .and_then(|v| v.as_str())
-                .expect("should include a rewritten adm");
+                .expect("should have bid entry")
+                .as_object()
+                .expect("should be object");
 
             assert!(
-                !adm.to_uppercase().contains("AUCTION_PRICE"),
-                "no literal or encoded ${{AUCTION_PRICE}} macro should survive: {adm}"
+                obj.get("adm").is_none(),
+                "should omit adm when debug injection is disabled"
             );
             assert!(
-                adm.contains("p=1.5"),
-                "the exact winning CPM should be substituted into the signed URL: {adm}"
+                obj.get("debug_bid").is_none(),
+                "should omit debug bid when debug injection is disabled"
             );
         }
 
         #[test]
-        fn build_bid_map_expands_auction_price_macro_in_notification_urls() {
-            // Per OpenRTB the win/billing notices are the primary carriers of
-            // ${AUCTION_PRICE}, and the bridge fires them verbatim. An unexpanded
-            // macro would report an unresolved clearing price to the SSP, and
-            // would disagree with the price already substituted into the adm.
+        fn client_bid_map_includes_adm_when_debug_injection_enabled() {
             let mut winning_bids = HashMap::new();
-            let bid = make_bid(
+            let mut bid = make_bid(
                 "atf_sidebar_ad",
                 1.50,
-                "examplessp",
+                "kargo",
                 "abc123",
-                "https://ssp.example.com/win?p=${AUCTION_PRICE}",
-                "https://ssp.example.com/bill?p=${AUCTION_PRICE}",
+                "https://ssp/win",
+                "https://ssp/bill",
             );
+            bid.creative = Some("<div>Creative</div>".to_string());
             winning_bids.insert("atf_sidebar_ad".to_string(), bid);
 
-            let map = build_bid_map(
-                &winning_bids,
-                PriceGranularity::Dense,
-                &test_settings(),
-                "",
-                false,
-            );
+            let map = build_bid_map(&winning_bids, PriceGranularity::Dense, true);
             let obj = map
                 .get("atf_sidebar_ad")
-                .and_then(|v| v.as_object())
-                .expect("should have bid entry");
-
-            for field in ["nurl", "burl"] {
-                let url = obj
-                    .get(field)
-                    .and_then(|v| v.as_str())
-                    .unwrap_or_else(|| panic!("should include {field}"));
-                assert!(
-                    !url.to_uppercase().contains("AUCTION_PRICE"),
-                    "no literal or encoded ${{AUCTION_PRICE}} macro should survive in {field}: {url}"
-                );
-                assert!(
-                    url.ends_with("?p=1.5"),
-                    "the exact winning CPM should be substituted into {field}: {url}"
-                );
-            }
-        }
-
-        #[test]
-        fn build_bids_script_escapes_line_separators_in_adm() {
-            // U+2028/U+2029 are valid JSON string content but terminate inline
-            // <script> statements; they survive the sanitize boundary as ordinary
-            // text, so build_bids_script must unicode-escape them.
-            let mut winning_bids = HashMap::new();
-            let mut bid = make_bid(
-                "s",
-                1.50,
-                "kargo",
-                "abc123",
-                "https://ssp/win",
-                "https://ssp/bill",
-            );
-            bid.creative = Some("<div>a\u{2028}b\u{2029}c</div>".to_string());
-            winning_bids.insert("s".to_string(), bid);
+                .expect("should have bid entry")
+                .as_object()
+                .expect("should be object");
 
-            let map = build_bid_map(
-                &winning_bids,
-                PriceGranularity::Dense,
-                &test_settings(),
-                "",
-                false,
-            );
-            let script = build_bids_script(&map);
-            assert!(
-                !script.contains('\u{2028}') && !script.contains('\u{2029}'),
-                "should unicode-escape both U+2028 and U+2029 in the adm"
+            assert_eq!(
+                obj.get("adm").and_then(|v| v.as_str()),
+                Some("<div>Creative</div>"),
+                "should include adm when debug injection is enabled"
             );
         }
 
@@ -7669,13 +4525,7 @@ mod tests {
             );
             winning_bids.insert("atf_sidebar_ad".to_string(), bid);
 
-            let map = build_bid_map(
-                &winning_bids,
-                PriceGranularity::Dense,
-                &test_settings(),
-                "",
-                true,
-            );
+            let map = build_bid_map(&winning_bids, PriceGranularity::Dense, true);
             let obj = map
                 .get("atf_sidebar_ad")
                 .expect("should have bid entry")
@@ -7729,20 +4579,17 @@ mod tests {
                     height: 250,
                     nurl: None,
                     burl: None,
+                    bid_id: None,
                     ad_id: Some("bid-impression-id".to_string()),
+                    creative_id: None,
+                    renderer: None,
                     cache_id: Some("f47447a0-b759-4f2f-9887-af458b79b570".to_string()),
                     cache_host: Some("openads.adsrvr.org".to_string()),
                     cache_path: Some("/cache".to_string()),
                     metadata: Default::default(),
                 },
             );
-            let map = build_bid_map(
-                &winning_bids,
-                PriceGranularity::Dense,
-                &test_settings(),
-                "",
-                false,
-            );
+            let map = build_bid_map(&winning_bids, PriceGranularity::Dense, false);
             let obj = map
                 .get("atf_sidebar_ad")
                 .expect("should have bid entry")
@@ -7776,25 +4623,22 @@ mod tests {
                     currency: "USD".to_string(),
                     creative: None,
                     adomain: None,
-                    bidder: "amazon-aps".to_string(),
+                    bidder: "ordinary".to_string(),
                     width: 300,
                     height: 250,
                     nurl: None,
                     burl: None,
-                    ad_id: Some("aps-bid-token".to_string()),
+                    bid_id: None,
+                    ad_id: Some("ordinary-ad-id".to_string()),
+                    creative_id: None,
+                    renderer: None,
                     cache_id: None,
                     cache_host: None,
                     cache_path: None,
                     metadata: Default::default(),
                 },
             );
-            let map = build_bid_map(
-                &winning_bids,
-                PriceGranularity::Dense,
-                &test_settings(),
-                "",
-                false,
-            );
+            let map = build_bid_map(&winning_bids, PriceGranularity::Dense, false);
             let obj = map
                 .get("atf_sidebar_ad")
                 .expect("should have bid entry")
@@ -7802,7 +4646,7 @@ mod tests {
                 .expect("should be object");
             assert_eq!(
                 obj.get("hb_adid").and_then(|v| v.as_str()),
-                Some("aps-bid-token"),
+                Some("ordinary-ad-id"),
                 "should fall back to ad_id when cache_id absent"
             );
             assert!(
@@ -7826,25 +4670,22 @@ mod tests {
                     currency: "USD".to_string(),
                     creative: None,
                     adomain: None,
-                    bidder: "amazon-aps".to_string(),
+                    bidder: "ordinary".to_string(),
                     width: 300,
                     height: 250,
                     nurl: None,
                     burl: None,
+                    bid_id: None,
                     ad_id: None,
+                    creative_id: None,
+                    renderer: None,
                     cache_id: None,
                     cache_host: None,
                     cache_path: None,
                     metadata: Default::default(),
                 },
             );
-            let map = build_bid_map(
-                &winning_bids,
-                PriceGranularity::Dense,
-                &test_settings(),
-                "",
-                false,
-            );
+            let map = build_bid_map(&winning_bids, PriceGranularity::Dense, false);
             let obj = map
                 .get("atf_sidebar_ad")
                 .expect("should have bid entry")
@@ -7872,20 +4713,17 @@ mod tests {
                     height: 250,
                     nurl: None,
                     burl: None,
+                    bid_id: None,
                     ad_id: None,
+                    creative_id: None,
+                    renderer: None,
                     cache_id: None,
                     cache_host: None,
                     cache_path: None,
                     metadata: Default::default(),
                 },
             );
-            let map = build_bid_map(
-                &winning_bids,
-                PriceGranularity::Dense,
-                &test_settings(),
-                "",
-                false,
-            );
+            let map = build_bid_map(&winning_bids, PriceGranularity::Dense, false);
             assert!(
                 map.is_empty(),
                 "slot with no price should be excluded from bid map"
@@ -7943,7 +4781,6 @@ mod tests {
                 None,
                 &ConsentContext::default(),
                 &request_info,
-                "publisher.example.com",
                 Some("Mozilla/5.0"),
             );
 
@@ -7955,52 +4792,6 @@ mod tests {
             );
         }
 
-        #[test]
-        fn auction_request_uses_configured_publisher_domain_not_edge_host() {
-            // On the SSAT proxy path the browser addresses the trusted-server
-            // edge host, but the auction must advertise the configured
-            // publisher domain to SSPs — otherwise injected creatives and the
-            // brand-safety pixel leak the edge/staging host.
-            let slot = make_slot();
-            let slots = [slot];
-            let slots_ctx = MatchedSlotsContext {
-                matched_slots: &slots,
-                request_path: "/2024/01/my-article/?edition=fictional",
-            };
-            let request_info = RequestInfo {
-                host: "ts.example.com".to_string(),
-                scheme: "https".to_string(),
-            };
-
-            let request = build_auction_request(
-                &slots_ctx,
-                None,
-                &ConsentContext::default(),
-                &request_info,
-                "www.example.com",
-                Some("Mozilla/5.0"),
-            );
-
-            assert_eq!(
-                request.publisher.domain, "www.example.com",
-                "publisher.domain should be the configured publisher domain, not the edge host"
-            );
-            let site = request.site.expect("should populate site metadata");
-            assert_eq!(
-                site.domain, "www.example.com",
-                "site.domain should be the configured publisher domain, not the edge host"
-            );
-            assert_eq!(
-                request.publisher.page_url.as_deref(),
-                Some("https://www.example.com/2024/01/my-article/?edition=fictional"),
-                "page_url host should be the configured publisher domain, not the edge host"
-            );
-            assert_eq!(
-                site.page, "https://www.example.com/2024/01/my-article/?edition=fictional",
-                "site.page host should be the configured publisher domain, not the edge host"
-            );
-        }
-
         #[test]
         fn auction_request_with_ec_id_sets_user_id_and_ec_request_id() {
             let slot = make_slot();
@@ -8019,7 +4810,6 @@ mod tests {
                 Some("ec-abc"),
                 &ConsentContext::default(),
                 &request_info,
-                "publisher.example.com",
                 Some("Mozilla/5.0"),
             );
 
@@ -8539,303 +5329,4 @@ mod tests {
             "should report the buffer cap in the error message"
         );
     }
-
-    /// Handler-level coverage that both navigation paths take the publisher
-    /// identity from configuration rather than the incoming edge `Host` header.
-    ///
-    /// The `build_auction_request` unit test above cannot catch a call site
-    /// regressing to `request_info.host`, because both sources are `&str`. These
-    /// tests drive the real handlers with a divergent edge host and assert on
-    /// the auction request the orchestrator dispatched and on the telemetry rows
-    /// the handler emitted.
-    mod navigation_publisher_domain_tests {
-        use super::*;
-        use crate::auction::provider::AuctionProvider;
-        use crate::auction::telemetry::{AuctionEventBatch, AuctionTelemetrySink};
-        use crate::auction::types::AuctionRequest;
-        use crate::auction::{AuctionContext, AuctionOrchestrator};
-        use crate::creative_opportunities::{CreativeOpportunityFormat, CreativeOpportunitySlot};
-        use crate::platform::test_support::{
-            NoopConfigStore, NoopGeo, NoopSecretStore, StubBackend,
-        };
-        use crate::platform::{ClientInfo, PlatformPendingRequest, PlatformResponse};
-        use crate::test_support::tests::crate_test_settings_str;
-        use std::sync::Mutex;
-
-        /// Trusted-server edge host the browser addresses on the SSAT proxy
-        /// path — deliberately different from the configured publisher domain.
-        const EDGE_HOST: &str = "ts.example.com";
-
-        /// `[publisher] domain` from [`crate_test_settings_str`].
-        const CONFIGURED_DOMAIN: &str = "test-publisher.com";
-
-        const CAPTURING_PROVIDER: &str = "request_capturing_provider";
-
-        /// Records the [`AuctionRequest`] the orchestrator dispatched, then
-        /// fails its launch so no real transport handle is needed.
-        struct RequestCapturingProvider {
-            captured: Arc<Mutex<Option<AuctionRequest>>>,
-        }
-
-        #[async_trait::async_trait(?Send)]
-        impl AuctionProvider for RequestCapturingProvider {
-            fn provider_name(&self) -> &'static str {
-                CAPTURING_PROVIDER
-            }
-
-            async fn request_bids(
-                &self,
-                request: &AuctionRequest,
-                _context: &AuctionContext<'_>,
-            ) -> Result<PlatformPendingRequest, Report<TrustedServerError>> {
-                *self.captured.lock().expect("should lock captured request") =
-                    Some(request.clone());
-                Err(Report::new(TrustedServerError::Auction {
-                    message: "capture only".to_string(),
-                }))
-            }
-
-            async fn parse_response(
-                &self,
-                _response: PlatformResponse,
-                _response_time_ms: u64,
-            ) -> Result<AuctionResponse, Report<TrustedServerError>> {
-                panic!("parse_response must not run when the launch fails");
-            }
-
-            fn timeout_ms(&self) -> u32 {
-                100
-            }
-
-            fn backend_name(
-                &self,
-                _services: &RuntimeServices,
-                _timeout_ms: u32,
-            ) -> Option<String> {
-                Some("capture-backend".to_string())
-            }
-        }
-
-        #[derive(Default)]
-        struct RecordingTelemetrySink {
-            batches: Mutex<Vec<AuctionEventBatch>>,
-        }
-
-        #[async_trait::async_trait(?Send)]
-        impl AuctionTelemetrySink for RecordingTelemetrySink {
-            async fn emit_auction_events(
-                &self,
-                _services: &RuntimeServices,
-                batch: AuctionEventBatch,
-            ) -> Result<(), Report<TrustedServerError>> {
-                self.batches
-                    .lock()
-                    .expect("should lock telemetry batches")
-                    .push(batch);
-                Ok(())
-            }
-        }
-
-        fn settings_with_capturing_provider() -> Settings {
-            let toml = format!(
-                "{}\n[auction]\nenabled = true\nproviders = [\"{CAPTURING_PROVIDER}\"]\n\n\
-                 [creative_opportunities]\ngam_network_id = \"12345\"\n",
-                crate_test_settings_str()
-            );
-            Settings::from_toml(&toml).expect("should parse settings with a capturing provider")
-        }
-
-        fn article_slot() -> Vec<CreativeOpportunitySlot> {
-            vec![CreativeOpportunitySlot {
-                id: "atf".to_string(),
-                gam_unit_path: None,
-                div_id: None,
-                page_patterns: vec!["/20**".to_string()],
-                formats: vec![CreativeOpportunityFormat {
-                    width: 300,
-                    height: 250,
-                    media_type: MediaType::Banner,
-                }],
-                floor_price: Some(0.50),
-                targeting: Default::default(),
-                providers: Default::default(),
-                compiled_patterns: Vec::new(),
-            }]
-        }
-
-        /// [`EcContext`] whose consent context permits the server-side auction.
-        fn consent_allowing_ec_context() -> EcContext {
-            let consent = crate::consent::ConsentContext {
-                jurisdiction: crate::consent::jurisdiction::Jurisdiction::NonRegulated,
-                ..Default::default()
-            };
-            EcContext::new_for_test(None, consent)
-        }
-
-        fn services_with(
-            http_client: Arc<dyn crate::platform::PlatformHttpClient>,
-            telemetry_sink: Arc<RecordingTelemetrySink>,
-        ) -> RuntimeServices {
-            let telemetry_sink: Arc<dyn AuctionTelemetrySink> = telemetry_sink;
-            RuntimeServices::builder()
-                .config_store(Arc::new(NoopConfigStore))
-                .secret_store(Arc::new(NoopSecretStore))
-                .kv_store(Arc::new(edgezero_core::key_value_store::NoopKvStore))
-                .backend(Arc::new(StubBackend))
-                .http_client(http_client)
-                .geo(Arc::new(NoopGeo))
-                .auction_telemetry_sink(telemetry_sink)
-                .client_info(ClientInfo::default())
-                .build()
-        }
-
-        fn orchestrator_capturing_request(
-            settings: &Settings,
-            captured: &Arc<Mutex<Option<AuctionRequest>>>,
-        ) -> AuctionOrchestrator {
-            let mut orchestrator = AuctionOrchestrator::new(settings.auction.clone());
-            orchestrator.register_provider(Arc::new(RequestCapturingProvider {
-                captured: Arc::clone(captured),
-            }));
-            orchestrator
-        }
-
-        /// Assert the dispatched request and every emitted telemetry row carry
-        /// the configured publisher domain rather than the edge host.
-        fn assert_configured_domain(
-            captured: &Arc<Mutex<Option<AuctionRequest>>>,
-            telemetry_sink: &RecordingTelemetrySink,
-        ) {
-            let request = captured
-                .lock()
-                .expect("should lock captured request")
-                .clone()
-                .expect("should dispatch an auction request");
-            assert_eq!(
-                request.publisher.domain, CONFIGURED_DOMAIN,
-                "publisher.domain should be the configured publisher domain, not the edge host"
-            );
-            let site = request.site.expect("should populate site metadata");
-            assert_eq!(
-                site.domain, CONFIGURED_DOMAIN,
-                "site.domain should be the configured publisher domain, not the edge host"
-            );
-            // Only the host is asserted: the two `AuctionRequest` builders still
-            // disagree on where the scheme comes from (edge-detected here,
-            // canonical `https` in `convert_tsjs_to_auction_request`), which is
-            // tracked separately.
-            let page_url = request
-                .publisher
-                .page_url
-                .as_deref()
-                .expect("should populate page_url");
-            let page_url_host = url::Url::parse(page_url)
-                .expect("should build a parseable page_url")
-                .host_str()
-                .map(str::to_owned)
-                .expect("should populate a page_url host");
-            assert_eq!(
-                page_url_host, CONFIGURED_DOMAIN,
-                "page_url host should be the configured publisher domain, not the edge host"
-            );
-            assert_eq!(
-                site.page, page_url,
-                "site.page should mirror page_url, so it carries the configured publisher domain too"
-            );
-
-            let batches = telemetry_sink
-                .batches
-                .lock()
-                .expect("should lock telemetry batches");
-            let rows: Vec<_> = batches.iter().flat_map(AuctionEventBatch::rows).collect();
-            assert!(!rows.is_empty(), "should emit at least one telemetry row");
-            for row in rows {
-                assert_eq!(
-                    row.publisher_domain, CONFIGURED_DOMAIN,
-                    "telemetry rows should be attributed to the configured publisher domain, not the edge host"
-                );
-            }
-        }
-
-        #[tokio::test]
-        async fn initial_navigation_advertises_configured_publisher_domain() {
-            let settings = settings_with_capturing_provider();
-            let captured = Arc::new(Mutex::new(None));
-            let orchestrator = orchestrator_capturing_request(&settings, &captured);
-            let telemetry_sink = Arc::new(RecordingTelemetrySink::default());
-            let stub = Arc::new(StubHttpClient::new());
-            stub.push_response(200, b"<html><head></head><body>ok</body></html>".to_vec());
-            let services = services_with(
-                Arc::clone(&stub) as Arc<dyn crate::platform::PlatformHttpClient>,
-                Arc::clone(&telemetry_sink),
-            );
-            let mut ec_context = consent_allowing_ec_context();
-            let req = HttpRequest::builder()
-                .method(Method::GET)
-                .uri(format!("https://{EDGE_HOST}/2024/01/my-article/"))
-                .header(header::HOST, EDGE_HOST)
-                .header("sec-fetch-dest", "document")
-                .body(EdgeBody::empty())
-                .expect("should build test request");
-
-            let _ = handle_publisher_request(
-                &settings,
-                &services,
-                None,
-                &mut ec_context,
-                AuctionDispatch {
-                    orchestrator: &orchestrator,
-                    slots: &article_slot(),
-                    registry: None,
-                },
-                req,
-            )
-            .await
-            .expect("should proxy publisher request");
-
-            assert_configured_domain(&captured, &telemetry_sink);
-        }
-
-        #[tokio::test]
-        async fn page_bids_advertises_configured_publisher_domain() {
-            let settings = settings_with_capturing_provider();
-            let captured = Arc::new(Mutex::new(None));
-            let orchestrator = orchestrator_capturing_request(&settings, &captured);
-            let telemetry_sink = Arc::new(RecordingTelemetrySink::default());
-            let services = services_with(
-                Arc::new(crate::platform::test_support::NoopHttpClient),
-                Arc::clone(&telemetry_sink),
-            );
-            let ec_context = consent_allowing_ec_context();
-            let mut req = HttpRequest::builder()
-                .method(Method::GET)
-                .uri(format!(
-                    "https://{EDGE_HOST}/_ts/page-bids?path=/2024/01/my-article/"
-                ))
-                .header(header::HOST, EDGE_HOST)
-                .body(EdgeBody::empty())
-                .expect("should build test request");
-            req.headers_mut().insert(
-                header::HeaderName::from_static("sec-fetch-site"),
-                HeaderValue::from_static("same-origin"),
-            );
-
-            let _ = handle_page_bids(
-                &settings,
-                &services,
-                None,
-                AuctionDispatch {
-                    orchestrator: &orchestrator,
-                    slots: &article_slot(),
-                    registry: None,
-                },
-                &ec_context,
-                req,
-            )
-            .await
-            .expect("should return ok response");
-
-            assert_configured_domain(&captured, &telemetry_sink);
-        }
-    }
 }
diff --git a/crates/trusted-server-integration-tests/README.md b/crates/trusted-server-integration-tests/README.md
index e7263755d..1aa43cee4 100644
--- a/crates/trusted-server-integration-tests/README.md
+++ b/crates/trusted-server-integration-tests/README.md
@@ -142,6 +142,7 @@ Playwright directly.
 |---|---|
 | `script-injection` | `script#trustedserver-js` present in live DOM, no console errors |
 | `script-bundle` | JS bundle loads with 200, no parse/runtime errors, correct content type |
+| `aps-renderer` | Static route nonce gating, restrictive CSP, replay rejection, and opaque iframe/script isolation |
 
 ### Browser-level — Next.js
 
diff --git a/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts b/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts
new file mode 100644
index 000000000..bbefc7dfb
--- /dev/null
+++ b/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts
@@ -0,0 +1,614 @@
+import { expect, test } from "@playwright/test";
+import { runtimeUrl } from "../../helpers/state.js";
+
+const RUNNER_URL = "https://client.aps.amazon-adsystem.com/prebid-creative.js";
+const IFRAME_CREATIVE_URL = "https://creative.example/iframe";
+const SCRIPT_CREATIVE_URL = "https://creative.example/script.js";
+const SANDBOX =
+    "allow-forms allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-scripts allow-top-navigation-by-user-activation";
+
+function descriptor(
+    tagType: "iframe" | "script",
+    creativeUrl =
+        tagType === "iframe" ? IFRAME_CREATIVE_URL : SCRIPT_CREATIVE_URL,
+) {
+    const envelope = {
+        seatbid: [
+            {
+                bid: [
+                    {
+                        id: `fictional-${tagType}-bid`,
+                        price: 1.23,
+                        w: 300,
+                        h: 250,
+                        ext: { creativeurl: creativeUrl, tagtype: tagType },
+                    },
+                ],
+            },
+        ],
+    };
+    return {
+        type: "aps",
+        version: 1,
+        accountId: "example-account-id",
+        bidId: `fictional-${tagType}-bid`,
+        creativeId: `fictional-${tagType}-creative`,
+        tagType,
+        creativeUrl,
+        aaxResponse: Buffer.from(JSON.stringify(envelope), "utf8").toString(
+            "base64",
+        ),
+        width: 300,
+        height: 250,
+    };
+}
+
+function testPage(rendererUrl: string) {
+    return `<!doctype html>
+<meta charset="utf-8">
+<div id="slots"></div>
+<script>
+window.apsMessages = [];
+window.startApsFrame = function(options) {
+  var slot = document.createElement('div');
+  slot.id = options.slotId;
+  slot.innerHTML = '<span class="existing">existing publisher content</span>';
+  document.getElementById('slots').appendChild(slot);
+
+  var frame = document.createElement('iframe');
+  frame.width = '300';
+  frame.height = '250';
+  frame.style.display = 'none';
+  if (!options.omitSandbox) {
+    frame.setAttribute('sandbox', ${JSON.stringify(SANDBOX)});
+  }
+  frame.src = ${JSON.stringify(rendererUrl)} +
+    (options.includeFragment === false ? '' : '#tsaps=' + options.fragmentNonce);
+
+  function receive(event) {
+    if (event.source !== frame.contentWindow || !event.data) return;
+    window.apsMessages.push({ slotId: options.slotId, data: event.data });
+    if (event.data.message === 'trusted-server/aps/renderer-ready' &&
+        event.data.nonce === options.fragmentNonce) {
+      var existing = slot.querySelector('.existing');
+      if (existing) existing.remove();
+      frame.style.display = '';
+    }
+  }
+  window.addEventListener('message', receive);
+  frame.onload = function() {
+    frame.contentWindow.postMessage({
+      nonce: options.messageNonce,
+      renderer: options.renderer
+    }, '*');
+  };
+  slot.appendChild(frame);
+};
+</script>`;
+}
+
+const FAKE_RUNNER = `(function(){
+  var runnerRead = false;
+  var runnerWrite = false;
+  try { void top.document.body; runnerRead = true; } catch (_error) {}
+  try { top.document.body.dataset.apsCompromised = 'runner'; runnerWrite = true; } catch (_error) {}
+  parent.postMessage({
+    message: 'fictional-runner-security',
+    runnerRead: runnerRead,
+    runnerWrite: runnerWrite,
+    accountMap: window._aps instanceof Map
+  }, '*');
+
+  addEventListener('message', function(event) {
+    if (event.data && event.data.message === 'fictional-creative-security') {
+      parent.postMessage(event.data, '*');
+    }
+  });
+
+  window._aps.forEach(function(account) {
+    var events = account.queue.splice(0);
+    events.forEach(function(event) {
+      var response = JSON.parse(atob(event.detail.aaxResponse));
+      var bid = response.seatbid[0].bid[0];
+      if (bid.ext.tagtype === 'iframe') {
+        var frame = document.createElement('iframe');
+        frame.setAttribute('sandbox', 'allow-scripts allow-same-origin');
+        frame.src = bid.ext.creativeurl;
+        document.body.appendChild(frame);
+      } else {
+        var script = document.createElement('script');
+        script.src = bid.ext.creativeurl;
+        document.head.appendChild(script);
+      }
+    });
+  });
+})();`;
+
+const IFRAME_CREATIVE = `<!doctype html><script>
+var creativeRead = false;
+var creativeWrite = false;
+try { void top.document.body; creativeRead = true; } catch (_error) {}
+try { top.document.body.dataset.apsCompromised = 'iframe'; creativeWrite = true; } catch (_error) {}
+parent.postMessage({
+  message: 'fictional-creative-security',
+  tagType: 'iframe',
+  creativeRead: creativeRead,
+  creativeWrite: creativeWrite
+}, '*');
+<\/script>`;
+
+const SCRIPT_CREATIVE = `(function(){
+  var creativeRead = false;
+  var creativeWrite = false;
+  try { void top.document.body; creativeRead = true; } catch (_error) {}
+  try { top.document.body.dataset.apsCompromised = 'script'; creativeWrite = true; } catch (_error) {}
+  parent.postMessage({
+    message: 'fictional-creative-security',
+    tagType: 'script',
+    creativeRead: creativeRead,
+    creativeWrite: creativeWrite
+  }, '*');
+})();`;
+
+test.describe("APS opaque renderer", () => {
+    test("enforces nonce gating and isolates iframe and script behavior under restrictive CSP", async ({
+        page,
+    }) => {
+        const rendererResponse = await page.request.get(
+            runtimeUrl("/integrations/aps/renderer"),
+        );
+        expect(rendererResponse.status()).toBe(200);
+        expect(rendererResponse.headers()["content-type"]).toContain(
+            "text/html",
+        );
+        const rendererCsp =
+            rendererResponse.headers()["content-security-policy"];
+        expect(rendererCsp).toContain("default-src 'none'");
+        expect(rendererCsp).toContain("sandbox allow-forms");
+        expect(rendererCsp).not.toContain("allow-same-origin");
+        expect(rendererResponse.headers()["referrer-policy"]).toBe(
+            "no-referrer",
+        );
+
+        let runnerRequests = 0;
+        await page.route(RUNNER_URL, async (route) => {
+            runnerRequests += 1;
+            await route.fulfill({
+                status: 200,
+                contentType: "application/javascript",
+                body: FAKE_RUNNER,
+            });
+        });
+        await page.route(IFRAME_CREATIVE_URL, async (route) => {
+            await route.fulfill({
+                status: 200,
+                contentType: "text/html",
+                body: IFRAME_CREATIVE,
+            });
+        });
+        await page.route(SCRIPT_CREATIVE_URL, async (route) => {
+            await route.fulfill({
+                status: 200,
+                contentType: "application/javascript",
+                body: SCRIPT_CREATIVE,
+            });
+        });
+        await page.route(runtimeUrl("/aps-security-test"), async (route) => {
+            await route.fulfill({
+                status: 200,
+                contentType: "text/html",
+                headers: {
+                    "Content-Security-Policy":
+                        "default-src 'none'; script-src 'unsafe-inline'; frame-src 'self'",
+                },
+                body: testPage(
+                    runtimeUrl("/integrations/aps/renderer"),
+                ),
+            });
+        });
+
+        await page.goto(runtimeUrl("/aps-security-test"));
+
+        const validNonce = "ABCDEFGHIJKLMNOPQRSTUV";
+        await page.evaluate(
+            ({ renderer, nonce }) => {
+                (
+                    window as unknown as {
+                        startApsFrame(options: Record<string, unknown>): void;
+                    }
+                ).startApsFrame({
+                    slotId: "iframe-slot",
+                    fragmentNonce: nonce,
+                    messageNonce: nonce,
+                    renderer,
+                });
+            },
+            { renderer: descriptor("iframe"), nonce: validNonce },
+        );
+
+        await expect
+            .poll(async () =>
+                page.evaluate(() =>
+                    (
+                        window as unknown as {
+                            apsMessages: Array<{ data: { message?: string } }>;
+                        }
+                    ).apsMessages.some(
+                        ({ data }) =>
+                            data.message === "fictional-creative-security",
+                    ),
+                ),
+            )
+            .toBe(true);
+        await expect(page.locator("#iframe-slot .existing")).toHaveCount(0);
+
+        const validState = await page.evaluate(() => {
+            const frame = document.querySelector<HTMLIFrameElement>(
+                "#iframe-slot iframe",
+            )!;
+            const messages = (
+                window as unknown as {
+                    apsMessages: Array<{ data: Record<string, unknown> }>;
+                }
+            ).apsMessages.map(({ data }) => data);
+            let publisherCanReadFrame = false;
+            try {
+                publisherCanReadFrame = Boolean(
+                    frame.contentWindow?.document.body,
+                );
+            } catch (_error) {
+                publisherCanReadFrame = false;
+            }
+            return {
+                existing: Boolean(
+                    document.querySelector("#iframe-slot .existing"),
+                ),
+                sandbox: frame.getAttribute("sandbox"),
+                publisherCanReadFrame,
+                compromised: document.body.dataset.apsCompromised,
+                messages,
+            };
+        });
+
+        expect(validState.existing).toBe(false);
+        expect(validState.sandbox).toBe(SANDBOX);
+        expect(validState.sandbox).not.toContain("allow-same-origin");
+        expect(validState.publisherCanReadFrame).toBe(false);
+        expect(validState.compromised).toBeUndefined();
+        expect(validState.messages).toContainEqual(
+            expect.objectContaining({
+                message: "fictional-runner-security",
+                runnerRead: false,
+                runnerWrite: false,
+                accountMap: true,
+            }),
+        );
+        expect(validState.messages).toContainEqual(
+            expect.objectContaining({
+                message: "fictional-creative-security",
+                tagType: "iframe",
+                creativeRead: false,
+                creativeWrite: false,
+            }),
+        );
+
+        const cspNonce = "csp-sandbox-0123456789";
+        await page.evaluate(
+            ({ renderer, nonce }) => {
+                (
+                    window as unknown as {
+                        startApsFrame(options: Record<string, unknown>): void;
+                    }
+                ).startApsFrame({
+                    slotId: "csp-sandbox-slot",
+                    fragmentNonce: nonce,
+                    messageNonce: nonce,
+                    omitSandbox: true,
+                    renderer,
+                });
+            },
+            { renderer: descriptor("script"), nonce: cspNonce },
+        );
+        await expect
+            .poll(async () =>
+                page.evaluate(() =>
+                    (
+                        window as unknown as {
+                            apsMessages: Array<{
+                                slotId: string;
+                                data: Record<string, unknown>;
+                            }>;
+                        }
+                    ).apsMessages.some(
+                        ({ slotId, data }) =>
+                            slotId === "csp-sandbox-slot" &&
+                            data.message === "fictional-creative-security" &&
+                            data.tagType === "script",
+                    ),
+                ),
+            )
+            .toBe(true);
+        await expect(page.locator("#csp-sandbox-slot .existing")).toHaveCount(
+            0,
+        );
+        const cspState = await page.evaluate(() => {
+            const frame = document.querySelector<HTMLIFrameElement>(
+                "#csp-sandbox-slot iframe",
+            )!;
+            let publisherCanReadFrame = false;
+            try {
+                publisherCanReadFrame = Boolean(
+                    frame.contentWindow?.document.body,
+                );
+            } catch (_error) {
+                publisherCanReadFrame = false;
+            }
+            return {
+                sandbox: frame.getAttribute("sandbox"),
+                existing: Boolean(
+                    document.querySelector("#csp-sandbox-slot .existing"),
+                ),
+                publisherCanReadFrame,
+                compromised: document.body.dataset.apsCompromised,
+                messages: (
+                    window as unknown as {
+                        apsMessages: Array<{
+                            slotId: string;
+                            data: Record<string, unknown>;
+                        }>;
+                    }
+                ).apsMessages
+                    .filter(({ slotId }) => slotId === "csp-sandbox-slot")
+                    .map(({ data }) => data),
+            };
+        });
+        expect(cspState.sandbox).toBeNull();
+        expect(cspState.existing).toBe(false);
+        expect(cspState.publisherCanReadFrame).toBe(false);
+        expect(cspState.compromised).toBeUndefined();
+        expect(cspState.messages).toContainEqual(
+            expect.objectContaining({
+                message: "fictional-runner-security",
+                runnerRead: false,
+                runnerWrite: false,
+            }),
+        );
+        expect(cspState.messages).toContainEqual(
+            expect.objectContaining({
+                message: "fictional-creative-security",
+                tagType: "script",
+                creativeRead: false,
+                creativeWrite: false,
+            }),
+        );
+
+        const messagesBeforeReplay = await page.evaluate(
+            () =>
+                (
+                    window as unknown as {
+                        apsMessages: Array<{ data: Record<string, unknown> }>;
+                    }
+                ).apsMessages.length,
+        );
+        await page.evaluate(
+            ({ renderer, nonce }) => {
+                const frame = document.querySelector<HTMLIFrameElement>(
+                    "#iframe-slot iframe",
+                )!;
+                frame.contentWindow!.postMessage({ nonce, renderer }, "*");
+            },
+            { renderer: descriptor("iframe"), nonce: validNonce },
+        );
+        await page.waitForTimeout(100);
+        expect(
+            await page.evaluate(
+                () =>
+                    (
+                        window as unknown as {
+                            apsMessages: Array<{
+                                data: Record<string, unknown>;
+                            }>;
+                        }
+                    ).apsMessages.length,
+            ),
+        ).toBe(messagesBeforeReplay);
+
+        const requestsBeforeInvalid = runnerRequests;
+        const wrongNonce = "ZYXWVUTSRQPONMLKJIHGFE";
+        await page.evaluate(
+            ({ renderer, fragmentNonce, messageNonce }) => {
+                (
+                    window as unknown as {
+                        startApsFrame(options: Record<string, unknown>): void;
+                    }
+                ).startApsFrame({
+                    slotId: "mismatch-slot",
+                    fragmentNonce,
+                    messageNonce,
+                    renderer,
+                });
+            },
+            {
+                renderer: descriptor("iframe"),
+                fragmentNonce: validNonce,
+                messageNonce: wrongNonce,
+            },
+        );
+        await page.waitForTimeout(100);
+        expect(runnerRequests).toBe(requestsBeforeInvalid);
+        await expect(page.locator("#mismatch-slot .existing")).toHaveCount(1);
+
+        await page.evaluate(
+            ({ renderer, nonce }) => {
+                (
+                    window as unknown as {
+                        startApsFrame(options: Record<string, unknown>): void;
+                    }
+                ).startApsFrame({
+                    slotId: "missing-fragment-slot",
+                    fragmentNonce: nonce,
+                    messageNonce: nonce,
+                    includeFragment: false,
+                    renderer,
+                });
+            },
+            { renderer: descriptor("iframe"), nonce: validNonce },
+        );
+        await page.waitForTimeout(100);
+        expect(runnerRequests).toBe(requestsBeforeInvalid);
+        await expect(
+            page.locator("#missing-fragment-slot .existing"),
+        ).toHaveCount(1);
+
+        await page.evaluate(
+            ({ renderer, nonce }) => {
+                (
+                    window as unknown as {
+                        startApsFrame(options: Record<string, unknown>): void;
+                    }
+                ).startApsFrame({
+                    slotId: "malformed-slot",
+                    fragmentNonce: nonce,
+                    messageNonce: nonce,
+                    renderer: { ...renderer, unexpected: true },
+                });
+            },
+            { renderer: descriptor("iframe"), nonce: wrongNonce },
+        );
+        await page.waitForTimeout(100);
+        expect(runnerRequests).toBe(requestsBeforeInvalid);
+        await expect(page.locator("#malformed-slot .existing")).toHaveCount(1);
+
+        const scriptNonce = "0123456789abcdefghijkl";
+        await page.evaluate(
+            ({ renderer, nonce }) => {
+                (
+                    window as unknown as {
+                        startApsFrame(options: Record<string, unknown>): void;
+                    }
+                ).startApsFrame({
+                    slotId: "script-slot",
+                    fragmentNonce: nonce,
+                    messageNonce: nonce,
+                    renderer,
+                });
+            },
+            { renderer: descriptor("script"), nonce: scriptNonce },
+        );
+
+        await expect
+            .poll(async () =>
+                page.evaluate(() =>
+                    (
+                        window as unknown as {
+                            apsMessages: Array<{
+                                data: Record<string, unknown>;
+                            }>;
+                        }
+                    ).apsMessages.some(
+                        ({ data }) =>
+                            data.message === "fictional-creative-security" &&
+                            data.tagType === "script",
+                    ),
+                ),
+            )
+            .toBe(true);
+        await expect(page.locator("#script-slot .existing")).toHaveCount(0);
+
+        const scriptState = await page.evaluate(() => ({
+            existing: Boolean(document.querySelector("#script-slot .existing")),
+            compromised: document.body.dataset.apsCompromised,
+            scriptSecurity: (
+                window as unknown as {
+                    apsMessages: Array<{ data: Record<string, unknown> }>;
+                }
+            ).apsMessages.find(
+                ({ data }) =>
+                    data.message === "fictional-creative-security" &&
+                    data.tagType === "script",
+            )?.data,
+        }));
+        expect(scriptState.existing).toBe(false);
+        expect(scriptState.compromised).toBeUndefined();
+        expect(scriptState.scriptSecurity).toEqual(
+            expect.objectContaining({
+                creativeRead: false,
+                creativeWrite: false,
+            }),
+        );
+    });
+
+    test("rejects same-origin creative URLs during static validation", async ({
+        page,
+    }) => {
+        const publisherOrigin = "https://publisher.example";
+        const rendererUrl = `${publisherOrigin}/integrations/aps/renderer`;
+        const testUrl = `${publisherOrigin}/aps-same-origin-test`;
+        const runtimeRenderer = await page.request.get(
+            runtimeUrl("/integrations/aps/renderer"),
+        );
+        const rendererDocument = await runtimeRenderer.text();
+        let runnerRequests = 0;
+
+        await page.route(RUNNER_URL, async (route) => {
+            runnerRequests += 1;
+            await route.fulfill({
+                status: 200,
+                contentType: "application/javascript",
+                body: FAKE_RUNNER,
+            });
+        });
+        await page.route(rendererUrl, async (route) => {
+            await route.fulfill({
+                status: 200,
+                contentType: "text/html",
+                headers: {
+                    "Content-Security-Policy":
+                        runtimeRenderer.headers()["content-security-policy"],
+                    "Referrer-Policy": "no-referrer",
+                },
+                body: rendererDocument,
+            });
+        });
+        await page.route(testUrl, async (route) => {
+            await route.fulfill({
+                status: 200,
+                contentType: "text/html",
+                headers: {
+                    "Content-Security-Policy":
+                        "default-src 'none'; script-src 'unsafe-inline'; frame-src 'self'",
+                },
+                body: testPage(rendererUrl),
+            });
+        });
+
+        await page.goto(testUrl);
+        const nonce = "same-origin-0123456789";
+        await page.evaluate(
+            ({ renderer, nonce }) => {
+                (
+                    window as unknown as {
+                        startApsFrame(options: Record<string, unknown>): void;
+                    }
+                ).startApsFrame({
+                    slotId: "same-origin-slot",
+                    fragmentNonce: nonce,
+                    messageNonce: nonce,
+                    omitSandbox: true,
+                    renderer,
+                });
+            },
+            {
+                renderer: descriptor(
+                    "script",
+                    `${publisherOrigin}/fictional-same-origin.js`,
+                ),
+                nonce,
+            },
+        );
+
+        await page.waitForTimeout(100);
+        expect(runnerRequests).toBe(0);
+        await expect(page.locator("#same-origin-slot .existing")).toHaveCount(1);
+    });
+});
diff --git a/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml b/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
index d6b436a9f..96616e6f5 100644
--- a/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
+++ b/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
@@ -100,10 +100,11 @@ timeout_ms = 2000
 allowed_context_keys = []
 
 [integrations.aps]
-enabled = false
-pub_id = "example-aps-publisher-id"
-endpoint = "https://aps.example.com/e/dtb/bid"
+enabled = true
+account_id = "example-aps-account-id"
+endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 1000
+allow_script_creatives = false
 
 [integrations.google_tag_manager]
 enabled = false
diff --git a/crates/trusted-server-js/lib/src/core/auction.ts b/crates/trusted-server-js/lib/src/core/auction.ts
index 40f54367a..a02684362 100644
--- a/crates/trusted-server-js/lib/src/core/auction.ts
+++ b/crates/trusted-server-js/lib/src/core/auction.ts
@@ -1,8 +1,11 @@
 // Shared auction module: builds AdRequest payloads, sends them to /auction,
-// and parses OpenRTB seatbid responses.  Used by both the core requestAds flow
+// and parses OpenRTB seatbid responses. Used by both the core requestAds flow
 // and the Prebid.js trustedServer adapter.
 
+import { parseApsRendererDescriptor } from '../integrations/aps/render';
+
 import { log } from './log';
+import type { ApsRendererV1 } from './types';
 
 // ---------------------------------------------------------------------------
 // Types
@@ -43,6 +46,8 @@ export interface AuctionBid {
   impid: string;
   /** Creative HTML (already rewritten with proxy URLs by the server). */
   adm: string;
+  /** Typed APS renderer descriptor, when the bid does not carry `adm`. */
+  renderer?: ApsRendererV1;
   /** CPM price. */
   price: number;
   /** Creative width. */
@@ -71,31 +76,31 @@ export interface AuctionBid {
 export function buildAdRequest(units: any[], options?: { eids?: AuctionEid[] }): AdRequest {
   const unitMap = new Map<string, AdRequestUnit>();
 
-  for (const u of units) {
-    const code: string = u.adUnitCode ?? u.code ?? '';
+  for (const unit of units) {
+    const code: string = unit.adUnitCode ?? unit.code ?? '';
     if (!unitMap.has(code)) {
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       const mediaTypes: any = {};
-      if (u.mediaTypes?.banner) {
+      if (unit.mediaTypes?.banner) {
         mediaTypes.banner = {
-          sizes: u.mediaTypes.banner.sizes ?? u.sizes ?? [],
+          sizes: unit.mediaTypes.banner.sizes ?? unit.sizes ?? [],
         };
       }
       unitMap.set(code, { code, mediaTypes, bids: [] });
     }
 
     // If the source object carries a `bidder` field (Prebid BidRequest style),
-    // add it as a bid entry.  Otherwise copy the existing `bids` array.
-    if (u.bidder) {
+    // add it as a bid entry. Otherwise copy the existing `bids` array.
+    if (unit.bidder) {
       unitMap.get(code)!.bids.push({
-        bidder: u.bidder,
-        params: u.params ?? {},
+        bidder: unit.bidder,
+        params: unit.params ?? {},
       });
-    } else if (Array.isArray(u.bids)) {
-      for (const b of u.bids) {
+    } else if (Array.isArray(unit.bids)) {
+      for (const bid of unit.bids) {
         unitMap.get(code)!.bids.push({
-          bidder: b.bidder ?? '',
-          params: b.params ?? {},
+          bidder: bid.bidder ?? '',
+          params: bid.params ?? {},
         });
       }
     }
@@ -115,10 +120,8 @@ export function buildAdRequest(units: any[], options?: { eids?: AuctionEid[] }):
 /**
  * Parse an OpenRTB-style response body into a flat array of {@link AuctionBid}.
  *
- * Expected shape:
- * ```json
- * { "seatbid": [{ "seat": "bidder", "bid": [{ "impid", "price", "adm", ... }] }] }
- * ```
+ * Parsing the renderer here is intentionally structural. The exact decoded
+ * APS envelope is validated immediately before any DOM or message side effect.
  */
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export function parseAuctionResponse(body: any): AuctionBid[] {
@@ -126,26 +129,34 @@ export function parseAuctionResponse(body: any): AuctionBid[] {
   const seatbids = body?.seatbid;
   if (!Array.isArray(seatbids)) return bids;
 
-  for (const sb of seatbids) {
-    const seat: string = sb.seat ?? 'unknown';
-    const sbBids = sb.bid;
-    if (!Array.isArray(sbBids)) continue;
-
-    for (const b of sbBids) {
-      // Coerce missing/null adm to '' so AuctionBid.adm is always a string.
-      // The empty-string case is filtered in renderCreativeInline via the
-      // `if (!bid.adm)` guard. The client-side `typeof !== 'string'` check in
-      // sanitizeCreativeHtml is a second line of defense for callers that bypass
-      // parseAuctionResponse and pass untrusted values directly.
+  for (const seatbid of seatbids) {
+    const seat: string = typeof seatbid?.seat === 'string' ? seatbid.seat : 'unknown';
+    const seatBids = seatbid?.bid;
+    if (!Array.isArray(seatBids)) continue;
+
+    for (const bid of seatBids) {
+      const impid = typeof bid?.impid === 'string' ? bid.impid : '';
+      const renderer = parseApsRendererDescriptor(bid?.ext?.trusted_server?.renderer);
+      const width = typeof bid?.w === 'number' ? bid.w : (renderer?.width ?? 300);
+      const height = typeof bid?.h === 'number' ? bid.h : (renderer?.height ?? 250);
+      const creativeId =
+        typeof bid?.crid === 'string' ? bid.crid : (renderer?.creativeId ?? `${seat}-${impid}`);
+
       bids.push({
-        impid: b.impid ?? '',
-        adm: b.adm ?? '',
-        price: b.price ?? 0,
-        width: b.w ?? 300,
-        height: b.h ?? 250,
+        impid,
+        // Preserve non-string untrusted values so the render-time sanitizer
+        // rejects them explicitly instead of silently converting them to an
+        // empty no-op creative.
+        adm: bid?.adm ?? '',
+        ...(renderer ? { renderer } : {}),
+        price: typeof bid?.price === 'number' ? bid.price : 0,
+        width,
+        height,
         seat,
-        creativeId: b.crid ?? `${seat}-${b.impid ?? ''}`,
-        adomain: Array.isArray(b.adomain) ? b.adomain : [],
+        creativeId,
+        adomain: Array.isArray(bid?.adomain)
+          ? bid.adomain.filter((domain: unknown): domain is string => typeof domain === 'string')
+          : [],
       });
     }
   }
@@ -170,7 +181,7 @@ export async function sendAuction(endpoint: string, request: AdRequest): Promise
   log.info('auction: sending request', { endpoint, units: request.adUnits.length });
 
   try {
-    const res = await fetch(endpoint, {
+    const response = await fetch(endpoint, {
       method: 'POST',
       headers: { 'content-type': 'application/json' },
       credentials: 'same-origin',
@@ -178,18 +189,22 @@ export async function sendAuction(endpoint: string, request: AdRequest): Promise
       keepalive: true,
     });
 
-    const ct = res.headers.get('content-type') || '';
-    if (res.ok && ct.includes('application/json')) {
-      const data: unknown = await res.json();
+    const contentType = response.headers.get('content-type') || '';
+    if (response.ok && contentType.includes('application/json')) {
+      const data: unknown = await response.json();
       const bids = parseAuctionResponse(data);
       log.info('auction: received bids', { count: bids.length });
       return bids;
     }
 
-    log.warn('auction: unexpected response', { ok: res.ok, status: res.status, ct });
+    log.warn('auction: unexpected response', {
+      ok: response.ok,
+      status: response.status,
+      ct: contentType,
+    });
     return [];
-  } catch (err) {
-    log.warn('auction: request failed', err);
+  } catch (error) {
+    log.warn('auction: request failed', error);
     return [];
   }
 }
diff --git a/crates/trusted-server-js/lib/src/core/request.ts b/crates/trusted-server-js/lib/src/core/request.ts
index e39300a14..ae352c58a 100644
--- a/crates/trusted-server-js/lib/src/core/request.ts
+++ b/crates/trusted-server-js/lib/src/core/request.ts
@@ -1,9 +1,11 @@
 // Request orchestration for tsjs: unified auction endpoint with iframe-based creative rendering.
-import { log } from './log';
+import { renderApsCreative } from '../integrations/aps/render';
+
+import { buildAdRequest, sendAuction } from './auction';
 import { collectContext } from './context';
+import { log } from './log';
 import { getAllUnits, firstSize } from './registry';
 import { createAdIframe, findSlot, buildCreativeDocument, sanitizeCreativeHtml } from './render';
-import { buildAdRequest, sendAuction } from './auction';
 
 export type RequestAdsCallback = () => void;
 export interface RequestAdsOptions {
@@ -49,6 +51,10 @@ export function requestAds(
         log.info('requestAds: got bids', { count: bids.length });
         for (const bid of bids) {
           if (!bid.impid) continue;
+          if (bid.renderer) {
+            renderApsCreative({ slotId: bid.impid, renderer: bid.renderer });
+            continue;
+          }
           if (!bid.adm) {
             log.debug('requestAds: bid has no adm, skipping', { slotId: bid.impid });
             continue;
diff --git a/crates/trusted-server-js/lib/src/core/types.ts b/crates/trusted-server-js/lib/src/core/types.ts
index 6de6959db..ffa5c1ed3 100644
--- a/crates/trusted-server-js/lib/src/core/types.ts
+++ b/crates/trusted-server-js/lib/src/core/types.ts
@@ -41,13 +41,33 @@ export interface AuctionDebugBidData {
   height?: number;
   nurl?: string | null;
   burl?: string | null;
+  bid_id?: string | null;
   ad_id?: string | null;
+  creative_id?: string | null;
   cache_id?: string | null;
   cache_host?: string | null;
   cache_path?: string | null;
   metadata?: Record<string, unknown>;
 }
 
+export type ApsTagType = 'iframe' | 'script';
+
+/** Version 1 Trusted Server APS renderer descriptor. */
+export interface ApsRendererV1 {
+  type: 'aps';
+  version: 1;
+  accountId: string;
+  bidId: string;
+  creativeId?: string;
+  tagType: ApsTagType;
+  creativeUrl: string;
+  aaxResponse: string;
+  width: number;
+  height: number;
+}
+
+export type AuctionBidRenderer = ApsRendererV1;
+
 /** Bid targeting data from the server-side auction, injected into `window.tsjs.bids`. */
 export interface AuctionBidData {
   hb_pb?: string;
@@ -55,27 +75,13 @@ export interface AuctionBidData {
   hb_adid?: string;
   hb_cache_host?: string;
   hb_cache_path?: string;
-  /** Winning creative width; the bridge sizes the inline render from this. */
-  w?: number;
-  /** Winning creative height; the bridge sizes the inline render from this. */
-  h?: number;
   nurl?: string;
   burl?: string;
-  /**
-   * Sanitized winning creative markup for local rendering through the pbRender
-   * bridge. Present whenever the winning bid carried a creative that passed the
-   * server-side sanitize/rewrite boundary; absent when there was no creative or
-   * it was rejected (e.g. over the 1 MiB cap), in which case the bridge falls
-   * back to the PBS Cache coordinates. This is NOT gated by
-   * `inject_adm_for_testing`.
-   */
+  /** Typed winning-bid renderer capability. */
+  renderer?: AuctionBidRenderer;
+  /** Raw creative markup. Only present when `[debug] inject_adm_for_testing = true`. */
   adm?: string;
-  /**
-   * Verbose per-bid debug blob (carries the raw, un-sanitized creative among
-   * other fields). Only present when `[debug] inject_adm_for_testing = true`;
-   * its presence is also the client-side gate for the testing-only direct
-   * GAM-replace path.
-   */
+  /** Debug-only bid field mirror. Only present when `[debug] inject_adm_for_testing = true`. */
   debug_bid?: AuctionDebugBidData;
 }
 
diff --git a/crates/trusted-server-js/lib/src/integrations/aps/render.ts b/crates/trusted-server-js/lib/src/integrations/aps/render.ts
new file mode 100644
index 000000000..f9e6b03b9
--- /dev/null
+++ b/crates/trusted-server-js/lib/src/integrations/aps/render.ts
@@ -0,0 +1,301 @@
+import { log } from '../../core/log';
+import type { ApsRendererV1 } from '../../core/types';
+
+export const APS_RENDERER_PATH = '/integrations/aps/renderer';
+export const APS_RENDERER_SANDBOX =
+  'allow-forms allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-scripts allow-top-navigation-by-user-activation';
+export const APS_UNIVERSAL_CREATIVE_RENDERER_VERSION = 4;
+
+const MAX_ACCOUNT_ID_BYTES = 1024;
+const MAX_CREATIVE_URL_BYTES = 4096;
+const MAX_RENDER_ENVELOPE_BYTES = 256 * 1024;
+const MAX_RENDER_ENVELOPE_BASE64_BYTES = 4 * Math.ceil(MAX_RENDER_ENVELOPE_BYTES / 3);
+const DESCRIPTOR_KEYS = [
+  'aaxResponse',
+  'accountId',
+  'bidId',
+  'creativeUrl',
+  'height',
+  'tagType',
+  'type',
+  'version',
+  'width',
+] as const;
+const DESCRIPTOR_KEYS_WITH_CREATIVE_ID = [...DESCRIPTOR_KEYS, 'creativeId'].sort();
+const activeFrames = new WeakMap<HTMLElement, HTMLIFrameElement>();
+const RENDERER_READY_MESSAGE = 'trusted-server/aps/renderer-ready';
+const RENDERER_FAILED_MESSAGE = 'trusted-server/aps/renderer-failed';
+const RENDERER_READY_TIMEOUT_MS = 10_000;
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function hasExactKeys(
+  value: unknown,
+  expected: readonly string[]
+): value is Record<string, unknown> {
+  if (!isRecord(value)) return false;
+  const actual = Object.keys(value).sort();
+  const sortedExpected = [...expected].sort();
+  return (
+    actual.length === sortedExpected.length &&
+    actual.every((key, index) => key === sortedExpected[index])
+  );
+}
+
+/** Parse only the versioned descriptor shape; decoded-envelope trust checks happen separately. */
+export function parseApsRendererDescriptor(value: unknown): ApsRendererV1 | undefined {
+  if (
+    !hasExactKeys(value, DESCRIPTOR_KEYS) &&
+    !hasExactKeys(value, DESCRIPTOR_KEYS_WITH_CREATIVE_ID)
+  ) {
+    return undefined;
+  }
+
+  if (
+    value.type !== 'aps' ||
+    value.version !== 1 ||
+    typeof value.accountId !== 'string' ||
+    value.accountId.length === 0 ||
+    new TextEncoder().encode(value.accountId).length > MAX_ACCOUNT_ID_BYTES ||
+    typeof value.bidId !== 'string' ||
+    value.bidId.length === 0 ||
+    (Object.prototype.hasOwnProperty.call(value, 'creativeId') &&
+      (typeof value.creativeId !== 'string' || value.creativeId.length === 0)) ||
+    (value.tagType !== 'iframe' && value.tagType !== 'script') ||
+    typeof value.creativeUrl !== 'string' ||
+    typeof value.aaxResponse !== 'string' ||
+    value.aaxResponse.length > MAX_RENDER_ENVELOPE_BASE64_BYTES ||
+    !Number.isSafeInteger(value.width) ||
+    (value.width as number) <= 0 ||
+    !Number.isSafeInteger(value.height) ||
+    (value.height as number) <= 0
+  ) {
+    return undefined;
+  }
+
+  return value as unknown as ApsRendererV1;
+}
+
+function decodeStandardBase64(value: string): Uint8Array | undefined {
+  if (
+    value.length === 0 ||
+    value.length % 4 !== 0 ||
+    !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)
+  ) {
+    return undefined;
+  }
+
+  try {
+    const binary = atob(value);
+    if (binary.length > MAX_RENDER_ENVELOPE_BYTES) return undefined;
+    return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+  } catch {
+    return undefined;
+  }
+}
+
+function validCreativeUrl(value: string, publisherOrigin: string): boolean {
+  if (new TextEncoder().encode(value).length > MAX_CREATIVE_URL_BYTES) return false;
+
+  try {
+    const url = new URL(value);
+    return (
+      url.protocol === 'https:' &&
+      url.username === '' &&
+      url.password === '' &&
+      url.origin !== publisherOrigin
+    );
+  } catch {
+    return false;
+  }
+}
+
+/** Fully validate the exact APS envelope and cross-check every duplicated descriptor field. */
+export function validateApsRenderer(
+  value: unknown,
+  publisherOrigin = window.location.origin
+): ApsRendererV1 | undefined {
+  const renderer = parseApsRendererDescriptor(value);
+  if (!renderer || !validCreativeUrl(renderer.creativeUrl, publisherOrigin)) return undefined;
+
+  const bytes = decodeStandardBase64(renderer.aaxResponse);
+  if (!bytes) return undefined;
+
+  let decoded: unknown;
+  try {
+    decoded = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+  } catch {
+    return undefined;
+  }
+
+  if (!hasExactKeys(decoded, ['seatbid'])) return undefined;
+  const seatbids = decoded.seatbid;
+  if (!Array.isArray(seatbids) || seatbids.length !== 1) return undefined;
+  const seat = seatbids[0];
+  if (!hasExactKeys(seat, ['bid']) || !Array.isArray(seat.bid) || seat.bid.length !== 1) {
+    return undefined;
+  }
+
+  const bid = seat.bid[0];
+  if (!hasExactKeys(bid, ['ext', 'h', 'id', 'price', 'w'])) return undefined;
+  if (!hasExactKeys(bid.ext, ['creativeurl', 'tagtype'])) return undefined;
+
+  if (
+    bid.id !== renderer.bidId ||
+    bid.w !== renderer.width ||
+    bid.h !== renderer.height ||
+    bid.ext.creativeurl !== renderer.creativeUrl ||
+    bid.ext.tagtype !== renderer.tagType ||
+    typeof bid.price !== 'number' ||
+    !Number.isFinite(bid.price) ||
+    bid.price < 0
+  ) {
+    return undefined;
+  }
+
+  return renderer;
+}
+
+function createNonce(): string | undefined {
+  if (typeof crypto === 'undefined' || typeof crypto.getRandomValues !== 'function')
+    return undefined;
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  let binary = '';
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+}
+
+/** Return the absolute, same-publisher URL used by direct and Universal Creative rendering. */
+export function apsRendererUrl(pageOrigin = window.location.origin): string | undefined {
+  try {
+    const origin = new URL(pageOrigin);
+    const url = new URL(APS_RENDERER_PATH, origin);
+    if (
+      url.origin !== origin.origin ||
+      url.pathname !== APS_RENDERER_PATH ||
+      url.search !== '' ||
+      url.hash !== ''
+    ) {
+      return undefined;
+    }
+    return url.href;
+  } catch {
+    return undefined;
+  }
+}
+
+export interface RenderApsCreativeOptions {
+  slotId: string;
+  renderer: unknown;
+}
+
+/** Render APS through the static endpoint under an outer opaque-origin sandbox. */
+export function renderApsCreative({ slotId, renderer: input }: RenderApsCreativeOptions): boolean {
+  const renderer = validateApsRenderer(input);
+  const rendererUrl = apsRendererUrl();
+  const nonce = createNonce();
+  if (!renderer || !rendererUrl || !nonce) {
+    log.warn('APS renderer: rejected descriptor');
+    return false;
+  }
+
+  const container = document.getElementById(slotId);
+  if (!container) {
+    log.warn('APS renderer: slot not found');
+    return false;
+  }
+
+  const iframe = document.createElement('iframe');
+  iframe.title = 'Ad content';
+  iframe.width = String(renderer.width);
+  iframe.height = String(renderer.height);
+  iframe.style.border = '0';
+  iframe.style.display = 'none';
+  iframe.setAttribute('sandbox', APS_RENDERER_SANDBOX);
+  iframe.src = `${rendererUrl}#tsaps=${nonce}`;
+
+  const priorFrame = activeFrames.get(container);
+  if (priorFrame?.style.display === 'none') priorFrame.remove();
+  activeFrames.set(container, iframe);
+
+  let settled = false;
+  const cleanup = (): void => {
+    window.removeEventListener('message', receive);
+    window.clearTimeout(timeoutId);
+  };
+  const fail = (): void => {
+    if (settled) return;
+    settled = true;
+    cleanup();
+    if (activeFrames.get(container) === iframe) activeFrames.delete(container);
+    iframe.remove();
+    log.warn('APS renderer: frame load failed');
+  };
+  const commit = (): void => {
+    if (settled || activeFrames.get(container) !== iframe || !iframe.isConnected) return;
+    settled = true;
+    cleanup();
+    for (const child of Array.from(container.children)) {
+      if (child !== iframe) child.remove();
+    }
+    iframe.style.display = '';
+  };
+  function receive(event: MessageEvent): void {
+    if (event.source !== iframe.contentWindow || !hasExactKeys(event.data, ['message', 'nonce'])) {
+      return;
+    }
+    if (event.data.nonce !== nonce) return;
+    if (event.data.message === RENDERER_READY_MESSAGE) commit();
+    else if (event.data.message === RENDERER_FAILED_MESSAGE) fail();
+  }
+
+  window.addEventListener('message', receive);
+  iframe.addEventListener(
+    'load',
+    () => {
+      if (settled || activeFrames.get(container) !== iframe || !iframe.isConnected) return;
+      try {
+        const target = iframe.contentWindow;
+        if (!target) {
+          fail();
+          return;
+        }
+        target.postMessage({ nonce, renderer }, '*');
+      } catch {
+        fail();
+      }
+    },
+    { once: true }
+  );
+  iframe.addEventListener('error', fail, { once: true });
+
+  const timeoutId = window.setTimeout(fail, RENDERER_READY_TIMEOUT_MS);
+  container.appendChild(iframe);
+  return true;
+}
+
+/**
+ * Static source executed by Prebid Universal Creative's dynamic-renderer frame.
+ * It reads only the validated descriptor and trusted absolute endpoint URL from data.
+ */
+export const APS_UNIVERSAL_CREATIVE_RENDERER =
+  '(function(){window.render=function(d,_h,w){return new Promise(function(resolve,reject){' +
+  'try{var r=d&&d.apsRenderer,u=d&&d.rendererUrl;if(!r||typeof u!=="string")throw new Error("invalid APS renderer data");' +
+  'var p=new URL(u);if((p.protocol!=="https:"&&p.protocol!=="http:")||p.username||p.password||p.pathname!=="/integrations/aps/renderer"||p.search||p.hash)throw new Error("invalid APS renderer URL");' +
+  'var c=w.crypto;if(!c||typeof c.getRandomValues!=="function")throw new Error("APS renderer randomness unavailable");' +
+  'var b=new Uint8Array(16);c.getRandomValues(b);var s="";for(var i=0;i<b.length;i++)s+=String.fromCharCode(b[i]);' +
+  'var n=w.btoa(s).replace(/\\+/g,"-").replace(/\\//g,"_").replace(/=+$/g,"");' +
+  'var f=w.document.createElement("iframe"),done=false,t;' +
+  'function clean(){w.removeEventListener("message",receive);if(t)w.clearTimeout(t);}' +
+  'function fail(){if(done)return;done=true;clean();f.remove();reject(new Error("APS renderer frame failed"));}' +
+  'function receive(e){var m=e.data;if(e.source!==f.contentWindow||!m||m.nonce!==n)return;' +
+  'if(m.message==="trusted-server/aps/renderer-ready"){done=true;clean();resolve();}' +
+  'else if(m.message==="trusted-server/aps/renderer-failed")fail();}' +
+  'f.width=String(r.width);f.height=String(r.height);f.style.border="0";' +
+  'f.setAttribute("sandbox","allow-forms allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-scripts allow-top-navigation-by-user-activation");' +
+  'f.src=p.href+"#tsaps="+n;f.onload=function(){if(!done&&f.contentWindow)f.contentWindow.postMessage({nonce:n,renderer:r},"*");};' +
+  'f.onerror=fail;w.addEventListener("message",receive);t=w.setTimeout(fail,10000);w.document.body.appendChild(f);' +
+  '}catch(e){reject(e);}});};})();';
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt/index.ts b/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
index 1f5aa14d6..362cca19d 100644
--- a/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
+++ b/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
@@ -1,5 +1,11 @@
 import { log } from '../../core/log';
 import type { AuctionSlot, AuctionBidData, TsjsApi } from '../../core/types';
+import {
+  APS_UNIVERSAL_CREATIVE_RENDERER,
+  APS_UNIVERSAL_CREATIVE_RENDERER_VERSION,
+  apsRendererUrl,
+  validateApsRenderer,
+} from '../aps/render';
 
 import { installGptGuard } from './script_guard';
 
@@ -560,13 +566,8 @@ export function installTsAdInit(): void {
           slotsToRefresh.push(gptSlot);
         }
 
-        // APS: signal to apstag that bids are ready so Amazon's GAM creative
-        // can render.  apstag must already be initialised on the page (which it
-        // is on production publisher pages).  Safe no-op if apstag is absent.
-        if (bid.hb_bidder === 'aps' || bid.hb_bidder === 'amazon-aps') {
-          // eslint-disable-next-line @typescript-eslint/no-explicit-any
-          (window as any).apstag?.setDisplayBids?.();
-        }
+        // Trusted Server APS winners carry their own typed renderer and never
+        // enter the publisher-owned native apstag rendering path.
       });
 
       ts.prevGptSlots = newSlots as unknown[];
@@ -971,6 +972,38 @@ export function installTsRenderBridge(): void {
     const width = matchedBid.w ?? fallbackWidth;
     const height = matchedBid.h ?? fallbackHeight;
 
+    if (matchedBid.renderer !== undefined) {
+      const renderer = validateApsRenderer(matchedBid.renderer);
+      const rendererUrl = apsRendererUrl();
+      if (!renderer || !rendererUrl) return;
+
+      // Ownership and the complete consumed envelope are valid before this
+      // handler claims the message or suppresses another legitimate handler.
+      e.stopImmediatePropagation();
+      if (renderingAdIds.has(adId)) return;
+      renderingAdIds.add(adId);
+
+      try {
+        port.postMessage(
+          JSON.stringify({
+            message: 'Prebid Response',
+            adId,
+            renderer: APS_UNIVERSAL_CREATIVE_RENDERER,
+            rendererVersion: APS_UNIVERSAL_CREATIVE_RENDERER_VERSION,
+            rendererUrl,
+            apsRenderer: renderer,
+            width: renderer.width,
+            height: renderer.height,
+          })
+        );
+        log.debug(`[tsjs-gpt] pbRender bridge served '${slotId}' through APS renderer`);
+      } catch (err) {
+        renderingAdIds.delete(adId);
+        log.warn('[tsjs-gpt] pbRender bridge: APS response failed', err);
+      }
+      return;
+    }
+
     if (matchedBid.adm) {
       e.stopImmediatePropagation();
       port.postMessage(
diff --git a/crates/trusted-server-js/lib/test/core/auction.test.ts b/crates/trusted-server-js/lib/test/core/auction.test.ts
index 31e020eff..7e9bb2947 100644
--- a/crates/trusted-server-js/lib/test/core/auction.test.ts
+++ b/crates/trusted-server-js/lib/test/core/auction.test.ts
@@ -1,5 +1,22 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { buildAdRequest, parseAuctionResponse, sendAuction } from '../../src/core/auction';
+import envelope from '../fixtures/aps-renderer-v1.json';
+
+function apsRenderer(creativeId?: string) {
+  const bid = envelope.seatbid[0].bid[0];
+  return {
+    type: 'aps' as const,
+    version: 1 as const,
+    accountId: 'example-account-id',
+    bidId: bid.id,
+    ...(creativeId ? { creativeId } : {}),
+    tagType: 'iframe' as const,
+    creativeUrl: bid.ext.creativeurl,
+    aaxResponse: btoa(JSON.stringify(envelope)),
+    width: bid.w,
+    height: bid.h,
+  };
+}
 
 describe('auction/buildAdRequest', () => {
   it('builds from tsjs AdUnit objects', () => {
@@ -174,6 +191,83 @@ describe('auction/parseAuctionResponse', () => {
     });
   });
 
+  it('parses an APS typed renderer without requiring adm', () => {
+    const renderer = apsRenderer('fictional-creative-id');
+    const bids = parseAuctionResponse({
+      seatbid: [
+        {
+          seat: 'aps',
+          bid: [
+            {
+              id: renderer.bidId,
+              impid: 'fictional-slot',
+              price: 1.23,
+              crid: renderer.creativeId,
+              w: 300,
+              h: 250,
+              ext: { trusted_server: { renderer } },
+            },
+          ],
+        },
+      ],
+    });
+
+    expect(bids).toHaveLength(1);
+    expect(bids[0]).toEqual(
+      expect.objectContaining({
+        impid: 'fictional-slot',
+        adm: '',
+        renderer,
+        width: 300,
+        height: 250,
+        creativeId: 'fictional-creative-id',
+      })
+    );
+  });
+
+  it('parses an APS renderer with optional creativeId omitted', () => {
+    const renderer = apsRenderer();
+    const bids = parseAuctionResponse({
+      seatbid: [
+        {
+          seat: 'aps',
+          bid: [
+            {
+              impid: 'fictional-slot',
+              price: 1.23,
+              w: 300,
+              h: 250,
+              ext: { trusted_server: { renderer } },
+            },
+          ],
+        },
+      ],
+    });
+
+    expect(bids[0].renderer).toEqual(renderer);
+    expect(bids[0].creativeId).toBe('aps-fictional-slot');
+  });
+
+  it('ignores unrelated or malformed renderer extensions while retaining ordinary adm', () => {
+    const bids = parseAuctionResponse({
+      seatbid: [
+        {
+          seat: 'ordinary',
+          bid: [
+            {
+              impid: 'slot-1',
+              adm: '<div>ordinary</div>',
+              ext: { trusted_server: { renderer: { type: 'aps', version: 99 } } },
+            },
+          ],
+        },
+      ],
+    });
+
+    expect(bids[0].renderer).toBeUndefined();
+    expect(bids[0].adm).toBe('<div>ordinary</div>');
+  });
+
   it('handles multiple seatbids with multiple bids', () => {
     const body = {
       seatbid: [
diff --git a/crates/trusted-server-js/lib/test/core/request.test.ts b/crates/trusted-server-js/lib/test/core/request.test.ts
index 2c56361dc..8dffd825b 100644
--- a/crates/trusted-server-js/lib/test/core/request.test.ts
+++ b/crates/trusted-server-js/lib/test/core/request.test.ts
@@ -1,4 +1,5 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import envelope from '../fixtures/aps-renderer-v1.json';
 
 async function flushRequestAds(): Promise<void> {
   await new Promise((resolve) => setTimeout(resolve, 0));
@@ -66,6 +67,107 @@ describe('request.requestAds', () => {
     );
   });
 
+  it('dispatches a valid APS descriptor to the opaque static renderer route', async () => {
+    const apsBid = envelope.seatbid[0].bid[0];
+    const renderer = {
+      type: 'aps',
+      version: 1,
+      accountId: 'example-account-id',
+      bidId: apsBid.id,
+      tagType: apsBid.ext.tagtype,
+      creativeUrl: apsBid.ext.creativeurl,
+      aaxResponse: btoa(JSON.stringify(envelope)),
+      width: apsBid.w,
+      height: apsBid.h,
+    };
+    (globalThis as any).fetch = vi.fn().mockResolvedValue({
+      ok: true,
+      status: 200,
+      headers: { get: () => 'application/json' },
+      json: async () => ({
+        seatbid: [
+          {
+            seat: 'aps',
+            bid: [
+              {
+                impid: 'slot1',
+                price: 1.23,
+                w: 300,
+                h: 250,
+                ext: { trusted_server: { renderer } },
+              },
+            ],
+          },
+        ],
+      }),
+    });
+
+    const { addAdUnits } = await import('../../src/core/registry');
+    const { requestAds } = await import('../../src/core/request');
+    document.body.innerHTML = '<div id="slot1"><span>existing</span></div>';
+    addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } } as any);
+
+    requestAds();
+    await flushRequestAds();
+
+    const iframe = document.querySelector('#slot1 iframe') as HTMLIFrameElement | null;
+    expect(iframe).not.toBeNull();
+    expect(iframe!.src).toContain('/integrations/aps/renderer#tsaps=');
+    expect(iframe!.srcdoc).toBe('');
+    expect(iframe!.getAttribute('sandbox')).not.toContain('allow-same-origin');
+    expect(document.querySelector('#slot1 span')).not.toBeNull();
+
+    const postMessage = vi.spyOn(iframe!.contentWindow!, 'postMessage');
+    iframe!.dispatchEvent(new Event('load'));
+    expect(document.querySelector('#slot1 span')).not.toBeNull();
+    expect(postMessage).toHaveBeenCalledWith(expect.objectContaining({ renderer }), '*');
+
+    const message = postMessage.mock.calls[0][0] as { nonce: string };
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        data: { message: 'trusted-server/aps/renderer-ready', nonce: message.nonce },
+        source: iframe!.contentWindow,
+      })
+    );
+    expect(document.querySelector('#slot1 span')).toBeNull();
+  });
+
+  it('does not mutate the slot for an invalid APS descriptor', async () => {
+    (globalThis as any).fetch = vi.fn().mockResolvedValue({
+      ok: true,
+      status: 200,
+      headers: { get: () => 'application/json' },
+      json: async () => ({
+        seatbid: [
+          {
+            seat: 'aps',
+            bid: [
+              {
+                impid: 'slot1',
+                ext: {
+                  trusted_server: {
+                    renderer: { type: 'aps', version: 1, aaxResponse: 'invalid' },
+                  },
+                },
+              },
+            ],
+          },
+        ],
+      }),
+    });
+
+    const { addAdUnits } = await import('../../src/core/registry');
+    const { requestAds } = await import('../../src/core/request');
+    document.body.innerHTML = '<div id="slot1"><span>existing</span></div>';
+    addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } } as any);
+
+    requestAds();
+    await flushRequestAds();
+
+    expect(document.querySelector('#slot1 iframe')).toBeNull();
+    expect(document.querySelector('#slot1 span')).not.toBeNull();
+  });
+
   it('does not render on non-JSON response', async () => {
     (globalThis as any).fetch = vi.fn().mockResolvedValue({
       ok: true,
diff --git a/crates/trusted-server-js/lib/test/fixtures/aps-renderer-v1.json b/crates/trusted-server-js/lib/test/fixtures/aps-renderer-v1.json
new file mode 100644
index 000000000..f970ac68c
--- /dev/null
+++ b/crates/trusted-server-js/lib/test/fixtures/aps-renderer-v1.json
@@ -0,0 +1,18 @@
+{
+  "seatbid": [
+    {
+      "bid": [
+        {
+          "id": "fictional-selected-bid-id",
+          "price": 1.23,
+          "w": 300,
+          "h": 250,
+          "ext": {
+            "creativeurl": "https://creative.example/render",
+            "tagtype": "iframe"
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts b/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts
new file mode 100644
index 000000000..78d459c7d
--- /dev/null
+++ b/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts
@@ -0,0 +1,295 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import envelope from '../../fixtures/aps-renderer-v1.json';
+import type { ApsRendererV1 } from '../../../src/core/types';
+import {
+  APS_RENDERER_PATH,
+  APS_RENDERER_SANDBOX,
+  APS_UNIVERSAL_CREATIVE_RENDERER,
+  APS_UNIVERSAL_CREATIVE_RENDERER_VERSION,
+  apsRendererUrl,
+  parseApsRendererDescriptor,
+  renderApsCreative,
+  validateApsRenderer,
+} from '../../../src/integrations/aps/render';
+
+function encodeEnvelope(value: unknown): string {
+  const bytes = new TextEncoder().encode(JSON.stringify(value));
+  let binary = '';
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
+
+function descriptor(overrides: Partial<ApsRendererV1> = {}): ApsRendererV1 {
+  const bid = envelope.seatbid[0].bid[0];
+  return {
+    type: 'aps',
+    version: 1,
+    accountId: 'example-account-id',
+    bidId: bid.id,
+    creativeId: 'fictional-creative-id',
+    tagType: bid.ext.tagtype as 'iframe',
+    creativeUrl: bid.ext.creativeurl,
+    aaxResponse: encodeEnvelope(envelope),
+    width: bid.w,
+    height: bid.h,
+    ...overrides,
+  };
+}
+
+describe('APS renderer validation', () => {
+  it('consumes the shared fictional golden envelope and supports an omitted creative ID', () => {
+    const withCreativeId = descriptor();
+    const withoutCreativeId = descriptor();
+    delete withoutCreativeId.creativeId;
+
+    expect(validateApsRenderer(withCreativeId)).toEqual(withCreativeId);
+    expect(validateApsRenderer(withoutCreativeId)).toEqual(withoutCreativeId);
+  });
+
+  it('keeps auction parsing structural and leaves complete trust validation to render time', () => {
+    const renderer = descriptor({ aaxResponse: 'not-base64' });
+
+    expect(parseApsRendererDescriptor(renderer)).toEqual(renderer);
+    expect(validateApsRenderer(renderer)).toBeUndefined();
+  });
+
+  it.each([
+    ['unknown root field', { ...envelope, id: 'forbidden' }],
+    ['sibling seat', { seatbid: [...envelope.seatbid, envelope.seatbid[0]] }],
+    [
+      'sibling bid',
+      { seatbid: [{ bid: [...envelope.seatbid[0].bid, envelope.seatbid[0].bid[0]] }] },
+    ],
+    [
+      'markup',
+      {
+        seatbid: [
+          { bid: [{ ...envelope.seatbid[0].bid[0], adm: '<script>forbidden()</script>' }] },
+        ],
+      },
+    ],
+    [
+      'notification',
+      { seatbid: [{ bid: [{ ...envelope.seatbid[0].bid[0], nurl: 'https://notify.example' }] }] },
+    ],
+    [
+      'unknown extension',
+      {
+        seatbid: [
+          {
+            bid: [
+              {
+                ...envelope.seatbid[0].bid[0],
+                ext: { ...envelope.seatbid[0].bid[0].ext, userSyncs: [] },
+              },
+            ],
+          },
+        ],
+      },
+    ],
+  ])('rejects an envelope containing %s', (_name, invalidEnvelope) => {
+    expect(
+      validateApsRenderer(descriptor({ aaxResponse: encodeEnvelope(invalidEnvelope) }))
+    ).toBeUndefined();
+  });
+
+  it.each([
+    ['bid ID', { bidId: 'another-bid' }],
+    ['width', { width: 728 }],
+    ['height', { height: 90 }],
+    ['creative URL', { creativeUrl: 'https://other.example/render' }],
+    ['tag type', { tagType: 'script' as const }],
+  ])('rejects a descriptor/envelope %s mismatch', (_name, override) => {
+    expect(validateApsRenderer(descriptor(override))).toBeUndefined();
+  });
+
+  it.each(['not-base64', 'e30', '====', btoa(String.fromCharCode(0xc3, 0x28)), btoa('{not json}')])(
+    'rejects invalid base64, UTF-8, or JSON',
+    (aaxResponse) => {
+      expect(validateApsRenderer(descriptor({ aaxResponse }))).toBeUndefined();
+    }
+  );
+
+  it.each([
+    'http://creative.example/render',
+    'https://user:password@creative.example/render',
+    `${window.location.origin}/creative`,
+  ])('rejects an unsafe creative URL', (creativeUrl) => {
+    const invalidEnvelope = structuredClone(envelope);
+    invalidEnvelope.seatbid[0].bid[0].ext.creativeurl = creativeUrl;
+    expect(
+      validateApsRenderer(descriptor({ creativeUrl, aaxResponse: encodeEnvelope(invalidEnvelope) }))
+    ).toBeUndefined();
+  });
+
+  it('rejects unknown descriptor fields and version mismatches', () => {
+    expect(
+      parseApsRendererDescriptor({ ...descriptor(), adm: '<div>forbidden</div>' })
+    ).toBeUndefined();
+    expect(parseApsRendererDescriptor({ ...descriptor(), version: 2 })).toBeUndefined();
+  });
+});
+
+describe('direct APS rendering', () => {
+  beforeEach(() => {
+    document.body.innerHTML = '<div id="fictional-slot"><span>existing</span></div>';
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    document.body.innerHTML = '';
+  });
+
+  it('loads the static route with a fragment-bound 128-bit nonce and opaque sandbox', () => {
+    expect(renderApsCreative({ slotId: 'fictional-slot', renderer: descriptor() })).toBe(true);
+
+    const slot = document.getElementById('fictional-slot')!;
+    const iframe = slot.querySelector('iframe')!;
+    const existing = slot.querySelector('span');
+    expect(existing).not.toBeNull();
+    expect(iframe.src).toMatch(
+      new RegExp(`${APS_RENDERER_PATH.replace(/\//g, '\\/')}#tsaps=[A-Za-z0-9_-]{22}$`)
+    );
+    expect(iframe.getAttribute('sandbox')).toBe(APS_RENDERER_SANDBOX);
+    expect(iframe.getAttribute('sandbox')).not.toContain('allow-same-origin');
+    expect(iframe.srcdoc).toBe('');
+
+    const postMessage = vi.spyOn(iframe.contentWindow!, 'postMessage');
+    iframe.dispatchEvent(new Event('load'));
+
+    expect(slot.querySelector('span')).not.toBeNull();
+    expect(iframe.style.display).toBe('none');
+    expect(postMessage).toHaveBeenCalledTimes(1);
+    expect(postMessage).toHaveBeenCalledWith(
+      {
+        nonce: expect.stringMatching(/^[A-Za-z0-9_-]{22}$/),
+        renderer: descriptor(),
+      },
+      '*'
+    );
+
+    const message = postMessage.mock.calls[0][0] as { nonce: string };
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        data: {
+          message: 'trusted-server/aps/renderer-ready',
+          nonce: `wrong-${message.nonce}`,
+        },
+        source: iframe.contentWindow,
+      })
+    );
+    expect(slot.querySelector('span')).not.toBeNull();
+
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        data: { message: 'trusted-server/aps/renderer-ready', nonce: message.nonce },
+        source: iframe.contentWindow,
+      })
+    );
+    expect(slot.querySelector('span')).toBeNull();
+    expect(iframe.style.display).toBe('');
+  });
+
+  it('leaves existing slot content intact when validation or loading fails', () => {
+    expect(
+      renderApsCreative({
+        slotId: 'fictional-slot',
+        renderer: descriptor({ aaxResponse: 'invalid' }),
+      })
+    ).toBe(false);
+    expect(document.querySelector('#fictional-slot span')).not.toBeNull();
+    expect(document.querySelector('#fictional-slot iframe')).toBeNull();
+
+    expect(renderApsCreative({ slotId: 'fictional-slot', renderer: descriptor() })).toBe(true);
+    const iframe = document.querySelector('#fictional-slot iframe')!;
+    iframe.dispatchEvent(new Event('error'));
+    expect(document.querySelector('#fictional-slot span')).not.toBeNull();
+    expect(document.querySelector('#fictional-slot iframe')).toBeNull();
+  });
+
+  it('removes an unacknowledged frame without clearing publisher content', () => {
+    vi.useFakeTimers();
+    try {
+      expect(renderApsCreative({ slotId: 'fictional-slot', renderer: descriptor() })).toBe(true);
+      const iframe = document.querySelector('#fictional-slot iframe')!;
+      iframe.dispatchEvent(new Event('load'));
+
+      vi.advanceTimersByTime(10_000);
+
+      expect(document.querySelector('#fictional-slot span')).not.toBeNull();
+      expect(document.querySelector('#fictional-slot iframe')).toBeNull();
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+});
+
+describe('Universal Creative APS source', () => {
+  it('uses the deployed dynamic renderer protocol and only creates the opaque route frame', () => {
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER_VERSION).toBeGreaterThanOrEqual(4);
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).toContain('window.render=function');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).toContain('d&&d.apsRenderer');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).toContain('d&&d.rendererUrl');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).toContain(APS_RENDERER_PATH);
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).toContain(APS_RENDERER_SANDBOX);
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).not.toContain('allow-same-origin');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).not.toContain('srcdoc');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).not.toContain('document.write');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).not.toContain('creativeUrl');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).not.toContain('aaxResponse');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).not.toContain('example-account-id');
+  });
+
+  it('computes an absolute renderer URL from the publisher origin', () => {
+    expect(apsRendererUrl()).toBe(new URL(APS_RENDERER_PATH, window.location.origin).href);
+    expect(apsRendererUrl('not an origin')).toBeUndefined();
+  });
+
+  it('creates the opaque route frame and resolves only after the bound acknowledgement', async () => {
+    const dynamicWindow = window as unknown as {
+      render?: (data: Record<string, unknown>, helper: unknown, target: Window) => Promise<void>;
+    };
+    window.eval(APS_UNIVERSAL_CREATIVE_RENDERER);
+
+    try {
+      const renderer = descriptor();
+      const rendered = dynamicWindow.render!(
+        {
+          apsRenderer: renderer,
+          rendererUrl: apsRendererUrl(),
+        },
+        undefined,
+        window
+      );
+      const iframe = document.body.querySelector('iframe')!;
+      expect(iframe.src).toMatch(
+        new RegExp(`${APS_RENDERER_PATH.replace(/\//g, '\\/')}#tsaps=[A-Za-z0-9_-]{22}$`)
+      );
+      expect(iframe.getAttribute('sandbox')).toBe(APS_RENDERER_SANDBOX);
+      expect(iframe.getAttribute('sandbox')).not.toContain('allow-same-origin');
+
+      const postMessage = vi.spyOn(iframe.contentWindow!, 'postMessage');
+      iframe.dispatchEvent(new Event('load'));
+      const sent = postMessage.mock.calls[0][0] as { nonce: string; renderer: ApsRendererV1 };
+      expect(sent.renderer).toEqual(renderer);
+
+      let settled = false;
+      void rendered.then(() => {
+        settled = true;
+      });
+      await Promise.resolve();
+      expect(settled).toBe(false);
+
+      window.dispatchEvent(
+        new MessageEvent('message', {
+          data: { message: 'trusted-server/aps/renderer-ready', nonce: sent.nonce },
+          source: iframe.contentWindow,
+        })
+      );
+      await expect(rendered).resolves.toBeUndefined();
+    } finally {
+      delete dynamicWindow.render;
+      document.body.innerHTML = '';
+    }
+  });
+});
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
index ac55b60de..5dce07371 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
@@ -1,4 +1,21 @@
 import { describe, it, expect, vi, beforeEach, afterEach, afterAll } from 'vitest';
+import envelope from '../../fixtures/aps-renderer-v1.json';
+
+function apsRenderer() {
+  const bid = envelope.seatbid[0].bid[0];
+  return {
+    type: 'aps' as const,
+    version: 1 as const,
+    accountId: 'example-account-id',
+    bidId: bid.id,
+    creativeId: 'fictional-creative-id',
+    tagType: 'iframe' as const,
+    creativeUrl: bid.ext.creativeurl,
+    aaxResponse: btoa(JSON.stringify(envelope)),
+    width: bid.w,
+    height: bid.h,
+  };
+}
 
 // Track every 'message' EventListener added to window across the entire test
 // file.  This lets the installTsRenderBridge suite remove all accumulated
@@ -728,7 +745,7 @@ describe('installTsAdInit', () => {
     beaconSpy.mockRestore();
   });
 
-  it('calls apstag.setDisplayBids when hb_bidder is aps', async () => {
+  it('does not call native apstag for a Trusted Server APS renderer winner', async () => {
     const setDisplayBidsSpy = vi.fn();
     (window as TestWindow).apstag = { setDisplayBids: setDisplayBidsSpy };
 
@@ -761,7 +778,12 @@ describe('installTsAdInit', () => {
         },
       ],
       bids: {
-        atf_sidebar_ad: { hb_pb: '1.50', hb_bidder: 'aps', nurl: '', burl: '' },
+        atf_sidebar_ad: {
+          hb_pb: '1.50',
+          hb_bidder: 'aps',
+          hb_adid: envelope.seatbid[0].bid[0].id,
+          renderer: apsRenderer(),
+        },
       },
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
     } as any;
@@ -770,7 +792,8 @@ describe('installTsAdInit', () => {
     installTsAdInit();
     (window as TestWindow).tsjs!.adInit!();
 
-    expect(setDisplayBidsSpy).toHaveBeenCalled();
+    expect(setDisplayBidsSpy).not.toHaveBeenCalled();
+    expect((window as TestWindow).apstag).toEqual({ setDisplayBids: setDisplayBidsSpy });
 
     delete (window as TestWindow).apstag;
   });
@@ -1026,6 +1049,162 @@ describe('installTsRenderBridge', () => {
     return bridgeListener!;
   }
 
+  it('serves one exact APS dynamic-renderer response without cache fetches or beacons', async () => {
+    const renderer = apsRenderer();
+    (window as TestWindow).tsjs.bids.homepage_header = {
+      hb_adid: renderer.bidId,
+      hb_bidder: 'aps',
+      hb_pb: '1.23',
+      renderer,
+      // These must not be used even if unexpected legacy fields coexist.
+      nurl: 'https://notify.example/win',
+      burl: 'https://notify.example/bill',
+      hb_cache_host: 'cache.example.com',
+      hb_cache_path: '/cache',
+    };
+
+    const beaconSpy = vi.spyOn(navigator, 'sendBeacon').mockReturnValue(true);
+    const bridgeListener = await captureBridgeListener();
+    const source = createTrustedSlotIframe();
+    const stopSpy = vi.fn();
+    const portMessages: string[] = [];
+    const fakePort = { postMessage: (message: string) => portMessages.push(message) };
+    const event = Object.assign(new Event('message'), {
+      data: JSON.stringify({ message: 'Prebid Request', adId: renderer.bidId }),
+      ports: [fakePort],
+      source,
+      stopImmediatePropagation: stopSpy,
+    }) as unknown as MessageEvent;
+
+    bridgeListener(event);
+    bridgeListener(event);
+
+    expect(stopSpy).toHaveBeenCalledTimes(2);
+    expect(fetchStub).not.toHaveBeenCalled();
+    expect(beaconSpy).not.toHaveBeenCalled();
+    expect(portMessages).toHaveLength(1);
+    const response = JSON.parse(portMessages[0]) as Record<string, unknown>;
+    expect(Object.keys(response).sort()).toEqual(
+      [
+        'adId',
+        'apsRenderer',
+        'height',
+        'message',
+        'renderer',
+        'rendererUrl',
+        'rendererVersion',
+        'width',
+      ].sort()
+    );
+    expect(response).toEqual({
+      message: 'Prebid Response',
+      adId: renderer.bidId,
+      renderer: expect.stringContaining('window.render=function'),
+      rendererVersion: 4,
+      rendererUrl: new URL('/integrations/aps/renderer', window.location.origin).href,
+      apsRenderer: renderer,
+      width: 300,
+      height: 250,
+    });
+    expect(String(response.renderer)).not.toContain(renderer.accountId);
+    expect(String(response.renderer)).not.toContain(renderer.aaxResponse);
+
+    // Universal Creative's dynamic-renderer path evaluates the returned static
+    // source and calls window.render(response, helper, targetWindow). Consume
+    // the exact bridge response through that deployed protocol shape.
+    const dynamicWindow = window as unknown as {
+      render?: (data: Record<string, unknown>, helper: unknown, target: Window) => Promise<void>;
+    };
+    window.eval(String(response.renderer));
+    try {
+      const rendered = dynamicWindow.render!(response, undefined, window);
+      const outerFrame = document.querySelector<HTMLIFrameElement>(
+        'iframe[src*="/integrations/aps/renderer#tsaps="]'
+      )!;
+      expect(outerFrame).not.toBeNull();
+      expect(outerFrame.getAttribute('sandbox')).not.toContain('allow-same-origin');
+
+      const rendererPost = vi.spyOn(outerFrame.contentWindow!, 'postMessage');
+      outerFrame.dispatchEvent(new Event('load'));
+      const sent = rendererPost.mock.calls[0][0] as { nonce: string };
+      window.dispatchEvent(
+        new MessageEvent('message', {
+          data: { message: 'trusted-server/aps/renderer-ready', nonce: sent.nonce },
+          source: outerFrame.contentWindow,
+        })
+      );
+      await expect(rendered).resolves.toBeUndefined();
+      outerFrame.remove();
+    } finally {
+      delete dynamicWindow.render;
+    }
+    beaconSpy.mockRestore();
+  });
+
+  it('validates APS data before claiming the Prebid request', async () => {
+    const renderer = { ...apsRenderer(), aaxResponse: 'invalid' };
+    (window as TestWindow).tsjs.bids.homepage_header = {
+      hb_adid: renderer.bidId,
+      hb_bidder: 'aps',
+      renderer,
+    };
+
+    const bridgeListener = await captureBridgeListener();
+    const source = createTrustedSlotIframe();
+    const stopSpy = vi.fn();
+    const portMessages: string[] = [];
+    bridgeListener(
+      Object.assign(new Event('message'), {
+        data: JSON.stringify({ message: 'Prebid Request', adId: renderer.bidId }),
+        ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+        source,
+        stopImmediatePropagation: stopSpy,
+      }) as unknown as MessageEvent
+    );
+
+    expect(stopSpy).not.toHaveBeenCalled();
+    expect(portMessages).toEqual([]);
+    expect(fetchStub).not.toHaveBeenCalled();
+  });
+
+  it('ignores an APS ad ID requested by another configured slot', async () => {
+    const renderer = apsRenderer();
+    (window as TestWindow).tsjs.bids.homepage_header = {
+      hb_adid: renderer.bidId,
+      hb_bidder: 'aps',
+      renderer,
+    };
+    (window as TestWindow).tsjs.adSlots.push({
+      id: 'homepage_footer',
+      formats: [[300, 250]],
+      gam_unit_path: '/a/b/footer',
+      div_id: 'div-footer',
+      targeting: {},
+    });
+    const footer = document.createElement('div');
+    footer.id = 'div-footer';
+    const foreignIframe = document.createElement('iframe');
+    footer.appendChild(foreignIframe);
+    document.body.appendChild(footer);
+
+    const bridgeListener = await captureBridgeListener();
+    const stopSpy = vi.fn();
+    const portMessages: string[] = [];
+    bridgeListener(
+      Object.assign(new Event('message'), {
+        data: JSON.stringify({ message: 'Prebid Request', adId: renderer.bidId }),
+        ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+        source: foreignIframe.contentWindow,
+        stopImmediatePropagation: stopSpy,
+      }) as unknown as MessageEvent
+    );
+
+    expect(stopSpy).not.toHaveBeenCalled();
+    expect(portMessages).toEqual([]);
+    expect(fetchStub).not.toHaveBeenCalled();
+    footer.remove();
+  });
+
   it('calls stopImmediatePropagation and fetches PBS Cache for a TS bid', async () => {
     const beaconSpy = vi.spyOn(navigator, 'sendBeacon').mockReturnValue(true);
     const mockAd = '<div>Test Creative</div>';
@@ -1701,7 +1880,7 @@ describe('installTsRenderBridge', () => {
     window.dispatchEvent(
       new MessageEvent('message', {
         data: JSON.stringify({ message: 'Prebid Request', adId: 'test-cache-uuid' }),
-        ports: [fakePort as MessagePort],
+        ports: [fakePort as unknown as MessagePort],
         source: foreignIframe.contentWindow,
       })
     );
@@ -1746,7 +1925,7 @@ describe('installTsRenderBridge', () => {
       new MessageEvent('message', {
         // adId belongs to slot B (homepage_footer), not slot A's iframe.
         data: JSON.stringify({ message: 'Prebid Request', adId: 'footer-uuid' }),
-        ports: [fakePort as MessagePort],
+        ports: [fakePort as unknown as MessagePort],
         source,
       })
     );
diff --git a/docs/guide/auction-orchestration.md b/docs/guide/auction-orchestration.md
index d75958812..818c17d99 100644
--- a/docs/guide/auction-orchestration.md
+++ b/docs/guide/auction-orchestration.md
@@ -10,7 +10,7 @@ Key capabilities:
 
 - **Parallel execution** — Bid requests to all providers launch concurrently using Fastly's `select()` API
 - **Strategy-based winner selection** — Automatic strategy detection based on configuration
-- **Mediator support** — Optional external mediator for decoding encoded prices (e.g., APS) and applying unified floor pricing
+- **Mediator support** — Optional external mediator for final winner selection and unified floor pricing
 - **Provider abstraction** — Pluggable provider interface for adding new demand sources
 - **Creative rewriting** — Winning creatives automatically rewritten with first-party proxy URLs
 
@@ -92,26 +92,26 @@ sequenceDiagram
     activate Mock
 
     par Parallel Provider Calls
-      Orch->>APS: POST /e/dtb/bid<br/>APS TAM format
-      Note right of Orch: { "pubId": "5128",<br/>  "slots": [{ "slotID": "header-banner",<br/>    "sizes": [[728,90]] }] }
+      Orch->>APS: POST /e/pb/bid<br/>APS OpenRTB
+      Note right of Orch: { "id": "request",<br/>  "imp": [{ "id": "header-banner",<br/>    "banner": { "w": 728, "h": 90 } }],<br/>  "ext": { "account": "example-account" } }
 
-      APS->>Mock: APS TAM request
-      Mock-->>APS: APS bid response<br/>(encoded prices, no creative)
-      Note right of Mock: { "contextual": { "slots": [{<br/>  "slotID": "header-banner",<br/>  "amznbid": "Mi41MA==", // "2.50"<br/>  "fif": "1" }] } }
+      APS->>Mock: APS OpenRTB request
+      Mock-->>APS: OpenRTB bid response<br/>(decoded price and renderer URL)
+      Note right of Mock: { "seatbid": [{ "bid": [{<br/>  "impid": "header-banner", "price": 2.50,<br/>  "ext": { "creativeurl": "https://creative.example/render",<br/>    "tagtype": "iframe" } }] }] }
 
-      APS-->>Orch: AuctionResponse<br/>(APS bids)
+      APS-->>Orch: AuctionResponse<br/>(decoded price and typed renderer)
     and
       Orch->>Prebid: POST /openrtb2/auction<br/>OpenRTB 2.x format
       Note right of Orch: { "id": "request",<br/>  "imp": [{ "id": "header-banner",<br/>    "banner": { "w": 728, "h": 90 } }] }
 
       Prebid->>Mock: OpenRTB request
-      Mock-->>Prebid: OpenRTB response<br/>(clear prices, with creative)
+      Mock-->>Prebid: OpenRTB response<br/>(decoded price with creative)
       Note right of Mock: { "seatbid": [{ "seat": "prebid",<br/>  "bid": [{ "price": 2.00, "adm": "<html>..." }] }] }
 
       Prebid-->>Orch: AuctionResponse<br/>(Prebid bids)
     end
 
-    Note over Orch: Collected bids from all providers<br/>APS: encoded prices, no creative<br/>Prebid: clear prices, with creative
+    Note over Orch: Collected decoded-price bids<br/>APS: typed renderer, no adm<br/>Prebid: sanitized creative or cache source
     deactivate Mock
     deactivate APS
     deactivate Prebid
@@ -122,23 +122,19 @@ sequenceDiagram
     rect rgb(236,253,245)
       Note over Client,Mock: Mediation Flow
       activate Med
-      Orch->>Med: POST /adserver/mediate<br/>All bids for final selection
-      Note right of Orch: { "id": "auction-123",<br/>  "imp": [...],<br/>  "ext": { "bidder_responses": [<br/>    { "bidder": "amazon-aps",<br/>      "bids": [{ "encoded_price": "Mi41MA==" }] },<br/>    { "bidder": "prebid",<br/>      "bids": [{ "price": 2.00 }] }] } }
-
-      Med->>Med: Decode APS encoded prices<br/>Apply floor prices<br/>Select highest CPM per slot
-      Note right of Med: Base64 decode: "Mi41MA==" → "2.50"<br/>Winner: APS at $2.50 vs Prebid at $2.00
+      Orch->>Med: POST /adserver/mediate<br/>Decoded-price bids for final selection
+      Note right of Orch: APS price: 2.50<br/>Prebid price: 2.00
 
+      Med->>Med: Apply mediation policy and floors<br/>Select highest CPM per slot
       Med-->>Orch: OpenRTB response with winners
-      Note right of Med: { "seatbid": [{ "seat": "amazon-aps",<br/>  "bid": [{ "price": 2.50, "impid": "header-banner" }] }] }
+      Note right of Med: APS renderer state is restored from<br/>the reduced source bid after mediation
       deactivate Med
     end
   else No Mediator (parallel_only)
     rect rgb(253,243,235)
       Note over Client,Mock: Direct Winner Selection
-      Orch->>Orch: Compare clear prices only<br/>Skip APS (encoded prices)<br/>Select highest CPM
-      Note right of Orch: APS bids skipped (encoded prices)<br/>Winner: Prebid at $2.00 (only clear price)
-
-      Note over Orch: Results: Limited winner selection<br/>Cannot compare encoded APS prices<br/>Prebid wins by default
+      Orch->>Orch: Compare decoded prices<br/>Apply slot floor<br/>Select highest CPM
+      Note right of Orch: Winner: APS at $2.50 vs Prebid at $2.00
     end
   end
 
@@ -147,12 +143,12 @@ sequenceDiagram
     Note over Client,Mock: Response Assembly
     activate TS
     activate Client
-    Orch->>Orch: Transform to OpenRTB response<br/>Generate iframe creatives<br/>Rewrite creative URLs<br/>Add orchestrator metadata
+    Orch->>Orch: Transform to OpenRTB response<br/>Preserve typed render source<br/>Rewrite ordinary creatives<br/>Add orchestrator metadata
 
     Orch-->>TS: OpenRTB BidResponse
-    Note right of Orch: { "id": "auction-response",<br/>  "seatbid": [{ "seat": "amazon-aps",<br/>    "bid": [{ "price": 2.50,<br/>      "adm": "<iframe src=\"/first-party/proxy?tsurl=...\">",<br/>      "w": 728, "h": 90 }] }] }<br/>  "ext": { "orchestrator": {<br/>    "strategy": "parallel_mediation",<br/>    "bidders": 2, "time_ms": 150 } }
+    Note right of Orch: APS winner carries ext.trusted_server.renderer<br/>with no adm; ordinary winners retain sanitized adm/cache data
 
-    TS-->>Client: 200 OpenRTB response<br/>with winning creative
+    TS-->>Client: 200 OpenRTB response<br/>with winning render capability
     deactivate Orch
     deactivate TS
   end
@@ -160,8 +156,8 @@ sequenceDiagram
   %% === Creative Rendering ===
   rect rgb(239,246,255)
     Note over Client,Mock: Creative Rendering
-    Client->>Client: Inject winning creative<br/>Render iframe<br/>Load creative through proxy
-    Note right of Client: iframe src="/first-party/proxy?tsurl=...&tstoken=sig"<br/>Ensures first-party serving<br/>Maintains privacy & security
+    Client->>Client: Validate renderer descriptor<br/>Create opaque sandbox iframe<br/>Load /integrations/aps/renderer
+    Note right of Client: Fragment-bound nonce and one-time acknowledgement<br/>No allow-same-origin on the outer frame
     deactivate Client
   end
 ```
@@ -187,8 +183,8 @@ AuctionOrchestrator.run_auction()
   ├─ Launch all providers in parallel via select()
   ├─ Collect responses as they complete
   │
-  ├─[parallel_only]─── Select highest CPM per slot (clear prices only)
-  └─[parallel_mediation]─── Forward all bids to mediator for final selection
+  ├─[parallel_only]─── Select highest decoded CPM per slot
+  └─[parallel_mediation]─── Forward decoded-price bids to mediator for final selection
   │
   ▼
 Convert OrchestrationResult → OpenRTB 2.x Response
@@ -246,21 +242,17 @@ timeout_ms = 2000
 
 **How winner selection works:**
 
-1. Collect bids from all providers
-2. Group bids by slot ID
-3. For each slot, select the bid with the highest CPM
-4. Bids with `price: None` (e.g., APS encoded prices) are **skipped** — they cannot be compared without decoding
-5. Apply floor prices — drop winners below the slot's floor
-
-**Limitations:**
+1. Collect bids from all providers.
+2. Group bids by slot ID.
+3. Skip bids without a decoded numeric price.
+4. Select the highest CPM for each slot.
+5. Apply floor prices and drop winners below the slot's floor.
 
-- APS bids are effectively ignored since their prices are encoded
-- Only bidders returning clear decimal prices can compete
-- May result in lower revenue when APS would have won
+APS OpenRTB supplies decoded prices, so eligible APS bids participate directly without requiring a mediator.
 
 ### Parallel Mediation
 
-When a `mediator` is configured, all provider responses are forwarded to the mediator service for final winner selection. The mediator can decode proprietary price formats (like APS encoded bids) and apply unified floor pricing.
+When a `mediator` is configured, provider responses are forwarded to the mediator service for final winner selection and unified floor pricing.
 
 ```toml
 [auction]
@@ -272,21 +264,14 @@ timeout_ms = 2000
 
 **How mediation works:**
 
-1. Run all providers in parallel (same as parallel_only)
-2. Collect all responses
-3. Forward all bids to the mediator as a single request, including:
-   - Regular bids with clear `price` fields
-   - APS bids with `encoded_price` fields (from `amznbid` metadata)
-4. Mediator decodes APS prices, applies floor pricing, and selects the highest CPM per slot
-5. Mediator returns an OpenRTB response with winning bids at decoded prices
-6. Orchestrator filters any bids the mediator returned without a decoded price
+1. Run all providers in parallel (same as parallel_only).
+2. Collect all responses.
+3. Forward bids with decoded numeric prices to the mediator.
+4. Let the mediator apply policy and choose a winner.
+5. Restore render/accounting state from the selected source bid.
+6. Filter any mediator winner without a decoded price.
 
-**Advantages over parallel_only:**
-
-- All bidders compete on equal footing, including those with encoded prices
-- Centralized floor pricing enforcement
-- Proper APS integration — encoded bids are decoded and compared fairly
-- Higher potential revenue from broader competition
+Mediation is optional for APS. APS reduces to one candidate per impression before mediation so the selected renderer can be restored without same-slot ambiguity.
 
 ## Providers
 
@@ -354,33 +339,37 @@ bidders = ["appnexus", "rubicon"]
 
 ### APS Provider
 
-Transforms auction requests into Amazon's TAM (Transparent Ad Marketplace) format.
+Builds an independent banner OpenRTB request for Amazon Publisher Services.
 
 **Request transformation:**
 
-- `AdSlot` → `ApsSlot` with `slot_id`, `slot_name`, and `sizes` array
-- Publisher ID, page URL, user agent, and timeout included
+- banner `AdSlot` formats become secure OpenRTB impressions;
+- `ext.account` uses canonical `account_id`;
+- `ext.sdk` identifies the compatible Prebid contract; and
+- existing page, device, consent, identity, and geo privacy gates are preserved.
 
 **Response parsing:**
 
-- Bids have `price: None` — APS uses proprietary encoding (`amznbid` field is base64-encoded)
-- Bids have `creative: None` — APS does not return HTML creatives
-- Encoded price metadata (`amznbid`, `amznp`) preserved in bid metadata for the mediator
-- Only slots with `fif: "1"` (filled) are processed
-
-This is why mediation is important when using APS: without a mediator, APS bids cannot participate in winner selection.
+- decoded USD prices compete directly with other providers;
+- positive compatible dimensions and an HTTPS `creativeurl` are required;
+- script creatives are rejected before winner selection unless explicitly enabled;
+- one candidate per impression is retained deterministically; and
+- a minimized typed renderer is preserved instead of creative markup or APS notifications.
 
 ```toml
 [integrations.aps]
 enabled = true
-pub_id = "example-publisher"
-endpoint = "https://aps.example.com/e/dtb/bid"
+account_id = "example-account"
+endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 800
+allow_script_creatives = false
 ```
 
+See [APS OpenRTB Integration](/guide/integrations/aps) for rollout and rendering requirements.
+
 ### AdServer Mock Mediator
 
-An external mediation service that receives all bidder responses and performs unified winner selection. The mock implementation uses base64 decoding for APS prices; a production mediator would use Amazon's proprietary decoding.
+An external mediation service that receives decoded-price bidder responses and performs final winner selection. APS prices are already decoded at the provider boundary.
 
 **Mediation request format:**
 
@@ -393,8 +382,8 @@ An external mediation service that receives all bidder responses and performs un
   "ext": {
     "bidder_responses": [
       {
-        "bidder": "amazon-aps",
-        "bids": [{ "imp_id": "header-banner", "encoded_price": "Mi41MA==" }]
+        "bidder": "aps",
+        "bids": [{ "imp_id": "header-banner", "price": 2.5, "adm": null }]
       },
       {
         "bidder": "prebid",
@@ -457,20 +446,21 @@ The unified bid format used across all providers:
 ```rust
 pub struct Bid {
     pub slot_id: String,
-    pub price: Option<f64>,           // None for APS (encoded)
+    pub price: Option<f64>,           // Missing prices fail closed
     pub currency: String,
-    pub creative: Option<String>,     // None for APS (no HTML from TAM)
+    pub creative: Option<String>,     // APS uses renderer instead of markup
     pub adomain: Option<Vec<String>>,
     pub bidder: String,
     pub width: u32,
     pub height: u32,
     pub nurl: Option<String>,         // Win notification URL
     pub burl: Option<String>,         // Billing URL
+    pub renderer: Option<BidRenderer>,
     pub metadata: HashMap<String, serde_json::Value>,
 }
 ```
 
-The `price` and `creative` fields are `Option` types specifically to handle APS, which returns encoded prices and no creative HTML. This is a key design decision — it lets the type system enforce awareness of encoded vs. decoded bids throughout the auction pipeline.
+The `price` field remains optional so missing-price bids fail closed. APS supplies a decoded price and a typed renderer instead of creative HTML; the renderer is retained through direct winner selection and mediation.
 
 ### OrchestrationResult
 
@@ -593,9 +583,10 @@ debug = false
 
 [integrations.aps]
 enabled = true
-pub_id = "example-publisher"
-endpoint = "https://aps.example.com/e/dtb/bid"
+account_id = "example-account"
+endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 800
+allow_script_creatives = false
 
 [integrations.adserver_mock]
 enabled = true
@@ -629,12 +620,13 @@ price_floor = 0.50
 
 #### `[integrations.aps]`
 
-| Field        | Type   | Default                             | Description                 |
-| ------------ | ------ | ----------------------------------- | --------------------------- |
-| `enabled`    | bool   | `false`                             | Enable APS provider         |
-| `pub_id`     | string | —                                   | APS publisher ID (required) |
-| `endpoint`   | string | `https://aps.example.com/e/dtb/bid` | APS TAM endpoint            |
-| `timeout_ms` | u32    | `800`                               | Request timeout             |
+| Field                    | Type   | Default                                            | Description                                      |
+| ------------------------ | ------ | -------------------------------------------------- | ------------------------------------------------ |
+| `enabled`                | bool   | `false`                                            | Enable APS provider                              |
+| `account_id`             | string | —                                                  | APS account ID (required; `pub_id` is an alias)  |
+| `endpoint`               | string | `https://web.ads.aps.amazon-adsystem.com/e/pb/bid` | APS OpenRTB endpoint                             |
+| `timeout_ms`             | u32    | `800`                                              | Request timeout                                  |
+| `allow_script_creatives` | bool   | `false`                                            | Admit script bids before APS candidate reduction |
 
 #### `[integrations.adserver_mock]`
 
@@ -673,7 +665,7 @@ TRUSTED_SERVER__AUCTION__PROVIDERS=prebid,aps
 TRUSTED_SERVER__AUCTION__MEDIATOR=adserver_mock
 TRUSTED_SERVER__AUCTION__TIMEOUT_MS=2000
 TRUSTED_SERVER__INTEGRATIONS__PREBID__SERVER_URL=https://pbs.example.com
-TRUSTED_SERVER__INTEGRATIONS__APS__PUB_ID=5128
+TRUSTED_SERVER__INTEGRATIONS__APS__ACCOUNT_ID=example-account
 ```
 
 ## Floor Prices
@@ -682,7 +674,7 @@ Floor prices can be set per-slot in the auction request. The orchestrator enforc
 
 - In **parallel_only** mode: bids below the floor are dropped after selection
 - In **parallel_mediation** mode: the floor is sent to the mediator in `ext.config.price_floor`, and also enforced locally as a safety net
-- Bids with `price: None` (encoded prices) **pass through** floor checks — the floor is deferred to the mediator
+- Bids without a decoded numeric price are dropped before delivery in both strategies
 
 ## Error Handling
 
@@ -703,7 +695,7 @@ The auction system logs at multiple levels throughout execution:
 | Level   | Examples                                                                              |
 | ------- | ------------------------------------------------------------------------------------- |
 | `info`  | Auction request received, provider launch, bid counts, winner selection, total timing |
-| `debug` | Skipped bids (encoded prices), creative rewrite sizes                                 |
+| `debug` | Bid-drop reasons, mediation restoration notes, creative rewrite sizes                 |
 | `warn`  | Provider launch failures, parse failures, mediator bids without decoded prices        |
 
 ### Response Metadata
diff --git a/docs/guide/configuration.md b/docs/guide/configuration.md
index ad91a6026..2619552f1 100644
--- a/docs/guide/configuration.md
+++ b/docs/guide/configuration.md
@@ -1221,8 +1221,9 @@ timeout_ms = 2000
 
 [integrations.aps]
 enabled = true
-pub_id = "example-publisher"
-endpoint = "https://aps.example.com/e/dtb/bid"
+account_id = "example-account"
+endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
+allow_script_creatives = false
 
 [integrations.prebid]
 enabled = true
diff --git a/docs/guide/integrations/aps.md b/docs/guide/integrations/aps.md
index 878761769..ff4220070 100644
--- a/docs/guide/integrations/aps.md
+++ b/docs/guide/integrations/aps.md
@@ -1,412 +1,210 @@
-# Amazon Publisher Services (APS) Integration
+# Amazon Publisher Services (APS) OpenRTB Integration
 
-Server-side bidding integration for Amazon's Transparent Ad Marketplace (TAM).
+Trusted Server can request banner bids from Amazon Publisher Services (APS) through the APS OpenRTB endpoint and let their decoded USD CPMs compete with other auction providers.
 
-## Overview
+> [!IMPORTANT]
+> APS's public adapter metadata describes Prebid Server support as unavailable. Confirm edge/server-originated traffic with your APS account team before a broad production rollout. Start with an isolated cohort and disable publisher-native APS demand for that cohort to avoid duplicate demand.
 
-The APS integration enables publishers to request bids from Amazon's demand sources server-side, providing:
+## Scope
 
-- **Privacy-first bidding**: No client-side ID tracking or third-party cookies required
-- **Reduced latency**: Server-side auction reduces page load impact
-- **Unified auction**: Integrates seamlessly with other bidders (Prebid, GAM)
-- **Performance**: Async bidding with configurable timeouts
+The integration supports:
 
-## Quick Start
+- banner impressions;
+- APS OpenRTB requests to `https://web.ads.aps.amazon-adsystem.com/e/pb/bid`;
+- decoded-CPM winner selection with or without a mediator;
+- direct `/auction` rendering; and
+- initial-navigation and page-bids rendering through GAM/Prebid Universal Creative.
 
-Get started with server-side APS bidding in 5 minutes.
+The integration does not implement:
 
-### Prerequisites
+- video or native impressions;
+- APS user sync;
+- Trusted Server delivery of APS `nurl` or `burl`; or
+- native `apstag.setDisplayBids()` handling for Trusted Server APS winners.
 
-- Fastly Compute service configured
-- APS publisher account with valid `pub_id`
-- Rust toolchain installed (see main README)
-
-### Step 1: Configure Fastly Backend
-
-Add APS backend to your Fastly service:
-
-**Option A: Via Fastly UI**
-
-1. Go to your service → Origins
-2. Click "Create a Backend"
-3. Configure:
-   - Name: `aax.amazon-adsystem.com`
-   - Address: `aax.amazon-adsystem.com`
-   - Port: `443`
-   - Enable TLS: ✓
-
-**Option B: Via `fastly.toml`**
-
-Add to your `fastly.toml`:
-
-```toml
-[[backends]]
-name = "aax.amazon-adsystem.com"
-address = "aax.amazon-adsystem.com"
-port = 443
-use_ssl = true
-ssl_cert_hostname = "aax.amazon-adsystem.com"
-ssl_sni_hostname = "aax.amazon-adsystem.com"
-```
-
-### Step 2: Enable APS in Configuration
-
-Edit `trusted-server.toml`:
+## Configuration
 
 ```toml
-# Enable APS bidding
 [integrations.aps]
 enabled = true
-pub_id = "5128"  # Replace with your APS publisher ID
-endpoint = "https://aax.amazon-adsystem.com/e/dtb/bid"
+account_id = "example-aps-account-id"
+endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 800
+allow_script_creatives = false
 
-# Configure auction to use APS
 [auction]
 enabled = true
-strategy = "parallel_only"  # Run APS alongside other bidders
-bidders = ["aps"]  # Add other bidders like ["aps", "prebid"]
+providers = ["aps", "prebid"]
 timeout_ms = 2000
 ```
 
-### Step 3: Deploy or Test Locally
-
-**Deploy to Fastly:**
-
-```bash
-cargo build --release --target wasm32-wasip1
-fastly compute publish
-```
-
-**Test Locally:**
-
-```bash
-fastly compute serve
-```
-
-### Step 4: Verify It's Working
-
-Check the logs for APS activity:
-
-```bash
-# You should see:
-INFO APS: requesting bids for 2 slots (pub_id: 5128)
-DEBUG APS: sending bid request: {...}
-DEBUG APS: received response: {...}
-INFO APS returned 2 bids in 150ms
-```
-
-## Architecture
-
-```
-Publisher Page Request
-        ↓
-Auction Orchestrator
-        ↓
-APS Provider (async)
-        ↓
-https://aax.amazon-adsystem.com/e/dtb/bid
-        ↓
-Parse APS Response → Unified Bid Format
-        ↓
-Auction Winner Selection
-```
-
-## Configuration
-
-### Basic Setup
+`account_id` is the canonical field. `pub_id` remains a compatibility alias for migration, including integer values, but new configuration should not use it. Supplying both names is an error.
 
-Add to `trusted-server.toml`:
-
-```toml
-[integrations.aps]
-enabled = true
-pub_id = "5128"  # Your APS publisher ID
-endpoint = "https://aax.amazon-adsystem.com/e/dtb/bid"
-timeout_ms = 800
-```
-
-### Environment Variables
-
-Override settings via environment variables:
-
-```bash
-TRUSTED_SERVER__INTEGRATIONS__APS__ENABLED=true
-TRUSTED_SERVER__INTEGRATIONS__APS__PUB_ID=5128
-TRUSTED_SERVER__INTEGRATIONS__APS__TIMEOUT_MS=800
-```
+`allow_script_creatives` defaults to `false`. While disabled, APS script bids are rejected before per-impression reduction, floors, mediation, and winner selection. Enable it only for a controlled cohort after the browser-security checks in [Rollout](#rollout) pass.
 
-## Auction Strategies
+APS uses ordinary auction slot IDs and banner formats. Legacy creative-opportunity APS `slot_id` configuration is accepted for compatibility but ignored, and `bidders.aps.slotID` is not required. Remove both during migration.
 
-### APS Only
-
-```toml
-[auction]
-enabled = true
-bidders = ["aps"]
-# No mediator = parallel only (highest CPM wins)
-```
-
-### APS + Prebid (Parallel)
-
-Best for maximum revenue:
+The APS provider may also participate through a configured mediator:
 
 ```toml
 [auction]
 enabled = true
 providers = ["aps", "prebid"]
+mediator = "adserver_mock"
 timeout_ms = 2000
-# No mediator = all providers compete, highest CPM wins
+```
 
-[integrations.aps]
-enabled = true
-pub_id = "5128"
-timeout_ms = 800
+## OpenRTB request
 
-[integrations.prebid]
-enabled = true
-server_url = "https://prebid-server.example.com"
-timeout_ms = 1000
-```
+Trusted Server builds the APS request independently from its Prebid Server request. The request includes:
 
-**Benefits:**
+- `ext.account` from `account_id`;
+- `ext.sdk = { "source": "prebid", "version": "2.2.0" }`;
+- secure banner impressions and configured floors;
+- page, site, device, and consent fields allowed by the existing privacy gates; and
+- eligible EIDs only when consent policy permits them.
 
-- Maximum fill rate
-- Best CPM selection
-- All bidders compete equally
+Precise latitude/longitude, disallowed identifiers, unsupported media types, and Trusted Server/Prebid-only extensions are not forwarded. Unsafe or oversized page URLs are omitted or replaced by the validated publisher fallback.
 
-### APS + Prebid + Mediation
+Raw outbound and inbound payloads are logged only at TRACE level. Normal logs and auction metadata contain aggregate counts and drop reasons.
 
-Let a mediator decide winners:
+## Bid eligibility and selection
 
-```toml
-[auction]
-enabled = true
-providers = ["aps", "prebid"]
-mediator = "adserver_mock"  # Enables parallel mediation (mediator decides winner)
-timeout_ms = 2000
-```
+APS responses must use USD when a response currency is present. Each eligible bid must have:
 
-## Request Format
+- a known `impid`;
+- a finite decoded price;
+- positive `w` and `h` that match a configured banner format;
+- an HTTPS, credential-free `ext.creativeurl` on an origin other than the publisher; and
+- `ext.tagtype` equal to `iframe`, or `script` when the script gate is enabled.
 
-The integration transforms unified `AuctionRequest` to APS TAM format:
+Trusted Server rejects legacy contextual response shapes and bids with markup-only render sources. It deterministically keeps one eligible APS candidate per impression by highest price, then lexicographically smallest bid ID. This reduction prevents same-slot renderer ambiguity in mediation.
 
-```json
-{
-  "pubId": "5128",
-  "slots": [
-    {
-      "slotID": "header-banner",
-      "slotName": "header-banner",
-      "sizes": [
-        [728, 90],
-        [970, 250]
-      ]
-    }
-  ],
-  "pageUrl": "https://example.com/article",
-  "ua": "Mozilla/5.0...",
-  "timeout": 800
-}
-```
+APS bids use `aps` as both the bidder identity and `hb_bidder`, regardless of an upstream seat value. The selected APS bid ID is used for `hb_adid`. APS then competes directly against other decoded-price bids and ordinary slot floors.
 
-## Response Format
+## Rendering security model
 
-APS returns bids in this format:
+Trusted Server does not insert APS creative markup into the publisher document. It serializes only the selected bid into a versioned renderer descriptor. The base64 OpenRTB envelope has exactly this shape:
 
 ```json
 {
-  "bids": [
+  "seatbid": [
     {
-      "slotID": "header-banner",
-      "price": 2.5,
-      "adm": "<div>Creative HTML</div>",
-      "w": 728,
-      "h": 90,
-      "adomain": ["amazon.com"],
-      "bidId": "bid-123",
-      "nurl": "https://win-notification.com",
-      "targeting": {
-        "amzniid": "user-id",
-        "amznbid": "2.50"
-      }
+      "bid": [
+        {
+          "id": "fictional-selected-bid-id",
+          "price": 1.23,
+          "w": 300,
+          "h": 250,
+          "ext": {
+            "creativeurl": "https://creative.example/render",
+            "tagtype": "iframe"
+          }
+        }
+      ]
     }
   ]
 }
 ```
 
-The integration automatically transforms this to unified `Bid` format.
+Seats, `impid`, markup, notifications, user-sync data, sibling bids, losing seats, and unknown fields are not exposed. The browser decodes this envelope and cross-checks the ID, dimensions, URL, and tag type before any DOM mutation or message suppression.
 
-## Testing
+Both rendering paths use `GET /integrations/aps/renderer`, a static Trusted Server document with its own restrictive CSP. The document initializes the account-keyed APS queue and then loads only the fixed runner at `https://client.aps.amazon-adsystem.com/prebid-creative.js`.
 
-### Unit Tests
+The outer iframe uses these sandbox permissions:
 
-```bash
-cargo test -p trusted-server-core aps::tests
+```text
+allow-forms
+allow-pointer-lock
+allow-popups
+allow-popups-to-escape-sandbox
+allow-scripts
+allow-top-navigation-by-user-activation
 ```
 
-### Local Testing
+It deliberately omits `allow-same-origin`, so APS and bidder execution remains below an opaque-origin boundary. The renderer response repeats these restrictions with a CSP `sandbox` directive, preventing another embedding path from restoring publisher-origin execution by omitting the iframe attribute. Trusted Server generates a fresh 128-bit nonce, binds it in the iframe URL fragment before navigation, and requires the same one-time nonce in the parent message and renderer acknowledgement. Existing slot content is retained until the static renderer has accepted the descriptor and loaded the fixed runner.
 
-1. Configure APS in `trusted-server.toml`
-2. Set up Fastly backend
-3. Run locally:
-   ```bash
-   fastly compute serve
-   ```
-4. Inspect logs for bid requests/responses
+### Direct `/auction`
 
-### Testing
+The TSJS auction client validates the typed renderer descriptor, creates the opaque renderer iframe, and sends the minimized envelope after the frame loads. Ordinary non-APS `adm` continues through the existing sanitizer and generic creative iframe.
 
-For local testing without live APS credentials, configure the integration with test values:
+### GAM and Universal Creative
 
-```toml
-[integrations.aps]
-enabled = true
-pub_id = "test-publisher-123"
-endpoint = "https://aax.amazon-adsystem.com/e/dtb/bid"
-timeout_ms = 800
-```
-
-Run unit tests:
-
-```bash
-cargo test -p trusted-server-core aps
-```
-
-## Monitoring
+For initial navigation and page-bids, Trusted Server publishes the same descriptor in `window.tsjs.bids`. The source-checked Prebid Universal Creative bridge accepts requests only from the iframe that owns the matching `hb_adid`, validates the complete envelope, and returns a static dynamic-renderer program that creates the same opaque renderer iframe.
 
-The integration logs detailed information at different levels:
+This path does not fetch PBS Cache, fire generic APS win/billing beacons, or call `apstag.setDisplayBids()` for the Trusted Server winner. Publisher-owned native APS objects are otherwise left untouched.
 
-```rust
-// Info: Auction lifecycle
-log::info!("APS: requesting bids for 2 slots (pub_id: 5128)");
-log::info!("APS returned 2 bids in 150ms");
+## Publisher CSP
 
-// Debug: Request/response payloads
-log::debug!("APS: sending bid request: {...}");
-log::debug!("APS: received response: {...}");
+The publisher policy must permit the same-origin renderer route, for example:
 
-// Warn: Non-success responses
-log::warn!("APS returned non-success status: 400");
+```text
+frame-src 'self'
 ```
 
-## Troubleshooting
-
-### Problem: No bids returned
-
-**Check:**
-
-1. Verify `pub_id` is correct
-2. Check backend is configured: `fastly backend list`
-3. Increase timeout: `timeout_ms = 1200`
-4. View logs with `fastly compute serve`
-
-**Possible causes:**
+Do not add `allow-same-origin` to the outer renderer sandbox. The renderer endpoint supplies its own CSP for the fixed runner and HTTPS creative resources.
 
-- Invalid `pub_id` configuration
-- Timeout too short (increase `timeout_ms`)
-- Backend not configured correctly
-- APS account not active
+Before enabling script creatives, verify under the publisher's actual CSP that both iframe and script-tag creatives:
 
-### Problem: "Backend not found" error
+- render and size correctly;
+- cannot read or modify `top.document`;
+- cannot restore publisher-origin execution;
+- reject malformed descriptors, nonce mismatches, and replay; and
+- work through both direct and GAM/Universal Creative paths.
 
-**Solution:**
-Add backend to Fastly (see Step 1)
+If script rendering requires weakening the outer sandbox, leave `allow_script_creatives = false` and consult APS instead.
 
-### Problem: Parse errors
+## Migration from the legacy APS integration
 
-**Check:**
+This release is a direct protocol cutover:
 
-- Enable debug logging
-- Verify endpoint URL is correct
-- Check APS API for changes
+1. Replace the legacy `/e/dtb/bid` endpoint with `/e/pb/bid`.
+2. Rename `pub_id` to `account_id`.
+3. Remove APS-specific slot ID configuration and remove `aps` from Prebid Server bidder lists. Trusted Server also filters APS from PBS requests for this path.
+4. Prepare GAM line items and Universal Creative for `hb_bidder=aps` and the selected APS `hb_adid`.
+5. Disable publisher-native APS demand for the Trusted Server test cohort.
 
-**Solutions:**
+There is no legacy runtime switch. Roll back by disabling `[integrations.aps]`, restoring native APS for the cohort, or deploying the prior binary.
 
-- Enable debug logging to inspect response
-- Verify APS endpoint is correct
-- Check for API changes (update structs if needed)
+## Rollout
 
-### Timeout Errors
+Use fictional values in source-controlled configuration and fixtures. Supply controlled account details out of band.
 
-**Symptoms:**
+1. Obtain APS account-team confirmation for edge-originated OpenRTB traffic.
+2. Enable Trusted Server APS only for an isolated cohort and disable native APS demand there.
+3. Keep `allow_script_creatives = false` and observe iframe bids through direct and GAM paths.
+4. Confirm outbound privacy fields, aggregate diagnostics, decoded-price competition, line-item targeting, dimensions, click-throughs, and opaque-origin isolation.
+5. Run the restrictive-CSP browser proof for script behavior.
+6. Only then enable script creatives for the isolated cohort and validate them in a real browser.
+7. Expand traffic only after APS confirmation and successful controlled validation.
 
-```
-APS request failed: Timeout
-```
-
-**Solutions:**
-
-- Increase `timeout_ms` in config
-- Check backend connectivity
-- Verify DNS resolution for `aax.amazon-adsystem.com`
+## Troubleshooting
 
-## Performance Tuning
+### No APS bids
 
-### Timeout Configuration
+- Confirm `account_id` and account eligibility with APS.
+- Confirm the endpoint is `/e/pb/bid` and uses HTTPS without credentials.
+- Ensure `aps` appears in `auction.providers`.
+- Check aggregate APS drop reasons for currency, dimensions, render source, URL, tag type, or script-gate rejection.
+- Confirm the provider timeout fits inside the auction timeout.
 
-- **Default**: 800ms (matches APS client-side behavior)
-- **Aggressive**: 500ms (reduce latency, may miss some bids)
-- **Conservative**: 1200ms (maximize fill rate)
+### Winner targets but does not render
 
-```toml
-[integrations.aps]
-timeout_ms = 800  # Balance latency vs fill rate
-```
+- Confirm `GET /integrations/aps/renderer` returns HTML with its CSP and `Referrer-Policy: no-referrer`.
+- Confirm publisher CSP permits `frame-src 'self'`.
+- Confirm the GAM creative uses the supported Prebid Universal Creative bridge and the winning `hb_adid`.
+- Ensure no native APS path is trying to handle the same cohort.
+- Keep script creatives disabled while diagnosing iframe rendering.
 
-### Orchestrator Timeout
+## Verification
 
-Ensure orchestrator timeout exceeds provider timeout:
-
-```toml
-[auction]
-timeout_ms = 2000  # > sum of all provider timeouts
-
-[integrations.aps]
-timeout_ms = 800
+```bash
+cargo test-fastly integrations::aps
+cargo test-fastly auction::orchestrator
+cargo test-fastly integrations::adserver_mock
 
-[integrations.prebid]
-timeout_ms = 1000
+cd crates/trusted-server-js/lib
+npx vitest run test/integrations/aps/render.test.ts test/core/auction.test.ts
 ```
 
-## Integration with Client-Side
-
-While this implementation focuses on server-side bidding, you can optionally add client-side components later:
-
-1. **ID Resolution**: Integrate third-party ID vendors client-side
-2. **Analytics**: Load `aps_csm.js` for viewability tracking
-3. **Config Loading**: Fetch `/configs/{pub_id}` for advanced settings
-
-See the original network flow documentation for client-side patterns.
-
-## Future Enhancements
-
-Potential additions for complete APS TAM parity:
-
-1. **Video Support**: Add video slot formats
-2. **ID Enrichment**: Server-side ID resolution (LiveRamp, ID5, etc.)
-3. **Advanced Targeting**: Pass user segments, geo data
-4. **Config API**: Fetch APS configuration from `/configs/{pub_id}`
-5. **Analytics**: Integrate with APS measurement endpoints
-
-## Reference
-
-- **APS TAM Docs**: https://aps.amazon.com/aps/transparent-ad-marketplace-api/
-- **Integration Code**: `crates/trusted-server-core/src/integrations/aps.rs`
-- **Tests**: `crates/trusted-server-core/src/integrations/aps.rs#tests`
-- **Example Config**: `trusted-server.toml`
-
-## Support
-
-Questions? Issues?
-
-1. Check logs: `fastly compute serve`
-2. Run tests: `cargo test aps`
-3. Verify configuration in `trusted-server.toml`
-4. Review this documentation
-
----
-
-**Status**: ✅ Production Ready (Server-Side Bidding)
-
-**Last Updated**: 2025-12-23
+See `crates/trusted-server-core/src/integrations/aps.rs` for the request/parser implementation and `crates/trusted-server-js/lib/src/integrations/aps/render.ts` for the browser renderer contract.
diff --git a/docs/roadmap.md b/docs/roadmap.md
index d76c14b96..e0b16e336 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -75,6 +75,12 @@ Our development is focused on three key areas:
 - Real-time cohort updates
 - Secure Signals integration
 
+**Amazon Publisher Services (APS) OpenRTB Integration**
+
+- Banner OpenRTB bidding with decoded-price competition
+- Opaque sandboxed rendering for direct and GAM/Universal Creative paths
+- Controlled rollout pending APS account-team confirmation for edge-originated traffic
+
 ### Planned for 2026
 
 **Full Google Ad Manager (GAM) Support**
@@ -84,12 +90,6 @@ Our development is focused on three key areas:
 - Programmatic guaranteed support
 - First-party GAM reporting
 
-**Amazon Publisher Services (APS) Integration**
-
-- Transparent Ad Marketplace (TAM) support
-- A9 bidding integration
-- First-party APS header bidding
-
 **Kargo SSP Integration**
 
 - Native Kargo bid adapter
diff --git a/docs/superpowers/plans/2026-07-15-aps-openrtb-first-class-integration.md b/docs/superpowers/plans/2026-07-15-aps-openrtb-first-class-integration.md
new file mode 100644
index 000000000..0f89e6f9f
--- /dev/null
+++ b/docs/superpowers/plans/2026-07-15-aps-openrtb-first-class-integration.md
@@ -0,0 +1,897 @@
+# Amazon APS OpenRTB First-Class Integration Implementation Plan
+
+> **For agentic workers:** Implement task-by-task with tests first. Do not use bare
+> `cargo test --workspace`; use the adapter-aware aliases from `.cargo/config.toml`.
+> Commit or push only when the supervising user explicitly requests it.
+
+**Goal:** Replace the legacy APS `/e/dtb/bid` integration with APS OpenRTB,
+participate with decoded prices without mediation, and render APS banner creatives in
+the direct-auction and GPT/page-bids browser paths.
+
+**Architecture:** Keep APS request/response policy in an APS-specific OpenRTB adapter.
+Map the response into the shared `Bid` plus a typed, versioned APS renderer descriptor.
+Carry that descriptor through `/auction` and the publisher bid map. TSJS builds a
+Trusted Server-owned bootstrap for the fixed APS `prebid-creative.js` runner and
+executes it in the approved sandbox. Ordinary `adm` remains on the existing mandatory
+sanitize/rewrite path.
+
+**Tech stack:** Rust 2024, generated OpenRTB types, serde/serde_json, base64 0.22,
+error-stack, URL validation, TypeScript, Vitest, Prebid Universal Creative messaging.
+
+**Spec:**
+`docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md`
+
+**Branch:** `issue-764-aps-openrtb`
+
+---
+
+## Context and guardrails for every task
+
+- APS may be implemented and tested before production edge support is confirmed.
+  Broad production rollout remains blocked until the APS account team confirms the
+  Fastly/edge contract.
+- Send APS SDK identity `{ "source": "prebid", "version": "2.2.0" }`.
+- Build the exact renderer allowlist: one bid with only `id`, `price`, `w`, `h`,
+  `ext.creativeurl`, and `ext.tagtype`. Do not preserve unknown fields or silently
+  expose the complete APS response.
+- The outer renderer sandbox must omit `allow-same-origin`.
+  `allow_script_creatives` is a server-side capability gate that defaults false;
+  disabled script bids must be dropped before candidate reduction/winner selection.
+  Enable it only under the staged opaque-origin and controlled-account test policy.
+- APS user sync and APS `nurl`/`burl` delivery are out of scope. Do not add either
+  browser path.
+- Cut over directly. Keep `pub_id` as an alias only; do not add a legacy protocol
+  switch.
+- When a Trusted Server APS renderer is present, do not call
+  `apstag.setDisplayBids()`.
+- Banner only. Do not advertise APS video support in this issue.
+- Do not weaken `sanitize_creative_html` or its tests.
+- Raw APS requests/responses remain TRACE-only. Never log real account IDs, EIDs,
+  consent strings, creative URLs, bid tokens, or response bodies at normal levels.
+- All committed fixtures/docs use fictional `example` values. Controlled test-account
+  values stay out of the repository and terminal transcripts intended for review.
+- Use `error-stack`; no anyhow/eyre/thiserror in core code.
+- Use `log::` macros, not `println!`; use descriptive `expect("should ...")`, not
+  `unwrap()`.
+- Run the focused test immediately after each production-code change.
+
+---
+
+## File map
+
+### Rust core
+
+- `crates/trusted-server-core/src/auction/types.rs`: bid identifiers and typed
+  renderer contract.
+- `crates/trusted-server-core/src/openrtb.rs`: narrowly scoped request/bid extension
+  serialization types if they are shared outside APS.
+- `crates/trusted-server-core/src/integrations/aps.rs`: configuration, OpenRTB request,
+  response parser, exact renderer envelope, candidate reduction, static renderer route,
+  diagnostics and provider dispatch.
+- `crates/trusted-server-core/src/integrations/mod.rs`: register the APS proxy route as
+  well as the separate auction provider.
+- `crates/trusted-server-core/src/auction/formats.rs`: page derivation and `/auction`
+  renderer extension.
+- `crates/trusted-server-core/src/auction/orchestrator.rs`: decoded-price direct-winner
+  coverage and stale-comment removal.
+- `crates/trusted-server-core/src/integrations/adserver_mock.rs`: preserve renderer and
+  IDs through mediation.
+- `crates/trusted-server-core/src/publisher.rs`: normal bid-map renderer transport and
+  APS `hb_adid`.
+
+### Browser
+
+- `crates/trusted-server-js/lib/src/core/types.ts`: APS renderer wire type.
+- `crates/trusted-server-js/lib/src/core/auction.ts`: parse `/auction` renderer ext.
+- `crates/trusted-server-js/lib/src/core/request.ts`: direct APS render dispatch.
+- New `crates/trusted-server-js/lib/src/integrations/aps/render.ts`: exact envelope
+  decoding/cross-checking, opaque renderer frame creation and postMessage dispatch.
+- `crates/trusted-server-js/lib/src/integrations/gpt/index.ts`: exact APS Universal
+  Creative bridge, APS beacon suppression and native-APS hook removal.
+- New `crates/trusted-server-js/lib/test/fixtures/aps-renderer-v1.json`: shared Rust/TS
+  golden wire fixture.
+- New `crates/trusted-server-js/lib/test/integrations/aps/render.test.ts` plus existing
+  core/GPT tests.
+- `crates/trusted-server-integration-tests/browser/`: restrictive-CSP and opaque-origin
+  Playwright coverage.
+
+### Configuration and docs
+
+- `trusted-server.example.toml`
+- `docs/guide/integrations/aps.md`
+- `CHANGELOG.md`
+
+---
+
+## Task 1: Add typed bid identifiers and renderer state
+
+**What:** Give the shared auction model enough typed state to distinguish OpenRTB bid,
+ad, and creative IDs and carry a validated APS renderer without using arbitrary
+metadata.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/auction/types.rs`
+- Modify: every production/test `Bid { ... }` construction found by
+  `rg -n 'Bid \{' crates/trusted-server-core`
+- Test: `crates/trusted-server-core/src/auction/types.rs`
+
+- [ ] Add failing serde tests for a bid with:
+  - separate `bid_id`, `ad_id`, and `creative_id`;
+  - an APS renderer version, account ID, selected bid ID, tag type, creative URL,
+    encoded response, and dimensions; and
+  - `renderer = None` omission for ordinary bids.
+- [ ] Define a strict `ApsTagType` enum with only `Iframe` and `Script`.
+- [ ] Define a versioned, typed renderer enum/descriptor. The serialized renderer must
+      use camelCase and a discriminator equivalent to:
+
+  ```json
+  {
+    "type": "aps",
+    "version": 1,
+    "accountId": "example-account-id",
+    "bidId": "fictional-bid-id",
+    "creativeId": "fictional-creative-id",
+    "tagType": "iframe",
+    "creativeUrl": "https://creative.example/render",
+    "aaxResponse": "base64-data",
+    "width": 300,
+    "height": 250
+  }
+  ```
+
+- [ ] Add to `Bid`:
+  - `bid_id: Option<String>`;
+  - `creative_id: Option<String>`; and
+  - `renderer: Option<...>`.
+- [ ] Make descriptor `creativeId` optional and omit it when APS does not return
+      `crid`; add a serde test for the absent-`crid` case.
+- [ ] Correct stale comments saying APS prices are encoded or that APS has no creative
+      delivery mechanism.
+- [ ] Update every `Bid` literal. Use `None` outside production parser paths; do not use
+      serde defaults to hide missed production mappings.
+- [ ] Update Prebid's `parse_bid` to preserve OpenRTB `id` as `bid_id` and `crid` as
+      `creative_id`, while retaining the existing strict `adid -> ad_id` semantics.
+- [ ] Run the focused tests:
+
+  ```bash
+  cargo test-fastly auction::types
+  cargo test-fastly integrations::prebid::tests::parse_bid
+  ```
+
+- [ ] Run `cargo fmt --all` and `cargo check-fastly` before proceeding.
+
+**Expected result:** Shared bids can represent APS renderer state without overloading
+`ad_id` or leaking renderer data through general metadata.
+
+---
+
+## Task 2: Cut APS configuration over to the OpenRTB contract
+
+**What:** Replace the public APS configuration terminology and default endpoint before
+replacing request/response behavior.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/aps.rs`
+- Test: existing APS test module in the same file
+
+- [ ] Add failing configuration tests proving:
+  - `account_id = "example-account-id"` deserializes;
+  - legacy `pub_id` deserializes to the same field;
+  - string and integer compatibility is retained;
+  - empty and whitespace-only strings fail validation;
+  - surrounding whitespace is trimmed deterministically;
+  - supplying both names fails as a duplicate field;
+  - the default endpoint is `/e/pb/bid`;
+  - HTTP, missing-host, and credential-bearing endpoint overrides fail validation; and
+  - APS remains disabled by default; and
+  - `allow_script_creatives` defaults false.
+- [ ] Rename `ApsConfig.pub_id` to `account_id`, using `pub_id` only as a serde alias.
+      Trim string values, reject empty-after-trim, normalize integers to strings, and
+      rename the custom deserializer/error text accordingly.
+- [ ] Add `allow_script_creatives: bool` with a serde default of `false`. Treat it as a
+      server-side bid-eligibility capability, not a browser-only rendering preference.
+- [ ] Change `default_endpoint()` to:
+
+  ```text
+  https://web.ads.aps.amazon-adsystem.com/e/pb/bid
+  ```
+
+- [ ] Replace generic URL-only endpoint validation with a custom check requiring HTTPS,
+      a non-empty host, and no username/password. Do not add a plaintext test exception:
+      the endpoint response is trusted to select executable renderer data.
+- [ ] Remove account IDs from registration and request INFO logs. Log only that APS was
+      registered and the endpoint/provider-safe state needed operationally.
+- [ ] Change `supports_media_type` to banner only.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly integrations::aps::tests
+  ```
+
+- [ ] Run `cargo fmt --all -- --check`.
+
+**Expected result:** Existing configs continue through `pub_id`, new configs use
+`account_id`, and no runtime protocol switch is introduced.
+
+---
+
+## Task 3: Replace the legacy request builder with APS OpenRTB
+
+**What:** Delete the private `/e/dtb/bid` request types and build the request described
+by the design spec from trusted auction context.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/aps.rs`
+- Modify only if useful: `crates/trusted-server-core/src/openrtb.rs`
+- Modify: `crates/trusted-server-core/src/auction/formats.rs`
+- Test: APS and auction-format test modules
+
+### 3.1 Request fixture tests
+
+- [ ] Add a failing complete-request test with fictional values. Assert exact JSON for:
+  - request `id`, `tmax`, and `cur = ["USD"]`;
+  - `ext.account`;
+  - `ext.sdk.source = "prebid"` and `version = "2.2.0"`;
+  - one impression per eligible slot with direct `imp.id` mapping;
+  - banner `format`, first `w`/`h`, `topframe = 0`, floor, floor currency, and
+    unconditional `secure = 1`;
+  - site page/domain/publisher fields;
+  - consent-allowed user ID and EIDs;
+  - UA/IP/language/DNT and coarse geo;
+  - TCF/USP/GPP registrations with COPPA omitted because no trusted signal exists; and
+  - absence of all PBS-only request and impression extensions.
+- [ ] Add focused privacy/validation tests:
+  - latitude/longitude are omitted while permitted coarse geo remains;
+  - gated-out user/EID values stay absent;
+  - no user data, keywords, gender, YOB, customdata, cookies, or arbitrary headers;
+  - non-banner slots are omitted;
+  - dimensions above `i32::MAX` are omitted safely;
+  - empty/invalid formats cannot create a malformed impression;
+  - configured and effective timeout use the orchestrator-granted budget.
+
+### 3.2 `/auction` page derivation
+
+- [ ] Add failing tests to `auction/formats.rs` proving:
+  - a valid same-publisher HTTP(S) `Referer` becomes the `/auction` current page;
+  - userinfo, wrong-host, non-HTTP(S), malformed, and oversized URLs are rejected;
+  - rejection falls back to the configured publisher origin; and
+  - no unrestricted browser body field is accepted as page context.
+- [ ] Implement a small private URL-validation helper. Reuse it in APS referrer
+      handling if practical, but do not make it a broad URL-policy refactor.
+
+### 3.3 Implementation
+
+- [ ] Remove `ApsBidRequest`, `ApsSlot`, legacy consent wrappers, slot-ID fallback, and
+      `to_aps_request`.
+- [ ] Add APS request extension types locally in `aps.rs` unless another module must
+      serialize them. Implement `ToExt` consistently with existing OpenRTB extension
+      types.
+- [ ] Implement `build_openrtb_request(&AuctionRequest, &AuctionContext)` using generated
+      OpenRTB types and `to_openrtb_i32`.
+- [ ] Build registrations from the existing `ConsentContext` placements. Copy only the
+      small field mapping needed by APS; do not expose/refactor the PBS builder in this
+      task.
+- [ ] Derive `site.ref` only from a valid HTTP(S) downstream `Referer` that differs from
+      the normalized current page.
+- [ ] Change `request_bids` to serialize/send the OpenRTB body with
+      `Content-Type: application/json`, the existing bounded auction timeout, and no
+      forwarded cookies.
+- [ ] Keep serialized request logging at TRACE.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly integrations::aps::tests
+  cargo test-fastly auction::formats
+  cargo check-fastly
+  ```
+
+- [ ] Review serialized request fixtures against the immutable upstream request code;
+      explicitly confirm no `ext.prebid` or Trusted Server signing extension appears.
+
+**Expected result:** Every eligible APS banner slot produces a standards-based OpenRTB
+impression with explicit APS and privacy policy.
+
+---
+
+## Task 4: Parse APS OpenRTB and build the minimized renderer envelope
+
+**What:** Replace `contextual.slots` parsing with strict `seatbid` parsing, decoded CPM,
+one APS candidate per impression, and the exact renderer envelope.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/aps.rs`
+- Test: APS test module
+
+### 4.1 Add failing response tests
+
+- [ ] A runner-compatible banner bid maps:
+  - `id -> bid_id`;
+  - optional `adid -> ad_id` and `crid -> creative_id`;
+  - `impid -> slot_id`;
+  - decoded price/USD, dimensions and domains;
+  - `Bid.bidder = "aps"` regardless of upstream seat; and
+  - `ext.creativeurl`/`ext.tagtype` into the typed renderer.
+- [ ] Missing, string, numeric, and unexpected seat values never become `Bid.bidder` or
+      `hb_bidder` and do not invalidate an otherwise valid bid.
+- [ ] A valid runner-compatible bid without `crid` remains renderable with no
+      `creativeId` in the descriptor.
+- [ ] The immutable official adapter fixture (`ext.bidder` only) is an expected safe
+      drop because the live runner requires `creativeurl`/`tagtype`.
+- [ ] `iframe` and `script` parse into strict enum variants. With
+      `allow_script_creatives = false`, every script bid is safe-dropped before
+      per-impression reduction and winner selection; iframe bids remain eligible.
+- [ ] With one higher-priced script bid and one lower-priced iframe bid for the same
+      impression, the disabled script cannot win and the iframe candidate survives.
+      With only disabled script bids, APS returns no bid.
+- [ ] An APS bid with `adm` but no valid URL/tag type is dropped. When valid renderer
+      metadata coexists with `adm`, all markup is excluded from the browser envelope
+      and `Bid.creative`.
+- [ ] HTTP 204, empty/missing `seatbid`, and seat bids with no bids are normal no-bids.
+- [ ] Legacy `{ "contextual": ... }` is `Error`/`unexpected_response_shape`.
+- [ ] Drop individual bids with unknown/missing `impid`, invalid price/currency/media,
+      missing/zero/out-of-range/incompatible `w` or `h`, missing bid ID, invalid tag
+      type, disabled script capability, or invalid creative URL.
+- [ ] Creative URLs using HTTP, credentials, excessive length, malformed syntax, or the
+      configured publisher origin are rejected.
+- [ ] One structurally malformed bid does not discard another valid bid. Invalid JSON or
+      non-representable numeric literals fail the complete response.
+- [ ] APS `nurl`/`burl` are intentionally discarded, and top-level `ext.userSyncs`
+      reaches neither `Bid`, diagnostics, nor renderer data.
+- [ ] Diagnostics contain only fixed reason/count keys and never IDs, URLs, payloads,
+      account values, seats, or raw extension data.
+
+### 4.2 Exact envelope and collision tests
+
+- [ ] Add `test/fixtures/aps-renderer-v1.json` containing exactly:
+  - root `seatbid`;
+  - one seat object containing only `bid`;
+  - one bid containing only `id`, `price`, `w`, `h`, and `ext`; and
+  - `ext` containing only `creativeurl` and `tagtype`.
+- [ ] Assert Rust serialization equals that golden JSON semantically and that decoded
+      `aaxResponse` has no top-level ID/currency, seat, impid, ad/crid/domain,
+      notifications, markup, syncs, sibling bids, or unknown extensions.
+- [ ] Remove unknown fields after transient parsing; do not copy an upstream extension
+      map wholesale into the renderer envelope.
+- [ ] Add a response over the 256 KiB pre-base64 cap and assert
+      `render_payload_too_large`.
+- [ ] Add two valid APS bids with the same impression/seat. Assert the parser returns
+      only the highest price; for a tie, lexicographically lowest bid ID wins with its
+      own matching renderer payload.
+
+### 4.3 Implementation
+
+- [ ] Remove all legacy request/response types, slot maps and tests.
+- [ ] Special-case HTTP 204 before body collection/JSON parsing.
+- [ ] Parse the response as `serde_json::Value`, validate response-level fields, then
+      validate each bid independently so a wrong-typed bid cannot discard valid
+      siblings.
+- [ ] Set `Bid.bidder = "aps"`; discard upstream seat/network ID unless a bounded typed
+      internal consumer is introduced. Set APS `nurl = None` and `burl = None`.
+- [ ] Require present, positive, compatible `w` and `h`. Apply
+      `allow_script_creatives` before adding a candidate to the per-impression group so
+      a disabled script cannot reach floors, mediation, or winner selection.
+- [ ] Validate creative URL against the configured publisher origin and build the exact
+      allowlisted envelope from new values rather than cloning upstream objects.
+- [ ] Group accepted candidates by `impid`, reduce deterministically to one, then build
+      the final `AuctionResponse` and aggregate diagnostics.
+- [ ] Preserve `collect_response_bounded(..., UPSTREAM_RTB_MAX_RESPONSE_BYTES, "aps")`,
+      TRACE-only raw body logging, and safe aggregate normal logs.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly integrations::aps::tests
+  cargo fmt --all -- --check
+  cargo clippy-fastly
+  ```
+
+**Expected result:** APS returns at most one priced, renderer-compatible candidate per
+impression, with an exact browser envelope and stable `bidder = "aps"`.
+
+---
+
+## Task 5: Emit APS winners through `/auction` and prove direct selection
+
+**What:** Use the new identifiers and renderer in the OpenRTB response without
+manufacturing an empty creative, then replace the old mediation assumptions.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/auction/formats.rs`
+- Modify: `crates/trusted-server-core/src/openrtb.rs` if a typed bid extension helper is
+  useful
+- Modify: `crates/trusted-server-core/src/auction/orchestrator.rs`
+- Test: format and orchestrator test modules
+
+### 5.1 Failing tests
+
+- [ ] `/auction` maps `Bid.bid_id`, `ad_id`, and optional `creative_id` to OpenRTB
+      `id`, `adid`, and optional `crid` instead of fabricating APS identifiers.
+- [ ] An APS renderer winner has no `adm` key and has
+      `ext.trusted_server.renderer` with the complete versioned descriptor—not a
+      `{type,version}` abbreviation.
+- [ ] A normal `Bid.creative` is still sanitized and rewritten before becoming `adm`.
+- [ ] A winning bid with neither creative nor renderer fails explicitly; it does not
+      serialize `adm: ""`.
+- [ ] A renderer descriptor does not enter the HTML sanitizer.
+- [ ] APS decoded price wins with no mediator when it is highest.
+- [ ] APS loses to a higher clear-price bid.
+- [ ] APS is removed below a slot floor.
+- [ ] Optional mediator presence does not make decoded APS pricing special.
+
+### 5.2 Implementation
+
+- [ ] Add a typed bid-extension serializer for `trusted_server.renderer`.
+- [ ] In `convert_to_openrtb_response`:
+  - preserve real bid/ad/creative IDs;
+  - process `creative` only through the existing sanitize/rewrite branch;
+  - emit renderer ext only for a typed renderer; and
+  - return an auction error for a winner with no render source.
+- [ ] Remove stale “mediation should have provided creative” APS assumptions and encoded
+      price comments.
+- [ ] Replace old orchestrator APS tests with decoded-price/floor tests. Do not change the
+      winner algorithm itself.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly auction::formats
+  cargo test-fastly auction::orchestrator
+  cargo fmt --all -- --check
+  ```
+
+**Expected result:** Direct clients receive a priced APS winner with an explicit render
+capability and never mistake an empty `adm` for a creative.
+
+---
+
+## Task 6: Preserve APS renderer state through mediation and publisher bid maps
+
+**What:** Ensure both publisher paths expose the same APS descriptor and a mediator
+cannot accidentally strip it.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/adserver_mock.rs`
+- Modify: `crates/trusted-server-core/src/publisher.rs`
+- Test: tests in both files
+
+### 6.1 Mediation tests
+
+- [ ] Add a regression test documenting the current collision: two unreduced APS bids
+      with the same provider/slot/bidder overwrite the `(provider, slot, bidder)` index
+      and can restore the wrong renderer.
+- [ ] Feed the parser's reduced APS response into mediation and prove only the selected
+      source bid reaches the index/request and its bid ID/renderer survive reconstruction.
+- [ ] Keep the broader mediator index unchanged in this issue; APS avoids its existing
+      ambiguity by returning one candidate per impression. Extend restoration only for
+      `bid_id`, optional `creative_id`, and renderer while preserving existing non-APS
+      notification/cache behavior.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly integrations::adserver_mock
+  ```
+
+### 6.2 Bid-map tests
+
+- [ ] Add failing `build_bid_map` tests proving:
+  - APS renderer is present when `include_adm = false`;
+  - renderer data is identical for initial-page and page-bids serialization;
+  - `hb_bidder` is always `aps`, never upstream seat/network ID;
+  - `hb_adid` uses APS selected `bid_id` ahead of OpenRTB `adid`;
+  - PBS Cache UUID remains highest priority for PBS bids;
+  - APS `nurl`/`burl` are absent while existing non-APS notifications are unchanged;
+  - no general metadata is exposed in normal mode;
+  - `aaxResponse` and account data survive `build_bids_script` escaping without
+    breaking out of the script; and
+  - a non-APS bid has no renderer property.
+- [ ] Update `build_bid_map` to serialize typed renderer data normally while retaining
+      `adm`/`debug_bid` only under the existing debug flag.
+- [ ] Set APS `hb_adid` from the descriptor's selected bid ID. Preserve current cache and
+      ad-ID fallbacks.
+- [ ] Update `debug_bid` deliberately: IDs may be shown under existing debug behavior,
+      but do not duplicate the potentially large encoded renderer envelope there.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly publisher
+  cargo fmt --all -- --check
+  ```
+
+**Expected result:** Direct, mediated, initial-navigation, and SPA auction paths retain
+one typed APS render contract without exposing losing bids or arbitrary metadata.
+
+---
+
+## Task 7: Add the opaque APS renderer endpoint and direct-auction integration
+
+**What:** Serve a static renderer document with its own CSP, validate the exact data the
+vendor consumes, and keep all APS/bidder execution below an outer opaque-origin
+sandbox.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/aps.rs`
+- Modify: `crates/trusted-server-core/src/integrations/mod.rs`
+- New: `crates/trusted-server-js/lib/src/integrations/aps/render.ts`
+- New: `crates/trusted-server-js/lib/test/integrations/aps/render.test.ts`
+- New: `crates/trusted-server-js/lib/test/fixtures/aps-renderer-v1.json`
+- Modify: `crates/trusted-server-js/lib/src/core/types.ts`
+- Modify: `crates/trusted-server-js/lib/src/core/auction.ts`
+- Modify: `crates/trusted-server-js/lib/src/core/request.ts`
+- Modify: `crates/trusted-server-js/lib/test/core/auction.test.ts`
+- Modify/add: `crates/trusted-server-integration-tests/browser/`
+
+### 7.1 Shared wire contract
+
+- [ ] Add TypeScript discriminated types matching the Rust descriptor, with optional
+      `creativeId`.
+- [ ] Make the shared fictional JSON fixture the source of truth: Rust serialization
+      equals it and TS tests import it.
+- [ ] Add `/auction` parser tests for valid renderer ext, absent APS `adm`, optional
+      creative ID, ordinary non-APS `adm`, unrelated ext, and malformed descriptors.
+- [ ] Keep parsing structural; complete trust validation happens before DOM/message
+      side effects.
+
+### 7.2 Static renderer endpoint
+
+- [ ] Add APS to `integrations::builders()` as a proxy registration using the same
+      validated `ApsConfig`, `.with_proxy(...)`, and `.without_js()`.
+- [ ] Register only `GET /integrations/aps/renderer` and return a static document—no
+      account, bid, URL, or response data in HTML.
+- [ ] Add Rust tests for exact route registration, method rejection, content type,
+      `nosniff`, `Referrer-Policy: no-referrer`, and the explicit renderer CSP. The CSP
+      must repeat the approved sandbox tokens without `allow-same-origin` so direct
+      embedding cannot bypass the opaque boundary.
+- [ ] Before loading the vendor runner, the static initializer reads and strictly
+      validates the expected nonce from the iframe URL fragment, stores it, removes the
+      fragment from visible history, and installs its one-message listener.
+- [ ] The static script accepts one parent message, verifies `event.source`, version,
+      exact structure, and equality with the independently fragment-bound nonce, then
+      removes its listener, initializes the official account queue, dispatches
+      `prebid/creative/render`, and dynamically loads the fixed runner. Reply with the
+      accepted nonce only after runner load (or report runner failure). Because the
+      sandbox origin is opaque, use `"*"` as the target origin in both directions but
+      require the exact child/source window and one-time nonce.
+- [ ] Load only the fixed Amazon runner URL; do not interpolate renderer data into
+      script text, HTML, `srcdoc`, `document.write`, or another executable sink.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly integrations::aps
+  cargo test-fastly integrations::tests
+  ```
+
+### 7.3 Decode and cross-check consumed data
+
+- [ ] `validateApsRenderer` must base64-decode UTF-8 JSON and require the exact allowlist:
+      one seat, one bid, exact bid/ext keys, finite price, dimensions, URL, and tag type.
+- [ ] Cross-check decoded ID/dimensions/URL/tag type against descriptor fields.
+- [ ] Reject unknown keys, markup, notifications, syncs, invalid base64/UTF-8/JSON,
+      non-HTTPS or credential-bearing URLs, and URLs matching `location.origin`.
+- [ ] Validate before slot clearing, `stopImmediatePropagation`, iframe creation, or
+      `postMessage`.
+- [ ] Repeat message/envelope validation inside the static renderer document.
+
+### 7.4 Opaque direct renderer
+
+- [ ] `renderApsCreative` creates a sized iframe with `src` set to
+      `/integrations/aps/renderer`; it never uses outer `srcdoc`.
+- [ ] Apply exactly these tokens and assert `allow-same-origin` is absent:
+
+  ```text
+  allow-forms
+  allow-pointer-lock
+  allow-popups
+  allow-popups-to-escape-sandbox
+  allow-scripts
+  allow-top-navigation-by-user-activation
+  ```
+
+- [ ] Generate at least 128 random bits per frame with `crypto.getRandomValues`, encode
+      them as strict base64url, and set `iframe.src` to the trusted renderer URL with
+      that nonce in the fragment before insertion/navigation. After load, post the
+      validated descriptor with the same nonce. Clear existing content and reveal the
+      frame only after an exact source- and nonce-bound runner-ready acknowledgement;
+      remove an unacknowledged or failed hidden frame after a bounded timeout.
+- [ ] Reject a missing/malformed fragment, nonce mismatch, repeat, or stale message; a
+      nonce carried only in the posted message is not sufficient.
+- [ ] Leave existing slot content intact on validation/load failure and log no payload,
+      account, URL or bid ID.
+- [ ] Dispatch valid APS renderer bids before ordinary non-APS `adm`; do not change the
+      generic sanitizer/renderer.
+
+### 7.5 Restrictive-CSP and origin proof
+
+- [ ] Add Playwright coverage using a restrictive publisher CSP that permits only
+      `frame-src 'self'` for the renderer route.
+- [ ] Use a local fictional runner/creative implementation matching observed APS
+      iframe/script behavior; CI must not depend on the live Amazon script.
+- [ ] Prove iframe and fetched-HTML script creatives cannot read or modify
+      `top.document`, even though the nested vendor frame requests
+      `allow-same-origin`. Also embed the renderer without an iframe sandbox attribute
+      and prove the response-level CSP sandbox still keeps it opaque.
+- [ ] Prove the renderer route's CSP permits required HTTPS ad resources, the outer
+      frame stays opaque, malformed/mismatched envelopes or fragment/message nonce
+      mismatches do not clear slots, replay is rejected, and the runner can size/render
+      without parent-origin `frameElement` access.
+- [ ] Keep `allow_script_creatives = false` for normal traffic during local browser
+      proof. If script rendering/resizing fails, keep the server gate false and stop for
+      an APS-supported isolated renderer contract. Never add `allow-same-origin` to the
+      outer frame.
+- [ ] Run:
+
+  ```bash
+  cd crates/trusted-server-js/lib
+  npx vitest run test/integrations/aps/render.test.ts test/core/auction.test.ts
+  node build-all.mjs
+  npm run format
+
+  cd ../../../crates/trusted-server-integration-tests/browser
+  npx playwright test
+  ```
+
+**Expected result:** Direct APS rendering uses a separately served document below an
+opaque outer sandbox with a pre-bound, one-time nonce; script bids cannot win while the
+default-off server capability is disabled.
+
+---
+
+## Task 8: Integrate APS with the GPT/Prebid Universal Creative bridge
+
+**What:** Serve APS descriptors through the existing source-checked `Prebid Request`
+message path and stop signaling the native APS SDK for TS winners.
+
+**Files:**
+
+- Modify: `crates/trusted-server-js/lib/src/integrations/gpt/index.ts`
+- Modify: `crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts`
+- Modify if needed: `crates/trusted-server-js/lib/test/integrations/gpt/index.test.ts`
+- Reuse: `src/integrations/aps/render.ts`
+
+### 8.1 Add failing bridge tests
+
+- [ ] A matching APS `hb_adid` and renderer:
+  - is accepted only from the owning slot's message source;
+  - is fully decoded/cross-checked before `stopImmediatePropagation()`;
+  - does not fetch PBS Cache or fire generic nurl/burl beacons;
+  - posts one exact serializable `Prebid Response` using the deployed Universal
+    Creative renderer version; and
+  - creates only the opaque renderer-route iframe before posting the descriptor.
+- [ ] Two concurrent requests for the same APS ad ID do not double-render.
+- [ ] An APS descriptor requested from another slot is ignored.
+- [ ] Invalid renderer data does not stop another legitimate handler and does not clear
+      a slot.
+- [ ] Existing debug-ADM and PBS Cache tests remain green.
+- [ ] `adInit()` does not call `apstag.setDisplayBids()` for a bid with a Trusted Server
+      APS renderer, even if `window.apstag` exists.
+- [ ] A publisher-owned native APS SDK remains otherwise untouched; TS does not delete,
+      reinitialize, or monkey-patch it.
+
+### 8.2 Implement bridge support
+
+- [ ] Import the shared envelope validator/opaque-frame helper without importing the
+      full Prebid bundle.
+- [ ] Add the APS branch after source-slot ownership and full renderer validation, before
+      debug ADM/PBS Cache branches.
+- [ ] Define and fixture-test the exact Universal Creative message object, including
+      `rendererVersion`; do not describe or send a non-cloneable function.
+- [ ] Compute an absolute `/integrations/aps/renderer` URL from the trusted publisher
+      page origin before crossing into GAM; a relative URL in the creative frame would
+      resolve against GAM. Validate that URL separately from APS data.
+- [ ] Keep renderer source static and limited to creating the sandboxed iframe with that
+      absolute renderer URL plus a fresh nonce fragment, then post validated data and
+      the matching nonce after load and resolve only after the source- and nonce-bound
+      renderer-ready acknowledgement.
+- [ ] Preserve `renderingAdIds` and live `window.tsjs.bids`. Do not call
+      `fireWinBillingBeacons` for APS; existing non-APS beacon deduplication is unchanged.
+- [ ] Remove the `apstag?.setDisplayBids?.()` block that treats every APS targeting bid
+      as a native SDK bid. Update comments accordingly.
+- [ ] Run:
+
+  ```bash
+  cd crates/trusted-server-js/lib
+  npx vitest run \
+    test/integrations/aps/render.test.ts \
+    test/integrations/gpt/ad_init.test.ts \
+    test/integrations/gpt/index.test.ts \
+    test/integrations/gpt/spa_hook.test.ts
+  npm run format
+  ```
+
+**Expected result:** Initial navigation and SPA page-bids render the selected APS bid
+through the same typed bootstrap, without relying on native `apstag` state.
+
+---
+
+## Task 9: Update operator configuration, migration docs, and changelog
+
+**What:** Replace all legacy public guidance and document test/rollout dependencies.
+
+**Files:**
+
+- Modify: `trusted-server.example.toml`
+- Rewrite: `docs/guide/integrations/aps.md`
+- Modify: `CHANGELOG.md`
+- Review references found by:
+
+  ```bash
+  rg -n 'e/dtb/bid|pub_id|amznbid|amznp|setDisplayBids|APS.*mediat' \
+    --glob '!target/**' .
+  ```
+
+- [ ] Change the example to `account_id` and `/e/pb/bid`, with fictional values.
+- [ ] Document `pub_id` as a compatibility alias and duplicate-name failure.
+- [ ] Remove any claim that `slot_id`/`bidders.aps.slotID` is required for the OpenRTB
+      provider.
+- [ ] Document banner-only scope, USD comparison, decoded-price direct winners, and
+      aggregate diagnostics.
+- [ ] Document both rendering paths, static renderer endpoint, fixed APS runner URL,
+      exact envelope allowlist, fragment-bound nonce, outer sandbox without
+      `allow-same-origin`, renderer endpoint/publisher CSP requirements, and the
+      default-off `allow_script_creatives` server gate.
+- [ ] State that user sync and Trusted Server firing of APS `nurl`/`burl` are not
+      implemented.
+- [ ] State that public APS metadata says PBS unsupported and production edge traffic
+      still requires account-team confirmation.
+- [ ] Add a cohort rollout checklist:
+  - TS APS enabled;
+  - native APS demand disabled for that cohort;
+  - GAM line item/Universal Creative prepared for `hb_bidder=aps` and selected
+    `hb_adid`;
+  - iframe rendering observed first while `allow_script_creatives = false`;
+  - script enabled only for the isolated cohort after local browser proof, then observed
+    in a real browser; and
+  - no real IDs/tokens captured in docs or fixtures.
+- [ ] Document rollback as disabling APS, restoring native APS for the cohort, or binary
+      rollback—not a legacy config switch.
+- [ ] Add a breaking/migration changelog entry for endpoint and canonical field changes.
+- [ ] Run:
+
+  ```bash
+  cd docs
+  npx prettier --write \
+    superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md \
+    superpowers/plans/2026-07-15-aps-openrtb-first-class-integration.md \
+    guide/integrations/aps.md
+  npm run format
+  ```
+
+**Expected result:** Operators cannot accidentally configure the old protocol or assume
+user sync/video/native SDK behavior that no longer exists.
+
+---
+
+## Task 10: Controlled APS and browser verification
+
+**What:** Validate the uncertain external contract without putting account-specific
+material into source control.
+
+**Prerequisites:** Controlled APS account/config supplied out of band; native APS demand
+disabled for the test cohort; representative GAM line items and publisher CSP; local
+restrictive-CSP/opaque-origin script proof already passing.
+
+- [ ] Deploy with APS enabled only in the controlled cohort and
+      `allow_script_creatives = false` initially.
+- [ ] Prove with parser/orchestrator telemetry and tests that disabled script bids are
+      removed before candidate reduction/winner selection and cannot leave a winning
+      slot without a renderer.
+- [ ] Confirm the outbound body has:
+  - `/e/pb/bid` endpoint;
+  - `ext.account` from operator config;
+  - `ext.sdk = { source: "prebid", version: "2.2.0" }`;
+  - expected impressions, floors, page/device/privacy fields; and
+  - no latitude/longitude or disallowed identity fields.
+- [ ] Confirm a bid returns a decoded price and can beat another provider with no
+      mediator.
+- [ ] Confirm the browser receives the exact one-bid allowlist in `aaxResponse`, with no
+      seat, impid, IDs beyond selected bid ID, domains, notifications, markup, syncs,
+      unknown extensions, sibling bids, or losing seats.
+- [ ] Confirm the immutable official no-renderer fixture safe-drops and separately
+      observe real `creativeurl`/`tagtype` responses.
+- [ ] Exercise a real `tagtype=iframe` response through direct `/auction` and
+      navigation/page-bids/GAM while the script gate remains false.
+- [ ] Only after the local browser proof, set `allow_script_creatives = true` for this
+      isolated cohort and exercise a real `tagtype=script` response through both paths.
+      Do not enable it for other traffic yet.
+- [ ] Verify the exact envelope works with the current APS runner. If it does not, record
+      only missing field names/shape, stop rollout, consult APS, and update spec/tests;
+      never preserve unknown fields or fall back to the full response.
+- [ ] Verify the outer frame has an opaque origin, restrictive publisher CSP succeeds,
+      click-through/dimensions work, and bidder content cannot access parent DOM.
+- [ ] If the fixed runner cannot render/resize script creatives without outer
+      `allow-same-origin`, restore `allow_script_creatives = false` and stop; do not
+      weaken the boundary.
+- [ ] Verify `apstag.setDisplayBids()` is not called for the TS winner and APS is not
+      participating twice.
+- [ ] Verify INFO/WARN logs and auction summaries contain no raw response or sensitive
+      values.
+- [ ] Obtain APS account-team confirmation before enabling broad production traffic.
+
+**Expected result:** Iframe creatives render under the default policy; script creatives
+become winner-eligible only for the staged cohort after both browser proof phases pass,
+or the server gate returns to false and rollout stops with a bounded contract gap.
+
+---
+
+## Task 11: Final regression and repository verification
+
+Run the complete required matrix from the repository root.
+
+### Rust formatting, tests, and lint
+
+- [ ] Run:
+
+  ```bash
+  cargo fmt --all -- --check
+  cargo test-fastly
+  cargo test-axum
+  cargo test-cloudflare
+  cargo test-spin
+  cargo clippy-fastly
+  cargo clippy-axum
+  cargo clippy-cloudflare
+  cargo clippy-cloudflare-wasm
+  cargo clippy-spin-native
+  cargo clippy-spin-wasm
+  ```
+
+### Cross-adapter parity
+
+- [ ] Run:
+
+  ```bash
+  cargo test \
+    --manifest-path crates/trusted-server-integration-tests/Cargo.toml \
+    --test parity
+  ```
+
+### JS and docs
+
+- [ ] Run:
+
+  ```bash
+  (cd crates/trusted-server-js/lib && node build-all.mjs)
+  (cd crates/trusted-server-js/lib && npx vitest run)
+  (cd crates/trusted-server-js/lib && npm run format)
+  (cd crates/trusted-server-integration-tests/browser && npx playwright test)
+  (cd docs && npm run format)
+  ```
+
+### Final review
+
+- [ ] Run:
+
+  ```bash
+  git diff --check
+  git status --short
+  ```
+
+- [ ] Review every `Bid` construction and mediator conversion for the new identifiers
+      and renderer field.
+- [ ] Review every `adm` assignment and prove it still passes through server
+      sanitization.
+- [ ] Review every renderer serialization boundary and prove only winning APS data is
+      exposed.
+- [ ] Review logs for account IDs, URLs, bid IDs, payloads, and consent/EID leakage.
+- [ ] Verify no real controlled-account data entered source, tests, docs, comments, or
+      snapshots.
+- [ ] Compare the final behavior against all acceptance criteria in the design spec.
+
+---
+
+## Suggested implementation checkpoints
+
+If commits are requested, keep reviewable checkpoints aligned with the tasks:
+
+1. `Add typed APS renderer state to auction bids`
+2. `Build APS OpenRTB requests`
+3. `Parse APS OpenRTB responses`
+4. `Carry APS renderer metadata to clients`
+5. `Render APS creatives in TSJS and GPT`
+6. `Document APS OpenRTB migration`
+
+Do not combine unrelated refactors with these checkpoints.
diff --git a/docs/superpowers/specs/2026-03-19-auction-orchestration-flow-design.md b/docs/superpowers/specs/2026-03-19-auction-orchestration-flow-design.md
index 02a86d629..4ecfa9e75 100644
--- a/docs/superpowers/specs/2026-03-19-auction-orchestration-flow-design.md
+++ b/docs/superpowers/specs/2026-03-19-auction-orchestration-flow-design.md
@@ -1,5 +1,11 @@
 # 🎯 Auction Orchestration Flow
 
+> [!WARNING]
+> The APS portions of this historical design are superseded by
+> [APS OpenRTB First-Class Integration](./2026-07-15-aps-openrtb-first-class-integration-design.md).
+> The legacy `/e/dtb/bid` contextual flow and encoded-price mediation described below
+> are not current runtime behavior.
+
 ## 🔄 System Flow Diagram
 
 ```mermaid
diff --git a/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md b/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md
new file mode 100644
index 000000000..0a9c84fd1
--- /dev/null
+++ b/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md
@@ -0,0 +1,839 @@
+# Amazon APS OpenRTB First-Class Integration Design
+
+**Date:** 2026-07-15  
+**Status:** Approved for implementation and test; production rollout remains subject to APS account-team validation  
+**Issue:** [#764 — Add the Amazon APS Prebid Adapter as first class integration](https://github.com/IABTechLab/trusted-server/issues/764)
+
+---
+
+## 1. Goal
+
+Replace Trusted Server's legacy Amazon Publisher Services (APS/TAM) wire contract
+with the OpenRTB contract used by the official APS Prebid.js adapter, so APS can:
+
+1. receive a valid OpenRTB request for each eligible banner slot;
+2. return a decoded CPM that competes directly without a mediator;
+3. render winning `iframe` and `script` creatives through a deliberate APS browser
+   renderer; and
+4. preserve Trusted Server's existing privacy, sanitization, bounded-I/O, and
+   observability invariants.
+
+The new default endpoint is:
+
+```text
+https://web.ads.aps.amazon-adsystem.com/e/pb/bid
+```
+
+The implementation may proceed against fictional fixtures and a controlled APS test
+account before APS confirms Fastly/edge-originated production support. Lack of that
+confirmation is a rollout gate, not an implementation blocker.
+
+---
+
+## 2. Approved decisions
+
+| Decision                  | Resolution                                                                                                                                                                                                                                                                               |
+| ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Edge/server support       | Implement and test now; do not claim production support until APS confirms it for the account.                                                                                                                                                                                           |
+| APS SDK identity          | Send `ext.sdk.source = "prebid"`, which APS has approved as the starting identity. Match the current adapter version with `ext.sdk.version = "2.2.0"`.                                                                                                                                   |
+| Creative response payload | Send an exact allowlisted envelope containing one bid with only `id`, `price`, `w`, `h`, `ext.creativeurl`, and `ext.tagtype`. Do not preserve unknown fields or silently fall back to the full response.                                                                                |
+| Sandbox compatibility     | APS confirmed `allow-same-origin` compatibility, but Trusted Server must not grant it on the outer security boundary. The outer renderer iframe has an opaque origin; descendant APS frames cannot relax an ancestor sandbox restriction. `script` remains disabled until browser proof. |
+| APS notifications         | Do not expose or fire APS `nurl`/`burl` in this issue. The fixed APS runner owns creative tracking until APS approves a separate notification contract.                                                                                                                                  |
+| APS user sync             | Out of scope. Do not expose or execute `ext.userSyncs`.                                                                                                                                                                                                                                  |
+| Migration                 | Cut over directly. Keep `pub_id` only as a configuration alias; do not retain a legacy/OpenRTB protocol switch.                                                                                                                                                                          |
+| Native APS coexistence    | When a Trusted Server APS renderer descriptor is present, Trusted Server must not call `apstag.setDisplayBids()`. The test cohort must disable native APS demand to avoid duplicate participation.                                                                                       |
+
+---
+
+## 3. Primary upstream evidence
+
+The design follows immutable official APS/Prebid sources:
+
+- [APS endpoint and adapter version](https://github.com/prebid/Prebid.js/blob/cf8537da6b54223aea1bb29c6f939ba3b615a273/modules/apsBidAdapter.js#L16-L21)
+- [OpenRTB request enrichment and privacy filtering](https://github.com/prebid/Prebid.js/blob/cf8537da6b54223aea1bb29c6f939ba3b615a273/modules/apsBidAdapter.js#L118-L187)
+- [Request dispatch](https://github.com/prebid/Prebid.js/blob/cf8537da6b54223aea1bb29c6f939ba3b615a273/modules/apsBidAdapter.js#L247-L265)
+- [Creative construction](https://github.com/prebid/Prebid.js/blob/cf8537da6b54223aea1bb29c6f939ba3b615a273/modules/apsBidAdapter.js#L279-L313)
+- [Purpose-1-gated user sync behavior](https://github.com/prebid/Prebid.js/blob/cf8537da6b54223aea1bb29c6f939ba3b615a273/modules/apsBidAdapter.js#L322-L345)
+- [Official APS adapter documentation and capability metadata](https://github.com/prebid/prebid.github.io/blob/adc4af1425c3433c81ee85560519cab0f7d17887/dev-docs/aps.md)
+
+The capability metadata says `pbjs: true` and `pbs: false`. The public source proves
+browser Prebid behavior; it does not by itself establish an approved production
+server-to-server contract for Fastly or another edge runtime.
+
+The immutable adapter test fixture is not a renderer contract: it accepts a banner bid
+whose extension contains only `bidder`, then verifies that the adapter builds the
+script wrapper. The unversioned live `prebid-creative.js` observed on 2026-07-15
+(SHA-256 `ac99774f4d0f6b34aed7584952661007125345b7433970edd832e8451f9a6aef`)
+requires `bid.id`, `price`, `w`, `h`, `ext.creativeurl`, and `ext.tagtype`. This
+live-runner observation is intentionally treated as unverified behavior: the official
+fixture must safe-drop in Trusted Server, while controlled-account responses provide
+the separate renderer-compatible test path.
+
+---
+
+## 4. Current-state problems
+
+`crates/trusted-server-core/src/integrations/aps.rs` currently:
+
+- POSTs a private `pubId`/`slots`/`pageUrl` payload to `/e/dtb/bid`;
+- requires per-slot `bidders.aps.slotID` or falls back to the incoming slot ID;
+- parses `contextual.slots` rather than OpenRTB `seatbid`;
+- stores encoded `amznbid`/`amznp` values in metadata;
+- sets `Bid.price = None` and `Bid.creative = None`; and
+- therefore cannot produce a direct no-mediator winner or a normal creative.
+
+The generic winner selector intentionally ignores price-less bids. The publisher bid
+map also starts from `bid.price`, so the current behavior is internally consistent but
+cannot satisfy #764.
+
+The existing Prebid provider has a mature OpenRTB builder, but that builder also owns
+PBS-specific bidder params, stored requests, request signing, debug behavior,
+`ext.prebid`, and consent-forwarding policy. Reusing it wholesale would couple APS to
+PBS and increase regression risk.
+
+---
+
+## 5. Scope and non-goals
+
+### 5.1 In scope
+
+- APS banner OpenRTB request construction.
+- APS OpenRTB response/no-bid parsing.
+- Decoded-price direct winner selection.
+- A typed APS renderer descriptor.
+- APS creative rendering in both:
+  - direct `POST /auction` TSJS rendering; and
+  - publisher navigation/page-bids through the GPT/Prebid Universal Creative bridge.
+- Safe aggregate diagnostics.
+- Configuration and documentation migration.
+- Controlled APS account/browser testing for `iframe` and `script` tag types.
+
+### 5.2 Out of scope
+
+- APS video/VAST support. Although the upstream adapter advertises video, this issue
+  enables banner only until Trusted Server has a designed video delivery path.
+- APS `ext.userSyncs` execution or exposure.
+- A generic third-party renderer framework for arbitrary providers.
+- Refactoring the entire Prebid OpenRTB builder.
+- Retaining the legacy `/e/dtb/bid` request/parser behind a runtime switch.
+- Server-side creative URL fetching or caching.
+- Changes to the global HTML sanitizer's allowed elements or attributes.
+- Production support claims before APS account-team confirmation.
+
+---
+
+## 6. Configuration contract and cutover
+
+The canonical configuration becomes:
+
+```toml
+[integrations.aps]
+enabled = false
+account_id = "example-account-id"
+endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
+timeout_ms = 800
+allow_script_creatives = false
+```
+
+### 6.1 Compatibility
+
+- Rename `pub_id` to `account_id` in the Rust type, example configuration, and docs.
+- Accept `pub_id` as a serde alias for `account_id` for existing operator configs.
+- Continue accepting a string or integer value during migration. Trim strings, reject
+  empty-after-trim values, and normalize integers to strings.
+- If both names are supplied, deserialization must fail as a duplicate field rather
+  than silently selecting one.
+- Keep `endpoint` as an operator-owned test/override setting, but require HTTPS with a
+  non-empty host and no URL credentials. Its configured endpoint must implement this
+  OpenRTB contract; it is not a legacy-protocol switch. There is no plaintext test
+  exception because the APS response is trusted to select an executable renderer.
+- APS remains disabled by default.
+- `allow_script_creatives` is a separate server-side capability gate and defaults to
+  `false`. It may be set to `true` only for an isolated test cohort after the
+  restrictive-CSP/opaque-origin Playwright proof passes, and may remain enabled for
+  production only after controlled-account `tagtype=script` validation.
+
+### 6.2 Slot configuration
+
+The OpenRTB impression ID is the Trusted Server slot ID. APS's official adapter has no
+per-impression bidder parameters, so the provider no longer reads
+`bidders.aps.slotID`. Existing generic creative-opportunity configuration may continue
+to deserialize that value during migration, but APS documentation must mark it unused
+and remove it from new examples.
+
+---
+
+## 7. APS OpenRTB request design
+
+### 7.1 Builder boundary
+
+Implement an APS-specific builder in `integrations/aps.rs` using the generated types
+re-exported by `openrtb.rs`.
+
+Do not make `PrebidAuctionProvider::to_openrtb` public. Initially duplicate the small
+common mappings so APS policy remains explicit. A provider-neutral helper may be
+extracted later only when tests prove byte-for-byte parity for the fields it owns.
+
+### 7.2 Request shape
+
+For each eligible slot, emit one `imp`:
+
+- `imp.id = slot.id`;
+- banner-only `banner.format` entries for valid dimensions;
+- first valid format in `banner.w`/`banner.h` for APS compatibility;
+- `bidfloor` and `bidfloorcur = "USD"` when a floor exists;
+- `banner.topframe = 0`, matching the official framed-delivery fixture;
+- `secure = 1` unconditionally because APS creative delivery is HTTPS-only; and
+- no `imp.ext.prebid`, stored request, or bidder-parameter extension.
+
+At request level emit:
+
+- `id = AuctionRequest.id`;
+- `tmax = context.timeout_ms`, the same effective budget enforced by the backend;
+- `cur = ["USD"]`;
+- `site.domain`, `site.page`, publisher data, and a valid referrer when known;
+- consent-allowed `user.id` and already-gated EIDs;
+- trusted device UA and client IP;
+- coarse device geo with latitude and longitude explicitly omitted;
+- valid `Accept-Language` and DNT signals from the downstream request;
+- TCF, USP, GPP, and GPP SID signals in their existing Trusted Server OpenRTB
+  placements. COPPA remains omitted because Trusted Server has no trusted COPPA signal
+  source in this issue; and
+- APS request extension:
+
+```json
+{
+  "ext": {
+    "account": "example-account-id",
+    "sdk": {
+      "source": "prebid",
+      "version": "2.2.0"
+    }
+  }
+}
+```
+
+### 7.3 Page and referrer provenance
+
+- Publisher navigation and page-bids continue using the server-derived scheme, host,
+  and matched request path.
+- `POST /auction` should use a valid same-publisher `Referer` URL as the current page
+  instead of always reducing the page to `https://<configured-domain>`; otherwise it
+  falls back to the configured publisher origin.
+- A candidate URL must use HTTP(S), have no userinfo, be length-bounded, and match the
+  configured publisher host before it can become `site.page`.
+- `site.ref` is emitted only when a valid HTTP(S) downstream `Referer` differs from the
+  normalized current page. If the endpoint request's `Referer` is simply the current
+  page, omit `site.ref` rather than mislabeling it as the document's prior referrer.
+- Do not add an unrestricted client-provided URL or copy arbitrary headers.
+
+### 7.4 Privacy rules
+
+The provider consumes the privacy-filtered `AuctionRequest`; it does not independently
+weaken endpoint decisions.
+
+- Existing auction consent denial still returns before contacting APS.
+- APS only receives `request.user.eids`, which endpoint code has already gated.
+- Do not serialize `user.data`, `user.keywords`, `user.gender`, `yob`, `customdata`, or
+  arbitrary context into APS.
+- Remove precise `device.geo.lat` and `device.geo.lon` even if available.
+- Do not forward browser cookies or arbitrary X-\* headers to APS.
+- Request and response payloads may be logged only at TRACE.
+
+---
+
+## 8. Response validation and unified bid mapping
+
+Parse the response envelope as `serde_json::Value`, validate response-level fields,
+and deserialize or validate each `seatbid[].bid[]` independently. This preserves valid
+siblings when one bid has a wrong field type while retaining extension maps needed for
+APS creative metadata. Syntactically invalid JSON still fails the whole response.
+
+### 8.1 Response-level validation
+
+- HTTP `204 No Content` is a normal APS no-bid and returns before body collection or
+  JSON parsing.
+- Other non-success HTTP statuses produce provider `Error` without reflecting the body.
+- Body collection remains capped by `UPSTREAM_RTB_MAX_RESPONSE_BYTES`.
+- Invalid JSON, including a non-representable numeric literal such as an overflowing
+  exponent under the repository's default `serde_json` configuration, or a legacy
+  `contextual` envelope is an error with safe reason `unexpected_response_shape`.
+- Empty/missing `seatbid`, or seat bids containing no bids, is a normal no-bid.
+- Currency must be absent or case-insensitive USD. A non-USD response is dropped
+  because Trusted Server has no currency conversion before winner comparison.
+- Top-level `ext.userSyncs` is ignored and must not enter diagnostics or renderer data.
+
+### 8.2 Bid-level validation
+
+A bid is eligible only when:
+
+- `impid` matches a slot in the request;
+- `price` is finite and non-negative;
+- `mtype` is absent or banner-compatible;
+- `w` and `h` are both present, non-zero, safely convert to `u32`, and are compatible
+  with the requested slot; and
+- it has APS `ext.creativeurl` plus a usable bid ID and an eligible `ext.tagtype`:
+  `iframe` is eligible, while `script` is eligible only when the server-side
+  `allow_script_creatives` capability is enabled. This check happens before candidate
+  reduction and winner selection, so a disabled or otherwise unrenderable script bid
+  cannot win and blank the slot.
+
+An APS `adm` without a valid renderer descriptor is not independently renderable in the
+normal publisher flow and must therefore be dropped. If APS supplies `adm` alongside a
+valid descriptor, remove all markup from the minimized envelope and do not copy it into
+`Bid.creative`. If controlled testing proves markup is required, stop for a separate
+security review rather than forwarding it unsanitized.
+
+`creativeurl` must be an HTTPS URL without userinfo, must not match the configured
+publisher origin, and must stay within a bounded serialized length. Validate the same
+rules again in the browser. It comes only from the HTTPS APS endpoint response, never
+from the client. Unknown tag types and recognized-but-disabled `script` bids are dropped rather than
+passed through.
+
+The pinned official adapter response fixture lacks `creativeurl` and `tagtype`; Trusted
+Server must include that fixture as an expected safe-drop test. A separate fictional
+fixture models the live runner's required extension fields. Controlled APS-account
+validation of both observed tag types remains a rollout prerequisite.
+
+### 8.3 Unified fields and APS candidate reduction
+
+Extend `Bid` with generic identifiers and a typed optional renderer:
+
+```text
+bid_id       <- OpenRTB bid.id
+ad_id        <- OpenRTB bid.adid
+creative_id  <- optional OpenRTB bid.crid
+renderer     <- typed APS renderer descriptor for every accepted APS bid
+```
+
+Set `Bid.bidder = "aps"` unconditionally. Upstream `seat` and `ext.bidder` are APS
+network metadata, not the adapter identity; normalize them only into bounded internal
+fields if an operational consumer is identified, otherwise discard them. Missing,
+numeric, or unexpected seat values do not invalidate an otherwise valid bid and never
+become `hb_bidder`.
+
+Map decoded price, currency, `impid`, dimensions, and `adomain`. Do not map APS `nurl`
+or `burl` in this issue; the vendor runner owns APS creative tracking until a separate
+notification policy is approved.
+
+Before returning `AuctionResponse`, collapse multiple valid APS candidates for the same
+impression to one candidate: highest decoded price wins, with lexicographically lowest
+bid ID as a deterministic tie-break. This produces the same APS result as direct
+winner selection and prevents the current mediator's `(provider, slot, bidder)`
+last-write-wins index from attaching another APS bid's renderer. The mediator still
+restores `bid_id`, optional `creative_id`, and `renderer` for that single APS candidate.
+A two-bids/same-slot/same-seat test is mandatory.
+
+### 8.4 Diagnostics
+
+`AuctionResponse.metadata` may contain only bounded aggregate fields, for example:
+
+```json
+{
+  "seatbid_count": 1,
+  "accepted_bid_count": 1,
+  "dropped_bid_count": 0,
+  "drop_reasons": {}
+}
+```
+
+Allowed reason keys are fixed enums such as:
+
+- `empty_seatbid`;
+- `unknown_impid`;
+- `invalid_price`;
+- `unsupported_currency`;
+- `unsupported_media_type`;
+- `invalid_dimensions`;
+- `missing_render_source`;
+- `unsupported_tagtype`;
+- `script_rendering_disabled`;
+- `invalid_creative_url`;
+- `render_payload_too_large`; and
+- `unexpected_response_shape`.
+
+Do not include account IDs, bid IDs, URLs, tokens, consent strings, raw extensions, or
+raw bodies in INFO/WARN diagnostics or client-facing provider summaries.
+
+---
+
+## 9. Exact APS renderer response envelope
+
+The official adapter gives `prebid-creative.js` the base64-encoded complete response
+and selected bid ID. Trusted Server instead sends an exact allowlisted envelope based
+on the fields required by the live runner observed on 2026-07-15:
+
+```json
+{
+  "seatbid": [
+    {
+      "bid": [
+        {
+          "id": "fictional-selected-bid-id",
+          "price": 1.23,
+          "w": 300,
+          "h": 250,
+          "ext": {
+            "creativeurl": "https://creative.example/render",
+            "tagtype": "iframe"
+          }
+        }
+      ]
+    }
+  ]
+}
+```
+
+The allowlist is exact:
+
+- root: `seatbid` only;
+- selected seat object: `bid` only;
+- selected bid: `id`, `price`, `w`, `h`, and `ext` only; and
+- selected bid extension: `creativeurl` and `tagtype` only.
+
+Do not include top-level ID/currency/extensions, upstream seat, `impid`, `adid`, `crid`,
+`adomain`, notifications, markup, native data, user syncs, unknown extensions, sibling
+bids, or losing seats. Unknown fields may exist transiently while the server validates
+an upstream bid, but they are discarded before renderer construction.
+
+Serialize the allowlisted object once, enforce a 256 KiB pre-base64 maximum, then
+base64 encode with the standard alphabet. Store it in the typed renderer descriptor,
+not general metadata. If the envelope exceeds the cap, drop the bid as non-renderable.
+If controlled APS testing proves the exact envelope insufficient, stop and review the
+specific missing field with APS; do not widen it or fall back to the full response
+automatically.
+
+A single fictional golden fixture under the TSJS test fixtures is the source of truth:
+Rust serialization must equal it, and TypeScript parsing/validation/render-dispatch
+tests must consume that same file.
+
+---
+
+## 10. Renderer descriptor and browser wire formats
+
+### 10.1 Typed descriptor
+
+The Rust and TypeScript contracts represent the same versioned data:
+
+```json
+{
+  "type": "aps",
+  "version": 1,
+  "accountId": "example-account-id",
+  "bidId": "fictional-selected-bid-id",
+  "creativeId": "fictional-creative-id",
+  "tagType": "iframe",
+  "creativeUrl": "https://creative.example/render",
+  "aaxResponse": "base64-data",
+  "width": 300,
+  "height": 250
+}
+```
+
+Only `iframe` and `script` are valid tag-type values. `creativeId` is optional and is
+omitted when APS does not return `crid`; the live runner does not consume it. Version
+mismatch is fail-closed. The APS account identifier is not a secret, but it must still
+be safely serialized and must never be hardcoded from a real account in repository
+fixtures.
+
+### 10.2 `POST /auction`
+
+For APS renderer bids, the OpenRTB response bid contains the complete descriptor:
+
+```json
+{
+  "id": "fictional-selected-bid-id",
+  "impid": "fictional-slot",
+  "price": 1.23,
+  "crid": "fictional-creative-id",
+  "w": 300,
+  "h": 250,
+  "ext": {
+    "trusted_server": {
+      "renderer": {
+        "type": "aps",
+        "version": 1,
+        "accountId": "example-account-id",
+        "bidId": "fictional-selected-bid-id",
+        "creativeId": "fictional-creative-id",
+        "tagType": "iframe",
+        "creativeUrl": "https://creative.example/render",
+        "aaxResponse": "eyJzZWF0YmlkIjpbeyJiaWQiOltdfV19",
+        "width": 300,
+        "height": 250
+      }
+    }
+  }
+}
+```
+
+`creativeId`/`crid` are omitted together when APS does not return `crid`. `adm` is
+omitted, not serialized as an empty string. Ordinary non-APS `adm` behavior is
+unchanged.
+
+### 10.3 Publisher navigation and page-bids
+
+`build_bid_map` adds the same complete descriptor as a normal, non-debug `renderer`
+property for APS winners:
+
+```json
+{
+  "fictional-slot": {
+    "hb_pb": "1.23",
+    "hb_bidder": "aps",
+    "hb_adid": "fictional-selected-bid-id",
+    "renderer": {
+      "type": "aps",
+      "version": 1,
+      "accountId": "example-account-id",
+      "bidId": "fictional-selected-bid-id",
+      "creativeId": "fictional-creative-id",
+      "tagType": "iframe",
+      "creativeUrl": "https://creative.example/render",
+      "aaxResponse": "eyJzZWF0YmlkIjpbeyJiaWQiOltdfV19",
+      "width": 300,
+      "height": 250
+    }
+  }
+}
+```
+
+`hb_adid` priority becomes:
+
+1. PBS Cache UUID for cached Prebid bids;
+2. APS renderer selected bid ID;
+3. existing OpenRTB `adid` fallback.
+
+The complete renderer object is emitted only for the winning bid. It is not gated by
+`debug.inject_adm_for_testing`, and general bid metadata remains debug-only.
+
+---
+
+## 11. Browser rendering design
+
+### 11.1 Static renderer endpoint
+
+Do not put the APS initializer and runner into publisher-origin `srcdoc`. Register APS
+as a proxy-capable integration (without an automatic JS bundle) and serve a static
+renderer document at:
+
+```text
+GET /integrations/aps/renderer
+```
+
+The document contains only static Trusted Server initialization code and the fixed
+`https://client.aps.amazon-adsystem.com/prebid-creative.js` script. Before loading the
+vendor runner, the static initializer reads a strictly encoded, cryptographically
+random per-frame nonce from the iframe URL fragment, stores it as the expected nonce,
+and removes the fragment from visible history. The fragment is not sent in the HTTP
+request. It then receives one versioned renderer descriptor from its embedding parent
+through `postMessage`, verifies `event.source === parent`, and requires the message
+nonce to equal the independently established expected nonce. After the first accepted
+message it removes the listener, initializes the account-keyed APS queue, dispatches
+`CustomEvent("prebid/creative/render", { detail: { aaxResponse, seatBidId } })`, and only
+then dynamically inserts the fixed runner script. On runner load or failure it sends a
+source-bound response carrying the accepted nonce. Because the sandboxed document has
+an opaque origin, both directions use `"*"` as the `postMessage` target origin and rely
+on the exact child/parent window, source checks, one-time fragment-bound nonce, and full
+descriptor validation.
+
+The descriptor is data, never generated script text. No APS-provided HTML, script text,
+URL, account value, or decoded JSON is concatenated into an executable context. The
+vendor runner URL is a compile-time constant. The response carries
+`Content-Type: text/html`, `X-Content-Type-Options: nosniff`,
+`Referrer-Policy: no-referrer`, and a CSP `sandbox` directive containing the
+approved tokens without `allow-same-origin`. The response-level sandbox preserves the
+opaque boundary even if another embedding path omits its iframe sandbox attribute.
+
+### 11.2 Opaque outer sandbox
+
+Both direct and GPT flows load the static endpoint through `iframe.src`, not `srcdoc`,
+with this outer sandbox:
+
+```text
+allow-forms
+allow-pointer-lock
+allow-popups
+allow-popups-to-escape-sandbox
+allow-scripts
+allow-top-navigation-by-user-activation
+```
+
+The outer boundary deliberately omits `allow-same-origin`. The live APS runner grants
+`allow-same-origin` to the nested frame it creates, but a descendant cannot relax an
+ancestor sandbox's origin restriction. Therefore both `iframe` and fetched-HTML
+`script` creatives remain under the outer opaque-origin boundary rather than inheriting
+the publisher origin.
+
+This is a compatibility hypothesis, not an assumption: the current runner also touches
+`frameElement` while resizing. `tagtype=script` is rejected server-side before winner
+selection while `allow_script_creatives` is false. The capability may be enabled for an
+isolated test cohort only after a real-browser test proves that the fixed runner renders
+and resizes correctly without publisher-origin access, and may be enabled beyond that
+cohort only after controlled-account validation. If either test fails, keep the gate
+off and obtain an APS-supported isolated renderer page/origin; do not add
+`allow-same-origin` back to the outer boundary.
+
+### 11.3 Browser validation of consumed data
+
+Before creating or messaging the renderer iframe, TSJS must decode `aaxResponse` and
+validate the exact envelope consumed by the vendor runner:
+
+- root contains only one `seatbid` entry;
+- that entry contains only one `bid`;
+- the bid has exactly `id`, `price`, `w`, `h`, and `ext`;
+- `ext` has exactly `creativeurl` and `tagtype`;
+- bid ID, dimensions, creative URL, and tag type equal the duplicated descriptor fields;
+- price is finite and non-negative;
+- tag type is `iframe`, or `script` from a response the server emitted only after its
+  default-off `allow_script_creatives` eligibility gate;
+- creative URL is bounded HTTPS without credentials and does not match the publisher
+  origin; and
+- no markup, notifications, syncs, or unknown fields are present.
+
+Validation happens before slot clearing, `stopImmediatePropagation()`, iframe creation,
+or message dispatch. The static renderer document repeats the structural/message
+validation as defense in depth.
+
+### 11.4 Direct `/auction` flow
+
+`parseAuctionResponse` accepts either ordinary sanitized `adm` or a structurally typed
+renderer. The request loop performs the full decoded-envelope validation, dispatches a
+valid APS descriptor to `renderApsCreative`, and sends ordinary markup to
+`renderCreativeInline`.
+
+`renderApsCreative` generates at least 128 bits of randomness with
+`crypto.getRandomValues`, base64url-encodes it, and binds it to the static renderer URL
+as a fragment before assigning `iframe.src`. After load, it posts the validated
+descriptor with the same nonce, then waits for an exact source- and nonce-bound runner
+ready acknowledgement before clearing existing content or showing the frame. A runner
+failure or bounded acknowledgement timeout removes the hidden frame. A malformed
+descriptor, malformed fragment, nonce mismatch, replay, stale message, or runner load
+failure leaves existing slot content intact and emits a safe warning.
+
+### 11.5 GPT/page-bids flow
+
+Extend `installTsRenderBridge` while retaining the existing `Prebid Request` parsing and
+source-slot ownership validation. For a valid APS winner, return the exact serializable
+Prebid Universal Creative dynamic-renderer shape, including the supported renderer
+version. The static Trusted Server renderer source may only create the opaque outer
+iframe, load `/integrations/aps/renderer`, post the already validated descriptor, and
+resolve only after the source- and nonce-bound ready acknowledgement; APS or bidder code
+never executes in the Universal Creative renderer frame itself.
+Fixture-test this message against the deployed Universal Creative protocol rather than
+assuming a function can be structured-cloned. Include a trusted absolute
+`rendererUrl`, computed from the publisher page origin by TSJS, because a relative URL
+inside the GAM creative would resolve against the GAM origin. The dynamic renderer
+must accept only that data field and the validated APS descriptor.
+
+Call `stopImmediatePropagation()` only after ownership and complete envelope validation
+succeed. Preserve in-flight render deduplication, but do not invoke the generic
+win/billing beacon path for APS. Existing debug-ADM and PBS Cache branches remain
+unchanged.
+
+When the winning bid has a Trusted Server APS renderer, do not call
+`apstag.setDisplayBids()`. The native APS SDK may remain installed by the CMS for other
+cohorts, but it is not the renderer or bid source for that TS winner.
+
+### 11.6 CSP and real-browser gate
+
+Because the outer frame navigates to a real response, it uses that response's CSP
+instead of inheriting publisher `srcdoc` CSP. The renderer endpoint starts from this
+explicit ad-compatible policy, tightened if controlled testing permits:
+
+```text
+default-src 'none';
+script-src 'unsafe-inline' https:;
+connect-src https:;
+frame-src https:;
+img-src https: data:;
+media-src https: blob:;
+style-src 'unsafe-inline' https:;
+font-src https: data:;
+```
+
+The publisher must permit `frame-src 'self'` for the direct renderer endpoint. The GAM
+Universal Creative context must also permit framing the absolute publisher renderer
+URL. The broad HTTPS resource allowances apply only inside the opaque sandbox and are
+required because the APS runner and bidder HTML may load arbitrary HTTPS ad resources.
+
+Add a Playwright test under `crates/trusted-server-integration-tests/browser` with a
+restrictive publisher CSP. It must prove the renderer endpoint loads, APS initializes,
+both tag types obey the outer opaque-origin boundary, a fictional script creative
+cannot access `top.document`, and malformed descriptors do not clear the slot. The server-side `allow_script_creatives` gate stays false during normal winner
+selection until this test passes. It may then be enabled only for the controlled test
+cohort needed to validate real rendering and remains false elsewhere until that
+validation also passes.
+
+---
+
+## 12. Sanitization and security invariants
+
+- `sanitize_creative_html` remains mandatory for every ordinary
+  `Bid.creative`/`adm` value.
+- Its element, attribute, URI, size, and fail-closed rules do not change.
+- APS executable rendering is a separate typed capability; it is never disguised as
+  sanitized `adm`.
+- Only a server-validated APS descriptor with an exact browser-validated envelope can
+  select that capability.
+- Unknown providers cannot request the APS renderer through arbitrary metadata.
+- The server never fetches `creativeurl`, avoiding an SSRF/redirect/content-type
+  service in the auction path.
+- Server and browser both require a bounded HTTPS creative URL without credentials and
+  reject the publisher origin.
+- APS/bidder execution occurs only below an outer opaque-origin sandbox. No test may
+  treat absence of `innerHTML` alone as proof; cover `srcdoc`, script text,
+  `document.write`, and message-driven sinks.
+- Existing same-origin/no-CORS-preflight protection for page-bids remains unchanged.
+- Per-user injected HTML stays private/non-shared, and page-bids stays no-store.
+- Existing upstream body caps and auction deadlines remain in force.
+
+---
+
+## 13. APS notification policy
+
+Do not map APS `nurl` or `burl` into the shared browser bid map in this issue. The live
+APS runner owns creative tracking, the official fixture does not establish that Trusted
+Server should fire OpenRTB notifications, and the direct `/auction` path has no matching
+notification lifecycle.
+
+This also prevents an APS-controlled URL from causing a credentialed same-origin POST
+through the current generic `sendBeacon`/fetch helper. If APS later requires Trusted
+Server notification delivery, design it separately with one explicit owner, bounded
+HTTPS URLs, publisher-origin rejection, omitted credentials, no referrer, macro policy,
+and equivalent direct/GPT tests. Existing non-APS notification behavior is unchanged by
+#764.
+
+---
+
+## 14. User sync policy
+
+APS user sync is explicitly out of scope:
+
+- ignore `BidResponse.ext.userSyncs`;
+- do not put sync URLs into `AuctionResponse.metadata`;
+- do not include them in the minimized renderer envelope;
+- do not fetch them at the edge; and
+- do not add image/iframe sync behavior to TSJS.
+
+A future implementation requires a separate spec covering Purpose 1, regional policy,
+URL allowlisting, deduplication, browser timing, and observability.
+
+---
+
+## 15. Logging and telemetry
+
+- Request/response bodies: TRACE only.
+- Routine request log: provider and eligible slot count, without account ID.
+- Routine response log: status, elapsed time, accepted count, and bounded dropped
+  count.
+- WARN: static condition plus slot/request-safe context; never include response body,
+  creative URL, bid token, EID, consent string, or account ID.
+- Client-facing provider summaries: aggregate reason keys/counts only.
+- Existing auction telemetry receives decoded price, currency, ad domain, and ad ID.
+  It must not receive the encoded renderer envelope.
+
+---
+
+## 16. Rollout and rollback
+
+### 16.1 Controlled rollout
+
+1. Implement server parsing and exact fictional fixtures with APS disabled and
+   `allow_script_creatives = false` by default.
+2. Prove disabled script bids are dropped before candidate reduction/winner selection.
+3. Pass the restrictive-CSP Playwright and opaque-origin access tests using the local
+   fictional script runner while the server gate remains false for normal traffic.
+4. Configure a controlled APS test account out of band.
+5. Enable Trusted Server APS only for a test cohort, disable native APS demand there,
+   and temporarily set `allow_script_creatives = true` only for that isolated cohort.
+6. Verify the official fixture safe-drops and a real account returns the unverified
+   `creativeurl`/`tagtype` contract.
+7. Verify both observed tag types through direct and GPT paths. If script cannot operate
+   below the opaque outer sandbox, set the gate false again and stop.
+8. Confirm the exact allowlisted envelope works with `prebid-creative.js`.
+9. Confirm GAM line items and the Universal Creative route request `hb_bidder=aps` and
+   the selected `hb_adid`.
+10. Obtain APS confirmation for Fastly/edge-originated production traffic before broad
+    rollout.
+
+### 16.2 Rollback
+
+- Immediate traffic rollback: set `[integrations.aps].enabled = false`.
+- Restore native APS participation for the affected cohort if required.
+- Binary rollback remains available if the old provider must temporarily be restored.
+- The new code does not retain a dormant legacy parser or protocol switch.
+
+---
+
+## 17. Required code areas
+
+| File                                                              | Change                                                                                                                                                       |
+| ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `crates/trusted-server-core/src/integrations/aps.rs`              | Replace legacy wire types, build/parse OpenRTB, reduce one APS candidate per imp, build the exact envelope, and serve the static renderer endpoint with CSP. |
+| `crates/trusted-server-core/src/integrations/mod.rs`              | Register the APS proxy integration in addition to the auction provider.                                                                                      |
+| `crates/trusted-server-core/src/openrtb.rs`                       | Add only narrowly scoped APS/request/response extension types if needed.                                                                                     |
+| `crates/trusted-server-core/src/auction/types.rs`                 | Add generic bid/creative identifiers and typed optional renderer. Remove stale encoded-price comments.                                                       |
+| `crates/trusted-server-core/src/auction/formats.rs`               | Preserve IDs; sanitize ordinary `adm`; emit the full APS renderer extension and omit empty `adm`.                                                            |
+| `crates/trusted-server-core/src/auction/orchestrator.rs`          | Replace encoded-price assumptions/tests with decoded APS direct-winner coverage.                                                                             |
+| `crates/trusted-server-core/src/integrations/adserver_mock.rs`    | Preserve renderer/identifiers for the single reduced APS candidate and test the prior two-bid collision case.                                                |
+| `crates/trusted-server-core/src/publisher.rs`                     | Emit APS renderer in the normal bid map, force `hb_bidder=aps`, and use selected bid ID for `hb_adid` without APS notifications.                             |
+| `crates/trusted-server-js/lib/test/fixtures/aps-renderer-v1.json` | Shared fictional golden wire fixture consumed by Rust and TypeScript tests.                                                                                  |
+| `crates/trusted-server-js/lib/src/core/auction.ts`                | Parse the typed renderer extension.                                                                                                                          |
+| `crates/trusted-server-js/lib/src/core/request.ts`                | Validate and dispatch APS descriptors to the opaque renderer endpoint.                                                                                       |
+| `crates/trusted-server-js/lib/src/core/types.ts`                  | Define shared APS renderer wire types with optional creative ID.                                                                                             |
+| `crates/trusted-server-js/lib/src/integrations/aps/render.ts`     | Decode/cross-check the exact envelope, create the opaque outer iframe, and message the static endpoint.                                                      |
+| `crates/trusted-server-js/lib/src/integrations/gpt/index.ts`      | Serve APS through the exact Universal Creative wire shape; skip generic beacons and native `apstag` for TS APS winners.                                      |
+| `crates/trusted-server-integration-tests/browser/`                | Add restrictive-CSP, opaque-origin, script/iframe, and parent-DOM isolation coverage.                                                                        |
+| `trusted-server.example.toml`                                     | Document canonical OpenRTB APS configuration with fictional values.                                                                                          |
+| `docs/guide/integrations/aps.md`                                  | Replace legacy setup, request, response, rendering, privacy, and rollout documentation.                                                                      |
+| `CHANGELOG.md`                                                    | Record the APS wire/config migration and support caveat.                                                                                                     |
+
+---
+
+## 18. Acceptance criteria
+
+1. APS receives the specified OpenRTB request for each eligible banner slot with
+   `topframe=0` and `secure=1`.
+2. Request fixtures prove trimmed account/SDK/USD, floors, trusted page/device context,
+   consent/EIDs, existing privacy registrations, and omission of precise coordinates
+   and unsupported COPPA claims.
+3. HTTP 204 and empty `seatbid` are no-bids; malformed/legacy responses are safely
+   diagnosed.
+4. The official no-renderer fixture safe-drops; every accepted APS bid has present,
+   valid `w`/`h` and the unverified-but-validated URL/tag-type renderer contract.
+5. `Bid.bidder`/`hb_bidder` are always `aps`, independent of upstream seat.
+6. Multiple APS bids for one impression reduce deterministically to one candidate, and
+   mediation cannot restore another candidate's renderer.
+7. APS can win without a mediator and is rejected normally below the floor.
+8. The browser envelope contains exactly the allowlisted fields and matches the full
+   descriptor; Rust and TypeScript share one golden fixture.
+9. The outer renderer iframe has no `allow-same-origin`; descendant iframe/script
+   creatives cannot access publisher DOM in the restrictive-CSP Playwright test.
+10. `allow_script_creatives` defaults false; while false, script bids are dropped before
+    candidate reduction and cannot win. It is enabled only under the staged browser and
+    controlled-account policy; otherwise script remains fail-closed.
+11. The renderer binds a one-time nonce through the iframe URL fragment before
+    messaging and rejects malformed, mismatched, replayed, or stale messages before
+    clearing content or stopping another renderer handler.
+12. Ordinary non-APS `adm` sanitization and PBS Cache rendering remain unchanged.
+13. APS user sync and APS `nurl`/`burl` browser delivery remain absent.
+14. Native `apstag.setDisplayBids()` is not called for a TS APS renderer winner.
+15. Raw request/response bodies remain TRACE-only.
+16. All repository CI, adapter, JS, browser, parity, and docs-format gates pass.
+
+---
+
+## 19. Known risks and follow-ups
+
+| Risk                                                                   | Handling                                                                                                                                                                    |
+| ---------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| APS has not confirmed production Fastly/edge traffic                   | Continue implementation/testing; block broad rollout pending confirmation.                                                                                                  |
+| Official fixture and live runner disagree on creative extension fields | Safe-drop the official fixture, pin the observed runner hash/date as evidence only, and require controlled-account validation.                                              |
+| Exact envelope may omit a field used by a future runner                | Stop and review with APS; never preserve unknown fields or fall back to the full response automatically.                                                                    |
+| Fixed unversioned vendor script can change independently               | Monitor the real-browser contract and require review before changing URL, envelope, CSP, or sandbox behavior.                                                               |
+| Runner may fail without outer `allow-same-origin`                      | Keep the server-side `allow_script_creatives` gate false unless the opaque-boundary Playwright and controlled-account tests pass; never restore publisher-origin execution. |
+| Broad ad-compatible CSP permits arbitrary HTTPS resources              | Scope it to the opaque renderer document; publisher CSP only needs to frame the same-origin renderer endpoint.                                                              |
+| Existing native APS and TS APS can duplicate demand                    | Cohort-gate and disable native APS participation wherever TS APS is enabled.                                                                                                |
+| APS notifications may be required for billing                          | Do not guess; vendor runner owns tracking until APS approves a separately secured notification contract.                                                                    |
+| APS video responses could appear                                       | Advertise banner-only support and drop non-banner `mtype` until a separate video design exists.                                                                             |
diff --git a/trusted-server.example.toml b/trusted-server.example.toml
index 26d95d681..53afdb9d6 100644
--- a/trusted-server.example.toml
+++ b/trusted-server.example.toml
@@ -118,9 +118,11 @@ allowed_context_keys = []
 
 [integrations.aps]
 enabled = false
-pub_id = "your-aps-publisher-id"
-endpoint = "https://aps.example.com/e/dtb/bid"
+account_id = "example-aps-account-id"
+endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 1000
+# Script creatives require separate security validation before opt-in.
+allow_script_creatives = false
 
 [integrations.google_tag_manager]
 enabled = false

From 5ad047899ca988eb825e8b0c40e1c44a07545328 Mon Sep 17 00:00:00 2001
From: Christian <christianpavilonis@outlook.com>
Date: Wed, 15 Jul 2026 21:25:02 -0500
Subject: [PATCH 2/9] Resolve APS test scanning alerts

---
 .../lib/test/integrations/aps/render.test.ts              | 8 ++------
 ...26-07-15-aps-openrtb-first-class-integration-design.md | 4 ++--
 2 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts b/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts
index 78d459c7d..4b1925014 100644
--- a/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts
@@ -147,9 +147,7 @@ describe('direct APS rendering', () => {
     const iframe = slot.querySelector('iframe')!;
     const existing = slot.querySelector('span');
     expect(existing).not.toBeNull();
-    expect(iframe.src).toMatch(
-      new RegExp(`${APS_RENDERER_PATH.replace(/\//g, '\\/')}#tsaps=[A-Za-z0-9_-]{22}$`)
-    );
+    expect(iframe.src).toMatch(/\/integrations\/aps\/renderer#tsaps=[A-Za-z0-9_-]{22}$/);
     expect(iframe.getAttribute('sandbox')).toBe(APS_RENDERER_SANDBOX);
     expect(iframe.getAttribute('sandbox')).not.toContain('allow-same-origin');
     expect(iframe.srcdoc).toBe('');
@@ -262,9 +260,7 @@ describe('Universal Creative APS source', () => {
         window
       );
       const iframe = document.body.querySelector('iframe')!;
-      expect(iframe.src).toMatch(
-        new RegExp(`${APS_RENDERER_PATH.replace(/\//g, '\\/')}#tsaps=[A-Za-z0-9_-]{22}$`)
-      );
+      expect(iframe.src).toMatch(/\/integrations\/aps\/renderer#tsaps=[A-Za-z0-9_-]{22}$/);
       expect(iframe.getAttribute('sandbox')).toBe(APS_RENDERER_SANDBOX);
       expect(iframe.getAttribute('sandbox')).not.toContain('allow-same-origin');
 
diff --git a/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md b/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md
index 0a9c84fd1..c2da08179 100644
--- a/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md
+++ b/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md
@@ -1,7 +1,7 @@
 # Amazon APS OpenRTB First-Class Integration Design
 
-**Date:** 2026-07-15  
-**Status:** Approved for implementation and test; production rollout remains subject to APS account-team validation  
+**Date:** 2026-07-15<br>
+**Status:** Approved for implementation and test; production rollout remains subject to APS account-team validation<br>
 **Issue:** [#764 — Add the Amazon APS Prebid Adapter as first class integration](https://github.com/IABTechLab/trusted-server/issues/764)
 
 ---

From 1b26199b5f63489a9ec706807412c50afa0b1556 Mon Sep 17 00:00:00 2001
From: Christian <christianpavilonis@outlook.com>
Date: Thu, 16 Jul 2026 10:54:23 -0500
Subject: [PATCH 3/9] Add APS inventory identity overrides

---
 CHANGELOG.md                                  |   1 +
 .../src/integrations/aps.rs                   | 197 +++++++++++++++++-
 crates/trusted-server-core/src/publisher.rs   |  60 ++++--
 .../lib/src/integrations/gpt/index.ts         |  18 +-
 .../test/integrations/gpt/spa_hook.test.ts    |   4 +-
 docs/guide/configuration.md                   |   3 +
 docs/guide/integrations/aps.md                |   6 +
 trusted-server.example.toml                   |   3 +
 8 files changed, 268 insertions(+), 24 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 28a4e4806..aa3bed697 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Breaking** — Replaced the legacy APS contextual integration with APS OpenRTB at `/e/pb/bid`. APS configuration now uses canonical `account_id` (`pub_id` remains a compatibility alias), no longer requires APS-specific slot IDs, and defaults script creative eligibility off. Operators must update the endpoint, disable native APS demand for Trusted Server cohorts, and prepare GAM/Universal Creative targeting for `hb_bidder=aps` before rollout.
 - **Breaking** — `bid_param_zone_overrides` inner values must now be JSON objects; previously non-object or empty values (`"header" = "x"`, `"header" = {}`) were accepted and silently produced a dead rule at runtime. They now fail at startup with a configuration error. Operators upgrading should audit their `bid_param_zone_overrides` config for non-object zone entries.
 - **Breaking** — Sourcepoint browser module inclusion now requires explicit `[integrations.sourcepoint].enabled = true`; operators relying on the previous unconditional Sourcepoint module should enable the integration before upgrading.
+- Added optional APS `inventory_domain` and `inventory_page_origin` overrides for deployments whose edge hostname differs from the APS-authorized inventory identity.
 
 ### Security
 
diff --git a/crates/trusted-server-core/src/integrations/aps.rs b/crates/trusted-server-core/src/integrations/aps.rs
index 90b6c6db5..f32fa9012 100644
--- a/crates/trusted-server-core/src/integrations/aps.rs
+++ b/crates/trusted-server-core/src/integrations/aps.rs
@@ -114,6 +114,7 @@ addEventListener('message',receive);
 
 /// Configuration for the APS `OpenRTB` integration.
 #[derive(Debug, Clone, Deserialize, Serialize, Validate)]
+#[validate(schema(function = "validate_inventory_identity_override"))]
 pub struct ApsConfig {
     /// Whether APS integration is enabled.
     #[serde(default = "default_enabled")]
@@ -131,6 +132,14 @@ pub struct ApsConfig {
     /// Whether APS script creatives are eligible before winner selection.
     #[serde(default)]
     pub allow_script_creatives: bool,
+    /// APS-authorized inventory domain used instead of the deployment hostname.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[validate(custom(function = "validate_inventory_domain"))]
+    pub inventory_domain: Option<String>,
+    /// Canonical HTTPS origin used for APS `site.page` while preserving path and query.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[validate(custom(function = "validate_inventory_page_origin"))]
+    pub inventory_page_origin: Option<String>,
 }
 
 fn deserialize_account_id<'de, D>(deserializer: D) -> Result<String, D::Error>
@@ -197,6 +206,78 @@ fn validate_aps_endpoint(value: &str) -> Result<(), ValidationError> {
     Ok(())
 }
 
+fn validate_inventory_domain(value: &str) -> Result<(), ValidationError> {
+    if value.trim() != value
+        || value.is_empty()
+        || value.len() > 253
+        || value.starts_with('.')
+        || value.ends_with('.')
+        || value.contains(['/', ':'])
+    {
+        return Err(ValidationError::new("invalid_aps_inventory_domain"));
+    }
+    for label in value.split('.') {
+        let bytes = label.as_bytes();
+        if label.is_empty()
+            || label.len() > 63
+            || bytes.first() == Some(&b'-')
+            || bytes.last() == Some(&b'-')
+            || !bytes
+                .iter()
+                .all(|byte| byte.is_ascii_alphanumeric() || *byte == b'-')
+        {
+            return Err(ValidationError::new("invalid_aps_inventory_domain"));
+        }
+    }
+    Ok(())
+}
+
+fn validate_inventory_page_origin(value: &str) -> Result<(), ValidationError> {
+    let parsed =
+        Url::parse(value).map_err(|_| ValidationError::new("invalid_aps_inventory_page_origin"))?;
+    if parsed.scheme() != "https"
+        || parsed.host_str().is_none()
+        || !parsed.username().is_empty()
+        || parsed.password().is_some()
+        || parsed.port().is_some()
+        || parsed.path() != "/"
+        || parsed.query().is_some()
+        || parsed.fragment().is_some()
+    {
+        return Err(ValidationError::new("invalid_aps_inventory_page_origin"));
+    }
+    Ok(())
+}
+
+fn validate_inventory_identity_override(config: &ApsConfig) -> Result<(), ValidationError> {
+    let (Some(domain), Some(origin)) = (
+        config.inventory_domain.as_deref(),
+        config.inventory_page_origin.as_deref(),
+    ) else {
+        if config.inventory_domain.is_none() && config.inventory_page_origin.is_none() {
+            return Ok(());
+        }
+        return Err(ValidationError::new(
+            "incomplete_aps_inventory_identity_override",
+        ));
+    };
+    let parsed = Url::parse(origin)
+        .map_err(|_| ValidationError::new("invalid_aps_inventory_page_origin"))?;
+    let host = parsed
+        .host_str()
+        .ok_or_else(|| ValidationError::new("invalid_aps_inventory_page_origin"))?
+        .to_ascii_lowercase();
+    let domain = domain.to_ascii_lowercase();
+    if host != domain
+        && !host
+            .strip_suffix(&domain)
+            .is_some_and(|prefix| prefix.ends_with('.'))
+    {
+        return Err(ValidationError::new("aps_inventory_origin_domain_mismatch"));
+    }
+    Ok(())
+}
+
 fn default_enabled() -> bool {
     false
 }
@@ -217,6 +298,8 @@ impl Default for ApsConfig {
             endpoint: default_endpoint(),
             timeout_ms: default_timeout_ms(),
             allow_script_creatives: false,
+            inventory_domain: None,
+            inventory_page_origin: None,
         }
     }
 }
@@ -324,6 +407,28 @@ impl ApsAuctionProvider {
         Some(parsed.to_string())
     }
 
+    fn inventory_site_identity(
+        &self,
+        fallback_domain: &str,
+        fallback_page: String,
+    ) -> (String, String) {
+        let (Some(domain), Some(origin)) = (
+            self.config.inventory_domain.as_ref(),
+            self.config.inventory_page_origin.as_deref(),
+        ) else {
+            return (fallback_domain.to_string(), fallback_page);
+        };
+        let (Ok(mut canonical_page), Ok(current_page)) =
+            (Url::parse(origin), Url::parse(&fallback_page))
+        else {
+            return (fallback_domain.to_string(), fallback_page);
+        };
+        canonical_page.set_path(current_page.path());
+        canonical_page.set_query(current_page.query());
+        canonical_page.set_fragment(None);
+        (domain.clone(), canonical_page.to_string())
+    }
+
     fn build_openrtb_request(
         &self,
         request: &AuctionRequest,
@@ -420,12 +525,13 @@ impl ApsAuctionProvider {
             .and_then(|value| value.to_str().ok())
             .and_then(Self::valid_http_url)
             .filter(|value| value != &page);
+        let (site_domain, page) = self.inventory_site_identity(&request.publisher.domain, page);
 
         OpenRtbRequest {
             id: Some(request.id.clone()),
             imp,
             site: Some(Site {
-                domain: Some(request.publisher.domain.clone()),
+                domain: Some(site_domain.clone()),
                 page: Some(page),
                 r#ref: referer,
                 publisher: Some(Publisher {
@@ -956,6 +1062,8 @@ mod tests {
             endpoint: default_endpoint(),
             timeout_ms: 800,
             allow_script_creatives: false,
+            inventory_domain: None,
+            inventory_page_origin: None,
         }
     }
 
@@ -1052,6 +1160,93 @@ mod tests {
         }
     }
 
+    #[test]
+    fn config_requires_safe_inventory_identity_override_pair() {
+        for value in [
+            json!({
+                "account_id": "example-account",
+                "inventory_domain": "publisher.example"
+            }),
+            json!({
+                "account_id": "example-account",
+                "inventory_page_origin": "https://www.publisher.example"
+            }),
+            json!({
+                "account_id": "example-account",
+                "inventory_domain": "publisher.example",
+                "inventory_page_origin": "http://www.publisher.example"
+            }),
+            json!({
+                "account_id": "example-account",
+                "inventory_domain": "publisher.example",
+                "inventory_page_origin": "https://www.publisher.example/path"
+            }),
+            json!({
+                "account_id": "example-account",
+                "inventory_domain": "publisher.example/path",
+                "inventory_page_origin": "https://www.publisher.example"
+            }),
+            json!({
+                "account_id": "example-account",
+                "inventory_domain": "publisher.example",
+                "inventory_page_origin": "https://unrelated.example"
+            }),
+        ] {
+            let parsed: ApsConfig =
+                serde_json::from_value(value).expect("should deserialize before validation");
+            assert!(
+                parsed.validate().is_err(),
+                "should reject unsafe or incomplete inventory identity override"
+            );
+        }
+    }
+
+    #[test]
+    fn inventory_identity_override_rewrites_site_and_preserves_page_path() {
+        let config: ApsConfig = serde_json::from_value(json!({
+            "enabled": true,
+            "account_id": "example-account",
+            "inventory_domain": "publisher.example",
+            "inventory_page_origin": "https://www.publisher.example"
+        }))
+        .expect("should deserialize APS inventory identity override");
+        config
+            .validate()
+            .expect("should validate APS inventory identity override");
+        let provider = ApsAuctionProvider::new(config);
+        let mut auction_request = request();
+        auction_request.publisher.domain = "deployment.example".to_string();
+        auction_request.publisher.page_url =
+            Some("https://deployment.example/news/story?edition=fictional#section".to_string());
+        let settings = create_test_settings();
+        let services = noop_services();
+        let downstream = http::Request::builder()
+            .uri("https://deployment.example/auction")
+            .body(EdgeBody::empty())
+            .expect("should build downstream request");
+        let context = AuctionContext {
+            settings: &settings,
+            request: &downstream,
+            timeout_ms: 321,
+            provider_responses: None,
+            services: &services,
+        };
+
+        let serialized =
+            serde_json::to_value(provider.build_openrtb_request(&auction_request, &context))
+                .expect("should serialize APS request");
+
+        assert_eq!(serialized["site"]["domain"], "publisher.example");
+        assert_eq!(
+            serialized["site"]["page"],
+            "https://www.publisher.example/news/story?edition=fictional"
+        );
+        assert_eq!(
+            serialized["site"]["publisher"]["domain"],
+            "deployment.example"
+        );
+    }
+
     #[test]
     fn builds_aps_openrtb_request_with_explicit_privacy_policy() {
         let provider = ApsAuctionProvider::new(config());
diff --git a/crates/trusted-server-core/src/publisher.rs b/crates/trusted-server-core/src/publisher.rs
index b834f148d..ebf298efd 100644
--- a/crates/trusted-server-core/src/publisher.rs
+++ b/crates/trusted-server-core/src/publisher.rs
@@ -1537,6 +1537,7 @@ pub async fn handle_publisher_request(
 
     log::debug!("Proxying request to configured publisher backend");
 
+    let request_path_and_query = origin_path_and_query.to_string();
     let request_path = req.uri().path().to_string();
     let is_get = req.method() == http::Method::GET;
 
@@ -1620,7 +1621,7 @@ pub async fn handle_publisher_request(
         if should_run_auction {
             let slots_ctx = MatchedSlotsContext {
                 matched_slots: &matched_slots,
-                request_path: &request_path,
+                request_path_and_query: &request_path_and_query,
             };
             let mut auction_request = build_auction_request(
                 &slots_ctx,
@@ -1930,11 +1931,11 @@ pub async fn handle_publisher_request(
 /// Bundle of the per-request creative-opportunity inputs that travel together.
 ///
 /// Extracted so `build_auction_request` stays under the project's
-/// 7-argument cap (`matched_slots` + `request_path` live for the same
+/// 7-argument cap (`matched_slots` + `request_path_and_query` live for the same
 /// request scope and are passed together everywhere).
 pub(crate) struct MatchedSlotsContext<'a> {
     pub matched_slots: &'a [crate::creative_opportunities::CreativeOpportunitySlot],
-    pub request_path: &'a str,
+    pub request_path_and_query: &'a str,
 }
 
 /// Borrowed inputs for [`apply_auction_eids_and_device`], bundled to keep the
@@ -2016,7 +2017,7 @@ pub(crate) fn build_auction_request(
         .collect();
     let page_url = format!(
         "{}://{}{}",
-        request_info.scheme, request_info.host, slots_ctx.request_path
+        request_info.scheme, request_info.host, slots_ctx.request_path_and_query
     );
     let ec_id = ec_id.filter(|id| !id.is_empty());
     let request_id = ec_id.map_or_else(
@@ -2331,8 +2332,8 @@ pub fn page_bids_preflight_denied() -> Response<EdgeBody> {
 
 /// Normalizes the client-supplied `path` query parameter before glob matching.
 ///
-/// The SPA hook sends `location.pathname`, but the parameter is
-/// client-controlled: strip any query string or fragment and force a leading
+/// The SPA hook sends `location.pathname + location.search`, but the parameter
+/// is client-controlled: strip any query string or fragment and force a leading
 /// `/` so slot `page_patterns` always match against a canonical path shape.
 fn normalize_page_bids_path(raw: &str) -> String {
     let path = raw.split(['?', '#']).next().unwrap_or("");
@@ -2343,6 +2344,20 @@ fn normalize_page_bids_path(raw: &str) -> String {
     }
 }
 
+/// Normalize the page path and query retained in the upstream auction context.
+///
+/// Fragments never reach an HTTP server and are discarded if a client includes
+/// one explicitly. Unlike [`normalize_page_bids_path`], the query is preserved
+/// for the `OpenRTB` `site.page` URL and is not used for slot matching.
+fn normalize_page_bids_path_and_query(raw: &str) -> String {
+    let path_and_query = raw.split('#').next().unwrap_or("");
+    if path_and_query.starts_with('/') {
+        path_and_query.to_string()
+    } else {
+        format!("/{path_and_query}")
+    }
+}
+
 /// Handle `GET /__ts/page-bids?path=<path>` — server-side auction for SPA navigation.
 ///
 /// Matches creative opportunity slots for the given path, runs a server-side
@@ -2383,15 +2398,17 @@ pub async fn handle_page_bids(
         return Ok(page_bids_preflight_denied());
     }
 
-    let path_param = req
+    let requested_page = req
         .uri()
         .query()
         .and_then(|query| {
             url::form_urlencoded::parse(query.as_bytes())
-                .find(|(k, _)| k == "path")
-                .map(|(_, v)| normalize_page_bids_path(&v))
+                .find(|(key, _)| key == "path")
+                .map(|(_, value)| value.into_owned())
         })
         .unwrap_or_else(|| "/".to_string());
+    let path_param = normalize_page_bids_path(&requested_page);
+    let page_path_and_query = normalize_page_bids_path_and_query(&requested_page);
 
     let matched_slots: Vec<_> =
         crate::creative_opportunities::match_slots(auction.slots, &path_param)
@@ -2454,7 +2471,7 @@ pub async fn handle_page_bids(
         if ad_stack_enabled && !is_bot && !is_prefetch {
             let slots_ctx = MatchedSlotsContext {
                 matched_slots: &matched_slots,
-                request_path: &path_param,
+                request_path_and_query: &page_path_and_query,
             };
             let mut auction_request = build_auction_request(
                 &slots_ctx,
@@ -4769,7 +4786,7 @@ mod tests {
             let slots = [slot];
             let slots_ctx = MatchedSlotsContext {
                 matched_slots: &slots,
-                request_path: "/2024/01/my-article/",
+                request_path_and_query: "/2024/01/my-article/?edition=fictional",
             };
             let request_info = RequestInfo {
                 host: "publisher.example.com".to_string(),
@@ -4790,6 +4807,11 @@ mod tests {
                 "should use a non-EC request id, got {}",
                 request.id
             );
+            assert_eq!(
+                request.publisher.page_url.as_deref(),
+                Some("https://publisher.example.com/2024/01/my-article/?edition=fictional"),
+                "should preserve the page path and query for auction providers"
+            );
         }
 
         #[test]
@@ -4798,7 +4820,7 @@ mod tests {
             let slots = [slot];
             let slots_ctx = MatchedSlotsContext {
                 matched_slots: &slots,
-                request_path: "/2024/01/my-article/",
+                request_path_and_query: "/2024/01/my-article/",
             };
             let request_info = RequestInfo {
                 host: "publisher.example.com".to_string(),
@@ -5228,6 +5250,20 @@ mod tests {
             );
         }
 
+        #[test]
+        fn normalize_page_bids_path_and_query_preserves_query_but_drops_fragment() {
+            assert_eq!(
+                normalize_page_bids_path_and_query("/2024/01/article/?edition=fictional#section"),
+                "/2024/01/article/?edition=fictional",
+                "query should reach auction providers without a browser-only fragment"
+            );
+            assert_eq!(
+                normalize_page_bids_path_and_query("2024/01/article/?edition=fictional"),
+                "/2024/01/article/?edition=fictional",
+                "missing leading slash should be added"
+            );
+        }
+
         #[tokio::test]
         async fn disabled_auction_returns_no_slots_or_bids() {
             // [auction].enabled = false is a global kill switch: it must disable
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt/index.ts b/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
index 362cca19d..127d670ce 100644
--- a/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
+++ b/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
@@ -716,17 +716,16 @@ export function installSpaAuctionHook(): void {
   ts.spaHookInstalled = true;
 
   let inflight: AbortController | null = null;
-  // Last path an auction was run for. popstate fires for hash-only and
-  // same-pathname back/forward (scroll restoration), and pushState/replaceState
-  // can be called with the current URL, so guard every entry point against
-  // re-requesting impressions for a path we already loaded.
-  let currentPath = location.pathname;
+  // Last path and query an auction was run for. popstate fires for hash-only
+  // changes and pushState/replaceState can be called with the current URL, so
+  // guard every entry point against re-requesting impressions already loaded.
+  let currentPath = `${location.pathname}${location.search}`;
   // Last path whose slots/bids were actually applied — the initial SSR page
   // counts. A failed navigation rolls `currentPath` back to this rather than to
   // the immediately-previous committed value: on rapid A→B where A was aborted
   // mid-flight and B then fails, rolling back to A (never loaded) would strand
   // it behind the no-op guard, so we roll back to the last applied route instead.
-  let lastAppliedPath = location.pathname;
+  let lastAppliedPath = `${location.pathname}${location.search}`;
 
   async function onNavigate(path: string): Promise<void> {
     if (path === currentPath) return;
@@ -786,8 +785,9 @@ export function installSpaAuctionHook(): void {
     const original = history[method].bind(history);
     history[method] = function (state: unknown, unused: string, url?: string | URL | null): void {
       original(state, unused, url);
-      const newPath = url ? new URL(String(url), location.href).pathname : location.pathname;
-      // onNavigate no-ops when newPath equals the last loaded path.
+      const locationUrl = url ? new URL(String(url), location.href) : location;
+      const newPath = `${locationUrl.pathname}${locationUrl.search}`;
+      // onNavigate no-ops when newPath equals the last loaded path and query.
       void onNavigate(newPath);
     };
   }
@@ -796,7 +796,7 @@ export function installSpaAuctionHook(): void {
   patchHistoryMethod('replaceState');
 
   window.addEventListener('popstate', () => {
-    void onNavigate(location.pathname);
+    void onNavigate(`${location.pathname}${location.search}`);
   });
 }
 
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts
index 9a08defcb..761fa8b3b 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts
@@ -74,11 +74,11 @@ describe('installSpaAuctionHook', () => {
     const adInit = vi.fn();
     ts.adInit = adInit;
 
-    history.pushState({}, '', '/next-page');
+    history.pushState({}, '', '/next-page?edition=fictional#section');
     await flushAsync();
 
     expect(fetchStub).toHaveBeenCalledWith(
-      '/__ts/page-bids?path=%2Fnext-page',
+      '/__ts/page-bids?path=%2Fnext-page%3Fedition%3Dfictional',
       expect.objectContaining({
         credentials: 'include',
         headers: { 'X-TSJS-Page-Bids': '1' },
diff --git a/docs/guide/configuration.md b/docs/guide/configuration.md
index 2619552f1..9248a1333 100644
--- a/docs/guide/configuration.md
+++ b/docs/guide/configuration.md
@@ -1223,6 +1223,9 @@ timeout_ms = 2000
 enabled = true
 account_id = "example-account"
 endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
+# Optional pair for deployments hosted away from APS-authorized inventory.
+# inventory_domain = "publisher.example"
+# inventory_page_origin = "https://www.publisher.example"
 allow_script_creatives = false
 
 [integrations.prebid]
diff --git a/docs/guide/integrations/aps.md b/docs/guide/integrations/aps.md
index ff4220070..2b36cb253 100644
--- a/docs/guide/integrations/aps.md
+++ b/docs/guide/integrations/aps.md
@@ -30,6 +30,9 @@ enabled = true
 account_id = "example-aps-account-id"
 endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 800
+# Set both when the deployment hostname differs from APS-authorized inventory.
+# inventory_domain = "publisher.example"
+# inventory_page_origin = "https://www.publisher.example"
 allow_script_creatives = false
 
 [auction]
@@ -42,6 +45,8 @@ timeout_ms = 2000
 
 `allow_script_creatives` defaults to `false`. While disabled, APS script bids are rejected before per-impression reduction, floors, mediation, and winner selection. Enable it only for a controlled cohort after the browser-security checks in [Rollout](#rollout) pass.
 
+Set `inventory_domain` and `inventory_page_origin` together only when the public deployment hostname differs from the inventory identity authorized by APS. The domain becomes `site.domain`. The HTTPS page origin replaces the current page's scheme and host while preserving its path and query. The origin must be the inventory domain or one of its subdomains and cannot include credentials, a port, path, query, or fragment. These values come only from operator configuration; Trusted Server never accepts APS inventory identity from the client auction payload.
+
 APS uses ordinary auction slot IDs and banner formats. Legacy creative-opportunity APS `slot_id` configuration is accepted for compatibility but ignored, and `bidders.aps.slotID` is not required. Remove both during migration.
 
 The APS provider may also participate through a configured mediator:
@@ -184,6 +189,7 @@ Use fictional values in source-controlled configuration and fixtures. Supply con
 
 - Confirm `account_id` and account eligibility with APS.
 - Confirm the endpoint is `/e/pb/bid` and uses HTTPS without credentials.
+- If the deployment hostname differs from APS-authorized inventory, configure both `inventory_domain` and `inventory_page_origin` with the APS-approved identity.
 - Ensure `aps` appears in `auction.providers`.
 - Check aggregate APS drop reasons for currency, dimensions, render source, URL, tag type, or script-gate rejection.
 - Confirm the provider timeout fits inside the auction timeout.
diff --git a/trusted-server.example.toml b/trusted-server.example.toml
index 53afdb9d6..9a3a1e890 100644
--- a/trusted-server.example.toml
+++ b/trusted-server.example.toml
@@ -121,6 +121,9 @@ enabled = false
 account_id = "example-aps-account-id"
 endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 1000
+# Set both when the deployment hostname differs from APS-authorized inventory.
+# inventory_domain = "publisher.example"
+# inventory_page_origin = "https://www.publisher.example"
 # Script creatives require separate security validation before opt-in.
 allow_script_creatives = false
 

From 004778b488cb26d01488651f51b97bba7da0192d Mon Sep 17 00:00:00 2001
From: Christian <christianpavilonis@outlook.com>
Date: Thu, 16 Jul 2026 16:56:13 -0500
Subject: [PATCH 4/9] Render APS bids from the trustedServer Prebid adapter

---
 .github/workflows/integration-tests.yml       |  11 +-
 CHANGELOG.md                                  |   1 +
 .../browser/tests/shared/aps-renderer.spec.ts | 204 ++++++++++++-
 .../lib/build-prebid-external.mjs             |   7 +
 .../trusted-server-js/lib/src/core/types.ts   |  17 ++
 .../lib/src/integrations/aps/render.ts        | 106 ++++++-
 .../lib/src/integrations/gpt/index.ts         | 280 +++++++++---------
 .../lib/src/integrations/prebid/index.ts      |  35 ++-
 .../prebid/prebid_modules/aliases.d.ts        |   5 +
 .../lib/test/integrations/aps/render.test.ts  |  42 +++
 .../lib/test/integrations/gpt/ad_init.test.ts | 117 ++++++++
 .../test/integrations/prebid/index.test.ts    | 131 ++++++++
 crates/trusted-server-js/lib/vitest.config.ts |   4 +
 docs/guide/integrations/aps.md                |   8 +-
 scripts/integration-tests-browser.sh          |   9 +
 15 files changed, 822 insertions(+), 155 deletions(-)

diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index ec85b96ac..4973afe44 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -183,7 +183,16 @@ jobs:
         with:
           node-version: ${{ steps.shared-setup.outputs.node-version }}
           cache: npm
-          cache-dependency-path: crates/trusted-server-integration-tests/browser/package-lock.json
+          cache-dependency-path: |
+            crates/trusted-server-integration-tests/browser/package-lock.json
+            crates/trusted-server-js/lib/package-lock.json
+
+      - name: Build TSJS browser fixtures
+        working-directory: crates/trusted-server-js/lib
+        run: |
+          npm ci
+          npm run build
+          npm run build:prebid-external
 
       - name: Install Playwright
         working-directory: crates/trusted-server-integration-tests/browser
diff --git a/CHANGELOG.md b/CHANGELOG.md
index aa3bed697..6ab91d4f3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Breaking** — `bid_param_zone_overrides` inner values must now be JSON objects; previously non-object or empty values (`"header" = "x"`, `"header" = {}`) were accepted and silently produced a dead rule at runtime. They now fail at startup with a configuration error. Operators upgrading should audit their `bid_param_zone_overrides` config for non-object zone entries.
 - **Breaking** — Sourcepoint browser module inclusion now requires explicit `[integrations.sourcepoint].enabled = true`; operators relying on the previous unconditional Sourcepoint module should enable the integration before upgrading.
 - Added optional APS `inventory_domain` and `inventory_page_origin` overrides for deployments whose edge hostname differs from the APS-authorized inventory identity.
+- Preserved APS renderer capabilities through the client-side `trustedServer` Prebid adapter, allowing its generated `hb_adid` to render through GAM and Prebid Universal Creative instead of producing an empty creative.
 
 ### Security
 
diff --git a/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts b/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts
index bbefc7dfb..7a2078625 100644
--- a/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts
+++ b/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts
@@ -1,3 +1,5 @@
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
 import { expect, test } from "@playwright/test";
 import { runtimeUrl } from "../../helpers/state.js";
 
@@ -6,11 +8,24 @@ const IFRAME_CREATIVE_URL = "https://creative.example/iframe";
 const SCRIPT_CREATIVE_URL = "https://creative.example/script.js";
 const SANDBOX =
     "allow-forms allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-scripts allow-top-navigation-by-user-activation";
+const TSJS_CRATE = resolve(__dirname, "../../../../trusted-server-js");
+
+function clientAuctionBundlePaths() {
+    const manifestPath = resolve(TSJS_CRATE, "dist/prebid/manifest.json");
+    const manifest = JSON.parse(readFileSync(manifestPath, "utf8")) as {
+        filename: string;
+    };
+    return {
+        gpt: resolve(TSJS_CRATE, "dist/tsjs-gpt.js"),
+        prebid: resolve(TSJS_CRATE, "dist/prebid", manifest.filename),
+    };
+}
 
 function descriptor(
     tagType: "iframe" | "script",
-    creativeUrl =
-        tagType === "iframe" ? IFRAME_CREATIVE_URL : SCRIPT_CREATIVE_URL,
+    creativeUrl = tagType === "iframe"
+        ? IFRAME_CREATIVE_URL
+        : SCRIPT_CREATIVE_URL,
 ) {
     const envelope = {
         seatbid: [
@@ -151,6 +166,183 @@ const SCRIPT_CREATIVE = `(function(){
 })();`;
 
 test.describe("APS opaque renderer", () => {
+    test("renders a trustedServer adapter bid using Prebid's generated GAM ad ID", async ({
+        page,
+    }) => {
+        const apsRenderer = descriptor("iframe");
+        const responseBody = {
+            id: "fictional-auction",
+            seatbid: [
+                {
+                    seat: "aps",
+                    bid: [
+                        {
+                            id: apsRenderer.bidId,
+                            impid: "div-aps",
+                            price: 1.23,
+                            crid: apsRenderer.creativeId,
+                            w: 300,
+                            h: 250,
+                            ext: {
+                                trusted_server: { renderer: apsRenderer },
+                            },
+                        },
+                    ],
+                },
+            ],
+            ext: {},
+        };
+        let auctionRequests = 0;
+        await page.route(runtimeUrl("/aps-prebid-adapter-test"), (route) =>
+            route.fulfill({
+                status: 200,
+                contentType: "text/html",
+                body: '<!doctype html><div id="div-aps"></div>',
+            }),
+        );
+        await page.route(runtimeUrl("/auction"), (route) => {
+            auctionRequests += 1;
+            return route.fulfill({
+                status: 200,
+                contentType: "application/json",
+                body: JSON.stringify(responseBody),
+            });
+        });
+
+        await page.goto(runtimeUrl("/aps-prebid-adapter-test"));
+        const bundles = clientAuctionBundlePaths();
+        await page.addScriptTag({ path: bundles.gpt });
+        await page.addScriptTag({ path: bundles.prebid });
+
+        const result = await page.evaluate(async () => {
+            type PrebidBid = {
+                ad?: string;
+                adId: string;
+                bidderCode: string;
+                status?: string;
+            };
+            type PrebidApi = {
+                getAllWinningBids(): PrebidBid[];
+                getBidResponsesForAdUnitCode(code: string): {
+                    bids: PrebidBid[];
+                };
+                onEvent(
+                    name: string,
+                    callback: (value: Record<string, unknown>) => void,
+                ): void;
+                requestBids(options: Record<string, unknown>): void;
+            };
+            const pbjs = (window as unknown as { pbjs: PrebidApi }).pbjs;
+            const bidWon: string[] = [];
+            const renderSucceeded: string[] = [];
+            pbjs.onEvent("bidWon", (bid) => bidWon.push(String(bid.adId)));
+            pbjs.onEvent("adRenderSucceeded", (event) =>
+                renderSucceeded.push(String(event.adId)),
+            );
+
+            const acceptedBid = await new Promise<PrebidBid | undefined>(
+                (resolveBid) => {
+                    pbjs.requestBids({
+                        adUnits: [
+                            {
+                                code: "div-aps",
+                                mediaTypes: { banner: { sizes: [[300, 250]] } },
+                                bids: [],
+                            },
+                        ],
+                        bidsBackHandler: () =>
+                            resolveBid(
+                                pbjs
+                                    .getBidResponsesForAdUnitCode("div-aps")
+                                    .bids.find(
+                                        (bid) => bid.bidderCode === "aps",
+                                    ),
+                            ),
+                        timeout: 1_000,
+                    });
+                },
+            );
+            if (!acceptedBid)
+                throw new Error("APS bid was not accepted by Prebid");
+
+            const universalCreativeResponse = await new Promise<
+                Record<string, unknown>
+            >((resolveResponse, rejectResponse) => {
+                const frame = document.createElement("iframe");
+                const adIdJson = JSON.stringify(acceptedBid.adId);
+                frame.srcdoc = `<script>
+const renderChannel = new MessageChannel();
+renderChannel.port1.onmessage = function(event) {
+  parent.postMessage({ type: 'captured-prebid-response', payload: event.data }, '*');
+  const eventChannel = new MessageChannel();
+  parent.postMessage(JSON.stringify({
+    message: 'Prebid Event',
+    adId: ${adIdJson},
+    event: 'adRenderSucceeded'
+  }), '*', [eventChannel.port2]);
+};
+parent.postMessage(JSON.stringify({
+  message: 'Prebid Request',
+  adId: ${adIdJson}
+}), '*', [renderChannel.port2]);
+<\/script>`;
+                const receive = (event: MessageEvent) => {
+                    if (event.data?.type !== "captured-prebid-response") return;
+                    window.removeEventListener("message", receive);
+                    resolveResponse(JSON.parse(String(event.data.payload)));
+                };
+                window.addEventListener("message", receive);
+                document.getElementById("div-aps")!.appendChild(frame);
+                window.setTimeout(
+                    () =>
+                        rejectResponse(
+                            new Error("Universal Creative response timed out"),
+                        ),
+                    3_000,
+                );
+            });
+            await new Promise((resolveTick) =>
+                window.setTimeout(resolveTick, 50),
+            );
+
+            return {
+                acceptedAd: acceptedBid.ad,
+                acceptedAdId: acceptedBid.adId,
+                acceptedStatus: acceptedBid.status,
+                bidWon,
+                renderSucceeded,
+                universalCreativeResponse,
+                winningAdIds: pbjs.getAllWinningBids().map((bid) => bid.adId),
+                registrySize: Object.keys(
+                    (
+                        window as unknown as {
+                            tsjs?: {
+                                apsPrebidRenderers?: Record<string, unknown>;
+                            };
+                        }
+                    ).tsjs?.apsPrebidRenderers ?? {},
+                ).length,
+            };
+        });
+
+        expect(auctionRequests).toBe(1);
+        expect(result.acceptedAd).toBe("");
+        expect(result.acceptedAdId).not.toBe(apsRenderer.bidId);
+        expect(result.universalCreativeResponse).toEqual(
+            expect.objectContaining({
+                message: "Prebid Response",
+                adId: result.acceptedAdId,
+                rendererVersion: 4,
+                apsRenderer,
+            }),
+        );
+        expect(result.bidWon).toEqual([result.acceptedAdId]);
+        expect(result.renderSucceeded).toEqual([result.acceptedAdId]);
+        expect(result.winningAdIds).toContain(result.acceptedAdId);
+        expect(result.acceptedStatus).toBe("rendered");
+        expect(result.registrySize).toBe(0);
+    });
+
     test("enforces nonce gating and isolates iframe and script behavior under restrictive CSP", async ({
         page,
     }) => {
@@ -201,9 +393,7 @@ test.describe("APS opaque renderer", () => {
                     "Content-Security-Policy":
                         "default-src 'none'; script-src 'unsafe-inline'; frame-src 'self'",
                 },
-                body: testPage(
-                    runtimeUrl("/integrations/aps/renderer"),
-                ),
+                body: testPage(runtimeUrl("/integrations/aps/renderer")),
             });
         });
 
@@ -609,6 +799,8 @@ test.describe("APS opaque renderer", () => {
 
         await page.waitForTimeout(100);
         expect(runnerRequests).toBe(0);
-        await expect(page.locator("#same-origin-slot .existing")).toHaveCount(1);
+        await expect(page.locator("#same-origin-slot .existing")).toHaveCount(
+            1,
+        );
     });
 });
diff --git a/crates/trusted-server-js/lib/build-prebid-external.mjs b/crates/trusted-server-js/lib/build-prebid-external.mjs
index 4e89723ed..a63758c32 100644
--- a/crates/trusted-server-js/lib/build-prebid-external.mjs
+++ b/crates/trusted-server-js/lib/build-prebid-external.mjs
@@ -224,6 +224,13 @@ async function buildExternalBundle(outDir, generatedModules) {
               'node_modules/prebid.js/dist/src/src/adapterManager.js'
             ),
           },
+          {
+            find: 'prebid.js/src/adRendering.js',
+            replacement: path.resolve(
+              __dirname,
+              'node_modules/prebid.js/dist/src/src/adRendering.js'
+            ),
+          },
         ],
       },
       build: {
diff --git a/crates/trusted-server-js/lib/src/core/types.ts b/crates/trusted-server-js/lib/src/core/types.ts
index ffa5c1ed3..7cae70396 100644
--- a/crates/trusted-server-js/lib/src/core/types.ts
+++ b/crates/trusted-server-js/lib/src/core/types.ts
@@ -68,6 +68,18 @@ export interface ApsRendererV1 {
 
 export type AuctionBidRenderer = ApsRendererV1;
 
+/** A client-side Prebid bid's generated ad ID bound to its APS render capability. */
+export interface ApsPrebidRendererEntry {
+  adUnitCode: string;
+  renderer: ApsRendererV1;
+  registeredAt: number;
+  expiresAt: number;
+  /** Notify Prebid that GAM selected this bid before replying to Universal Creative. */
+  markWinner(): void;
+  /** Mark Prebid's bid rendered after the Universal Creative response is posted. */
+  markRendered(): void;
+}
+
 /** Bid targeting data from the server-side auction, injected into `window.tsjs.bids`. */
 export interface AuctionBidData {
   hb_pb?: string;
@@ -112,6 +124,11 @@ export interface TsjsApi {
   adSlots?: AuctionSlot[];
   /** Winning bid targeting data injected before </body>. */
   bids?: Record<string, AuctionBidData>;
+  /**
+   * Bounded client-side Prebid APS renderer capabilities keyed by Prebid's generated
+   * `hb_adid`. The Universal Creative bridge consumes each entry at most once.
+   */
+  apsPrebidRenderers?: Record<string, ApsPrebidRendererEntry>;
   /** Initialises GPT slots with server-side bid targeting and calls refresh(). */
   adInit?: () => void;
   /** GPT slot objects TS defined — used to destroy stale slots on SPA navigation. */
diff --git a/crates/trusted-server-js/lib/src/integrations/aps/render.ts b/crates/trusted-server-js/lib/src/integrations/aps/render.ts
index f9e6b03b9..ff37e2cb4 100644
--- a/crates/trusted-server-js/lib/src/integrations/aps/render.ts
+++ b/crates/trusted-server-js/lib/src/integrations/aps/render.ts
@@ -1,5 +1,5 @@
 import { log } from '../../core/log';
-import type { ApsRendererV1 } from '../../core/types';
+import type { ApsPrebidRendererEntry, ApsRendererV1, TsjsApi } from '../../core/types';
 
 export const APS_RENDERER_PATH = '/integrations/aps/renderer';
 export const APS_RENDERER_SANDBOX =
@@ -26,6 +26,10 @@ const activeFrames = new WeakMap<HTMLElement, HTMLIFrameElement>();
 const RENDERER_READY_MESSAGE = 'trusted-server/aps/renderer-ready';
 const RENDERER_FAILED_MESSAGE = 'trusted-server/aps/renderer-failed';
 const RENDERER_READY_TIMEOUT_MS = 10_000;
+const MAX_PREBID_RENDERER_ENTRIES = 256;
+const DEFAULT_PREBID_RENDERER_TTL_SECONDS = 300;
+const MAX_PREBID_RENDERER_TTL_SECONDS = 3600;
+const MAX_PREBID_ID_BYTES = 1024;
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -158,6 +162,106 @@ export function validateApsRenderer(
   return renderer;
 }
 
+function validPrebidIdentity(value: unknown): value is string {
+  return (
+    typeof value === 'string' &&
+    value.length > 0 &&
+    new TextEncoder().encode(value).length <= MAX_PREBID_ID_BYTES
+  );
+}
+
+function validPrebidAdId(value: unknown): value is string {
+  return validPrebidIdentity(value) && /^[A-Za-z0-9-]+$/.test(value);
+}
+
+function prunePrebidRenderers(registry: Record<string, ApsPrebidRendererEntry>, now: number): void {
+  for (const [adId, entry] of Object.entries(registry)) {
+    if (!Number.isFinite(entry.expiresAt) || entry.expiresAt <= now) delete registry[adId];
+  }
+
+  const entries = Object.entries(registry);
+  if (entries.length <= MAX_PREBID_RENDERER_ENTRIES) return;
+  entries
+    .sort(([, left], [, right]) => left.registeredAt - right.registeredAt)
+    .slice(0, entries.length - MAX_PREBID_RENDERER_ENTRIES)
+    .forEach(([adId]) => delete registry[adId]);
+}
+
+/** Bind Prebid's generated ad ID to a fully validated APS renderer capability. */
+export function registerApsPrebidRenderer(
+  adId: unknown,
+  adUnitCode: unknown,
+  input: unknown,
+  ttlSeconds: unknown = DEFAULT_PREBID_RENDERER_TTL_SECONDS,
+  lifecycle?: { markWinner(): void; markRendered(): void }
+): boolean {
+  if (
+    !validPrebidAdId(adId) ||
+    !validPrebidIdentity(adUnitCode) ||
+    typeof lifecycle?.markWinner !== 'function' ||
+    typeof lifecycle.markRendered !== 'function'
+  ) {
+    return false;
+  }
+  const renderer = validateApsRenderer(input);
+  if (!renderer) return false;
+
+  const now = Date.now();
+  const boundedTtlSeconds =
+    typeof ttlSeconds === 'number' && Number.isFinite(ttlSeconds) && ttlSeconds > 0
+      ? Math.min(ttlSeconds, MAX_PREBID_RENDERER_TTL_SECONDS)
+      : DEFAULT_PREBID_RENDERER_TTL_SECONDS;
+  const tsjs = (window.tsjs ??= {} as TsjsApi);
+  const registry = (tsjs.apsPrebidRenderers ??= Object.create(null) as Record<
+    string,
+    ApsPrebidRendererEntry
+  >);
+  prunePrebidRenderers(registry, now);
+
+  if (!(adId in registry) && Object.keys(registry).length >= MAX_PREBID_RENDERER_ENTRIES) {
+    const oldest = Object.entries(registry).sort(
+      ([, left], [, right]) => left.registeredAt - right.registeredAt
+    )[0];
+    if (oldest) delete registry[oldest[0]];
+  }
+
+  registry[adId] = {
+    adUnitCode,
+    renderer,
+    registeredAt: now,
+    expiresAt: now + boundedTtlSeconds * 1000,
+    markWinner: lifecycle.markWinner,
+    markRendered: lifecycle.markRendered,
+  };
+  return true;
+}
+
+/** Return an unexpired Prebid APS capability without consuming it. */
+export function getApsPrebidRenderer(adId: string): ApsPrebidRendererEntry | undefined {
+  if (!validPrebidAdId(adId)) return undefined;
+  const registry = window.tsjs?.apsPrebidRenderers;
+  const entry = registry?.[adId];
+  if (!entry) return undefined;
+  if (
+    !Number.isFinite(entry.expiresAt) ||
+    entry.expiresAt <= Date.now() ||
+    typeof entry.markWinner !== 'function' ||
+    typeof entry.markRendered !== 'function'
+  ) {
+    delete registry![adId];
+    return undefined;
+  }
+  return entry;
+}
+
+/** Atomically consume the exact capability previously returned by the registry. */
+export function consumeApsPrebidRenderer(adId: string, expected: ApsPrebidRendererEntry): boolean {
+  const registry = window.tsjs?.apsPrebidRenderers;
+  if (!registry || registry[adId] !== expected) return false;
+  delete registry[adId];
+  return true;
+}
+
 function createNonce(): string | undefined {
   if (typeof crypto === 'undefined' || typeof crypto.getRandomValues !== 'function')
     return undefined;
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt/index.ts b/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
index 127d670ce..aab9e3094 100644
--- a/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
+++ b/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
@@ -4,6 +4,8 @@ import {
   APS_UNIVERSAL_CREATIVE_RENDERER,
   APS_UNIVERSAL_CREATIVE_RENDERER_VERSION,
   apsRendererUrl,
+  consumeApsPrebidRenderer,
+  getApsPrebidRenderer,
   validateApsRenderer,
 } from '../aps/render';
 
@@ -97,6 +99,21 @@ function slotIdForMessageSource(source: MessageEventSource | null): string | und
   )?.id;
 }
 
+function messageSourceBelongsToAdUnit(
+  source: MessageEventSource | null,
+  adUnitCode: string
+): boolean {
+  if (!source) return false;
+  const roots = [
+    document.getElementById(adUnitCode),
+    document.getElementById(`${adUnitCode}-container`),
+  ].filter((root): root is HTMLElement => root !== null);
+
+  return roots.some((root) =>
+    Array.from(root.querySelectorAll('iframe')).some((iframe) => iframe.contentWindow === source)
+  );
+}
+
 function clearTargetingKeys(slot: GoogleTagSlot, keys: Iterable<string>): void {
   if (typeof slot.clearTargeting !== 'function') return;
 
@@ -287,11 +304,7 @@ export function safeAdmIframeSrc(src: string): string | undefined {
  *
  * Adapted from PR #241 (github.com/IABTechLab/trusted-server/pull/241).
  * Instead of reading from pbjs, reads adm directly from window.tsjs.bids.
- *
- * This is the testing-only direct-replace path that bypasses GAM entirely. The
- * sanitized `adm` now ships in production for the pbRender bridge, so `adm`
- * presence no longer gates it; the caller gates on the per-bid `debug_bid`
- * signal (present only under `inject_adm_for_testing`) instead.
+ * Only active when inject_adm_for_testing injects adm server-side.
  *
  * Strategy:
  * 1. If adm contains an <iframe src="..."> with a safe http(s) src, set that
@@ -598,13 +611,10 @@ export function installTsAdInit(): void {
           // Read ts.bids live (not the snapshot above) so post-navigation bid data is used.
           const bid = (ts.bids ?? {})[slotId] ?? {};
 
-          // GAM interceptor (testing bypass): directly replace the GAM creative.
-          // `adm` is now always injected in production, so it can no longer gate
-          // this path. `debug_bid` is present only when inject_adm_for_testing is
-          // on, so it is the per-bid signal that the testing bypass is enabled.
-          // In production the render bridge serves the creative and GAM stays in
-          // the loop; this direct replace stays testing-only.
-          if (bid.adm && bid.debug_bid) {
+          // GAM interceptor (testing): when adm is present, replace the GAM creative.
+          // Adapted from PR #241 — uses window.tsjs.bids[slotId].adm instead of pbjs.
+          // Only active when inject_adm_for_testing injects adm into bids server-side.
+          if (bid.adm) {
             injectAdmIntoSlot(divId, bid.adm);
           }
         });
@@ -827,79 +837,6 @@ const TS_DISPLAY_RENDERER =
   'if(d.adUrl&&!d.ad){f.src=d.adUrl;}else{f.srcdoc=d.ad;}' +
   'w.document.body.appendChild(f);};})();';
 
-/** The clear-price auction macro DSPs embed in creative markup and tracking URLs. */
-const AUCTION_PRICE_MACRO = '${AUCTION_PRICE}';
-
-/**
- * Substitute the `${AUCTION_PRICE}` macro with a clearing price. Mirrors the
- * server-side `expand_auction_price_macro`: only the exact clear-price token is
- * replaced, so the encrypted `${AUCTION_PRICE:B64}` variant is left intact.
- */
-function expandAuctionPriceMacro(markup: string, cpm: number): string {
-  return markup.includes(AUCTION_PRICE_MACRO)
-    ? markup.split(AUCTION_PRICE_MACRO).join(String(cpm))
-    : markup;
-}
-
-/** A decoded PBS Cache bid: the renderable creative plus its render metadata. */
-export interface CachedBid {
-  adm: string;
-  width?: number;
-  height?: number;
-  price?: number;
-}
-
-/**
- * Decode a PBS Cache GET response into a renderable bid.
- *
- * Prebid Cache entries are JSON bid objects (`{ "adm": "<div…>", "w": …, … }`);
- * the Prebid Universal Creative's own cache path `JSON.parse`s the response and
- * renders `bidObject.adm`, sizing from the cached dimensions. This mirrors that,
- * retaining the fields the fallback render needs — creative dimensions (`w`/`h`
- * or `width`/`height`) and clearing `price` for macro expansion — rather than
- * reducing the payload to a bare `adm` string that forces the first slot format
- * and leaves price macros unresolved.
- *
- * A non-JSON body is treated as raw creative markup (the `{ adm }`-only variant)
- * for backward compatibility with caches that store the creative directly.
- * Returns `undefined` when the JSON payload carries no usable string `adm`, so
- * the caller can decline to render instead of injecting a serialized object.
- */
-export function parseCachedBid(body: string): CachedBid | undefined {
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(body);
-  } catch {
-    // Not JSON — a cache that returned the creative markup directly. No render
-    // metadata is available, so only the raw markup variant is returned.
-    return body.trim().length > 0 ? { adm: body } : undefined;
-  }
-  if (!parsed || typeof parsed !== 'object') {
-    // A JSON primitive (string/number/bool) is not a valid cached bid object.
-    return undefined;
-  }
-  const obj = parsed as Record<string, unknown>;
-  const adm = obj.adm;
-  if (typeof adm !== 'string' || adm.length === 0) return undefined;
-
-  const num = (v: unknown): number | undefined =>
-    typeof v === 'number' && Number.isFinite(v) ? v : undefined;
-  // A zero (or missing) dimension is not usable render metadata; treat it as
-  // absent so the caller falls back to the slot format rather than sizing to 0.
-  const dim = (v: unknown): number | undefined => {
-    const n = num(v);
-    return n !== undefined && n > 0 ? n : undefined;
-  };
-
-  return {
-    adm,
-    // PBS OpenRTB bids carry w/h; the Prebid.js cache format uses width/height.
-    width: dim(obj.w) ?? dim(obj.width),
-    height: dim(obj.h) ?? dim(obj.height),
-    price: num(obj.price),
-  };
-}
-
 /**
  * Install the TS → pbRender bridge.
  *
@@ -909,9 +846,7 @@ export function parseCachedBid(body: string): CachedBid | undefined {
  *
  * When `adId` matches a TS server-side bid in `window.tsjs.bids` AND the bid
  * has renderable markup, the bridge:
- *   1. Uses the inline `adm` directly when present (the sanitized winning
- *      creative, now shipped in production), otherwise fetches from PBS Cache
- *      and extracts `adm` from the cached bid JSON (see `extractCachedAdm`).
+ *   1. Uses debug `adm` directly when present, otherwise fetches from PBS Cache.
  *   2. Replies via the MessageChannel port with a `"Prebid Response"`.
  *   3. Calls `stopImmediatePropagation()` so Prebid.js does not also process
  *      the message and log spurious failures.
@@ -922,14 +857,27 @@ export function parseCachedBid(body: string): CachedBid | undefined {
 export function installTsRenderBridge(): void {
   if (typeof window === 'undefined') return;
 
-  // `slotId|adId` renders whose PBS Cache fetch is in flight. `fireWinBillingBeacons`
-  // only dedups after the async fetch resolves, so two Prebid Request messages for
-  // the same render arriving before the first fetch settles would both fetch and
-  // both fire the nurl/burl beacons. Tracking the in-flight render prevents the
-  // concurrent double-fire; the entry is cleared once the fetch settles. The key
-  // is scoped to the slot, not the bare adId: hb_adid is not unique per bid, so
-  // keying on it alone would let one slot block a distinct slot's render.
-  const renderingKeys = new Set<string>();
+  // adIds whose PBS Cache render is in flight. `fireWinBillingBeacons` only
+  // dedups after the async cache fetch resolves, so two Prebid Request messages
+  // for the same adId arriving before the first fetch settles would both fetch
+  // and both fire the nurl/burl beacons. Tracking in-flight adIds prevents the
+  // concurrent double-fire; the entry is cleared once the fetch settles.
+  const renderingAdIds = new Set<string>();
+  const consumedPrebidApsIds = new Map<string, { adUnitCode: string; expiresAt: number }>();
+  const rememberConsumedPrebidApsId = (
+    adId: string,
+    entry: { adUnitCode: string; expiresAt: number }
+  ): void => {
+    const now = Date.now();
+    for (const [consumedAdId, consumed] of consumedPrebidApsIds) {
+      if (consumed.expiresAt <= now) consumedPrebidApsIds.delete(consumedAdId);
+    }
+    if (!consumedPrebidApsIds.has(adId) && consumedPrebidApsIds.size >= 256) {
+      const oldestAdId = consumedPrebidApsIds.keys().next().value as string | undefined;
+      if (oldestAdId) consumedPrebidApsIds.delete(oldestAdId);
+    }
+    consumedPrebidApsIds.set(adId, entry);
+  };
 
   window.addEventListener('message', (e: MessageEvent) => {
     let data: Record<string, unknown>;
@@ -948,29 +896,96 @@ export function installTsRenderBridge(): void {
 
     const port = e.ports?.[0];
     if (!port) return;
+
+    const consumedPrebidAps = consumedPrebidApsIds.get(adId);
+    if (consumedPrebidAps) {
+      if (consumedPrebidAps.expiresAt <= Date.now()) {
+        consumedPrebidApsIds.delete(adId);
+      } else {
+        if (messageSourceBelongsToAdUnit(e.source, consumedPrebidAps.adUnitCode)) {
+          e.stopImmediatePropagation();
+        }
+        return;
+      }
+    }
+
+    // Client-side trustedServer adapter bids receive a new adId from Prebid. Bind
+    // that ID to the server-validated APS descriptor only after confirming the
+    // requesting Universal Creative frame belongs to the same GPT ad unit.
+    const prebidRendererEntry = getApsPrebidRenderer(adId);
+    if (prebidRendererEntry) {
+      if (!messageSourceBelongsToAdUnit(e.source, prebidRendererEntry.adUnitCode)) return;
+      const renderer = validateApsRenderer(prebidRendererEntry.renderer);
+      const rendererUrl = apsRendererUrl();
+      if (!renderer || !rendererUrl) return;
+      if (!consumeApsPrebidRenderer(adId, prebidRendererEntry)) return;
+      rememberConsumedPrebidApsId(adId, {
+        adUnitCode: prebidRendererEntry.adUnitCode,
+        expiresAt: prebidRendererEntry.expiresAt,
+      });
+
+      e.stopImmediatePropagation();
+      try {
+        prebidRendererEntry.markWinner();
+      } catch (err) {
+        log.warn('[tsjs-gpt] pbRender bridge: Prebid APS winner lifecycle failed', err);
+        return;
+      }
+
+      try {
+        port.postMessage(
+          JSON.stringify({
+            message: 'Prebid Response',
+            adId,
+            renderer: APS_UNIVERSAL_CREATIVE_RENDERER,
+            rendererVersion: APS_UNIVERSAL_CREATIVE_RENDERER_VERSION,
+            rendererUrl,
+            apsRenderer: renderer,
+            width: renderer.width,
+            height: renderer.height,
+          })
+        );
+      } catch (err) {
+        log.warn('[tsjs-gpt] pbRender bridge: Prebid APS response failed', err);
+        return;
+      }
+
+      try {
+        prebidRendererEntry.markRendered();
+      } catch (err) {
+        log.warn('[tsjs-gpt] pbRender bridge: Prebid APS rendered lifecycle failed', err);
+      }
+      log.debug(
+        `[tsjs-gpt] pbRender bridge served Prebid APS bid for '${prebidRendererEntry.adUnitCode}'`
+      );
+      return;
+    }
+
     const sourceSlotId = slotIdForMessageSource(e.source);
     if (!sourceSlotId) return;
 
-    // Resolve the bid by the requesting slot, not by the first bid whose hb_adid
-    // matches. hb_adid is not unique per bid: absent PBS Cache, it falls back to a
-    // creative id a bidder may reuse across slots. A first-match-by-adId lookup
-    // would resolve every duplicate to one slot, so all but that slot render blank.
+    // Build reverse map adId → slotId from live window.tsjs.bids.
     const bids = window.tsjs?.bids ?? {};
-    const slotId = sourceSlotId;
-    const matchedBid = bids[slotId];
+    let slotId: string | undefined;
+    let matchedBid: (typeof bids)[string] | undefined;
+    for (const [sid, bid] of Object.entries(bids)) {
+      if (bid.hb_adid === adId) {
+        slotId = sid;
+        matchedBid = bid;
+        break;
+      }
+    }
+
+    // Not a TS bid — let Prebid.js handle it.
+    if (!slotId || !matchedBid) return;
 
-    // Not a TS bid, or the requesting slot's bid does not own this adId — let
-    // Prebid.js handle it. The adId guard also prevents an iframe under slot A from
-    // pulling slot B's creative and firing slot B's win/billing beacons.
-    if (!matchedBid || matchedBid.hb_adid !== adId) return;
+    // The requesting iframe's slot must own the resolved adId. Without this an
+    // iframe under slot A could request slot B's hb_adid and receive slot B's
+    // creative/dimensions while firing slot B's win/billing beacons.
+    if (slotId !== sourceSlotId) return;
 
     const slot = window.tsjs?.adSlots?.find((s) => s.id === slotId);
-    // Prefer the winning creative's own dimensions; the first configured slot
-    // format is only a fallback and mis-sizes a multi-size slot whose winner is
-    // not the first format.
-    const [fallbackWidth, fallbackHeight] = slot?.formats?.[0] ?? [728, 90];
-    const width = matchedBid.w ?? fallbackWidth;
-    const height = matchedBid.h ?? fallbackHeight;
+    const [width, height] = slot?.formats?.[0] ?? [728, 90];
 
     if (matchedBid.renderer !== undefined) {
       const renderer = validateApsRenderer(matchedBid.renderer);
@@ -1017,7 +1032,7 @@ export function installTsRenderBridge(): void {
         })
       );
       fireWinBillingBeacons(slotId, matchedBid);
-      log.debug(`[tsjs-gpt] pbRender bridge served '${slotId}' from inline adm`);
+      log.debug(`[tsjs-gpt] pbRender bridge served '${slotId}' from debug adm`);
       return;
     }
 
@@ -1027,49 +1042,26 @@ export function installTsRenderBridge(): void {
     // TS owns this adId — stop Prebid from also processing it.
     e.stopImmediatePropagation();
 
-    // Skip a concurrent re-render of the same slot's adId so its win/billing
-    // beacons fire at most once even before the first cache fetch resolves.
-    const renderingKey = `${slotId}|${adId}`;
-    if (renderingKeys.has(renderingKey)) return;
-    renderingKeys.add(renderingKey);
+    // Skip a concurrent re-render of the same adId so its win/billing beacons
+    // fire at most once even before the first cache fetch resolves.
+    if (renderingAdIds.has(adId)) return;
+    renderingAdIds.add(adId);
 
     const cacheUrl = `https://${matchedBid.hb_cache_host}${matchedBid.hb_cache_path}?uuid=${encodeURIComponent(adId)}`;
 
     fetch(cacheUrl, { mode: 'cors' })
       .then((res) => (res.ok ? res.text() : Promise.reject(res.status)))
-      .then((body) => {
-        // PBS Cache returns the cached bid as a JSON object; decode its creative
-        // and render metadata the same way the Prebid Universal Creative does.
-        const cached = parseCachedBid(body);
-        if (!cached) {
-          // No renderable creative in the cache payload — decline rather than
-          // ship a serialized bid document to PUC. Beacons stay unfired.
-          log.warn(
-            `[tsjs-gpt] pbRender bridge: PBS Cache response for '${slotId}' had no renderable adm`
-          );
-          return;
-        }
-        // Resolve the auction-price macro from the cached clearing price, and
-        // size from the cached bid's own dimensions, falling back to the slot
-        // format only when the cache omits them.
-        const ad =
-          cached.price !== undefined
-            ? expandAuctionPriceMacro(cached.adm, cached.price)
-            : cached.adm;
+      .then((ad) => {
         port.postMessage(
           JSON.stringify({
             message: 'Prebid Response',
             adId,
             ad,
             renderer: TS_DISPLAY_RENDERER,
-            width: cached.width ?? width,
-            height: cached.height ?? height,
+            width,
+            height,
           })
         );
-        // Beacons carry the server-expanded ${AUCTION_PRICE} from the auction's
-        // clearing price, not `cached.price` — the auction result is the
-        // authoritative clearing price, and the cached copy is only the render
-        // source. Do not re-expand them here.
         fireWinBillingBeacons(slotId, matchedBid);
         log.debug(`[tsjs-gpt] pbRender bridge served '${slotId}' from PBS Cache`);
       })
@@ -1077,7 +1069,7 @@ export function installTsRenderBridge(): void {
         log.warn(`[tsjs-gpt] pbRender bridge: PBS Cache fetch failed for '${slotId}'`, err);
       })
       .finally(() => {
-        renderingKeys.delete(renderingKey);
+        renderingAdIds.delete(adId);
       });
   });
 }
diff --git a/crates/trusted-server-js/lib/src/integrations/prebid/index.ts b/crates/trusted-server-js/lib/src/integrations/prebid/index.ts
index 342e4038d..2975e5f41 100644
--- a/crates/trusted-server-js/lib/src/integrations/prebid/index.ts
+++ b/crates/trusted-server-js/lib/src/integrations/prebid/index.ts
@@ -13,6 +13,7 @@
 
 import pbjs from 'prebid.js';
 import adapterManager from 'prebid.js/src/adapterManager.js';
+import { markBidAsRendered, markWinner } from 'prebid.js/src/adRendering.js';
 import 'prebid.js/modules/consentManagementTcf.js';
 import 'prebid.js/modules/consentManagementGpp.js';
 import 'prebid.js/modules/consentManagementUsp.js';
@@ -28,6 +29,7 @@ import './_adapters.generated';
 
 import { log } from '../../core/log';
 import { buildAdRequest, parseAuctionResponse } from '../../core/auction';
+import { registerApsPrebidRenderer } from '../aps/render';
 import type { AuctionBid, AuctionEid } from '../../core/auction';
 import type { AuctionSlot } from '../../core/types';
 
@@ -35,6 +37,9 @@ import { INCLUDED_PREBID_USER_ID_MODULES } from './_user_ids.generated';
 import { PREBID_USER_ID_MODULE_REGISTRY } from './user_id_modules';
 
 const ADAPTER_CODE = 'trustedServer';
+const APS_BIDDER_CODE = 'aps';
+const APS_RENDERER_FIELD = 'trustedServerRenderer';
+const APS_BID_RESPONSE_LISTENER_SENTINEL = '__tsApsBidResponseListenerInstalled';
 // OpenRTB permits vendor-specific agent types; PAIR uses 571187.
 // Keep this range aligned with the signed 32-bit Rust/OpenRTB representation.
 const MAX_OPENRTB_ATYPE = 2_147_483_647;
@@ -211,7 +216,8 @@ export function auctionBidsToPrebidBids(auctionBids: AuctionBid[], bidRequests:
       cpm: bid.price,
       width: bid.width,
       height: bid.height,
-      ad: bid.adm,
+      ad: bid.renderer ? '' : bid.adm,
+      ...(bid.renderer ? { [APS_RENDERER_FIELD]: bid.renderer } : {}),
       ttl: 300,
       creativeId: bid.creativeId,
       netRevenue: true,
@@ -501,6 +507,32 @@ function collectAuctionEids(): AuctionEid[] | undefined {
  * 1. `window.__tsjs_prebid` — injected by the server from trusted-server.toml
  * 2. `config` argument — explicit overrides from the publisher's JS
  */
+function installApsBidResponseRegistry(): void {
+  const prebid = pbjs as typeof pbjs & Record<string, unknown>;
+  if (prebid[APS_BID_RESPONSE_LISTENER_SENTINEL] === true) return;
+
+  pbjs.onEvent('bidResponse', (rawBid) => {
+    const bid = rawBid as unknown as Record<string, unknown>;
+    const renderer = bid[APS_RENDERER_FIELD];
+    if (
+      bid['adapterCode'] !== ADAPTER_CODE ||
+      bid['bidderCode'] !== APS_BIDDER_CODE ||
+      renderer === undefined
+    ) {
+      return;
+    }
+
+    registerApsPrebidRenderer(bid['adId'], bid['adUnitCode'], renderer, bid['ttl'], {
+      markWinner: () => markWinner(rawBid),
+      markRendered: () => markBidAsRendered(rawBid),
+    });
+    // Keep the executable capability only in the bounded, one-time registry. Prebid
+    // still owns the generated ad ID and ordinary GAM targeting on this bid object.
+    delete bid[APS_RENDERER_FIELD];
+  });
+  prebid[APS_BID_RESPONSE_LISTENER_SENTINEL] = true;
+}
+
 export function installPrebidNpm(config?: Partial<PrebidNpmConfig>): typeof pbjs {
   const injected = getInjectedConfig();
   const merged: PrebidNpmConfig = {
@@ -510,6 +542,7 @@ export function installPrebidNpm(config?: Partial<PrebidNpmConfig>): typeof pbjs
   };
 
   auctionEndpoint = merged.endpoint ?? '/auction';
+  installApsBidResponseRegistry();
 
   // Register the trustedServer adapter using pbjs.registerBidAdapter(null, code, spec)
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
diff --git a/crates/trusted-server-js/lib/src/integrations/prebid/prebid_modules/aliases.d.ts b/crates/trusted-server-js/lib/src/integrations/prebid/prebid_modules/aliases.d.ts
index e725a80f8..8280ea216 100644
--- a/crates/trusted-server-js/lib/src/integrations/prebid/prebid_modules/aliases.d.ts
+++ b/crates/trusted-server-js/lib/src/integrations/prebid/prebid_modules/aliases.d.ts
@@ -3,3 +3,8 @@ declare module 'tsjs-prebid/liveIntentIdSystemStandard';
 declare module 'tsjs-prebid/prebidGlobal' {
   export function registerModule(name: string): void;
 }
+
+declare module 'prebid.js/src/adRendering.js' {
+  export function markBidAsRendered(bid: unknown): void;
+  export function markWinner(bid: unknown): void;
+}
diff --git a/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts b/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts
index 4b1925014..e7978e1cb 100644
--- a/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts
@@ -7,7 +7,9 @@ import {
   APS_UNIVERSAL_CREATIVE_RENDERER,
   APS_UNIVERSAL_CREATIVE_RENDERER_VERSION,
   apsRendererUrl,
+  getApsPrebidRenderer,
   parseApsRendererDescriptor,
+  registerApsPrebidRenderer,
   renderApsCreative,
   validateApsRenderer,
 } from '../../../src/integrations/aps/render';
@@ -130,6 +132,46 @@ describe('APS renderer validation', () => {
   });
 });
 
+describe('Prebid APS renderer registry', () => {
+  afterEach(() => {
+    delete window.tsjs;
+  });
+
+  it('bounds entries and evicts the oldest capability', () => {
+    for (let index = 0; index <= 256; index += 1) {
+      expect(
+        registerApsPrebidRenderer(`prebid-${index}`, 'fictional-slot', descriptor(), 300, {
+          markWinner: vi.fn(),
+          markRendered: vi.fn(),
+        })
+      ).toBe(true);
+    }
+
+    expect(Object.keys(window.tsjs?.apsPrebidRenderers ?? {})).toHaveLength(256);
+    expect(getApsPrebidRenderer('prebid-0')).toBeUndefined();
+    expect(getApsPrebidRenderer('prebid-256')).toEqual(
+      expect.objectContaining({ adUnitCode: 'fictional-slot', renderer: descriptor() })
+    );
+  });
+
+  it('rejects unsafe Prebid IDs and invalid descriptors', () => {
+    const lifecycle = { markWinner: vi.fn(), markRendered: vi.fn() };
+    expect(
+      registerApsPrebidRenderer('__proto__', 'fictional-slot', descriptor(), 300, lifecycle)
+    ).toBe(false);
+    expect(
+      registerApsPrebidRenderer(
+        'safe-prebid-id',
+        'fictional-slot',
+        descriptor({ aaxResponse: 'invalid' }),
+        300,
+        lifecycle
+      )
+    ).toBe(false);
+    expect(window.tsjs?.apsPrebidRenderers).toBeUndefined();
+  });
+});
+
 describe('direct APS rendering', () => {
   beforeEach(() => {
     document.body.innerHTML = '<div id="fictional-slot"><span>existing</span></div>';
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
index 5dce07371..4ac85e2bb 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
@@ -1141,6 +1141,123 @@ describe('installTsRenderBridge', () => {
     beaconSpy.mockRestore();
   });
 
+  it('serves a registered Prebid APS renderer when its generated ad ID differs from the APS bid ID', async () => {
+    const renderer = apsRenderer();
+    const prebidAdId = 'prebid-generated-ad-id';
+    const markWinner = vi.fn();
+    const markRendered = vi.fn();
+    (window as TestWindow).tsjs.apsPrebidRenderers = {
+      [prebidAdId]: {
+        adUnitCode: 'div-header',
+        renderer,
+        registeredAt: Date.now(),
+        expiresAt: Date.now() + 60_000,
+        markWinner,
+        markRendered,
+      },
+    };
+
+    const bridgeListener = await captureBridgeListener();
+    const source = createTrustedSlotIframe();
+    const stopSpy = vi.fn();
+    const portMessages: string[] = [];
+    const event = Object.assign(new Event('message'), {
+      data: JSON.stringify({ message: 'Prebid Request', adId: prebidAdId }),
+      ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+      source,
+      stopImmediatePropagation: stopSpy,
+    }) as unknown as MessageEvent;
+
+    bridgeListener(event);
+    bridgeListener(event);
+
+    expect(stopSpy).toHaveBeenCalledTimes(2);
+    expect(portMessages).toHaveLength(1);
+    expect(markWinner).toHaveBeenCalledTimes(1);
+    expect(markRendered).toHaveBeenCalledTimes(1);
+    expect(JSON.parse(portMessages[0])).toEqual(
+      expect.objectContaining({
+        message: 'Prebid Response',
+        adId: prebidAdId,
+        apsRenderer: renderer,
+        width: renderer.width,
+        height: renderer.height,
+      })
+    );
+    expect(renderer.bidId).not.toBe(prebidAdId);
+    expect((window as TestWindow).tsjs.apsPrebidRenderers[prebidAdId]).toBeUndefined();
+    expect(fetchStub).not.toHaveBeenCalled();
+  });
+
+  it('does not expose a registered Prebid APS renderer to another slot iframe', async () => {
+    const renderer = apsRenderer();
+    const prebidAdId = 'prebid-generated-ad-id';
+    (window as TestWindow).tsjs.apsPrebidRenderers = {
+      [prebidAdId]: {
+        adUnitCode: 'div-header',
+        renderer,
+        registeredAt: Date.now(),
+        expiresAt: Date.now() + 60_000,
+        markWinner: vi.fn(),
+        markRendered: vi.fn(),
+      },
+    };
+
+    const footer = document.createElement('div');
+    footer.id = 'div-footer';
+    const foreignIframe = document.createElement('iframe');
+    footer.appendChild(foreignIframe);
+    document.body.appendChild(footer);
+
+    const bridgeListener = await captureBridgeListener();
+    const stopSpy = vi.fn();
+    const portMessages: string[] = [];
+    bridgeListener(
+      Object.assign(new Event('message'), {
+        data: JSON.stringify({ message: 'Prebid Request', adId: prebidAdId }),
+        ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+        source: foreignIframe.contentWindow,
+        stopImmediatePropagation: stopSpy,
+      }) as unknown as MessageEvent
+    );
+
+    expect(stopSpy).not.toHaveBeenCalled();
+    expect(portMessages).toEqual([]);
+    expect((window as TestWindow).tsjs.apsPrebidRenderers[prebidAdId]).toBeDefined();
+    footer.remove();
+  });
+
+  it('drops an expired Prebid APS renderer without claiming the creative request', async () => {
+    const prebidAdId = 'expired-prebid-ad-id';
+    (window as TestWindow).tsjs.apsPrebidRenderers = {
+      [prebidAdId]: {
+        adUnitCode: 'div-header',
+        renderer: apsRenderer(),
+        registeredAt: Date.now() - 61_000,
+        expiresAt: Date.now() - 1_000,
+        markWinner: vi.fn(),
+        markRendered: vi.fn(),
+      },
+    };
+
+    const bridgeListener = await captureBridgeListener();
+    const source = createTrustedSlotIframe();
+    const stopSpy = vi.fn();
+    const portMessages: string[] = [];
+    bridgeListener(
+      Object.assign(new Event('message'), {
+        data: JSON.stringify({ message: 'Prebid Request', adId: prebidAdId }),
+        ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+        source,
+        stopImmediatePropagation: stopSpy,
+      }) as unknown as MessageEvent
+    );
+
+    expect(stopSpy).not.toHaveBeenCalled();
+    expect(portMessages).toEqual([]);
+    expect((window as TestWindow).tsjs.apsPrebidRenderers[prebidAdId]).toBeUndefined();
+  });
+
   it('validates APS data before claiming the Prebid request', async () => {
     const renderer = { ...apsRenderer(), aaxResponse: 'invalid' };
     (window as TestWindow).tsjs.bids.homepage_header = {
diff --git a/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts b/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts
index 726f40b49..3700744bc 100644
--- a/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts
@@ -1,4 +1,21 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import envelope from '../../fixtures/aps-renderer-v1.json';
+
+function apsRenderer() {
+  const bid = envelope.seatbid[0].bid[0];
+  return {
+    type: 'aps' as const,
+    version: 1 as const,
+    accountId: 'example-account-id',
+    bidId: bid.id,
+    creativeId: 'fictional-creative-id',
+    tagType: 'iframe' as const,
+    creativeUrl: bid.ext.creativeurl,
+    aaxResponse: btoa(JSON.stringify(envelope)),
+    width: bid.w,
+    height: bid.h,
+  };
+}
 
 // Define mocks using vi.hoisted so they're available inside vi.mock factories
 const {
@@ -8,6 +25,9 @@ const {
   mockRegisterBidAdapter,
   mockGetUserIdsAsEids,
   mockGetConfig,
+  mockMarkBidAsRendered,
+  mockMarkWinner,
+  mockOnEvent,
   mockPbjs,
   mockGetBidAdapter,
   mockAdapterManager,
@@ -17,6 +37,9 @@ const {
   const mockRequestBids = vi.fn();
   const mockRegisterBidAdapter = vi.fn();
   const mockGetBidAdapter = vi.fn();
+  const mockMarkBidAsRendered = vi.fn();
+  const mockMarkWinner = vi.fn();
+  const mockOnEvent = vi.fn();
   const mockGetUserIdsAsEids = vi.fn(
     () => [] as Array<{ source: string; uids?: Array<{ id: string; atype?: number }> }>
   );
@@ -28,6 +51,7 @@ const {
     registerBidAdapter: mockRegisterBidAdapter,
     getUserIdsAsEids: mockGetUserIdsAsEids,
     getConfig: mockGetConfig,
+    onEvent: mockOnEvent,
     adUnits: [] as any[],
   };
   const mockAdapterManager = {
@@ -40,6 +64,9 @@ const {
     mockRegisterBidAdapter,
     mockGetUserIdsAsEids,
     mockGetConfig,
+    mockMarkBidAsRendered,
+    mockMarkWinner,
+    mockOnEvent,
     mockPbjs,
     mockGetBidAdapter,
     mockAdapterManager,
@@ -50,6 +77,10 @@ const {
 // The real prebid.js cannot run in jsdom, so we provide a minimal stub.
 vi.mock('prebid.js', () => ({ default: mockPbjs }));
 vi.mock('prebid.js/src/adapterManager.js', () => ({ default: mockAdapterManager }));
+vi.mock('prebid.js/src/adRendering.js', () => ({
+  markBidAsRendered: mockMarkBidAsRendered,
+  markWinner: mockMarkWinner,
+}));
 
 // Side-effect imports are no-ops in tests
 vi.mock('prebid.js/modules/consentManagementTcf.js', () => ({}));
@@ -149,6 +180,37 @@ describe('prebid/auctionBidsToPrebidBids', () => {
     });
   });
 
+  it('preserves an APS renderer without converting it to executable markup', () => {
+    const renderer = apsRenderer();
+    const auctionBids: AuctionBid[] = [
+      {
+        impid: 'div-aps',
+        adm: '<script>must not become Prebid ad markup</script>',
+        renderer,
+        price: 1.23,
+        width: 300,
+        height: 250,
+        seat: 'aps',
+        creativeId: 'fictional-creative-id',
+        adomain: ['advertiser.example'],
+      },
+    ];
+
+    const result = auctionBidsToPrebidBids(auctionBids, [
+      { adUnitCode: 'div-aps', bidId: 'prebid-request-id' },
+    ]);
+
+    expect(result).toHaveLength(1);
+    expect(result[0]).toEqual(
+      expect.objectContaining({
+        requestId: 'prebid-request-id',
+        bidderCode: 'aps',
+        ad: '',
+        trustedServerRenderer: renderer,
+      })
+    );
+  });
+
   it('falls back to impid when no matching bidRequest found', () => {
     const auctionBids: AuctionBid[] = [
       {
@@ -218,6 +280,8 @@ describe('prebid/installPrebidNpm', () => {
     document.cookie = 'ts-eids=; Path=/; Max-Age=0';
     delete (window as any).__tsjs_prebid;
     delete (window as any).__tsjs_prebid_diagnostics;
+    delete (window as any).tsjs;
+    delete (mockPbjs as any).__tsApsBidResponseListenerInstalled;
   });
 
   afterEach(() => {
@@ -241,6 +305,73 @@ describe('prebid/installPrebidNpm', () => {
     );
   });
 
+  it('registers accepted APS descriptors under Prebid generated ad IDs', () => {
+    installPrebidNpm();
+
+    const bidResponseListener = mockOnEvent.mock.calls.find(
+      ([eventName]) => eventName === 'bidResponse'
+    )?.[1] as ((bid: Record<string, unknown>) => void) | undefined;
+    expect(bidResponseListener).toBeTypeOf('function');
+
+    const renderer = apsRenderer();
+    bidResponseListener!({
+      adapterCode: 'trustedServer',
+      bidderCode: 'aps',
+      adId: 'prebid-generated-ad-id',
+      adUnitCode: 'div-aps',
+      ttl: 300,
+      trustedServerRenderer: renderer,
+    });
+
+    const entry = (window as any).tsjs.apsPrebidRenderers['prebid-generated-ad-id'];
+    expect(entry).toEqual(
+      expect.objectContaining({
+        adUnitCode: 'div-aps',
+        renderer,
+        expiresAt: expect.any(Number),
+        markRendered: expect.any(Function),
+        markWinner: expect.any(Function),
+      })
+    );
+
+    entry.markWinner();
+    entry.markRendered();
+    expect(mockMarkWinner).toHaveBeenCalledWith(
+      expect.objectContaining({ adId: 'prebid-generated-ad-id' })
+    );
+    expect(mockMarkBidAsRendered).toHaveBeenCalledWith(
+      expect.objectContaining({ adId: 'prebid-generated-ad-id' })
+    );
+  });
+
+  it('does not register malformed or non-trusted APS renderer capabilities', () => {
+    installPrebidNpm();
+
+    const bidResponseListener = mockOnEvent.mock.calls.find(
+      ([eventName]) => eventName === 'bidResponse'
+    )?.[1] as ((bid: Record<string, unknown>) => void) | undefined;
+    const malformedBid: Record<string, unknown> = {
+      adapterCode: 'trustedServer',
+      bidderCode: 'aps',
+      adId: 'malformed-ad-id',
+      adUnitCode: 'div-aps',
+      ttl: 300,
+      trustedServerRenderer: { ...apsRenderer(), aaxResponse: 'invalid' },
+    };
+    bidResponseListener!(malformedBid);
+    bidResponseListener!({
+      adapterCode: 'publisherAdapter',
+      bidderCode: 'aps',
+      adId: 'foreign-ad-id',
+      adUnitCode: 'div-aps',
+      trustedServerRenderer: apsRenderer(),
+    });
+
+    expect((window as any).tsjs?.apsPrebidRenderers?.['malformed-ad-id']).toBeUndefined();
+    expect((window as any).tsjs?.apsPrebidRenderers?.['foreign-ad-id']).toBeUndefined();
+    expect(malformedBid).not.toHaveProperty('trustedServerRenderer');
+  });
+
   it('calls setConfig with debug=false by default', () => {
     installPrebidNpm();
 
diff --git a/crates/trusted-server-js/lib/vitest.config.ts b/crates/trusted-server-js/lib/vitest.config.ts
index 97d9d84c8..ad9452899 100644
--- a/crates/trusted-server-js/lib/vitest.config.ts
+++ b/crates/trusted-server-js/lib/vitest.config.ts
@@ -11,6 +11,10 @@ export default defineConfig({
         __dirname,
         'node_modules/prebid.js/dist/src/src/adapterManager.js'
       ),
+      'prebid.js/src/adRendering.js': path.resolve(
+        __dirname,
+        'node_modules/prebid.js/dist/src/src/adRendering.js'
+      ),
     },
   },
   test: {
diff --git a/docs/guide/integrations/aps.md b/docs/guide/integrations/aps.md
index 2b36cb253..fecde3323 100644
--- a/docs/guide/integrations/aps.md
+++ b/docs/guide/integrations/aps.md
@@ -12,7 +12,8 @@ The integration supports:
 - banner impressions;
 - APS OpenRTB requests to `https://web.ads.aps.amazon-adsystem.com/e/pb/bid`;
 - decoded-CPM winner selection with or without a mediator;
-- direct `/auction` rendering; and
+- direct `/auction` rendering;
+- client-side `trustedServer` Prebid adapter auctions through GAM; and
 - initial-navigation and page-bids rendering through GAM/Prebid Universal Creative.
 
 The integration does not implement:
@@ -137,7 +138,9 @@ The TSJS auction client validates the typed renderer descriptor, creates the opa
 
 For initial navigation and page-bids, Trusted Server publishes the same descriptor in `window.tsjs.bids`. The source-checked Prebid Universal Creative bridge accepts requests only from the iframe that owns the matching `hb_adid`, validates the complete envelope, and returns a static dynamic-renderer program that creates the same opaque renderer iframe.
 
-This path does not fetch PBS Cache, fire generic APS win/billing beacons, or call `apstag.setDisplayBids()` for the Trusted Server winner. Publisher-owned native APS objects are otherwise left untouched.
+For client-side `trustedServer` adapter auctions, Prebid generates its own `hb_adid`. Trusted Server binds that generated ID to the validated APS descriptor in a bounded, expiring browser registry before GAM refresh. The bridge verifies that the requesting Universal Creative iframe belongs to the same ad unit, consumes the capability once, and passes the APS bid ID separately to the Amazon runner.
+
+These paths do not fetch PBS Cache, fire generic APS win/billing beacons, or call `apstag.setDisplayBids()` for the Trusted Server winner. Publisher-owned native APS objects are otherwise left untouched.
 
 ## Publisher CSP
 
@@ -199,6 +202,7 @@ Use fictional values in source-controlled configuration and fixtures. Supply con
 - Confirm `GET /integrations/aps/renderer` returns HTML with its CSP and `Referrer-Policy: no-referrer`.
 - Confirm publisher CSP permits `frame-src 'self'`.
 - Confirm the GAM creative uses the supported Prebid Universal Creative bridge and the winning `hb_adid`.
+- For client-side `trustedServer` adapter auctions, confirm Prebid's `bidResponse` contains a generated `adId` and that the corresponding capability appears briefly in `window.tsjs.apsPrebidRenderers` before rendering.
 - Ensure no native APS path is trying to handle the same cohort.
 - Keep script creatives disabled while diagnosing iframe rendering.
 
diff --git a/scripts/integration-tests-browser.sh b/scripts/integration-tests-browser.sh
index ce5e64387..714de510b 100755
--- a/scripts/integration-tests-browser.sh
+++ b/scripts/integration-tests-browser.sh
@@ -18,6 +18,7 @@ cd "$REPO_ROOT"
 
 ORIGIN_PORT="${INTEGRATION_ORIGIN_PORT:-8888}"
 BROWSER_DIR="crates/trusted-server-integration-tests/browser"
+TSJS_LIB_DIR="crates/trusted-server-js/lib"
 NODE_VERSION="$(grep '^nodejs ' .tool-versions | awk '{print $2}')"
 
 if [ -z "$NODE_VERSION" ]; then
@@ -55,6 +56,14 @@ cd "$REPO_ROOT/$BROWSER_DIR"
 npm ci
 npx playwright install chromium
 
+# --- Build browser-side Trusted Server and external Prebid fixtures ---
+echo "==> Building TSJS browser fixtures..."
+cd "$REPO_ROOT/$TSJS_LIB_DIR"
+npm ci
+npm run build
+npm run build:prebid-external
+cd "$REPO_ROOT/$BROWSER_DIR"
+
 # --- Export env vars for global-setup.ts ---
 export WASM_BINARY_PATH="$REPO_ROOT/target/wasm32-wasip1/release/trusted-server-adapter-fastly.wasm"
 export INTEGRATION_ORIGIN_PORT="$ORIGIN_PORT"

From 3f7c202544f44e4e53da768ea87b5762615236d5 Mon Sep 17 00:00:00 2001
From: Christian <christianpavilonis@outlook.com>
Date: Fri, 17 Jul 2026 12:26:58 -0500
Subject: [PATCH 5/9] Add APS auction debug metadata

---
 CHANGELOG.md                                  |    1 +
 .../src/auction/formats.rs                    |   41 +
 .../src/auction/orchestrator.rs               | 1366 +++--------------
 .../src/integrations/aps.rs                   |  354 ++++-
 docs/guide/auction-orchestration.md           |   18 +-
 docs/guide/configuration.md                   |    2 +
 docs/guide/integrations/aps.md                |   39 +-
 ...-openrtb-first-class-integration-design.md |   13 +-
 trusted-server.example.toml                   |    2 +
 9 files changed, 699 insertions(+), 1137 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6ab91d4f3..7b4537704 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,6 +21,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Added opt-in APS HTTP debug metadata for controlled test sites, exposing the direct request and response under `/auction` provider metadata using the Prebid Server `debug.httpcalls` shape.
 - Added typed APS renderer transport for direct auctions and GAM/Prebid Universal Creative, using a minimized one-bid envelope, a fragment-bound nonce, and an opaque sandboxed renderer endpoint.
 - Added Osano consent mirror integration docs and public enablement guidance.
 - Implemented basic authentication for configurable endpoint paths (#73)
diff --git a/crates/trusted-server-core/src/auction/formats.rs b/crates/trusted-server-core/src/auction/formats.rs
index 63f777a19..b1f9f4b35 100644
--- a/crates/trusted-server-core/src/auction/formats.rs
+++ b/crates/trusted-server-core/src/auction/formats.rs
@@ -1022,6 +1022,47 @@ mod tests {
         );
     }
 
+    #[test]
+    fn convert_to_openrtb_response_preserves_aps_debug_metadata() {
+        let settings = make_settings();
+        let auction_request = make_auction_request();
+        let bid = make_bid("div-gpt-top", "aps", Some(2.75));
+        let debug = json!({
+            "httpcalls": {
+                "aps": [{
+                    "requestbody": "{\"id\":\"fictional-auction\"}",
+                    "requestheaders": {"content-type": ["application/json"]},
+                    "responsebody": "{\"seatbid\":[]}",
+                    "responseheaders": {"content-type": ["application/json"]},
+                    "status": 200,
+                    "uri": "https://aps.example/openrtb"
+                }]
+            }
+        });
+        let result = OrchestrationResult {
+            provider_responses: vec![AuctionResponse {
+                provider: "aps".to_string(),
+                bids: vec![bid.clone()],
+                status: BidStatus::Success,
+                response_time_ms: 42,
+                metadata: HashMap::from([("debug".to_string(), debug.clone())]),
+            }],
+            mediator_response: None,
+            winning_bids: HashMap::from([(bid.slot_id.clone(), bid)]),
+            total_time_ms: 50,
+            metadata: HashMap::new(),
+        };
+
+        let response = convert_to_openrtb_response(&result, &settings, &auction_request, false)
+            .expect("should convert APS response with debug metadata");
+        let json = response_json(response);
+
+        assert_eq!(
+            json["ext"]["orchestrator"]["provider_details"][0]["metadata"]["debug"], debug,
+            "should preserve APS debug metadata in the auction response"
+        );
+    }
+
     #[test]
     fn convert_to_openrtb_response_rejects_winner_without_render_source() {
         let settings = make_settings();
diff --git a/crates/trusted-server-core/src/auction/orchestrator.rs b/crates/trusted-server-core/src/auction/orchestrator.rs
index 3a6757ddf..f23818b09 100644
--- a/crates/trusted-server-core/src/auction/orchestrator.rs
+++ b/crates/trusted-server-core/src/auction/orchestrator.rs
@@ -1,7 +1,9 @@
 //! Auction orchestrator for managing multi-provider auctions.
 
+use edgezero_core::body::Body as EdgeBody;
 use error_stack::{Report, ResultExt};
-use std::collections::{HashMap, HashSet};
+use http::Request;
+use std::collections::HashMap;
 use std::sync::Arc;
 use std::time::Duration;
 use web_time::Instant;
@@ -23,11 +25,12 @@ use super::types::{AuctionContext, AuctionRequest, AuctionResponse, Bid, BidStat
 /// TTFB ≈ auction timeout.
 pub struct DispatchedAuction {
     pending_requests: Vec<PlatformPendingRequest>,
-    backend_to_provider: HashMap<String, (String, Instant, Arc<dyn AuctionProvider>)>,
+    backend_to_provider: HashMap<String, (String, Instant, Arc<dyn AuctionProvider>, u32)>,
     launch_responses: Vec<AuctionResponse>,
     auction_start: Instant,
     timeout_ms: u32,
     floor_prices: HashMap<String, f64>,
+    provider_request_context: Box<Request<EdgeBody>>,
     /// Carried so the mediator call in collect can pass it as the auction request.
     request: AuctionRequest,
 }
@@ -64,7 +67,7 @@ impl DispatchedAuction {
         let abandoned = self
             .backend_to_provider
             .into_values()
-            .map(|(provider_name, start_time, _)| {
+            .map(|(provider_name, start_time, _, _)| {
                 AbandonedProviderCall::bidder(
                     provider_name,
                     Some(u32::try_from(start_time.elapsed().as_millis()).unwrap_or(u32::MAX)),
@@ -85,6 +88,7 @@ impl DispatchedAuction {
             auction_start: Instant::now(),
             timeout_ms,
             floor_prices: HashMap::new(),
+            provider_request_context: Box::new(Request::new(EdgeBody::empty())),
             request,
         }
     }
@@ -162,6 +166,15 @@ fn remaining_budget_ms(start: Instant, timeout_ms: u32) -> u32 {
     timeout_ms.saturating_sub(elapsed)
 }
 
+fn snapshot_context_request(request: &Request<EdgeBody>) -> Request<EdgeBody> {
+    let mut snapshot = Request::new(EdgeBody::empty());
+    *snapshot.method_mut() = request.method().clone();
+    *snapshot.uri_mut() = request.uri().clone();
+    *snapshot.version_mut() = request.version();
+    *snapshot.headers_mut() = request.headers().clone();
+    snapshot
+}
+
 /// Manages auction execution across multiple providers.
 pub struct AuctionOrchestrator {
     config: AuctionConfig,
@@ -199,35 +212,6 @@ impl AuctionOrchestrator {
             return Ok(());
         }
 
-        // A provider listed twice would launch the same auction request twice
-        // (its backend name canonicalizes identically), so the duplicate is
-        // detected only after the second outbound send has already fired. Reject
-        // it at startup instead.
-        let mut seen = HashSet::new();
-        for provider_name in &self.config.providers {
-            if !seen.insert(provider_name.as_str()) {
-                return Err(Report::new(TrustedServerError::Configuration {
-                    message: format!(
-                        "Auction provider `{provider_name}` is listed more than once in [auction].providers; each provider may appear at most once"
-                    ),
-                }));
-            }
-        }
-
-        // A provider that is also the mediator would be called twice per
-        // auction — once in the bidding phase and again as the mediator. The
-        // mediator's own demand already flows through its mediation response,
-        // so the overlap is never a legitimate configuration.
-        if let Some(mediator_name) = &self.config.mediator
-            && seen.contains(mediator_name.as_str())
-        {
-            return Err(Report::new(TrustedServerError::Configuration {
-                message: format!(
-                    "Auction mediator `{mediator_name}` is also listed in [auction].providers; a provider may not mediate its own auction"
-                ),
-            }));
-        }
-
         for provider_name in self
             .config
             .providers
@@ -313,19 +297,10 @@ impl AuctionOrchestrator {
 
             // Give the mediator only the remaining time from the auction
             // deadline, not the full timeout — the bidding phase already
-            // consumed part of it, and the mediator has no select-loop
-            // deadline backstop. The platform canonicalizes the value for
-            // backend-name stability (see
-            // `PlatformBackend::canonicalize_transport_timeout_ms`); it never
-            // exceeds the remaining budget. See the transport-deadline note on
-            // `run_providers_parallel` for the limits of this bound.
+            // consumed part of it.
             let remaining_ms = remaining_budget_ms(mediation_start, context.timeout_ms);
-            let mediator_timeout = context
-                .services
-                .backend()
-                .canonicalize_transport_timeout_ms(remaining_ms, mediator.timeout_ms());
 
-            if mediator_timeout == 0 {
+            if remaining_ms == 0 {
                 log::warn!("Auction timeout exhausted during bidding phase; skipping mediator");
                 let winning = self.select_winning_bids(&provider_responses, &floor_prices);
                 return Ok(OrchestrationResult {
@@ -340,7 +315,9 @@ impl AuctionOrchestrator {
             let mediator_context = AuctionContext {
                 settings: context.settings,
                 request: context.request,
-                timeout_ms: mediator_timeout,
+                // Bound by both the remaining auction budget and the mediator's
+                // own configured timeout, matching the dispatched collect path.
+                timeout_ms: remaining_ms.min(mediator.timeout_ms()),
                 provider_responses: Some(&provider_responses),
                 services: context.services,
             };
@@ -479,8 +456,8 @@ impl AuctionOrchestrator {
         let auction_start = Instant::now();
 
         // Phase 1: Launch all requests concurrently and build mapping
-        // Maps backend_name -> (provider_name, start_time, provider)
-        let mut backend_to_provider: HashMap<String, (&str, Instant, &dyn AuctionProvider)> =
+        // Maps backend_name to provider state retained for response parsing.
+        let mut backend_to_provider: HashMap<String, (&str, Instant, &dyn AuctionProvider, u32)> =
             HashMap::new();
         let mut pending_requests: Vec<crate::platform::PlatformPendingRequest> = Vec::new();
         let mut responses = Vec::new();
@@ -504,14 +481,10 @@ impl AuctionOrchestrator {
 
             // Give each provider only the remaining time from the auction
             // deadline so that backend transport timeouts do not extend past
-            // the overall budget. The platform canonicalizes the value for
-            // backend-name stability (see
-            // `PlatformBackend::canonicalize_transport_timeout_ms`).
+            // the overall budget. Also respect the provider's own configured
+            // timeout when it is tighter than the remaining budget.
             let remaining_ms = remaining_budget_ms(auction_start, context.timeout_ms);
-            let effective_timeout = context
-                .services
-                .backend()
-                .canonicalize_transport_timeout_ms(remaining_ms, provider.timeout_ms());
+            let effective_timeout = remaining_ms.min(provider.timeout_ms());
 
             if effective_timeout == 0 {
                 log::warn!("Auction timeout exhausted before launching provider request; skipping");
@@ -532,23 +505,6 @@ impl AuctionOrchestrator {
                 }
             };
 
-            // Pre-launch guard: `request_bids` fires the outbound send, and
-            // discarding the returned pending handle afterwards does not retract
-            // it. If another provider this auction already claimed the predicted
-            // backend name, skip *before* dispatching so a duplicate never hits
-            // the wire. The post-launch check below stays as a defense for a
-            // provider that resolves to an unexpected name.
-            if backend_to_provider.contains_key(&backend_name) {
-                log::warn!(
-                    "Provider '{}' predicted backend name '{}' already claimed by another provider \
-                     this auction; skipping launch before dispatch to avoid a duplicate request",
-                    provider.provider_name(),
-                    backend_name,
-                );
-                responses.push(provider_launch_failed_response(provider.provider_name(), 0));
-                continue;
-            }
-
             let provider_context = AuctionContext {
                 settings: context.settings,
                 request: context.request,
@@ -579,34 +535,20 @@ impl AuctionOrchestrator {
                             );
                             backend_name.clone()
                         });
-                    // Post-launch defense: the resolved name differs from the
-                    // prediction and collides with another provider's. Responses
-                    // are correlated by backend name, so inserting here would
-                    // overwrite the first mapping and misattribute or drop a
-                    // response. Fail this launch attributably instead.
-                    if backend_to_provider.contains_key(&request_backend_name) {
-                        let response_time_ms = start_time.elapsed().as_millis() as u64;
-                        log::warn!(
-                            "Provider '{}' resolved to backend name '{}' already claimed by another \
-                             provider this auction; skipping launch to avoid response misattribution",
+                    backend_to_provider.insert(
+                        request_backend_name.clone(),
+                        (
                             provider.provider_name(),
-                            request_backend_name,
-                        );
-                        responses.push(provider_launch_failed_response(
-                            provider.provider_name(),
-                            response_time_ms,
-                        ));
-                    } else {
-                        backend_to_provider.insert(
-                            request_backend_name.clone(),
-                            (provider.provider_name(), start_time, provider.as_ref()),
-                        );
-                        pending_requests.push(pending);
-                        log::debug!(
-                            "Request to '{}' launched successfully",
-                            provider.provider_name()
-                        );
-                    }
+                            start_time,
+                            provider.as_ref(),
+                            effective_timeout,
+                        ),
+                    );
+                    pending_requests.push(pending);
+                    log::debug!(
+                        "Request to '{}' launched successfully",
+                        provider.provider_name()
+                    );
                 }
                 Err(e) => {
                     let response_time_ms = start_time.elapsed().as_millis() as u64;
@@ -639,25 +581,14 @@ impl AuctionOrchestrator {
         );
 
         // Phase 2: Wait for responses using select() to process as they become ready.
-        // After each select() returns, check elapsed time and drop remaining
-        // requests once the auction deadline passes.
+        // Enforce the auction deadline: after each select() returns, check
+        // elapsed time and drop remaining requests if the timeout is exceeded.
         //
-        // TRANSPORT-DEADLINE NOTE: this select loop is the only *absolute*
-        // wall-clock bound on the parallel path — it drops still-pending
-        // requests once `auction_start.elapsed()` exceeds the deadline. The
-        // per-backend transport timeouts set in Phase 1 are a complementary,
-        // not equivalent, bound: Fastly's connect timeout is a fixed ~1s, the
-        // first-byte timeout only starts after the connection is established,
-        // and the between-bytes timeout is an inactivity timer that resets on
-        // every byte received. A backend that connects slowly or trickles one
-        // byte just inside the between-bytes window can therefore outlive the
-        // configured budget. Bounding them to the remaining budget (Phase 1)
-        // guarantees they never *extend past* the deadline by their own
-        // configuration, but does not by itself enforce a hard total-response
-        // deadline. Paths without this select loop (the mediator and the
-        // dispatched-collect body read) inherit that weaker bound; a true
-        // absolute deadline carried through the platform HTTP API is tracked
-        // as follow-up work (see the streaming/deadline effort, #849).
+        // NOTE: `select()` blocks until at least one backend responds and, on
+        // some adapters, buffers the selected response body before returning.
+        // Hard deadline enforcement therefore depends on every backend's
+        // first-byte and between-bytes timeouts being set to at most the
+        // remaining auction budget, which Phase 1 above guarantees.
         let mut remaining = pending_requests;
 
         while !remaining.is_empty() {
@@ -684,10 +615,17 @@ impl AuctionOrchestrator {
                         .unwrap_or_default()
                         .to_string();
 
-                    if let Some((provider_name, start_time, provider)) =
+                    if let Some((provider_name, start_time, provider, effective_timeout)) =
                         backend_to_provider.remove(&backend_name)
                     {
                         let response_time_ms = start_time.elapsed().as_millis() as u64;
+                        let provider_context = AuctionContext {
+                            settings: context.settings,
+                            request: context.request,
+                            timeout_ms: effective_timeout,
+                            provider_responses: context.provider_responses,
+                            services: context.services,
+                        };
 
                         // Use the context-aware parse so a provider overriding
                         // `parse_response_with_context` behaves identically on the
@@ -698,7 +636,7 @@ impl AuctionOrchestrator {
                                 response,
                                 response_time_ms,
                                 request,
-                                context,
+                                &provider_context,
                             )
                             .await
                         {
@@ -737,7 +675,7 @@ impl AuctionOrchestrator {
                 }
                 Err(e) => {
                     if let Some(ref backend_name) = failed_backend_name {
-                        if let Some((provider_name, start_time, _)) =
+                        if let Some((provider_name, start_time, _, _)) =
                             backend_to_provider.remove(backend_name)
                         {
                             let response_time_ms = start_time.elapsed().as_millis() as u64;
@@ -774,7 +712,7 @@ impl AuctionOrchestrator {
             }
         }
 
-        for (provider_name, start_time, _) in backend_to_provider.into_values() {
+        for (provider_name, start_time, _, _) in backend_to_provider.into_values() {
             let response_time_ms = start_time.elapsed().as_millis() as u64;
             log::warn!("Provider '{provider_name}' timed out before auction collection completed");
             responses.push(provider_timeout_response(provider_name, response_time_ms));
@@ -936,8 +874,10 @@ impl AuctionOrchestrator {
         }
 
         let auction_start = Instant::now();
-        let mut backend_to_provider: HashMap<String, (String, Instant, Arc<dyn AuctionProvider>)> =
-            HashMap::new();
+        let mut backend_to_provider: HashMap<
+            String,
+            (String, Instant, Arc<dyn AuctionProvider>, u32),
+        > = HashMap::new();
         let mut pending_requests: Vec<PlatformPendingRequest> = Vec::new();
         let mut launch_responses: Vec<AuctionResponse> = Vec::new();
 
@@ -960,13 +900,8 @@ impl AuctionOrchestrator {
                 continue;
             }
 
-            // Remaining budget canonicalized by the platform for backend-name
-            // stability (see `PlatformBackend::canonicalize_transport_timeout_ms`).
             let remaining_ms = remaining_budget_ms(auction_start, context.timeout_ms);
-            let effective_timeout = context
-                .services
-                .backend()
-                .canonicalize_transport_timeout_ms(remaining_ms, provider.timeout_ms());
+            let effective_timeout = remaining_ms.min(provider.timeout_ms());
 
             if effective_timeout == 0 {
                 log::warn!(
@@ -988,21 +923,6 @@ impl AuctionOrchestrator {
                 }
             };
 
-            // Pre-launch guard: skip before `request_bids` fires the outbound
-            // send when another provider this auction already claimed the
-            // predicted backend name (see the parallel path). Dropping the
-            // pending handle afterwards would not retract the request.
-            if backend_to_provider.contains_key(&backend_name) {
-                log::warn!(
-                    "Provider '{}' predicted backend name '{}' already claimed by another provider \
-                     this auction; skipping dispatch before send to avoid a duplicate request",
-                    provider.provider_name(),
-                    backend_name,
-                );
-                launch_responses.push(provider_launch_failed_response(provider.provider_name(), 0));
-                continue;
-            }
-
             let provider_context = AuctionContext {
                 settings: context.settings,
                 request: context.request,
@@ -1014,57 +934,22 @@ impl AuctionOrchestrator {
             let start_time = Instant::now();
             match provider.request_bids(request, &provider_context).await {
                 Ok(pending) => {
-                    // Correlate on the *resolved* backend name the pending
-                    // request carries, falling back to the prediction only when
-                    // the adapter left it unset. Collection keys on the name the
-                    // response reports (Fastly's `get_backend_name()`), so keying
-                    // the map on the prediction here would drop a response whose
-                    // resolved name diverged. Mirrors run_providers_parallel.
-                    let request_backend_name = pending
-                        .backend_name()
-                        .map(str::to_string)
-                        .unwrap_or_else(|| {
-                            log::warn!(
-                                "Provider '{}' pending request returned no backend name; \
-                                 using predicted name '{}'",
-                                provider.provider_name(),
-                                backend_name,
-                            );
-                            backend_name.clone()
-                        });
-                    // Post-launch defense: a resolved backend name already claimed
-                    // by another provider this auction would misattribute the
-                    // collected response, so fail this launch attributably rather
-                    // than overwrite the mapping.
-                    if backend_to_provider.contains_key(&request_backend_name) {
-                        let response_time_ms = start_time.elapsed().as_millis() as u64;
-                        log::warn!(
-                            "Provider '{}' resolved to backend name '{}' already claimed by another \
-                             provider this auction; skipping dispatch to avoid response misattribution",
-                            provider.provider_name(),
-                            request_backend_name,
-                        );
-                        launch_responses.push(provider_launch_failed_response(
-                            provider.provider_name(),
-                            response_time_ms,
-                        ));
-                    } else {
-                        log::info!(
-                            "Dispatching bid request to '{}' (backend: {}, budget: {}ms)",
-                            provider.provider_name(),
-                            request_backend_name,
-                            effective_timeout
-                        );
-                        backend_to_provider.insert(
-                            request_backend_name.clone(),
-                            (
-                                provider.provider_name().to_string(),
-                                start_time,
-                                Arc::clone(provider),
-                            ),
-                        );
-                        pending_requests.push(pending.with_backend_name(request_backend_name));
-                    }
+                    log::info!(
+                        "Dispatching bid request to '{}' (backend: {}, budget: {}ms)",
+                        provider.provider_name(),
+                        backend_name,
+                        effective_timeout
+                    );
+                    backend_to_provider.insert(
+                        backend_name.clone(),
+                        (
+                            provider.provider_name().to_string(),
+                            start_time,
+                            Arc::clone(provider),
+                            effective_timeout,
+                        ),
+                    );
+                    pending_requests.push(pending.with_backend_name(backend_name));
                 }
                 Err(e) => {
                     let response_time_ms = start_time.elapsed().as_millis() as u64;
@@ -1106,6 +991,7 @@ impl AuctionOrchestrator {
             auction_start,
             timeout_ms: context.timeout_ms,
             floor_prices: self.floor_prices_by_slot(request),
+            provider_request_context: Box::new(snapshot_context_request(context.request)),
             request: request.clone(),
         })
     }
@@ -1133,6 +1019,7 @@ impl AuctionOrchestrator {
             auction_start,
             timeout_ms,
             floor_prices,
+            provider_request_context,
             request,
         } = dispatched;
 
@@ -1172,10 +1059,17 @@ impl AuctionOrchestrator {
             match ready {
                 Ok(platform_response) => {
                     let backend_name = platform_response.backend_name.clone().unwrap_or_default();
-                    if let Some((provider_name, start_time, provider)) =
+                    if let Some((provider_name, start_time, provider, effective_timeout)) =
                         backend_to_provider.remove(&backend_name)
                     {
                         let response_time_ms = start_time.elapsed().as_millis() as u64;
+                        let provider_context = AuctionContext {
+                            settings: context.settings,
+                            request: &provider_request_context,
+                            timeout_ms: effective_timeout,
+                            provider_responses: context.provider_responses,
+                            services: context.services,
+                        };
                         // Mirror run_providers_parallel: use the context-aware
                         // parse so providers behave identically on both paths.
                         match provider
@@ -1183,7 +1077,7 @@ impl AuctionOrchestrator {
                                 platform_response,
                                 response_time_ms,
                                 &request,
-                                context,
+                                &provider_context,
                             )
                             .await
                         {
@@ -1220,7 +1114,7 @@ impl AuctionOrchestrator {
                     // the provider behind `failed_backend_name` so it appears in
                     // provider_details instead of vanishing.
                     if let Some(ref backend_name) = failed_backend_name {
-                        if let Some((provider_name, start_time, _)) =
+                        if let Some((provider_name, start_time, _, _)) =
                             backend_to_provider.remove(backend_name)
                         {
                             let response_time_ms = start_time.elapsed().as_millis() as u64;
@@ -1254,7 +1148,7 @@ impl AuctionOrchestrator {
             // `remaining_budget_ms`.
         }
 
-        for (provider_name, start_time, _) in backend_to_provider.values() {
+        for (provider_name, start_time, _, _) in backend_to_provider.values() {
             let response_time_ms = start_time.elapsed().as_millis() as u64;
             log::warn!(
                 "Provider '{provider_name}' timed out before dispatched auction collection completed"
@@ -1267,28 +1161,15 @@ impl AuctionOrchestrator {
             match self.providers.get(mediator_name.as_str()) {
                 Some(mediator) => {
                     // Cap the mediator at whichever is tighter: its own configured
-                    // timeout or the remaining auction budget (A_deadline). Giving
-                    // the mediator an uncapped timeout would let it hold `</body>`
-                    // well past A_deadline, so the effective value must never
-                    // exceed the remaining budget.
-                    //
-                    // Caveat: unlike the parallel select loop, this path has no
-                    // absolute wall-clock backstop around the mediator call, and a
-                    // backend transport timeout bounds first-byte/inactivity rather
-                    // than total response time (see the transport-deadline note on
-                    // `run_providers_parallel`). Capping the value to the remaining
-                    // budget therefore prevents the mediator from *extending* the
-                    // hold by its own configuration, but a slow-connecting or
-                    // byte-trickling mediator can still overrun; a true absolute
-                    // deadline is tracked as follow-up (#849).
-                    //
-                    // The platform canonicalizes the value for backend-name
-                    // stability (see `PlatformBackend::canonicalize_transport_timeout_ms`).
+                    // timeout or the remaining auction budget (A_deadline).  The old
+                    // comment here claimed origin drain could exhaust the budget before
+                    // collection, but SSP backends are given first-byte and between-bytes
+                    // timeouts equal to effective_timeout (capped at their provider
+                    // timeout) at dispatch time, so they cannot run past A_deadline
+                    // independently. Giving the mediator an uncapped timeout lets it run
+                    // past A_deadline, violating the bounded hold invariant.
                     let remaining = remaining_budget_ms(auction_start, timeout_ms);
-                    let mediator_timeout = services
-                        .backend()
-                        .canonicalize_transport_timeout_ms(remaining, mediator.timeout_ms());
-                    if mediator_timeout == 0 {
+                    if remaining == 0 {
                         log::warn!(
                             "A_deadline exhausted before mediator '{}' — returning {} SSP bids without mediation",
                             mediator.provider_name(),
@@ -1303,6 +1184,7 @@ impl AuctionOrchestrator {
                             metadata: HashMap::new(),
                         };
                     }
+                    let mediator_timeout = remaining.min(mediator.timeout_ms());
                     let mediator_start = Instant::now();
                     log::info!(
                         "Running mediator '{}' with {}ms budget (A_deadline remaining: {}ms, configured: {}ms)",
@@ -1481,18 +1363,14 @@ mod tests {
         AuctionResponse, Bid, BidRenderer, BidStatus, MediaType, PublisherInfo, UserInfo,
     };
     use crate::error::TrustedServerError;
-    use crate::platform::test_support::{
-        StubHttpClient, build_services_with_backend_and_http_client,
-        build_services_with_http_client,
-    };
+    use crate::platform::test_support::{StubHttpClient, build_services_with_http_client};
     use crate::platform::{
-        PlatformBackend, PlatformBackendSpec, PlatformError, PlatformHttpRequest,
-        PlatformPendingRequest, PlatformResponse, RuntimeServices,
+        PlatformHttpRequest, PlatformPendingRequest, PlatformResponse, RuntimeServices,
     };
     use crate::test_support::tests::crate_test_settings_str;
     use error_stack::{Report, ResultExt};
     use std::collections::{HashMap, HashSet};
-    use std::sync::{Arc, Mutex};
+    use std::sync::Arc;
 
     use super::AuctionOrchestrator;
 
@@ -1500,56 +1378,9 @@ mod tests {
     // Minimal test double for AuctionProvider
     // ---------------------------------------------------------------------------
 
-    /// Minimal stub provider. Optionally records the transport timeouts it
-    /// observes, keeping the value passed to `backend_name` (which derives the
-    /// predicted backend name) separate from the `context.timeout_ms` handed to
-    /// `request_bids` (which configures the registered request). Recording them
-    /// separately lets tests assert the orchestrator hands the *same*
-    /// canonicalized value to both — a divergence would land responses in the
-    /// "unknown backend" branch and drop bids.
     struct StubAuctionProvider {
         name: &'static str,
         backend: &'static str,
-        configured_timeout_ms: u32,
-        predicted_timeouts: Option<Arc<Mutex<Vec<u32>>>>,
-        request_timeouts: Option<Arc<Mutex<Vec<u32>>>>,
-    }
-
-    impl StubAuctionProvider {
-        fn new(name: &'static str, backend: &'static str) -> Self {
-            Self {
-                name,
-                backend,
-                configured_timeout_ms: 2000,
-                predicted_timeouts: None,
-                request_timeouts: None,
-            }
-        }
-
-        fn recording(
-            name: &'static str,
-            backend: &'static str,
-            configured_timeout_ms: u32,
-            predicted_timeouts: Arc<Mutex<Vec<u32>>>,
-            request_timeouts: Arc<Mutex<Vec<u32>>>,
-        ) -> Self {
-            Self {
-                name,
-                backend,
-                configured_timeout_ms,
-                predicted_timeouts: Some(predicted_timeouts),
-                request_timeouts: Some(request_timeouts),
-            }
-        }
-
-        fn record(slot: &Option<Arc<Mutex<Vec<u32>>>>, timeout_ms: u32) {
-            if let Some(observed) = slot {
-                observed
-                    .lock()
-                    .expect("should lock observed timeouts")
-                    .push(timeout_ms);
-            }
-        }
     }
 
     #[async_trait::async_trait(?Send)]
@@ -1563,7 +1394,6 @@ mod tests {
             _request: &AuctionRequest,
             context: &AuctionContext<'_>,
         ) -> Result<PlatformPendingRequest, Report<TrustedServerError>> {
-            Self::record(&self.request_timeouts, context.timeout_ms);
             let req = PlatformHttpRequest::new(
                 http::Request::builder()
                     .method("POST")
@@ -1594,84 +1424,31 @@ mod tests {
             ))
         }
 
-        fn timeout_ms(&self) -> u32 {
-            self.configured_timeout_ms
-        }
-
-        fn backend_name(&self, _services: &RuntimeServices, timeout_ms: u32) -> Option<String> {
-            Self::record(&self.predicted_timeouts, timeout_ms);
-            Some(self.backend.to_string())
-        }
-    }
-
-    /// Provider whose `backend_name` prediction deliberately differs from the
-    /// backend name its `request_bids` puts on the wire (the resolved name the
-    /// pending request carries and collection correlates by). Models an adapter
-    /// that resolves a name unequal to the orchestrator's prediction, exercising
-    /// the dispatched path's resolved-name correlation and post-launch guard.
-    struct DivergentBackendProvider {
-        name: &'static str,
-        predicted: &'static str,
-        resolved: &'static str,
-    }
-
-    impl DivergentBackendProvider {
-        fn new(name: &'static str, predicted: &'static str, resolved: &'static str) -> Self {
-            Self {
-                name,
-                predicted,
-                resolved,
-            }
-        }
-    }
-
-    #[async_trait::async_trait(?Send)]
-    impl AuctionProvider for DivergentBackendProvider {
-        fn provider_name(&self) -> &'static str {
-            self.name
-        }
-
-        async fn request_bids(
+        async fn parse_response_with_context(
             &self,
+            response: PlatformResponse,
+            response_time_ms: u64,
             _request: &AuctionRequest,
             context: &AuctionContext<'_>,
-        ) -> Result<PlatformPendingRequest, Report<TrustedServerError>> {
-            let req = PlatformHttpRequest::new(
-                http::Request::builder()
-                    .method("POST")
-                    .uri("https://example.com/bid")
-                    .body(edgezero_core::body::Body::empty())
-                    .expect("should build stub bid request"),
-                self.resolved,
-            );
-            context
-                .services
-                .http_client()
-                .send_async(req)
-                .await
-                .change_context(TrustedServerError::Auction {
-                    message: "stub launch failed".to_string(),
-                })
-        }
-
-        async fn parse_response(
-            &self,
-            _response: PlatformResponse,
-            response_time_ms: u64,
         ) -> Result<AuctionResponse, Report<TrustedServerError>> {
-            Ok(AuctionResponse::success(
-                self.name,
-                vec![],
-                response_time_ms,
-            ))
+            let referer = context
+                .request
+                .headers()
+                .get(http::header::REFERER)
+                .and_then(|value| value.to_str().ok());
+            Ok(self
+                .parse_response(response, response_time_ms)
+                .await?
+                .with_metadata("context_referer", serde_json::json!(referer))
+                .with_metadata("context_timeout_ms", serde_json::json!(context.timeout_ms)))
         }
 
         fn timeout_ms(&self) -> u32 {
-            2000
+            125
         }
 
         fn backend_name(&self, _services: &RuntimeServices, _timeout_ms: u32) -> Option<String> {
-            Some(self.predicted.to_string())
+            Some(self.backend.to_string())
         }
     }
 
@@ -1828,10 +1605,10 @@ mod tests {
             ..Default::default()
         };
         let mut orchestrator = AuctionOrchestrator::new(config);
-        orchestrator.register_provider(Arc::new(StubAuctionProvider::new(
-            "bidder",
-            "bidder-backend",
-        )));
+        orchestrator.register_provider(Arc::new(StubAuctionProvider {
+            name: "bidder",
+            backend: "bidder-backend",
+        }));
         orchestrator.register_provider(Arc::new(CacheRestoringMediator));
 
         let request = create_test_auction_request();
@@ -2199,51 +1976,6 @@ mod tests {
         });
     }
 
-    #[test]
-    fn rejects_duplicate_configured_providers() {
-        // A provider listed twice canonicalizes to one backend name, so the
-        // duplicate would only be caught after its second outbound request had
-        // already fired. Startup validation must reject it up front.
-        let config = AuctionConfig {
-            enabled: true,
-            providers: vec!["prebid".to_string(), "prebid".to_string()],
-            timeout_ms: 2000,
-            ..Default::default()
-        };
-        let orchestrator = AuctionOrchestrator::new(config);
-
-        let err = orchestrator
-            .validate_configured_provider_names()
-            .expect_err("should reject a provider listed more than once");
-        assert!(
-            err.to_string().contains("listed more than once"),
-            "should explain the duplicate provider, got: {err}"
-        );
-    }
-
-    #[test]
-    fn rejects_mediator_also_listed_as_provider() {
-        // A provider acting as its own mediator would be called twice per
-        // auction (bidding phase, then mediation); its demand already flows
-        // through the mediation response, so reject the overlap at startup.
-        let config = AuctionConfig {
-            enabled: true,
-            providers: vec!["prebid".to_string()],
-            mediator: Some("prebid".to_string()),
-            timeout_ms: 2000,
-            ..Default::default()
-        };
-        let orchestrator = AuctionOrchestrator::new(config);
-
-        let err = orchestrator
-            .validate_configured_provider_names()
-            .expect_err("should reject a mediator that is also a provider");
-        assert!(
-            err.to_string().contains("may not mediate its own auction"),
-            "should explain the mediator/provider overlap, got: {err}"
-        );
-    }
-
     #[test]
     fn test_orchestrator_is_enabled() {
         let config = AuctionConfig {
@@ -2296,86 +2028,38 @@ mod tests {
         );
     }
 
-    /// Test backend whose [`PlatformBackend::canonicalize_transport_timeout_ms`]
-    /// returns a fixed value regardless of the wall-clock budget, so the
-    /// orchestrator's transport-timeout wiring can be asserted without timing
-    /// flakiness. Records every `(remaining_ms, configured_ms)` pair it sees.
-    ///
-    /// The exact quantization arithmetic lives in the Fastly adapter (the only
-    /// platform that overrides `canonicalize_transport_timeout_ms`); these core
-    /// tests only prove the orchestrator applies whatever the platform returns
-    /// and applies it identically to the predicted name and the launched
-    /// request.
-    struct CanonicalTimeoutBackend {
-        canonical_ms: u32,
-        calls: Arc<Mutex<Vec<(u32, u32)>>>,
-    }
-
-    impl CanonicalTimeoutBackend {
-        fn new(canonical_ms: u32, calls: Arc<Mutex<Vec<(u32, u32)>>>) -> Self {
-            Self {
-                canonical_ms,
-                calls,
-            }
-        }
-    }
-
-    impl PlatformBackend for CanonicalTimeoutBackend {
-        fn predict_name(
-            &self,
-            _spec: &PlatformBackendSpec,
-        ) -> Result<String, Report<PlatformError>> {
-            Ok("stub-backend".to_owned())
-        }
-
-        fn ensure(&self, _spec: &PlatformBackendSpec) -> Result<String, Report<PlatformError>> {
-            Ok("stub-backend".to_owned())
-        }
-
-        fn canonicalize_transport_timeout_ms(&self, remaining_ms: u32, configured_ms: u32) -> u32 {
-            self.calls
-                .lock()
-                .expect("should lock canonicalize calls")
-                .push((remaining_ms, configured_ms));
-            self.canonical_ms
-        }
-    }
-
     #[test]
-    fn parallel_launch_applies_canonical_timeout_to_name_and_request() {
+    fn select_error_is_attributed_to_correct_provider() {
         futures::executor::block_on(async {
-            // The orchestrator must hand the platform-canonicalized value to
-            // BOTH `backend_name` (which derives the correlation key) and
-            // `request_bids` (via `context.timeout_ms`). Recording them
-            // separately and asserting exact equality catches a regression that
-            // predicts one bucket but registers another — which would drop the
-            // response into the "unknown backend" branch.
+            // Arrange: two stub providers backed by distinct backend names.
+            // The stub HTTP client injects a select() error for the first request
+            // that completes (backend-a). backend-b should still produce a success.
             let stub = Arc::new(StubHttpClient::new());
-            stub.push_response(200, b"{}".to_vec());
-            let calls = Arc::new(Mutex::new(Vec::new()));
-            let backend = Arc::new(CanonicalTimeoutBackend::new(750, Arc::clone(&calls)));
-            let services = build_services_with_backend_and_http_client(backend, stub);
+            stub.push_response(200, b"{}".to_vec()); // consumed by send_async for backend-a
+            stub.push_response(200, b"{}".to_vec()); // consumed by send_async for backend-b
+            stub.push_select_error(); // first select() reports backend-a as failed
+
+            let services = build_services_with_http_client(stub);
             // SAFETY: `Box::leak` creates a `'static` reference for test use only.
             // The leaked allocation is bounded to the test process lifetime.
             let services: &'static RuntimeServices = Box::leak(Box::new(services));
 
-            let predicted = Arc::new(Mutex::new(Vec::new()));
-            let requested = Arc::new(Mutex::new(Vec::new()));
             let config = AuctionConfig {
                 enabled: true,
-                providers: vec!["bidder".to_string()],
+                providers: vec!["provider-a".to_string(), "provider-b".to_string()],
                 timeout_ms: 2000,
                 mediator: None,
                 ..Default::default()
             };
             let mut orchestrator = AuctionOrchestrator::new(config);
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::recording(
-                "bidder",
-                "bidder-backend",
-                1000,
-                Arc::clone(&predicted),
-                Arc::clone(&requested),
-            )));
+            orchestrator.register_provider(Arc::new(StubAuctionProvider {
+                name: "provider-a",
+                backend: "backend-a",
+            }));
+            orchestrator.register_provider(Arc::new(StubAuctionProvider {
+                name: "provider-b",
+                backend: "backend-b",
+            }));
 
             let request = create_test_auction_request();
             let settings = create_test_settings();
@@ -2392,683 +2076,143 @@ mod tests {
                 services,
             };
 
-            orchestrator
+            // Act
+            let result = orchestrator
                 .run_auction(&request, &context)
                 .await
-                .expect("should complete auction");
+                .expect("should complete auction even when one provider errors");
 
-            let predicted = predicted.lock().expect("should lock predicted");
-            let requested = requested.lock().expect("should lock requested");
+            // Assert: exactly two responses — one error, one success.
             assert_eq!(
-                *predicted,
-                vec![750],
-                "backend_name should receive the canonicalized value"
+                result.provider_responses.len(),
+                2,
+                "should collect responses from both providers"
             );
+
+            let provider_a = result
+                .provider_responses
+                .iter()
+                .find(|r| r.provider == "provider-a")
+                .expect("should have provider-a response");
+            let provider_b = result
+                .provider_responses
+                .iter()
+                .find(|r| r.provider == "provider-b")
+                .expect("should have provider-b response");
+
             assert_eq!(
-                *requested,
-                vec![750],
-                "request_bids should receive the same canonicalized value"
+                provider_a.status,
+                BidStatus::Error,
+                "provider-a should be marked error — select() Err was attributed via failed_backend_name"
             );
             assert_eq!(
-                *predicted, *requested,
-                "predicted and registered transport timeouts must be identical"
+                provider_b.status,
+                BidStatus::Success,
+                "provider-b should succeed — error was correctly isolated to provider-a"
             );
+        });
+    }
+
+    #[test]
+    fn dispatched_collection_reuses_provider_launch_context() {
+        futures::executor::block_on(async {
+            let stub = Arc::new(StubHttpClient::new());
+            stub.push_response(200, b"{}".to_vec());
+            let services = build_services_with_http_client(stub);
+            let config = AuctionConfig {
+                enabled: true,
+                providers: vec!["provider-a".to_string()],
+                timeout_ms: 750,
+                mediator: None,
+                ..Default::default()
+            };
+            let mut orchestrator = AuctionOrchestrator::new(config);
+            orchestrator.register_provider(Arc::new(StubAuctionProvider {
+                name: "provider-a",
+                backend: "backend-a",
+            }));
+            let request = create_test_auction_request();
+            let settings = create_test_settings();
+            let downstream = http::Request::builder()
+                .uri("https://publisher.example/article")
+                .header(http::header::REFERER, "https://referrer.example/source")
+                .body(edgezero_core::body::Body::empty())
+                .expect("should build downstream request");
+            let dispatch_context = AuctionContext {
+                settings: &settings,
+                request: &downstream,
+                timeout_ms: 750,
+                provider_responses: None,
+                services: &services,
+            };
+            let dispatched = match orchestrator
+                .dispatch_auction(&request, &dispatch_context)
+                .await
+            {
+                DispatchAuctionOutcome::Dispatched(dispatched) => dispatched,
+                _ => panic!("should dispatch provider request"),
+            };
+            let placeholder = http::Request::builder()
+                .uri("https://placeholder.invalid/")
+                .body(edgezero_core::body::Body::empty())
+                .expect("should build placeholder request");
+            let collect_context = AuctionContext {
+                settings: &settings,
+                request: &placeholder,
+                timeout_ms: 750,
+                provider_responses: None,
+                services: &services,
+            };
 
-            let calls = calls.lock().expect("should lock calls");
-            assert_eq!(calls.len(), 1, "should canonicalize once for the launch");
-            let (remaining_ms, configured_ms) = calls[0];
+            let result = orchestrator
+                .collect_dispatched_auction(dispatched, &services, &collect_context)
+                .await;
+
+            let response = result
+                .provider_responses
+                .first()
+                .expect("should collect provider response");
             assert_eq!(
-                configured_ms, 1000,
-                "should pass the provider's configured timeout as the configured bound"
+                response.metadata["context_referer"], "https://referrer.example/source",
+                "should parse with the downstream request used at launch"
             );
-            assert!(
-                remaining_ms > 0 && remaining_ms <= 2000,
-                "should pass the live remaining budget, got {remaining_ms}ms"
+            assert_eq!(
+                response.metadata["context_timeout_ms"], 125,
+                "should parse with the provider-capped launch timeout"
             );
         });
     }
 
     #[test]
-    fn zero_canonical_timeout_skips_parallel_launch() {
+    fn rejects_multi_provider_fanout_before_launch_on_sequential_platform() {
         futures::executor::block_on(async {
-            // A platform that canonicalizes to zero signals "budget exhausted";
-            // the orchestrator must skip the launch. With the only provider
-            // skipped, no requests launch and the auction errors.
+            // Arrange: two configured providers on a platform whose HTTP
+            // client executes send_async eagerly (no concurrent fan-out).
             let stub = Arc::new(StubHttpClient::new());
-            let calls = Arc::new(Mutex::new(Vec::new()));
-            let backend = Arc::new(CanonicalTimeoutBackend::new(0, Arc::clone(&calls)));
-            let services = build_services_with_backend_and_http_client(backend, stub);
+            stub.set_concurrent_fanout(false);
+            let stub_for_assertion = Arc::clone(&stub);
+
+            let services = build_services_with_http_client(stub);
             // SAFETY: `Box::leak` creates a `'static` reference for test use only.
             // The leaked allocation is bounded to the test process lifetime.
             let services: &'static RuntimeServices = Box::leak(Box::new(services));
 
             let config = AuctionConfig {
                 enabled: true,
-                providers: vec!["bidder".to_string()],
+                providers: vec!["provider-a".to_string(), "provider-b".to_string()],
                 timeout_ms: 2000,
                 mediator: None,
                 ..Default::default()
             };
             let mut orchestrator = AuctionOrchestrator::new(config);
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::new(
-                "bidder",
-                "bidder-backend",
-            )));
-
-            let request = create_test_auction_request();
-            let settings = create_test_settings();
-            let req = http::Request::builder()
-                .method(http::Method::GET)
-                .uri("https://example.com/test")
-                .body(edgezero_core::body::Body::empty())
-                .expect("should build request");
-            let context = AuctionContext {
-                settings: &settings,
-                request: &req,
-                timeout_ms: 2000,
-                provider_responses: None,
-                services,
-            };
-
-            let result = orchestrator.run_auction(&request, &context).await;
-            assert!(
-                result.is_err(),
-                "should error when the only provider is skipped for an exhausted budget"
-            );
-        });
-    }
-
-    #[test]
-    fn synchronous_mediation_applies_canonical_timeout_to_mediator() {
-        futures::executor::block_on(async {
-            // The mediator runs after the bidding phase and has no select-loop
-            // backstop; it must still receive the platform-canonicalized value
-            // for both prediction and request.
-            let stub = Arc::new(StubHttpClient::new());
-            stub.push_response(200, b"{}".to_vec()); // bidder send_async
-            stub.push_response(200, b"{}".to_vec()); // mediator send_async
-            let calls = Arc::new(Mutex::new(Vec::new()));
-            let backend = Arc::new(CanonicalTimeoutBackend::new(500, Arc::clone(&calls)));
-            let services = build_services_with_backend_and_http_client(backend, stub);
-            // SAFETY: `Box::leak` creates a `'static` reference for test use only.
-            // The leaked allocation is bounded to the test process lifetime.
-            let services: &'static RuntimeServices = Box::leak(Box::new(services));
-
-            let predicted = Arc::new(Mutex::new(Vec::new()));
-            let requested = Arc::new(Mutex::new(Vec::new()));
-            let config = AuctionConfig {
-                enabled: true,
-                providers: vec!["bidder".to_string()],
-                mediator: Some("mediator".to_string()),
-                timeout_ms: 2000,
-                ..Default::default()
-            };
-            let mut orchestrator = AuctionOrchestrator::new(config);
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::new(
-                "bidder",
-                "bidder-backend",
-            )));
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::recording(
-                "mediator",
-                "mediator-backend",
-                2000,
-                Arc::clone(&predicted),
-                Arc::clone(&requested),
-            )));
-
-            let request = create_test_auction_request();
-            let settings = create_test_settings();
-            let req = http::Request::builder()
-                .method(http::Method::GET)
-                .uri("https://example.com/test")
-                .body(edgezero_core::body::Body::empty())
-                .expect("should build request");
-            let context = AuctionContext {
-                settings: &settings,
-                request: &req,
-                timeout_ms: 2000,
-                provider_responses: None,
-                services,
-            };
-
-            orchestrator
-                .run_auction(&request, &context)
-                .await
-                .expect("should complete mediated auction");
-
-            let predicted = predicted.lock().expect("should lock predicted");
-            let requested = requested.lock().expect("should lock requested");
-            // The orchestrator hands the mediator its budget through
-            // `context.timeout_ms` and calls `request_bids` directly; it does not
-            // call the mediator's `backend_name` (the mediator self-registers its
-            // backend), so only the request side is observed here.
-            assert!(
-                predicted.is_empty(),
-                "orchestrator should not separately predict a backend name for the mediator"
-            );
-            assert_eq!(
-                *requested,
-                vec![500],
-                "mediator request should use the canonical value"
-            );
-        });
-    }
-
-    #[test]
-    fn dispatched_collect_applies_canonical_timeout_to_both_paths() {
-        futures::executor::block_on(async {
-            // Same wiring invariant on the split dispatch/collect path used by
-            // publisher page rendering: the dispatched bidder and the collected
-            // mediator both receive the canonicalized value for prediction and
-            // request.
-            let stub = Arc::new(StubHttpClient::new());
-            stub.push_response(200, b"{}".to_vec()); // bidder send_async
-            stub.push_response(200, b"{}".to_vec()); // mediator send_async
-            let calls = Arc::new(Mutex::new(Vec::new()));
-            let backend = Arc::new(CanonicalTimeoutBackend::new(500, Arc::clone(&calls)));
-            let services = build_services_with_backend_and_http_client(backend, stub);
-            // SAFETY: `Box::leak` creates a `'static` reference for test use only.
-            // The leaked allocation is bounded to the test process lifetime.
-            let services: &'static RuntimeServices = Box::leak(Box::new(services));
-
-            let bidder_predicted = Arc::new(Mutex::new(Vec::new()));
-            let bidder_requested = Arc::new(Mutex::new(Vec::new()));
-            let mediator_predicted = Arc::new(Mutex::new(Vec::new()));
-            let mediator_requested = Arc::new(Mutex::new(Vec::new()));
-            let config = AuctionConfig {
-                enabled: true,
-                providers: vec!["bidder".to_string()],
-                mediator: Some("mediator".to_string()),
-                timeout_ms: 2000,
-                ..Default::default()
-            };
-            let mut orchestrator = AuctionOrchestrator::new(config);
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::recording(
-                "bidder",
-                "bidder-backend",
-                2000,
-                Arc::clone(&bidder_predicted),
-                Arc::clone(&bidder_requested),
-            )));
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::recording(
-                "mediator",
-                "mediator-backend",
-                2000,
-                Arc::clone(&mediator_predicted),
-                Arc::clone(&mediator_requested),
-            )));
-
-            let request = create_test_auction_request();
-            let settings = create_test_settings();
-            let req = http::Request::builder()
-                .method(http::Method::GET)
-                .uri("https://example.com/test")
-                .body(edgezero_core::body::Body::empty())
-                .expect("should build request");
-            let context = AuctionContext {
-                settings: &settings,
-                request: &req,
-                timeout_ms: 2000,
-                provider_responses: None,
-                services,
-            };
-
-            let dispatched = match orchestrator.dispatch_auction(&request, &context).await {
-                DispatchAuctionOutcome::Dispatched(dispatched) => dispatched,
-                _ => panic!("should dispatch the bidder request"),
-            };
-            orchestrator
-                .collect_dispatched_auction(dispatched, services, &context)
-                .await;
-
-            let bidder_predicted = bidder_predicted
-                .lock()
-                .expect("should lock bidder predicted");
-            let bidder_requested = bidder_requested
-                .lock()
-                .expect("should lock bidder requested");
-            assert_eq!(
-                *bidder_predicted,
-                vec![500],
-                "dispatched bidder name should use canonical value"
-            );
-            assert_eq!(
-                *bidder_requested,
-                vec![500],
-                "dispatched bidder request should use canonical value"
-            );
-            assert_eq!(
-                *bidder_predicted, *bidder_requested,
-                "dispatched bidder predicted and registered timeouts must be identical"
-            );
-
-            let mediator_predicted = mediator_predicted
-                .lock()
-                .expect("should lock mediator predicted");
-            let mediator_requested = mediator_requested
-                .lock()
-                .expect("should lock mediator requested");
-            // As on the synchronous path, the orchestrator calls the mediator's
-            // `request_bids` directly without predicting a backend name for it.
-            assert!(
-                mediator_predicted.is_empty(),
-                "orchestrator should not separately predict a backend name for the mediator"
-            );
-            assert_eq!(
-                *mediator_requested,
-                vec![500],
-                "mediator request should use the canonical value"
-            );
-        });
-    }
-
-    #[test]
-    fn parallel_duplicate_backend_name_fails_second_provider_attributably() {
-        futures::executor::block_on(async {
-            // Two providers that canonicalize to the SAME backend name (e.g. two
-            // auction providers behind one gateway origin). The correlation map
-            // keys on backend name, so the second must not silently overwrite
-            // the first — it must fail attributably so no bid is misparsed or
-            // lost.
-            let stub = Arc::new(StubHttpClient::new());
-            stub.push_response(200, b"{}".to_vec()); // provider-a send_async
-            stub.push_response(200, b"{}".to_vec()); // provider-b send_async (dropped after guard)
-            let services = build_services_with_http_client(stub);
-            // SAFETY: `Box::leak` creates a `'static` reference for test use only.
-            // The leaked allocation is bounded to the test process lifetime.
-            let services: &'static RuntimeServices = Box::leak(Box::new(services));
-
-            let config = AuctionConfig {
-                enabled: true,
-                providers: vec!["provider-a".to_string(), "provider-b".to_string()],
-                timeout_ms: 2000,
-                mediator: None,
-                ..Default::default()
-            };
-            let mut orchestrator = AuctionOrchestrator::new(config);
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::new(
-                "provider-a",
-                "shared-backend",
-            )));
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::new(
-                "provider-b",
-                "shared-backend",
-            )));
-
-            let request = create_test_auction_request();
-            let settings = create_test_settings();
-            let req = http::Request::builder()
-                .method(http::Method::GET)
-                .uri("https://example.com/test")
-                .body(edgezero_core::body::Body::empty())
-                .expect("should build request");
-            let context = AuctionContext {
-                settings: &settings,
-                request: &req,
-                timeout_ms: 2000,
-                provider_responses: None,
-                services,
-            };
-
-            let result = orchestrator
-                .run_auction(&request, &context)
-                .await
-                .expect("should complete auction despite the name collision");
-
-            assert_eq!(
-                result.provider_responses.len(),
-                2,
-                "should account for both providers"
-            );
-            let provider_a = result
-                .provider_responses
-                .iter()
-                .find(|r| r.provider == "provider-a")
-                .expect("should have provider-a response");
-            let provider_b = result
-                .provider_responses
-                .iter()
-                .find(|r| r.provider == "provider-b")
-                .expect("should have provider-b response");
-            assert_eq!(
-                provider_a.status,
-                BidStatus::Success,
-                "the first provider on the shared name should launch and succeed"
-            );
-            assert_eq!(
-                provider_b.status,
-                BidStatus::Error,
-                "the second provider on the shared name should fail attributably, not be dropped"
-            );
-        });
-    }
-
-    #[test]
-    fn dispatched_duplicate_backend_name_fails_second_provider_attributably() {
-        futures::executor::block_on(async {
-            // Same collision defense on the dispatch/collect path.
-            let stub = Arc::new(StubHttpClient::new());
-            stub.push_response(200, b"{}".to_vec()); // provider-a send_async
-            stub.push_response(200, b"{}".to_vec()); // provider-b send_async (dropped after guard)
-            let services = build_services_with_http_client(stub);
-            // SAFETY: `Box::leak` creates a `'static` reference for test use only.
-            // The leaked allocation is bounded to the test process lifetime.
-            let services: &'static RuntimeServices = Box::leak(Box::new(services));
-
-            let config = AuctionConfig {
-                enabled: true,
-                providers: vec!["provider-a".to_string(), "provider-b".to_string()],
-                timeout_ms: 2000,
-                mediator: None,
-                ..Default::default()
-            };
-            let mut orchestrator = AuctionOrchestrator::new(config);
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::new(
-                "provider-a",
-                "shared-backend",
-            )));
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::new(
-                "provider-b",
-                "shared-backend",
-            )));
-
-            let request = create_test_auction_request();
-            let settings = create_test_settings();
-            let req = http::Request::builder()
-                .method(http::Method::GET)
-                .uri("https://example.com/test")
-                .body(edgezero_core::body::Body::empty())
-                .expect("should build request");
-            let context = AuctionContext {
-                settings: &settings,
-                request: &req,
-                timeout_ms: 2000,
-                provider_responses: None,
-                services,
-            };
-
-            let dispatched = match orchestrator.dispatch_auction(&request, &context).await {
-                DispatchAuctionOutcome::Dispatched(dispatched) => dispatched,
-                _ => panic!("should dispatch the first provider despite the name collision"),
-            };
-            let result = orchestrator
-                .collect_dispatched_auction(dispatched, services, &context)
-                .await;
-
-            let provider_b = result
-                .provider_responses
-                .iter()
-                .find(|r| r.provider == "provider-b")
-                .expect("should have provider-b response");
-            assert_eq!(
-                provider_b.status,
-                BidStatus::Error,
-                "the second provider on the shared name should fail attributably, not be dropped"
-            );
-        });
-    }
-
-    #[test]
-    fn dispatched_resolved_backend_name_diverging_from_prediction_still_correlates() {
-        futures::executor::block_on(async {
-            // The dispatched path must correlate on the backend name the pending
-            // request resolves to, not the orchestrator's prediction. A provider
-            // whose resolved name differs from its prediction would otherwise land
-            // its response in the "unknown backend" branch and drop the bid.
-            let stub = Arc::new(StubHttpClient::new());
-            stub.push_response(200, b"{}".to_vec());
-            let services = build_services_with_http_client(stub);
-            // SAFETY: `Box::leak` creates a `'static` reference for test use only.
-            // The leaked allocation is bounded to the test process lifetime.
-            let services: &'static RuntimeServices = Box::leak(Box::new(services));
-
-            let config = AuctionConfig {
-                enabled: true,
-                providers: vec!["provider-a".to_string()],
-                timeout_ms: 2000,
-                mediator: None,
-                ..Default::default()
-            };
-            let mut orchestrator = AuctionOrchestrator::new(config);
-            orchestrator.register_provider(Arc::new(DivergentBackendProvider::new(
-                "provider-a",
-                "predicted-backend",
-                "resolved-backend",
-            )));
-
-            let request = create_test_auction_request();
-            let settings = create_test_settings();
-            let req = http::Request::builder()
-                .method(http::Method::GET)
-                .uri("https://example.com/test")
-                .body(edgezero_core::body::Body::empty())
-                .expect("should build request");
-            let context = AuctionContext {
-                settings: &settings,
-                request: &req,
-                timeout_ms: 2000,
-                provider_responses: None,
-                services,
-            };
-
-            let dispatched = match orchestrator.dispatch_auction(&request, &context).await {
-                DispatchAuctionOutcome::Dispatched(dispatched) => dispatched,
-                _ => panic!("should dispatch the diverging provider"),
-            };
-            let result = orchestrator
-                .collect_dispatched_auction(dispatched, services, &context)
-                .await;
-
-            let provider_a = result
-                .provider_responses
-                .iter()
-                .find(|r| r.provider == "provider-a")
-                .expect("should have provider-a response");
-            assert_eq!(
-                provider_a.status,
-                BidStatus::Success,
-                "response should correlate by the resolved backend name, not the prediction"
-            );
-        });
-    }
-
-    #[test]
-    fn dispatched_post_launch_resolved_name_collision_fails_second_provider_attributably() {
-        futures::executor::block_on(async {
-            // Two providers with *distinct* predictions that resolve to the SAME
-            // backend name. The pre-launch guard keys on the predictions and lets
-            // both through; only the post-launch guard, reading the resolved name,
-            // can catch the collision. The second must fail attributably.
-            let stub = Arc::new(StubHttpClient::new());
-            stub.push_response(200, b"{}".to_vec()); // provider-a send_async
-            stub.push_response(200, b"{}".to_vec()); // provider-b send_async (dropped after guard)
-            let services = build_services_with_http_client(stub);
-            // SAFETY: `Box::leak` creates a `'static` reference for test use only.
-            // The leaked allocation is bounded to the test process lifetime.
-            let services: &'static RuntimeServices = Box::leak(Box::new(services));
-
-            let config = AuctionConfig {
-                enabled: true,
-                providers: vec!["provider-a".to_string(), "provider-b".to_string()],
-                timeout_ms: 2000,
-                mediator: None,
-                ..Default::default()
-            };
-            let mut orchestrator = AuctionOrchestrator::new(config);
-            orchestrator.register_provider(Arc::new(DivergentBackendProvider::new(
-                "provider-a",
-                "predicted-a",
-                "shared-resolved",
-            )));
-            orchestrator.register_provider(Arc::new(DivergentBackendProvider::new(
-                "provider-b",
-                "predicted-b",
-                "shared-resolved",
-            )));
-
-            let request = create_test_auction_request();
-            let settings = create_test_settings();
-            let req = http::Request::builder()
-                .method(http::Method::GET)
-                .uri("https://example.com/test")
-                .body(edgezero_core::body::Body::empty())
-                .expect("should build request");
-            let context = AuctionContext {
-                settings: &settings,
-                request: &req,
-                timeout_ms: 2000,
-                provider_responses: None,
-                services,
-            };
-
-            let dispatched = match orchestrator.dispatch_auction(&request, &context).await {
-                DispatchAuctionOutcome::Dispatched(dispatched) => dispatched,
-                _ => {
-                    panic!("should dispatch the first provider despite the resolved-name collision")
-                }
-            };
-            let result = orchestrator
-                .collect_dispatched_auction(dispatched, services, &context)
-                .await;
-
-            let provider_a = result
-                .provider_responses
-                .iter()
-                .find(|r| r.provider == "provider-a")
-                .expect("should have provider-a response");
-            let provider_b = result
-                .provider_responses
-                .iter()
-                .find(|r| r.provider == "provider-b")
-                .expect("should have provider-b response");
-            assert_eq!(
-                provider_a.status,
-                BidStatus::Success,
-                "the first provider on the shared resolved name should launch and succeed"
-            );
-            assert_eq!(
-                provider_b.status,
-                BidStatus::Error,
-                "the second provider colliding on the resolved name should fail attributably"
-            );
-        });
-    }
-
-    #[test]
-    fn select_error_is_attributed_to_correct_provider() {
-        futures::executor::block_on(async {
-            // Arrange: two stub providers backed by distinct backend names.
-            // The stub HTTP client injects a select() error for the first request
-            // that completes (backend-a). backend-b should still produce a success.
-            let stub = Arc::new(StubHttpClient::new());
-            stub.push_response(200, b"{}".to_vec()); // consumed by send_async for backend-a
-            stub.push_response(200, b"{}".to_vec()); // consumed by send_async for backend-b
-            stub.push_select_error(); // first select() reports backend-a as failed
-
-            let services = build_services_with_http_client(stub);
-            // SAFETY: `Box::leak` creates a `'static` reference for test use only.
-            // The leaked allocation is bounded to the test process lifetime.
-            let services: &'static RuntimeServices = Box::leak(Box::new(services));
-
-            let config = AuctionConfig {
-                enabled: true,
-                providers: vec!["provider-a".to_string(), "provider-b".to_string()],
-                timeout_ms: 2000,
-                mediator: None,
-                ..Default::default()
-            };
-            let mut orchestrator = AuctionOrchestrator::new(config);
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::new(
-                "provider-a",
-                "backend-a",
-            )));
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::new(
-                "provider-b",
-                "backend-b",
-            )));
-
-            let request = create_test_auction_request();
-            let settings = create_test_settings();
-            let req = http::Request::builder()
-                .method(http::Method::GET)
-                .uri("https://example.com/test")
-                .body(edgezero_core::body::Body::empty())
-                .expect("should build request");
-            let context = AuctionContext {
-                settings: &settings,
-                request: &req,
-                timeout_ms: 2000,
-                provider_responses: None,
-                services,
-            };
-
-            // Act
-            let result = orchestrator
-                .run_auction(&request, &context)
-                .await
-                .expect("should complete auction even when one provider errors");
-
-            // Assert: exactly two responses — one error, one success.
-            assert_eq!(
-                result.provider_responses.len(),
-                2,
-                "should collect responses from both providers"
-            );
-
-            let provider_a = result
-                .provider_responses
-                .iter()
-                .find(|r| r.provider == "provider-a")
-                .expect("should have provider-a response");
-            let provider_b = result
-                .provider_responses
-                .iter()
-                .find(|r| r.provider == "provider-b")
-                .expect("should have provider-b response");
-
-            assert_eq!(
-                provider_a.status,
-                BidStatus::Error,
-                "provider-a should be marked error — select() Err was attributed via failed_backend_name"
-            );
-            assert_eq!(
-                provider_b.status,
-                BidStatus::Success,
-                "provider-b should succeed — error was correctly isolated to provider-a"
-            );
-        });
-    }
-
-    #[test]
-    fn rejects_multi_provider_fanout_before_launch_on_sequential_platform() {
-        futures::executor::block_on(async {
-            // Arrange: two configured providers on a platform whose HTTP
-            // client executes send_async eagerly (no concurrent fan-out).
-            let stub = Arc::new(StubHttpClient::new());
-            stub.set_concurrent_fanout(false);
-            let stub_for_assertion = Arc::clone(&stub);
-
-            let services = build_services_with_http_client(stub);
-            // SAFETY: `Box::leak` creates a `'static` reference for test use only.
-            // The leaked allocation is bounded to the test process lifetime.
-            let services: &'static RuntimeServices = Box::leak(Box::new(services));
-
-            let config = AuctionConfig {
-                enabled: true,
-                providers: vec!["provider-a".to_string(), "provider-b".to_string()],
-                timeout_ms: 2000,
-                mediator: None,
-                ..Default::default()
-            };
-            let mut orchestrator = AuctionOrchestrator::new(config);
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::new(
-                "provider-a",
-                "backend-a",
-            )));
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::new(
-                "provider-b",
-                "backend-b",
-            )));
+            orchestrator.register_provider(Arc::new(StubAuctionProvider {
+                name: "provider-a",
+                backend: "backend-a",
+            }));
+            orchestrator.register_provider(Arc::new(StubAuctionProvider {
+                name: "provider-b",
+                backend: "backend-b",
+            }));
 
             let request = create_test_auction_request();
             let settings = create_test_settings();
@@ -3126,14 +2270,14 @@ mod tests {
                 ..Default::default()
             };
             let mut orchestrator = AuctionOrchestrator::new(config);
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::new(
-                "provider-a",
-                "backend-a",
-            )));
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::new(
-                "provider-b",
-                "backend-b",
-            )));
+            orchestrator.register_provider(Arc::new(StubAuctionProvider {
+                name: "provider-a",
+                backend: "backend-a",
+            }));
+            orchestrator.register_provider(Arc::new(StubAuctionProvider {
+                name: "provider-b",
+                backend: "backend-b",
+            }));
 
             let request = create_test_auction_request();
             let settings = create_test_settings();
diff --git a/crates/trusted-server-core/src/integrations/aps.rs b/crates/trusted-server-core/src/integrations/aps.rs
index f32fa9012..4e2facef4 100644
--- a/crates/trusted-server-core/src/integrations/aps.rs
+++ b/crates/trusted-server-core/src/integrations/aps.rs
@@ -8,7 +8,7 @@ use async_trait::async_trait;
 use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64_STANDARD};
 use edgezero_core::body::Body as EdgeBody;
 use error_stack::{Report, ResultExt};
-use http::{Method, StatusCode, header};
+use http::{HeaderMap, Method, StatusCode, header};
 use serde::de::{self, Visitor};
 use serde::{Deserialize, Serialize};
 use serde_json::{Value as Json, json};
@@ -129,6 +129,9 @@ pub struct ApsConfig {
     /// Timeout in milliseconds.
     #[serde(default = "default_timeout_ms")]
     pub timeout_ms: u32,
+    /// Whether to include the APS HTTP exchange in auction response metadata.
+    #[serde(default)]
+    pub debug: bool,
     /// Whether APS script creatives are eligible before winner selection.
     #[serde(default)]
     pub allow_script_creatives: bool,
@@ -297,6 +300,7 @@ impl Default for ApsConfig {
             account_id: String::new(),
             endpoint: default_endpoint(),
             timeout_ms: default_timeout_ms(),
+            debug: false,
             allow_script_creatives: false,
             inventory_domain: None,
             inventory_page_origin: None,
@@ -334,6 +338,11 @@ struct ApsRendererInput<'a> {
     height: u32,
 }
 
+struct ApsDebugRequest {
+    body: String,
+    headers: BTreeMap<String, Vec<String>>,
+}
+
 /// APS `OpenRTB` auction provider.
 pub struct ApsAuctionProvider {
     config: ApsConfig,
@@ -557,6 +566,78 @@ impl ApsAuctionProvider {
         }
     }
 
+    fn serialize_openrtb_request(
+        request: &OpenRtbRequest,
+    ) -> Result<Vec<u8>, Report<TrustedServerError>> {
+        serde_json::to_vec(request).change_context(TrustedServerError::Auction {
+            message: "Failed to serialize APS OpenRTB request".to_string(),
+        })
+    }
+
+    fn debug_headers(headers: &HeaderMap) -> BTreeMap<String, Vec<String>> {
+        let mut values = BTreeMap::<String, Vec<String>>::new();
+        for (name, value) in headers {
+            let Ok(value) = value.to_str() else {
+                continue;
+            };
+            values
+                .entry(name.as_str().to_string())
+                .or_default()
+                .push(value.to_string());
+        }
+        values
+    }
+
+    fn debug_request(
+        &self,
+        request: &AuctionRequest,
+        context: &AuctionContext<'_>,
+    ) -> Result<ApsDebugRequest, Report<TrustedServerError>> {
+        let openrtb = self.build_openrtb_request(request, context);
+        let body = Self::serialize_openrtb_request(&openrtb)?;
+        Ok(ApsDebugRequest {
+            body: String::from_utf8_lossy(&body).into_owned(),
+            headers: BTreeMap::from([(
+                header::CONTENT_TYPE.as_str().to_string(),
+                vec!["application/json".to_string()],
+            )]),
+        })
+    }
+
+    fn attach_debug_metadata(
+        &self,
+        response: AuctionResponse,
+        request: Option<ApsDebugRequest>,
+        response_body: Option<&[u8]>,
+        response_headers: &BTreeMap<String, Vec<String>>,
+        status: StatusCode,
+    ) -> AuctionResponse {
+        let Some(request) = request else {
+            return response;
+        };
+        let mut http_call = json!({
+            "requestbody": request.body,
+            "requestheaders": request.headers,
+            "responseheaders": response_headers,
+            "status": status.as_u16(),
+            "uri": self.config.endpoint.clone(),
+        });
+        if let (Some(response_body), Some(http_call)) = (response_body, http_call.as_object_mut()) {
+            http_call.insert(
+                "responsebody".to_string(),
+                json!(String::from_utf8_lossy(response_body)),
+            );
+        }
+        response.with_metadata(
+            "debug",
+            json!({
+                "httpcalls": {
+                    (APS_INTEGRATION_ID): [http_call]
+                }
+            }),
+        )
+    }
+
     fn compatible_dimensions(slot: &AdSlot, width: u32, height: u32) -> bool {
         width > 0
             && height > 0
@@ -828,17 +909,49 @@ impl ApsAuctionProvider {
         response: PlatformResponse,
         response_time_ms: u64,
         request: Option<&AuctionRequest>,
+        debug_request: Option<ApsDebugRequest>,
     ) -> Result<AuctionResponse, Report<TrustedServerError>> {
         let response = response.response;
-        if response.status() == StatusCode::NO_CONTENT {
-            return Ok(AuctionResponse::no_bid(
-                APS_INTEGRATION_ID,
-                response_time_ms,
+        let status = response.status();
+        let response_headers = debug_request
+            .as_ref()
+            .map_or_else(BTreeMap::new, |_| Self::debug_headers(response.headers()));
+
+        if status == StatusCode::NO_CONTENT {
+            return Ok(self.attach_debug_metadata(
+                AuctionResponse::no_bid(APS_INTEGRATION_ID, response_time_ms),
+                debug_request,
+                Some(&[]),
+                &response_headers,
+                status,
             ));
         }
-        if !response.status().is_success() {
+        if !status.is_success() {
             log::warn!("APS returns a non-success status");
-            return Ok(AuctionResponse::error(APS_INTEGRATION_ID, response_time_ms));
+            let body = if debug_request.is_some() {
+                match collect_response_bounded(
+                    response.into_body(),
+                    UPSTREAM_RTB_MAX_RESPONSE_BYTES,
+                    APS_INTEGRATION_ID,
+                )
+                .await
+                {
+                    Ok(body) => Some(body),
+                    Err(error) => {
+                        log::warn!("Failed to read APS debug response body: {error:?}");
+                        None
+                    }
+                }
+            } else {
+                None
+            };
+            return Ok(self.attach_debug_metadata(
+                AuctionResponse::error(APS_INTEGRATION_ID, response_time_ms),
+                debug_request,
+                body.as_deref(),
+                &response_headers,
+                status,
+            ));
         }
         let body = collect_response_bounded(
             response.into_body(),
@@ -854,8 +967,15 @@ impl ApsAuctionProvider {
             Ok(value) => value,
             Err(error) => {
                 log::warn!("Failed to parse APS response JSON: {error}");
-                return Ok(AuctionResponse::error(APS_INTEGRATION_ID, response_time_ms)
-                    .with_metadata("drop_reasons", json!({"unexpected_response_shape": 1})));
+                let parsed = AuctionResponse::error(APS_INTEGRATION_ID, response_time_ms)
+                    .with_metadata("drop_reasons", json!({"unexpected_response_shape": 1}));
+                return Ok(self.attach_debug_metadata(
+                    parsed,
+                    debug_request,
+                    Some(&body),
+                    &response_headers,
+                    status,
+                ));
             }
         };
         let Some(request) = request else {
@@ -867,7 +987,13 @@ impl ApsAuctionProvider {
             parsed.bids.len(),
             response_time_ms
         );
-        Ok(parsed)
+        Ok(self.attach_debug_metadata(
+            parsed,
+            debug_request,
+            Some(&body),
+            &response_headers,
+            status,
+        ))
     }
 }
 
@@ -890,9 +1016,7 @@ impl AuctionProvider for ApsAuctionProvider {
         }
         log::info!("APS requests bids for {} impressions", openrtb.imp.len());
         log::trace!("APS request body: {openrtb:?}");
-        let body = serde_json::to_vec(&openrtb).change_context(TrustedServerError::Auction {
-            message: "Failed to serialize APS OpenRTB request".to_string(),
-        })?;
+        let body = Self::serialize_openrtb_request(&openrtb)?;
         let request = http::Request::builder()
             .method(Method::POST)
             .uri(&self.config.endpoint)
@@ -925,7 +1049,7 @@ impl AuctionProvider for ApsAuctionProvider {
         response: PlatformResponse,
         response_time_ms: u64,
     ) -> Result<AuctionResponse, Report<TrustedServerError>> {
-        self.parse_response_inner(response, response_time_ms, None)
+        self.parse_response_inner(response, response_time_ms, None, None)
             .await
     }
 
@@ -934,9 +1058,20 @@ impl AuctionProvider for ApsAuctionProvider {
         response: PlatformResponse,
         response_time_ms: u64,
         request: &AuctionRequest,
-        _context: &AuctionContext<'_>,
+        context: &AuctionContext<'_>,
     ) -> Result<AuctionResponse, Report<TrustedServerError>> {
-        self.parse_response_inner(response, response_time_ms, Some(request))
+        let debug_request = if self.config.debug {
+            match self.debug_request(request, context) {
+                Ok(debug_request) => Some(debug_request),
+                Err(error) => {
+                    log::warn!("Failed to build APS debug request metadata: {error:?}");
+                    None
+                }
+            }
+        } else {
+            None
+        };
+        self.parse_response_inner(response, response_time_ms, Some(request), debug_request)
             .await
     }
 
@@ -1061,6 +1196,7 @@ mod tests {
             account_id: "example-account-id".to_string(),
             endpoint: default_endpoint(),
             timeout_ms: 800,
+            debug: false,
             allow_script_creatives: false,
             inventory_domain: None,
             inventory_page_origin: None,
@@ -1115,6 +1251,32 @@ mod tests {
         })
     }
 
+    fn parse_with_context(
+        provider: &ApsAuctionProvider,
+        response: PlatformResponse,
+    ) -> AuctionResponse {
+        let settings = create_test_settings();
+        let services = noop_services();
+        let downstream = http::Request::builder()
+            .uri("https://publisher.example/auction")
+            .body(EdgeBody::empty())
+            .expect("should build downstream request");
+        let context = AuctionContext {
+            settings: &settings,
+            request: &downstream,
+            timeout_ms: 321,
+            provider_responses: None,
+            services: &services,
+        };
+        futures::executor::block_on(provider.parse_response_with_context(
+            response,
+            12,
+            &request(),
+            &context,
+        ))
+        .expect("should parse APS response with context")
+    }
+
     #[test]
     fn config_accepts_canonical_alias_and_integer_ids() {
         let canonical: ApsConfig = serde_json::from_value(json!({
@@ -1123,9 +1285,16 @@ mod tests {
         .expect("should parse canonical account ID");
         let alias: ApsConfig =
             serde_json::from_value(json!({"pub_id": 1234})).expect("should parse legacy alias");
+        let debug: ApsConfig = serde_json::from_value(json!({
+            "account_id": "example-account",
+            "debug": true
+        }))
+        .expect("should parse debug flag");
         assert_eq!(canonical.account_id, "example-account");
         assert_eq!(alias.account_id, "1234");
         assert!(!canonical.enabled);
+        assert!(!canonical.debug);
+        assert!(debug.debug);
         assert!(!canonical.allow_script_creatives);
         assert!(canonical.endpoint.ends_with("/e/pb/bid"));
     }
@@ -1444,6 +1613,157 @@ mod tests {
         }
     }
 
+    #[test]
+    fn debug_metadata_matches_pbs_httpcalls_shape() {
+        let mut provider_config = config();
+        provider_config.debug = true;
+        provider_config.endpoint = "https://aps.example/openrtb".to_string();
+        let provider = ApsAuctionProvider::new(provider_config);
+        let response_body = serde_json::to_vec(&json!({
+            "cur": "USD",
+            "seatbid": [{"bid": [bid("fictional-debug-bid", 1.23, "iframe")]}]
+        }))
+        .expect("should serialize APS response fixture");
+        let platform_response = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::OK)
+                .header(header::CONTENT_TYPE, "application/json")
+                .header("x-example-debug", "first")
+                .header("x-example-debug", "second")
+                .body(EdgeBody::from(response_body.clone()))
+                .expect("should build APS response"),
+        );
+
+        let response = parse_with_context(&provider, platform_response);
+
+        assert_eq!(response.metadata["accepted_bid_count"], 1);
+        let call = &response.metadata["debug"]["httpcalls"]["aps"][0];
+        let request_body: Json = serde_json::from_str(
+            call["requestbody"]
+                .as_str()
+                .expect("should include request body as a string"),
+        )
+        .expect("should parse captured request body");
+        assert_eq!(request_body["id"], "fictional-auction");
+        assert_eq!(request_body["tmax"], 321);
+        assert_eq!(
+            call["requestheaders"]["content-type"],
+            json!(["application/json"])
+        );
+        assert_eq!(
+            call["responsebody"],
+            String::from_utf8_lossy(&response_body).as_ref()
+        );
+        assert_eq!(
+            call["responseheaders"]["content-type"],
+            json!(["application/json"])
+        );
+        assert_eq!(
+            call["responseheaders"]["x-example-debug"],
+            json!(["first", "second"])
+        );
+        assert_eq!(call["status"], 200);
+        assert_eq!(call["uri"], "https://aps.example/openrtb");
+    }
+
+    #[test]
+    fn disabled_debug_omits_httpcall_metadata() {
+        let provider = ApsAuctionProvider::new(config());
+        let platform_response = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::OK)
+                .body(EdgeBody::from(
+                    serde_json::to_vec(&json!({"seatbid": []}))
+                        .expect("should serialize APS no-bid response"),
+                ))
+                .expect("should build APS response"),
+        );
+
+        let response = parse_with_context(&provider, platform_response);
+
+        assert!(!response.metadata.contains_key("debug"));
+        assert_eq!(response.metadata["drop_reasons"]["empty_seatbid"], 1);
+    }
+
+    #[test]
+    fn debug_metadata_preserves_malformed_and_error_responses() {
+        let mut provider_config = config();
+        provider_config.debug = true;
+        let provider = ApsAuctionProvider::new(provider_config);
+        let malformed = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::OK)
+                .body(EdgeBody::from(b"{not-json".to_vec()))
+                .expect("should build malformed APS response"),
+        );
+        let unavailable = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::SERVICE_UNAVAILABLE)
+                .header("retry-after", "5")
+                .body(EdgeBody::from(b"temporarily unavailable".to_vec()))
+                .expect("should build unavailable APS response"),
+        );
+        let oversized = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::BAD_GATEWAY)
+                .body(EdgeBody::from(vec![
+                    b'x';
+                    UPSTREAM_RTB_MAX_RESPONSE_BYTES + 1
+                ]))
+                .expect("should build oversized APS response"),
+        );
+
+        let malformed = parse_with_context(&provider, malformed);
+        let unavailable = parse_with_context(&provider, unavailable);
+        let oversized = parse_with_context(&provider, oversized);
+
+        assert_eq!(
+            malformed.metadata["drop_reasons"]["unexpected_response_shape"],
+            1
+        );
+        assert_eq!(
+            malformed.metadata["debug"]["httpcalls"]["aps"][0]["responsebody"],
+            "{not-json"
+        );
+        let unavailable_call = &unavailable.metadata["debug"]["httpcalls"]["aps"][0];
+        assert_eq!(unavailable.status, BidStatus::Error);
+        assert_eq!(unavailable_call["status"], 503);
+        assert_eq!(unavailable_call["responsebody"], "temporarily unavailable");
+        assert_eq!(
+            unavailable_call["responseheaders"]["retry-after"],
+            json!(["5"])
+        );
+        let oversized_call = oversized.metadata["debug"]["httpcalls"]["aps"][0]
+            .as_object()
+            .expect("should include oversized HTTP call metadata");
+        assert_eq!(oversized.status, BidStatus::Error);
+        assert_eq!(oversized_call["status"], 502);
+        assert!(
+            !oversized_call.contains_key("responsebody"),
+            "should omit response body when bounded capture fails"
+        );
+    }
+
+    #[test]
+    fn debug_metadata_includes_no_content_response() {
+        let mut provider_config = config();
+        provider_config.debug = true;
+        let provider = ApsAuctionProvider::new(provider_config);
+        let platform_response = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::NO_CONTENT)
+                .body(EdgeBody::empty())
+                .expect("should build empty APS response"),
+        );
+
+        let response = parse_with_context(&provider, platform_response);
+
+        assert_eq!(response.status, BidStatus::NoBid);
+        let call = &response.metadata["debug"]["httpcalls"]["aps"][0];
+        assert_eq!(call["status"], 204);
+        assert_eq!(call["responsebody"], "");
+    }
+
     #[test]
     fn malformed_json_is_a_safe_shape_error() {
         let provider = ApsAuctionProvider::new(config());
@@ -1458,6 +1778,7 @@ mod tests {
             platform_response,
             12,
             Some(&auction_request),
+            None,
         ))
         .expect("should convert malformed JSON into a safe auction response");
 
@@ -1482,6 +1803,7 @@ mod tests {
             platform_response,
             12,
             Some(&auction_request),
+            None,
         ))
         .expect("should parse 204 as no bid");
         assert_eq!(no_content.status, BidStatus::NoBid);
diff --git a/docs/guide/auction-orchestration.md b/docs/guide/auction-orchestration.md
index 818c17d99..0641e73ca 100644
--- a/docs/guide/auction-orchestration.md
+++ b/docs/guide/auction-orchestration.md
@@ -362,6 +362,7 @@ enabled = true
 account_id = "example-account"
 endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 800
+debug = false
 allow_script_creatives = false
 ```
 
@@ -586,6 +587,7 @@ enabled = true
 account_id = "example-account"
 endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 800
+debug = false
 allow_script_creatives = false
 
 [integrations.adserver_mock]
@@ -620,13 +622,14 @@ price_floor = 0.50
 
 #### `[integrations.aps]`
 
-| Field                    | Type   | Default                                            | Description                                      |
-| ------------------------ | ------ | -------------------------------------------------- | ------------------------------------------------ |
-| `enabled`                | bool   | `false`                                            | Enable APS provider                              |
-| `account_id`             | string | —                                                  | APS account ID (required; `pub_id` is an alias)  |
-| `endpoint`               | string | `https://web.ads.aps.amazon-adsystem.com/e/pb/bid` | APS OpenRTB endpoint                             |
-| `timeout_ms`             | u32    | `800`                                              | Request timeout                                  |
-| `allow_script_creatives` | bool   | `false`                                            | Admit script bids before APS candidate reduction |
+| Field                    | Type   | Default                                            | Description                                                       |
+| ------------------------ | ------ | -------------------------------------------------- | ----------------------------------------------------------------- |
+| `enabled`                | bool   | `false`                                            | Enable APS provider                                               |
+| `account_id`             | string | —                                                  | APS account ID (required; `pub_id` is an alias)                   |
+| `endpoint`               | string | `https://web.ads.aps.amazon-adsystem.com/e/pb/bid` | APS OpenRTB endpoint                                              |
+| `timeout_ms`             | u32    | `800`                                              | Request timeout                                                   |
+| `debug`                  | bool   | `false`                                            | Include the raw APS HTTP exchange in `/auction` provider metadata |
+| `allow_script_creatives` | bool   | `false`                                            | Admit script bids before APS candidate reduction                  |
 
 #### `[integrations.adserver_mock]`
 
@@ -666,6 +669,7 @@ TRUSTED_SERVER__AUCTION__MEDIATOR=adserver_mock
 TRUSTED_SERVER__AUCTION__TIMEOUT_MS=2000
 TRUSTED_SERVER__INTEGRATIONS__PREBID__SERVER_URL=https://pbs.example.com
 TRUSTED_SERVER__INTEGRATIONS__APS__ACCOUNT_ID=example-account
+TRUSTED_SERVER__INTEGRATIONS__APS__DEBUG=false
 ```
 
 ## Floor Prices
diff --git a/docs/guide/configuration.md b/docs/guide/configuration.md
index 9248a1333..b025c67e7 100644
--- a/docs/guide/configuration.md
+++ b/docs/guide/configuration.md
@@ -1223,6 +1223,7 @@ timeout_ms = 2000
 enabled = true
 account_id = "example-account"
 endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
+debug = false
 # Optional pair for deployments hosted away from APS-authorized inventory.
 # inventory_domain = "publisher.example"
 # inventory_page_origin = "https://www.publisher.example"
@@ -1243,6 +1244,7 @@ TRUSTED_SERVER__AUCTION__PROVIDERS__1=prebid
 TRUSTED_SERVER__AUCTION__MEDIATOR=adserver_mock
 TRUSTED_SERVER__AUCTION__TIMEOUT_MS=2000
 TRUSTED_SERVER__AUCTION__CREATIVE_STORE=creative_store
+TRUSTED_SERVER__INTEGRATIONS__APS__DEBUG=false
 ```
 
 ## Fastly Runtime Config Store
diff --git a/docs/guide/integrations/aps.md b/docs/guide/integrations/aps.md
index fecde3323..4a3479870 100644
--- a/docs/guide/integrations/aps.md
+++ b/docs/guide/integrations/aps.md
@@ -31,6 +31,8 @@ enabled = true
 account_id = "example-aps-account-id"
 endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 800
+# Include raw APS request/response data in /auction metadata on test sites only.
+debug = false
 # Set both when the deployment hostname differs from APS-authorized inventory.
 # inventory_domain = "publisher.example"
 # inventory_page_origin = "https://www.publisher.example"
@@ -44,6 +46,8 @@ timeout_ms = 2000
 
 `account_id` is the canonical field. `pub_id` remains a compatibility alias for migration, including integer values, but new configuration should not use it. Supplying both names is an error.
 
+`debug` defaults to `false`. Enable it only on controlled test sites because it includes the raw APS request and response, including identity, consent, device, page, account, bid, and creative data, in the client-visible `/auction` response.
+
 `allow_script_creatives` defaults to `false`. While disabled, APS script bids are rejected before per-impression reduction, floors, mediation, and winner selection. Enable it only for a controlled cohort after the browser-security checks in [Rollout](#rollout) pass.
 
 Set `inventory_domain` and `inventory_page_origin` together only when the public deployment hostname differs from the inventory identity authorized by APS. The domain becomes `site.domain`. The HTTPS page origin replaces the current page's scheme and host while preserving its path and query. The origin must be the inventory domain or one of its subdomains and cannot include credentials, a port, path, query, or fragment. These values come only from operator configuration; Trusted Server never accepts APS inventory identity from the client auction payload.
@@ -72,7 +76,39 @@ Trusted Server builds the APS request independently from its Prebid Server reque
 
 Precise latitude/longitude, disallowed identifiers, unsupported media types, and Trusted Server/Prebid-only extensions are not forwarded. Unsafe or oversized page URLs are omitted or replaced by the validated publisher fallback.
 
-Raw outbound and inbound payloads are logged only at TRACE level. Normal logs and auction metadata contain aggregate counts and drop reasons.
+Raw outbound and inbound payloads are logged only at TRACE level. With debug disabled, auction metadata contains only aggregate counts and drop reasons.
+
+## Debug mode
+
+Set `debug = true` under `[integrations.aps]` to include the direct APS HTTP exchange in the APS provider summary returned by `POST /auction`:
+
+```json
+{
+  "metadata": {
+    "debug": {
+      "httpcalls": {
+        "aps": [
+          {
+            "requestbody": "{...}",
+            "requestheaders": { "content-type": ["application/json"] },
+            "responsebody": "{...}",
+            "responseheaders": { "content-type": ["application/json"] },
+            "status": 200,
+            "uri": "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
+          }
+        ]
+      }
+    }
+  }
+}
+```
+
+This follows the Prebid Server `metadata.debug.httpcalls` representation. APS makes one direct HTTP call per auction, so the map uses the provider key `aps` with one entry. Request and captured response bodies are strings, and header values are arrays so repeated headers are preserved. If a non-success response body cannot be read within the existing 2 MiB upstream limit, `responsebody` is omitted rather than reported as an empty body. APS does not add PBS-only `resolvedrequest` or `bidstatus` fields.
+
+The debug exchange is emitted for successful responses, `204 No Content`, malformed response bodies, and non-success HTTP statuses. Transport failures and auction timeouts happen before an HTTP response reaches the parser and continue to use the orchestrator's normal error metadata.
+
+> [!WARNING]
+> APS debug metadata is unredacted and client-visible. Use it only on controlled test sites, and disable it before production rollout.
 
 ## Bid eligibility and selection
 
@@ -196,6 +232,7 @@ Use fictional values in source-controlled configuration and fixtures. Supply con
 - Ensure `aps` appears in `auction.providers`.
 - Check aggregate APS drop reasons for currency, dimensions, render source, URL, tag type, or script-gate rejection.
 - Confirm the provider timeout fits inside the auction timeout.
+- On a controlled test site, set `debug = true` and inspect `ext.orchestrator.provider_details[].metadata.debug.httpcalls.aps` in the `/auction` response.
 
 ### Winner targets but does not render
 
diff --git a/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md b/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md
index c2da08179..82802970c 100644
--- a/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md
+++ b/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md
@@ -326,7 +326,7 @@ A two-bids/same-slot/same-seat test is mandatory.
 
 ### 8.4 Diagnostics
 
-`AuctionResponse.metadata` may contain only bounded aggregate fields, for example:
+With APS debug mode disabled, `AuctionResponse.metadata` may contain only bounded aggregate fields, for example:
 
 ```json
 {
@@ -353,7 +353,16 @@ Allowed reason keys are fixed enums such as:
 - `unexpected_response_shape`.
 
 Do not include account IDs, bid IDs, URLs, tokens, consent strings, raw extensions, or
-raw bodies in INFO/WARN diagnostics or client-facing provider summaries.
+raw bodies in INFO/WARN diagnostics. Client-facing provider summaries follow the same
+rule by default.
+
+An explicit `[integrations.aps].debug = true` exception is available for controlled test
+sites. It includes the unredacted direct APS request and response under
+`metadata.debug.httpcalls.aps`, using the same request body, request headers, response
+body, response headers, status, and URI fields exposed by Prebid Server debug output.
+If a non-success response body cannot be captured within the existing 2 MiB upstream
+limit, omit `responsebody` rather than misreporting it as empty. The flag defaults to
+`false` and must not change parsing, eligibility, or selection.
 
 ---
 
diff --git a/trusted-server.example.toml b/trusted-server.example.toml
index 9a3a1e890..948d3cf99 100644
--- a/trusted-server.example.toml
+++ b/trusted-server.example.toml
@@ -121,6 +121,8 @@ enabled = false
 account_id = "example-aps-account-id"
 endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 1000
+# Include raw APS request/response data in /auction metadata on test sites only.
+debug = false
 # Set both when the deployment hostname differs from APS-authorized inventory.
 # inventory_domain = "publisher.example"
 # inventory_page_origin = "https://www.publisher.example"

From 8a11546bbbe501976d933a52d3386048c8a4cc13 Mon Sep 17 00:00:00 2001
From: Christian <christianpavilonis@outlook.com>
Date: Tue, 21 Jul 2026 13:30:57 -0500
Subject: [PATCH 6/9] Address APS OpenRTB review findings

---
 CHANGELOG.md                                  |   2 +-
 TESTING.md                                    |  39 +-
 .../trusted-server-core/src/auction/README.md |   4 +-
 .../src/auction/formats.rs                    | 220 +++++--
 .../trusted-server-core/src/auction/types.rs  |   6 +-
 .../src/creative_opportunities.rs             |   6 +
 .../src/integrations/adserver_mock.rs         |   5 +-
 .../src/integrations/aps.rs                   | 245 ++++++-
 .../src/integrations/prebid.rs                | 602 ++++--------------
 crates/trusted-server-core/src/publisher.rs   |  12 +-
 .../browser/tests/shared/aps-renderer.spec.ts | 185 +++++-
 .../configs/trusted-server.integration.toml   |   2 +-
 .../lib/src/integrations/aps/render.ts        |  57 +-
 .../lib/src/integrations/gpt/index.ts         |  34 +-
 .../lib/src/integrations/prebid/index.ts      |  69 +-
 .../lib/test/integrations/aps/render.test.ts  | 160 ++++-
 .../lib/test/integrations/gpt/ad_init.test.ts |  66 +-
 .../test/integrations/prebid/index.test.ts    |  27 +-
 docs/guide/auction-orchestration.md           |  59 +-
 docs/guide/configuration.md                   |   1 -
 docs/guide/integrations/aps.md                |   5 +-
 trusted-server.example.toml                   |   1 -
 22 files changed, 1131 insertions(+), 676 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7b4537704..fd9f0566a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,7 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- **Breaking** — Replaced the legacy APS contextual integration with APS OpenRTB at `/e/pb/bid`. APS configuration now uses canonical `account_id` (`pub_id` remains a compatibility alias), no longer requires APS-specific slot IDs, and defaults script creative eligibility off. Operators must update the endpoint, disable native APS demand for Trusted Server cohorts, and prepare GAM/Universal Creative targeting for `hb_bidder=aps` before rollout.
+- **Breaking** — Replaced the legacy APS contextual integration with APS OpenRTB at `/e/pb/bid`. APS configuration now uses canonical `account_id` (`pub_id` remains a compatibility alias), no longer requires APS-specific slot IDs, and defaults script creative eligibility off. Operators must update the endpoint, disable native APS demand for Trusted Server cohorts, and prepare GAM/Universal Creative targeting for `hb_bidder=aps` before rollout. APS renderer winners now preserve the upstream bid `id`, omit `crid` when APS omits it, and carry `ext.trusted_server.renderer` instead of `adm`; external `/auction` consumers must support this response shape.
 - **Breaking** — `bid_param_zone_overrides` inner values must now be JSON objects; previously non-object or empty values (`"header" = "x"`, `"header" = {}`) were accepted and silently produced a dead rule at runtime. They now fail at startup with a configuration error. Operators upgrading should audit their `bid_param_zone_overrides` config for non-object zone entries.
 - **Breaking** — Sourcepoint browser module inclusion now requires explicit `[integrations.sourcepoint].enabled = true`; operators relying on the previous unconditional Sourcepoint module should enable the integration before upgrading.
 - Added optional APS `inventory_domain` and `inventory_page_origin` overrides for deployments whose edge hostname differs from the APS-authorized inventory identity.
diff --git a/TESTING.md b/TESTING.md
index c4a8c43ea..e5ccba4cf 100644
--- a/TESTING.md
+++ b/TESTING.md
@@ -46,8 +46,8 @@ curl -X POST http://localhost:7676/auction \
 
 **With Orchestrator Enabled** (`auction.enabled = true`):
 - Logs showing: `"Using auction orchestrator"`
-- Parallel execution of APS (mocked) and Prebid (real)
-- GAM mediation (mocked) selecting winning bids
+- Parallel execution of APS OpenRTB and Prebid Server
+- Optional mock-adserver mediation selecting winning bids
 - Final response with winning creatives
 
 **With Orchestrator Disabled** (`auction.enabled = false`):
@@ -66,11 +66,13 @@ providers = ["prebid", "aps"]
 mediator = "adserver_mock"  # If set: mediation, if omitted: highest bid wins
 timeout_ms = 2000
 
-# Mock provider configs
+# APS OpenRTB provider. The built-in production endpoint is used when
+# endpoint is omitted; use only an account authorized for test traffic.
 [integrations.aps]
 enabled = true
-mock = true
-mock_price = 2.50
+account_id = "example-account"
+timeout_ms = 800
+debug = false
 
 [integrations.adserver_mock]
 enabled = true
@@ -90,10 +92,10 @@ mediator = "adserver_mock"  # Mediator configured = parallel mediation strategy
 ```
 
 **Expected Flow:**
-1. Prebid queries real SSPs
-2. APS returns mock bids ($2.50 CPM)
-3. AdServer Mock mediates between all bids
-4. Winning creative returned
+1. Prebid queries its configured bidders through Prebid Server
+2. APS sends an OpenRTB request for eligible banner impressions
+3. AdServer Mock mediates the provider responses
+4. The winning creative or typed APS renderer is returned
 
 ### Scenario 2: Parallel Only (No Mediation)
 **Config:**
@@ -157,18 +159,19 @@ INFO: Registering auction provider: adserver_mock
 
 ## Next Steps
 
-1. **Test with real Prebid Server** - Verify Prebid bids work correctly
-2. **Implement real APS** - Replace mock with actual Amazon TAM API calls
-3. **Implement real GAM** - Add Google Ad Manager API integration
-4. **Add metrics** - Track bid rates, win rates, latency per provider
+1. **Verify Prebid Server demand** - Confirm configured bidders return expected test bids
+2. **Verify APS eligibility** - Confirm the test account, inventory identity, and `/e/pb/bid` endpoint are authorized
+3. **Exercise renderer security** - Run the APS browser integration suite for iframe and script creatives
+4. **Add metrics** - Track bid rates, win rates, latency, and aggregate drop reasons per provider
 
-## Mock Provider Behavior
+## Provider Behavior
 
 ### APS (Amazon)
-- Returns bids for all slots
-- Default mock price: $2.50 CPM
-- Always returns 2 bids
-- Response time: ~80ms (simulated)
+- Sends real OpenRTB requests for eligible banner slots
+- Safely drops malformed, unsupported, or unrenderable bids and reports aggregate reasons
+- Reduces multiple APS candidates to one winner per impression
+- Returns typed renderer descriptors rather than exposing `adm` outside the sandbox
+- Automated tests intercept upstream traffic and use fictional response fixtures
 
 ### AdServer Mock
 - Acts as mediator by calling mocktioneer's mediation endpoint
diff --git a/crates/trusted-server-core/src/auction/README.md b/crates/trusted-server-core/src/auction/README.md
index fad3cb4d5..44ba9ce11 100644
--- a/crates/trusted-server-core/src/auction/README.md
+++ b/crates/trusted-server-core/src/auction/README.md
@@ -117,7 +117,7 @@ When a request arrives at the `/auction` endpoint, it goes through the following
                               ▼
 ┌──────────────────────────────────────────────────────────────────────┐
 │  9. Each Provider Processes Request                                  │
-│     - Transform AuctionRequest → Provider OpenRTB request           │
+│     - Transform AuctionRequest → Provider OpenRTB request            │
 │     - Send HTTP request to provider endpoint                         │
 │     - Parse provider response                                        │
 │     - Transform → AuctionResponse with Bid[]                         │
@@ -201,7 +201,7 @@ For example, APS provider:
 // - banner slots become secure impressions with matching formats/floors
 // - existing consent, identity, device, and geo privacy gates apply
 
-// HTTP POST to https://web.ads.aps.amazon-adsystem.com/e/pb/bid
+// HTTP POST to https://aps.example.com/e/pb/bid
 // Parse decoded-price response → AuctionResponse with a typed renderer
 ```
 
diff --git a/crates/trusted-server-core/src/auction/formats.rs b/crates/trusted-server-core/src/auction/formats.rs
index b1f9f4b35..558385e33 100644
--- a/crates/trusted-server-core/src/auction/formats.rs
+++ b/crates/trusted-server-core/src/auction/formats.rs
@@ -98,20 +98,36 @@ fn publisher_page_url(req: &Request<EdgeBody>, publisher_domain: &str) -> String
         .and_then(|value| value.to_str().ok())
         .filter(|value| value.len() <= MAX_PUBLISHER_PAGE_URL_BYTES)
     else {
+        log::debug!(
+            "Auction page URL: using publisher origin because Referer is absent or invalid"
+        );
         return fallback;
     };
-    let Ok(parsed) = Url::parse(candidate) else {
+    let Ok(mut parsed) = Url::parse(candidate) else {
+        log::debug!("Auction page URL: using publisher origin because Referer is not a URL");
         return fallback;
     };
+    let publisher_domain = publisher_domain.trim_end_matches('.').to_ascii_lowercase();
+    let host_matches = !publisher_domain.is_empty()
+        && parsed.host_str().is_some_and(|host| {
+            let host = host.trim_end_matches('.').to_ascii_lowercase();
+            host == publisher_domain
+                || host
+                    .strip_suffix(&publisher_domain)
+                    .is_some_and(|prefix| prefix.ends_with('.'))
+        });
     if !matches!(parsed.scheme(), "http" | "https")
-        || !parsed
-            .host_str()
-            .is_some_and(|host| host.eq_ignore_ascii_case(publisher_domain))
+        || !host_matches
         || !parsed.username().is_empty()
         || parsed.password().is_some()
     {
+        log::debug!(
+            "Auction page URL: using publisher origin because Referer is not publisher-owned HTTP(S)"
+        );
         return fallback;
     }
+    parsed.set_query(None);
+    parsed.set_fragment(None);
     parsed.to_string()
 }
 
@@ -255,7 +271,7 @@ pub fn convert_tsjs_to_auction_request(
 /// # Errors
 ///
 /// Returns an error if:
-/// - A winning bid is missing a price or render source
+/// - A winning bid is missing a price
 /// - The response serialization fails
 pub fn convert_to_openrtb_response(
     result: &OrchestrationResult,
@@ -285,7 +301,19 @@ pub fn convert_to_openrtb_response(
 
         // Ordinary markup remains on the mandatory sanitize/rewrite path. A
         // typed renderer is serialized separately and never enters the HTML sanitizer.
-        let (adm, ext) = if let Some(ref raw_creative) = bid.creative {
+        let (adm, ext) = if let Some(raw_creative) = bid
+            .creative
+            .as_deref()
+            .filter(|creative| !creative.trim().is_empty())
+        {
+            if bid.renderer.is_some() {
+                log::warn!(
+                    "Auction {}: winning bid for slot '{}' from '{}' has both creative markup and a renderer; using creative markup",
+                    auction_request.id,
+                    slot_id,
+                    bid.bidder
+                );
+            }
             let sanitized = creative::sanitize_creative_html(raw_creative);
             let rewritten = creative::rewrite_creative_html(settings, &sanitized);
 
@@ -300,20 +328,27 @@ pub fn convert_to_openrtb_response(
 
             (Some(rewritten), None)
         } else if let Some(renderer) = bid.renderer.as_ref() {
-            (
-                None,
-                BidExt {
-                    trusted_server: BidTrustedServerExt { renderer },
-                }
-                .to_ext(),
-            )
+            let Some(ext) = (BidExt {
+                trusted_server: BidTrustedServerExt { renderer },
+            })
+            .to_ext() else {
+                log::warn!(
+                    "Auction {}: skipping winning bid for slot '{}' from '{}' because its renderer extension could not be serialized",
+                    auction_request.id,
+                    slot_id,
+                    bid.bidder
+                );
+                continue;
+            };
+            (None, Some(ext))
         } else {
-            return Err(Report::new(TrustedServerError::Auction {
-                message: format!(
-                    "Winning bid for slot '{}' from '{}' has no render source",
-                    slot_id, bid.bidder
-                ),
-            }));
+            log::warn!(
+                "Auction {}: skipping winning bid for slot '{}' from '{}' because it has no render source",
+                auction_request.id,
+                slot_id,
+                bid.bidder
+            );
+            continue;
         };
 
         let openrtb_bid = OpenRtbBid {
@@ -657,30 +692,48 @@ mod tests {
     }
 
     #[test]
-    fn publisher_page_url_accepts_only_same_publisher_http_urls() {
-        let request = Request::builder()
-            .uri("https://publisher.example.com/auction")
-            .header(
-                header::REFERER,
-                "https://publisher.example.com/article?id=1",
-            )
-            .body(EdgeBody::empty())
-            .expect("should build request");
-        assert_eq!(
-            publisher_page_url(&request, "publisher.example.com"),
-            "https://publisher.example.com/article?id=1"
-        );
-        assert_eq!(
-            publisher_page_url(&request, "Publisher.Example.Com"),
-            "https://publisher.example.com/article?id=1",
-            "DNS host comparison should be case-insensitive"
-        );
+    fn publisher_page_url_accepts_publisher_hosts_and_strips_private_components() {
+        for (candidate, expected) in [
+            (
+                "https://publisher.example.com/article?id=1#comments",
+                "https://publisher.example.com/article",
+            ),
+            (
+                "http://news.publisher.example.com/nested/story?token=secret",
+                "http://news.publisher.example.com/nested/story",
+            ),
+            (
+                "https://www.publisher.example.com/",
+                "https://www.publisher.example.com/",
+            ),
+        ] {
+            let request = Request::builder()
+                .uri("https://publisher.example.com/auction")
+                .header(header::REFERER, candidate)
+                .body(EdgeBody::empty())
+                .expect("should build request");
+            assert_eq!(
+                publisher_page_url(&request, "Publisher.Example.Com"),
+                expected,
+                "should sanitize publisher-owned Referer"
+            );
+        }
+    }
 
+    #[test]
+    fn publisher_page_url_rejects_untrusted_or_oversized_referers() {
+        let oversized = format!(
+            "https://publisher.example.com/{}",
+            "x".repeat(MAX_PUBLISHER_PAGE_URL_BYTES)
+        );
         for candidate in [
             "https://other.example/article",
+            "https://publisher.example.com.evil.example/article",
+            "https://evilpublisher.example.com/article",
             "javascript:alert(1)",
             "https://user:password@publisher.example.com/article",
             "not a url",
+            &oversized,
         ] {
             let request = Request::builder()
                 .uri("https://publisher.example.com/auction")
@@ -1064,19 +1117,98 @@ mod tests {
     }
 
     #[test]
-    fn convert_to_openrtb_response_rejects_winner_without_render_source() {
+    fn convert_to_openrtb_response_skips_invalid_winners_without_dropping_valid_slots() {
         let settings = make_settings();
         let auction_request = make_auction_request();
-        let mut bid = make_bid("div-gpt-top", "appnexus", Some(2.75));
-        bid.creative = None;
+        let mut missing = make_bid("missing", "invalid", Some(3.0));
+        missing.creative = None;
+        let mut whitespace = make_bid("whitespace", "invalid", Some(2.9));
+        whitespace.creative = Some(" \n\t ".to_string());
+        let ordinary = make_bid("ordinary", "appnexus", Some(2.75));
+        let mut renderer = make_bid("renderer", "aps", Some(2.5));
+        renderer.creative = Some("  ".to_string());
+        renderer.bid_id = Some("upstream-renderer-bid".to_string());
+        renderer.creative_id = None;
+        renderer.renderer = Some(BidRenderer::Aps(ApsRendererV1 {
+            version: 1,
+            account_id: "example-account".to_string(),
+            bid_id: "upstream-renderer-bid".to_string(),
+            creative_id: None,
+            tag_type: ApsTagType::Iframe,
+            creative_url: "https://creative.example/render".to_string(),
+            aax_response: "fictional-base64".to_string(),
+            width: 300,
+            height: 250,
+        }));
+        let result = OrchestrationResult {
+            provider_responses: vec![],
+            mediator_response: None,
+            winning_bids: HashMap::from([
+                (missing.slot_id.clone(), missing),
+                (whitespace.slot_id.clone(), whitespace),
+                (ordinary.slot_id.clone(), ordinary),
+                (renderer.slot_id.clone(), renderer),
+            ]),
+            total_time_ms: 50,
+            metadata: HashMap::new(),
+        };
+
+        let response = convert_to_openrtb_response(&result, &settings, &auction_request, false)
+            .expect("should omit invalid winners and preserve valid slots");
+        let json = response_json(response);
+        let bids: Vec<&JsonValue> = json["seatbid"]
+            .as_array()
+            .expect("should include valid seatbids")
+            .iter()
+            .map(|seatbid| &seatbid["bid"][0])
+            .collect();
+
+        assert_eq!(bids.len(), 2, "should omit only invalid winners");
+        let ordinary = bids
+            .iter()
+            .find(|bid| bid["impid"] == "ordinary")
+            .expect("should preserve ordinary winner");
+        assert_eq!(ordinary["adm"], "<div>Ad</div>");
+        let renderer = bids
+            .iter()
+            .find(|bid| bid["impid"] == "renderer")
+            .expect("should preserve renderer winner");
+        assert!(renderer.get("adm").is_none(), "should omit renderer adm");
+        assert!(
+            renderer.get("crid").is_none(),
+            "should omit absent upstream crid"
+        );
+        assert_eq!(renderer["id"], "upstream-renderer-bid");
+        assert!(renderer.get("ext").is_some(), "should include renderer ext");
+    }
+
+    #[test]
+    fn convert_to_openrtb_response_prefers_creative_when_both_render_sources_exist() {
+        let settings = make_settings();
+        let auction_request = make_auction_request();
+        let mut bid = make_bid("div-gpt-top", "aps", Some(2.75));
+        bid.renderer = Some(BidRenderer::Aps(ApsRendererV1 {
+            version: 1,
+            account_id: "example-account".to_string(),
+            bid_id: "fictional-bid".to_string(),
+            creative_id: None,
+            tag_type: ApsTagType::Iframe,
+            creative_url: "https://creative.example/render".to_string(),
+            aax_response: "fictional-base64".to_string(),
+            width: 300,
+            height: 250,
+        }));
         let result = make_result(bid);
 
-        let error = convert_to_openrtb_response(&result, &settings, &auction_request, false)
-            .expect_err("should reject bid without a render source");
+        let response = convert_to_openrtb_response(&result, &settings, &auction_request, false)
+            .expect("should prefer ordinary creative markup");
+        let json = response_json(response);
+        let bid = &json["seatbid"][0]["bid"][0];
 
+        assert_eq!(bid["adm"], "<div>Ad</div>");
         assert!(
-            format!("{error:?}").contains("has no render source"),
-            "should explain the missing render source"
+            bid.get("ext").is_none(),
+            "should omit renderer extension when creative markup wins precedence"
         );
     }
 
diff --git a/crates/trusted-server-core/src/auction/types.rs b/crates/trusted-server-core/src/auction/types.rs
index a6ad61f3a..f67faa303 100644
--- a/crates/trusted-server-core/src/auction/types.rs
+++ b/crates/trusted-server-core/src/auction/types.rs
@@ -215,11 +215,11 @@ pub enum BidRenderer {
 }
 
 impl BidRenderer {
-    /// Return the APS renderer descriptor.
+    /// Return the APS renderer descriptor when this is an APS renderer.
     #[must_use]
-    pub fn aps(&self) -> &ApsRendererV1 {
+    pub fn as_aps(&self) -> Option<&ApsRendererV1> {
         match self {
-            Self::Aps(renderer) => renderer,
+            Self::Aps(renderer) => Some(renderer),
         }
     }
 }
diff --git a/crates/trusted-server-core/src/creative_opportunities.rs b/crates/trusted-server-core/src/creative_opportunities.rs
index d56fa6a45..fb4f5b89f 100644
--- a/crates/trusted-server-core/src/creative_opportunities.rs
+++ b/crates/trusted-server-core/src/creative_opportunities.rs
@@ -62,6 +62,12 @@ impl CreativeOpportunitiesConfig {
     pub fn validate_runtime(&self) -> Result<(), String> {
         for slot in &self.slot {
             slot.validate_runtime(&self.gam_network_id)?;
+            if slot.providers.aps.is_some() {
+                log::warn!(
+                    "creative opportunity slot '{}': providers.aps is retained only for configuration compatibility and is ignored by APS OpenRTB",
+                    slot.id
+                );
+            }
         }
 
         Ok(())
diff --git a/crates/trusted-server-core/src/integrations/adserver_mock.rs b/crates/trusted-server-core/src/integrations/adserver_mock.rs
index 009ddd6ba..a96016c6d 100644
--- a/crates/trusted-server-core/src/integrations/adserver_mock.rs
+++ b/crates/trusted-server-core/src/integrations/adserver_mock.rs
@@ -119,7 +119,7 @@ fn build_bid_index(bidder_responses: &[AuctionResponse]) -> BidIndex {
             // be mis-attributed during mediation. Low severity for the mock
             // mediator, but log it so the collision is visible.
             if index.insert(key, bid.clone()).is_some() {
-                log::debug!(
+                log::warn!(
                     "adserver_mock: duplicate bid for (provider '{}', slot '{}', bidder '{}'); keeping the last — win/billing URL restoration may be mis-attributed",
                     response.provider,
                     bid.slot_id,
@@ -961,7 +961,8 @@ mod tests {
                 .renderer
                 .as_ref()
                 .expect("should restore APS renderer")
-                .aps()
+                .as_aps()
+                .expect("should be APS renderer")
                 .bid_id,
             "selected"
         );
diff --git a/crates/trusted-server-core/src/integrations/aps.rs b/crates/trusted-server-core/src/integrations/aps.rs
index 4e2facef4..460160537 100644
--- a/crates/trusted-server-core/src/integrations/aps.rs
+++ b/crates/trusted-server-core/src/integrations/aps.rs
@@ -41,7 +41,9 @@ const DEFAULT_CURRENCY: &str = "USD";
 const APS_SDK_SOURCE: &str = "prebid";
 const APS_SDK_VERSION: &str = "2.2.0";
 const MAX_ACCOUNT_ID_BYTES: usize = 1024;
+const MAX_CREATIVE_ID_BYTES: usize = 1024;
 const MAX_CREATIVE_URL_BYTES: usize = 4096;
+const MAX_LANGUAGE_BYTES: usize = 8;
 const MAX_PAGE_URL_BYTES: usize = 8192;
 const MAX_RENDER_ENVELOPE_BYTES: usize = 256 * 1024;
 const APS_RENDERER_CSP: &str = "default-src 'none'; sandbox allow-forms allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-scripts allow-top-navigation-by-user-activation; script-src 'unsafe-inline' https:; connect-src https:; frame-src https:; img-src https: data:; media-src https: blob:; style-src 'unsafe-inline' https:; font-src https: data:;";
@@ -65,7 +67,7 @@ function validRenderer(renderer){
     !keys(renderer,['aaxResponse','accountId','bidId','creativeUrl','height','tagType','type','version','width']))return false;
  if(renderer.type!=='aps'||renderer.version!==1||typeof renderer.accountId!=='string'||!renderer.accountId||new TextEncoder().encode(renderer.accountId).length>1024)return false;
  if(typeof renderer.bidId!=='string'||!renderer.bidId||!Number.isInteger(renderer.width)||renderer.width<=0||!Number.isInteger(renderer.height)||renderer.height<=0)return false;
- if(Object.prototype.hasOwnProperty.call(renderer,'creativeId')&&(typeof renderer.creativeId!=='string'||!renderer.creativeId))return false;
+ if(Object.prototype.hasOwnProperty.call(renderer,'creativeId')&&(typeof renderer.creativeId!=='string'||!renderer.creativeId||new TextEncoder().encode(renderer.creativeId).length>1024))return false;
  if(renderer.tagType!=='iframe'&&renderer.tagType!=='script')return false;
  if(typeof renderer.creativeUrl!=='string'||new TextEncoder().encode(renderer.creativeUrl).length>4096)return false;
  if(typeof renderer.aaxResponse!=='string'||!renderer.aaxResponse||renderer.aaxResponse.length>349528)return false;
@@ -206,6 +208,12 @@ fn validate_aps_endpoint(value: &str) -> Result<(), ValidationError> {
     {
         return Err(ValidationError::new("invalid_aps_endpoint"));
     }
+    if parsed.path().trim_end_matches('/').ends_with("/e/dtb/bid") {
+        let mut error = ValidationError::new("legacy_aps_endpoint");
+        error.message =
+            Some("legacy APS endpoint /e/dtb/bid is unsupported; migrate to /e/pb/bid".into());
+        return Err(error);
+    }
     Ok(())
 }
 
@@ -387,7 +395,7 @@ impl ApsAuctionProvider {
             .and_then(|value| value.split(';').next())
             .and_then(|value| value.split('-').next())
             .map(str::trim)
-            .filter(|value| !value.is_empty())
+            .filter(|value| !value.is_empty() && value.len() <= MAX_LANGUAGE_BYTES)
             .map(str::to_string)
     }
 
@@ -527,13 +535,10 @@ impl ApsAuctionProvider {
             .as_deref()
             .and_then(Self::valid_http_url)
             .unwrap_or_else(|| format!("https://{}", request.publisher.domain));
-        let referer = context
-            .request
-            .headers()
-            .get(header::REFERER)
-            .and_then(|value| value.to_str().ok())
-            .and_then(Self::valid_http_url)
-            .filter(|value| value != &page);
+        // For the same-origin `/auction` request, the browser Referer is the
+        // current publisher page already carried in sanitized form as
+        // `site.page`; forwarding the raw header as `site.ref` would reintroduce
+        // query-string identifiers and can leak the deployment host.
         let (site_domain, page) = self.inventory_site_identity(&request.publisher.domain, page);
 
         OpenRtbRequest {
@@ -542,9 +547,9 @@ impl ApsAuctionProvider {
             site: Some(Site {
                 domain: Some(site_domain.clone()),
                 page: Some(page),
-                r#ref: referer,
+                r#ref: None,
                 publisher: Some(Publisher {
-                    domain: Some(request.publisher.domain.clone()),
+                    domain: Some(site_domain),
                     ..Default::default()
                 }),
                 ..Default::default()
@@ -765,6 +770,12 @@ impl ApsAuctionProvider {
             .and_then(Json::as_str)
             .filter(|creative_id| !creative_id.is_empty())
             .map(str::to_string);
+        if creative_id
+            .as_ref()
+            .is_some_and(|creative_id| creative_id.len() > MAX_CREATIVE_ID_BYTES)
+        {
+            return Err("creative_id_too_large");
+        }
         let renderer = self
             .build_renderer(ApsRendererInput {
                 bid_id,
@@ -849,6 +860,8 @@ impl ApsAuctionProvider {
 
         for seatbid in seatbids.into_iter().flatten() {
             let Some(bids) = seatbid.get("bid").and_then(Json::as_array) else {
+                dropped += 1;
+                Self::increment_reason(&mut reasons, "empty_seatbid_bids");
                 continue;
             };
             for value in bids {
@@ -868,9 +881,11 @@ impl ApsAuctionProvider {
                                 .is_some()
                             {
                                 dropped += 1;
+                                Self::increment_reason(&mut reasons, "lost_to_higher_bid");
                             }
                         } else {
                             dropped += 1;
+                            Self::increment_reason(&mut reasons, "lost_to_higher_bid");
                         }
                     }
                     Err(reason) => {
@@ -979,7 +994,11 @@ impl ApsAuctionProvider {
             }
         };
         let Some(request) = request else {
-            return Ok(AuctionResponse::error(APS_INTEGRATION_ID, response_time_ms));
+            log::error!(
+                "APS cannot parse a successful bid response without the original auction request context"
+            );
+            return Ok(AuctionResponse::error(APS_INTEGRATION_ID, response_time_ms)
+                .with_metadata("drop_reasons", json!({"missing_request_context": 1})));
         };
         let parsed = self.parse_aps_response(&value, response_time_ms, request);
         log::info!(
@@ -1173,6 +1192,11 @@ pub fn register_providers(
         return Ok(Vec::new());
     };
     log::info!("Registering APS OpenRTB provider");
+    if config.debug {
+        log::warn!(
+            "APS debug mode is ON — raw request and response data, including creative markup, will be included in client-visible /auction responses"
+        );
+    }
     Ok(vec![Arc::new(ApsAuctionProvider::new(config))])
 }
 
@@ -1299,6 +1323,48 @@ mod tests {
         assert!(canonical.endpoint.ends_with("/e/pb/bid"));
     }
 
+    #[test]
+    fn config_accepts_default_and_custom_openrtb_endpoints() {
+        let default = ApsConfig {
+            account_id: "example-account".to_string(),
+            ..Default::default()
+        };
+        let custom: ApsConfig = serde_json::from_value(json!({
+            "account_id": "example-account",
+            "endpoint": "https://aps.example.com/custom/openrtb"
+        }))
+        .expect("should deserialize custom endpoint");
+
+        default
+            .validate()
+            .expect("should accept production default endpoint");
+        custom
+            .validate()
+            .expect("should accept fictional custom HTTPS endpoint");
+    }
+
+    #[test]
+    fn config_rejects_legacy_aps_endpoint_with_migration_error() {
+        for endpoint in [
+            "https://aps.example.com/e/dtb/bid",
+            "https://aps.example.com/e/dtb/bid/",
+            "https://aps.example.com/custom/e/dtb/bid",
+        ] {
+            let parsed: ApsConfig = serde_json::from_value(json!({
+                "account_id": "example-account",
+                "endpoint": endpoint
+            }))
+            .expect("should deserialize legacy endpoint before validation");
+            let error = parsed
+                .validate()
+                .expect_err("should reject legacy endpoint");
+            assert!(
+                error.to_string().contains("migrate to /e/pb/bid"),
+                "should provide endpoint migration guidance: {error}"
+            );
+        }
+    }
+
     #[test]
     fn config_rejects_blank_duplicate_and_unsafe_endpoint() {
         assert!(serde_json::from_value::<ApsConfig>(json!({"account_id": "   "})).is_err());
@@ -1391,6 +1457,10 @@ mod tests {
         let services = noop_services();
         let downstream = http::Request::builder()
             .uri("https://deployment.example/auction")
+            .header(
+                header::REFERER,
+                "https://deployment.example/private?token=fictional#section",
+            )
             .body(EdgeBody::empty())
             .expect("should build downstream request");
         let context = AuctionContext {
@@ -1412,7 +1482,14 @@ mod tests {
         );
         assert_eq!(
             serialized["site"]["publisher"]["domain"],
-            "deployment.example"
+            "publisher.example"
+        );
+        assert!(serialized["site"].get("ref").is_none());
+        assert!(
+            !serialized["site"]
+                .to_string()
+                .contains("deployment.example"),
+            "should not leak the deployment host in any Site field"
         );
     }
 
@@ -1514,9 +1591,9 @@ mod tests {
             serialized["site"]["page"],
             "https://publisher.example/article"
         );
-        assert_eq!(
-            serialized["site"]["ref"],
-            "https://referrer.example/article"
+        assert!(
+            serialized["site"].get("ref").is_none(),
+            "should not forward the raw browser Referer"
         );
         assert_eq!(
             serialized["site"]["publisher"]["domain"],
@@ -1546,6 +1623,36 @@ mod tests {
         assert!(serialized["imp"][0].get("ext").is_none());
     }
 
+    #[test]
+    fn request_language_enforces_byte_limit() {
+        let settings = create_test_settings();
+        let services = noop_services();
+
+        for (header_value, expected) in [
+            ("abcdefgh-US,xy;q=0.9", Some("abcdefgh")),
+            ("abcdefghi", None),
+        ] {
+            let downstream = http::Request::builder()
+                .uri("https://publisher.example/auction")
+                .header(header::ACCEPT_LANGUAGE, header_value)
+                .body(EdgeBody::empty())
+                .expect("should build downstream request");
+            let context = AuctionContext {
+                settings: &settings,
+                request: &downstream,
+                timeout_ms: 321,
+                provider_responses: None,
+                services: &services,
+            };
+
+            assert_eq!(
+                ApsAuctionProvider::request_language(&context).as_deref(),
+                expected,
+                "should enforce primary language byte limit for {header_value}"
+            );
+        }
+    }
+
     #[test]
     fn parses_bid_and_builds_exact_minimized_envelope() {
         let provider = ApsAuctionProvider::new(config());
@@ -1564,7 +1671,8 @@ mod tests {
             .renderer
             .as_ref()
             .expect("should include renderer")
-            .aps();
+            .as_aps()
+            .expect("should be APS renderer");
         let decoded = BASE64_STANDARD
             .decode(&renderer.aax_response)
             .expect("should decode renderer response");
@@ -1577,6 +1685,33 @@ mod tests {
         assert_eq!(decoded, fixture);
     }
 
+    #[test]
+    fn creative_id_enforces_utf8_byte_boundary() {
+        let provider = ApsAuctionProvider::new(config());
+        let mut at_limit = bid("creative-id-limit", 1.23, "iframe");
+        at_limit["crid"] = json!("é".repeat(MAX_CREATIVE_ID_BYTES / 2));
+        let accepted =
+            provider.parse_aps_response(&json!({"seatbid": [{"bid": [at_limit]}]}), 12, &request());
+        assert_eq!(
+            accepted.bids.len(),
+            1,
+            "should accept creative ID at byte limit"
+        );
+
+        let mut over_limit = bid("creative-id-over-limit", 1.23, "iframe");
+        over_limit["crid"] = json!(format!("{}x", "é".repeat(MAX_CREATIVE_ID_BYTES / 2)));
+        let rejected = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": [over_limit]}]}),
+            12,
+            &request(),
+        );
+        assert!(rejected.bids.is_empty());
+        assert_eq!(
+            rejected.metadata["drop_reasons"]["creative_id_too_large"],
+            1
+        );
+    }
+
     #[test]
     fn empty_creative_id_is_omitted_from_renderer() {
         let provider = ApsAuctionProvider::new(config());
@@ -1590,7 +1725,8 @@ mod tests {
             bid.renderer
                 .as_ref()
                 .expect("should retain renderer")
-                .aps()
+                .as_aps()
+                .expect("should be APS renderer")
                 .creative_id
                 .is_none()
         );
@@ -1789,6 +1925,32 @@ mod tests {
         );
     }
 
+    #[test]
+    fn context_free_parse_response_reports_missing_request_context() {
+        let provider = ApsAuctionProvider::new(config());
+        let platform_response = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::OK)
+                .body(EdgeBody::from(
+                    serde_json::to_vec(
+                        &json!({"seatbid": [{"bid": [bid("valid", 1.0, "iframe")]}]}),
+                    )
+                    .expect("should serialize APS response"),
+                ))
+                .expect("should build APS response"),
+        );
+
+        let response = futures::executor::block_on(provider.parse_response(platform_response, 12))
+            .expect("should return an explicit context error response");
+
+        assert_eq!(response.status, BidStatus::Error);
+        assert!(response.bids.is_empty());
+        assert_eq!(
+            response.metadata["drop_reasons"]["missing_request_context"],
+            1
+        );
+    }
+
     #[test]
     fn no_content_and_empty_responses_are_no_bids() {
         let provider = ApsAuctionProvider::new(config());
@@ -1815,6 +1977,18 @@ mod tests {
         }
     }
 
+    #[test]
+    fn missing_seatbid_bid_array_is_counted_as_a_drop() {
+        let provider = ApsAuctionProvider::new(config());
+        let response =
+            provider.parse_aps_response(&json!({"seatbid": [{"seat": "aps"}]}), 12, &request());
+
+        assert_eq!(response.status, BidStatus::NoBid);
+        assert_eq!(response.metadata["seatbid_count"], 1);
+        assert_eq!(response.metadata["dropped_bid_count"], 1);
+        assert_eq!(response.metadata["drop_reasons"]["empty_seatbid_bids"], 1);
+    }
+
     #[test]
     fn unsupported_currency_is_a_no_bid() {
         let provider = ApsAuctionProvider::new(config());
@@ -1857,7 +2031,8 @@ mod tests {
             .renderer
             .as_ref()
             .expect("should keep script renderer")
-            .aps();
+            .as_aps()
+            .expect("should be APS renderer");
         assert_eq!(renderer.tag_type, ApsTagType::Script);
     }
 
@@ -1878,15 +2053,23 @@ mod tests {
     }
 
     #[test]
-    fn reduces_candidates_by_price_then_bid_id() {
+    fn reduces_candidates_by_price_then_bid_id_and_reconciles_drops() {
         let provider = ApsAuctionProvider::new(config());
         let response = provider.parse_aps_response(
-            &json!({"seatbid": [{"bid": [bid("bid-z", 2.0, "iframe"), bid("bid-a", 2.0, "iframe")]}]}),
+            &json!({"seatbid": [{"bid": [
+                bid("low-incumbent", 1.0, "iframe"),
+                bid("bid-z", 2.0, "iframe"),
+                bid("bid-a", 2.0, "iframe"),
+                bid("lower-candidate", 1.5, "iframe")
+            ]}]}),
             12,
             &request(),
         );
         assert_eq!(response.bids.len(), 1);
         assert_eq!(response.bids[0].bid_id.as_deref(), Some("bid-a"));
+        assert_eq!(response.metadata["accepted_bid_count"], 1);
+        assert_eq!(response.metadata["dropped_bid_count"], 3);
+        assert_eq!(response.metadata["drop_reasons"]["lost_to_higher_bid"], 3);
     }
 
     #[test]
@@ -2003,6 +2186,26 @@ mod tests {
         assert!(registration.js_disabled);
     }
 
+    #[test]
+    fn enabled_invalid_config_fails_provider_registration() {
+        let mut settings = create_test_settings();
+        settings
+            .integrations
+            .insert_config(
+                APS_INTEGRATION_ID,
+                &json!({
+                    "enabled": true,
+                    "account_id": "example-account",
+                    "endpoint": "http://insecure.example/openrtb"
+                }),
+            )
+            .expect("should insert invalid APS config for startup validation");
+
+        let _error = register_providers(&settings)
+            .err()
+            .expect("should reject invalid enabled APS configuration");
+    }
+
     #[test]
     fn renderer_document_is_static_and_nonce_bound() {
         assert!(APS_RENDERER_DOCUMENT.contains("^#tsaps="));
diff --git a/crates/trusted-server-core/src/integrations/prebid.rs b/crates/trusted-server-core/src/integrations/prebid.rs
index f2e6e62e4..dd0ec26ba 100644
--- a/crates/trusted-server-core/src/integrations/prebid.rs
+++ b/crates/trusted-server-core/src/integrations/prebid.rs
@@ -1,4 +1,4 @@
-use std::collections::{HashMap, HashSet};
+use std::collections::HashMap;
 use std::sync::Arc;
 use std::time::Duration;
 
@@ -201,6 +201,7 @@ fn extract_prebid_error_message(
 const GPC_US_PRIVACY: &str = "1YYN";
 
 #[derive(Debug, Clone, Deserialize, Serialize, Validate)]
+#[validate(schema(function = "validate_prebid_bidder_lists"))]
 pub struct PrebidIntegrationConfig {
     #[serde(default = "default_enabled")]
     pub enabled: bool,
@@ -342,6 +343,29 @@ pub struct PrebidIntegrationConfig {
     pub suppress_nurl_bidders: Vec<String>,
 }
 
+fn validate_prebid_bidder_lists(config: &PrebidIntegrationConfig) -> Result<(), ValidationError> {
+    for (field, bidders) in [
+        ("bidders", &config.bidders),
+        ("client_side_bidders", &config.client_side_bidders),
+    ] {
+        if bidders
+            .iter()
+            .any(|bidder| bidder.eq_ignore_ascii_case("aps"))
+        {
+            let mut error = ValidationError::new("aps_managed_by_dedicated_integration");
+            error.message = Some(
+                format!(
+                    "integrations.prebid.{field} must not include APS; configure APS under [integrations.aps]"
+                )
+                .into(),
+            );
+            return Err(error);
+        }
+    }
+
+    Ok(())
+}
+
 impl IntegrationConfig for PrebidIntegrationConfig {
     fn is_enabled(&self) -> bool {
         self.enabled
@@ -1041,18 +1065,6 @@ impl IntegrationHeadInjector for PrebidIntegration {
     }
 }
 
-/// Returns `true` when `params` is not a usable PBS bidder-params object — an
-/// empty object `{}` or any non-object value such as `null`.
-///
-/// PBS rejects an imp whose `bidder.<name>` carries such a value, and it cannot
-/// tell a fabricated empty from an explicitly supplied one — they are identical
-/// bytes on the wire. The merge uses this to stop an unusable value from
-/// clobbering real params, and the final pass uses it to drop whatever remains.
-fn is_unusable_bidder_params(params: &Json) -> bool {
-    // `None` covers non-object values (e.g. `null`); an empty map covers `{}`.
-    params.as_object().is_none_or(serde_json::Map::is_empty)
-}
-
 fn expand_trusted_server_bidders(
     configured_bidders: &[String],
     params: &Json,
@@ -1395,14 +1407,18 @@ fn copy_request_headers(
     to: &mut http::Request<EdgeBody>,
     consent_forwarding: ConsentForwardingMode,
     client_ip: Option<std::net::IpAddr>,
+    sanitized_referer: Option<&str>,
 ) {
-    let headers_to_copy = [header::USER_AGENT, header::REFERER, header::ACCEPT_LANGUAGE];
+    let headers_to_copy = [header::USER_AGENT, header::ACCEPT_LANGUAGE];
 
     for header_name in &headers_to_copy {
         if let Some(value) = from.headers().get(header_name) {
             to.headers_mut().insert(header_name, value.clone());
         }
     }
+    if let Some(value) = sanitized_referer.and_then(|value| HeaderValue::from_str(value).ok()) {
+        to.headers_mut().insert(header::REFERER, value);
+    }
 
     if let Some(ip) = client_ip
         && let Ok(value) = HeaderValue::from_str(&ip.to_string())
@@ -1543,42 +1559,31 @@ impl PrebidAuctionProvider {
                     .and_then(|p| p.get(ZONE_KEY))
                     .and_then(Json::as_str);
 
-                // Build the bidder map for PBS from two sources:
-                //   1. the `trustedServer` orchestrator entry, expanded into the
-                //      configured PBS bidders (`expand_trusted_server_bidders`);
-                //   2. direct entries naming a configured PBS bidder.
-                // The JS adapter sends "trustedServer" as the bidder (our
-                // orchestrator adapter name); provider-specific keys like "aps"
-                // run their own auction and are skipped here.
-                //
-                // The two sources are collected separately so the merge below is
-                // deterministic regardless of `slot.bidders` HashMap iteration
-                // order: direct entries win, but an unusable direct value (`{}` or
-                // a non-object) must not clobber real params from the expansion.
-                let mut expanded: HashMap<String, Json> = HashMap::new();
-                let mut direct: Vec<(String, Json)> = Vec::new();
+                // Build the bidder map for PBS.
+                // The JS adapter sends "trustedServer" as the bidder (our orchestrator
+                // adapter name). Replace it with the real PBS bidders from config.
+                // Only pass through keys that are known PBS bidders — skip provider-specific
+                // keys like "aps" which belong to their own separate auction provider.
+                let mut bidder: HashMap<String, Json> = HashMap::new();
+                let mut excluded_aps = false;
                 for (name, params) in &slot.bidders {
-                    if name == "aps" {
+                    if name.eq_ignore_ascii_case("aps") {
                         // Trusted Server APS is a separate OpenRTB provider. Never
                         // send native APS demand through PBS for the same cohort.
+                        excluded_aps = true;
                         continue;
                     }
                     if name == TRUSTED_SERVER_BIDDER {
-<<<<<<< HEAD
-                        expanded.extend(expand_trusted_server_bidders(&self.config.bidders, params));
-                    } else if self.config.bidders.iter().any(|b| b == name) {
-                        direct.push((name.clone(), params.clone()));
-                    } else if name != "aps" {
-                        // `aps` is intentionally handled by its own provider. Any
-                        // other unrecognized key is likely a misconfiguration (a
-=======
                         bidder.extend(expand_trusted_server_bidders(&self.config.bidders, params));
-                        bidder.remove("aps");
+                        bidder.retain(|name, _| {
+                            let keep = !name.eq_ignore_ascii_case("aps");
+                            excluded_aps |= !keep;
+                            keep
+                        });
                     } else if self.config.bidders.iter().any(|b| b == name) {
                         bidder.insert(name.clone(), params.clone());
                     } else {
                         // Any other unrecognized key is likely a misconfiguration (a
->>>>>>> 161dafa4 (Add first-class APS OpenRTB integration)
                         // slot bidder absent from `config.bidders`) that silently
                         // yields an empty bidder map and a stored-request no-bid —
                         // log it so the drop is diagnosable.
@@ -1590,104 +1595,27 @@ impl PrebidAuctionProvider {
                     }
                 }
 
-                let mut bidder = expanded;
-                // Bidders whose params came from the slot itself rather than from
-                // `trustedServer` expansion. Only these can represent a publisher
-                // misconfiguration if they are dropped below; a dropped fabricated
-                // entry is the designed stored-request path.
-                let mut slot_supplied: HashSet<String> = HashSet::new();
-                for (name, params) in direct {
-                    // Direct entries win over the expansion — except when an
-                    // unusable direct value (`{}` or a non-object) would overwrite
-                    // real params the expansion already supplied. PBS cannot tell a
-                    // fabricated empty from an explicit one, so real params must not
-                    // be discarded in favour of either.
-                    let clobbers_real = is_unusable_bidder_params(&params)
-                        && bidder
-                            .get(&name)
-                            .is_some_and(|existing| !is_unusable_bidder_params(existing));
-                    if !clobbers_real {
-                        slot_supplied.insert(name.clone());
-                        bidder.insert(name, params);
-                    }
+                if excluded_aps && bidder.is_empty() {
+                    log::warn!(
+                        "prebid: dropping imp '{}' because it contains only APS demand; refusing PBS stored-request fallback",
+                        slot.id
+                    );
+                    return None;
                 }
 
-                // Apply canonical and compatibility-derived rules in normalized
-                // order. An override rule can populate a bidder that arrived with
-                // empty params, promoting a fabricated empty into a valid bidder.
+                // When no inline PBS bidder params exist (e.g. creative-opportunity slots
+                // whose PBS params live in stored requests), tell PBS to resolve bidder
+                // config from the stored request keyed by this slot ID.
+                let storedrequest = bidder.is_empty().then(|| ImpStoredRequest {
+                    id: slot.id.clone(),
+                });
+
+                // Apply canonical and compatibility-derived rules in normalized order.
                 for (name, params) in &mut bidder {
                     self.bid_param_override_engine
                         .apply(BidParamOverrideFacts { bidder: name, zone }, params);
                 }
 
-                // Drop any bidder whose params are still unusable after overrides —
-                // an empty `{}` or a non-object like `null`. Both are byte-identical
-                // to PBS regardless of whether they were fabricated or supplied
-                // explicitly, and shipping either gets the imp rejected; a single
-                // non-2xx then collapses into an auction-wide bid wipeout (see
-                // `parse_response`), so one misconfigured slot must never reach the
-                // wire.
-                //
-                // The two drop sources get different levels, one line per slot. A
-                // slot that supplied unusable params inline is a publisher mistake
-                // an operator can act on, so it warns — the PBS 400 body is
-                // otherwise discarded unless trace logging is enabled. Fabricated
-                // empties that no override rule filled are the designed
-                // creative-opportunity path (see `CreativeOpportunitySlot::to_ad_slot`),
-                // so they log at debug and do not bury the warn.
-                let mut dropped_slot_supplied: Vec<String> = Vec::new();
-                let mut dropped_fabricated: Vec<String> = Vec::new();
-                bidder.retain(|name, params| {
-                    if is_unusable_bidder_params(params) {
-                        if slot_supplied.contains(name) {
-                            dropped_slot_supplied.push(name.clone());
-                        } else {
-                            dropped_fabricated.push(name.clone());
-                        }
-                        return false;
-                    }
-                    true
-                });
-                if !dropped_slot_supplied.is_empty() {
-                    // Sorted so the line is stable across `HashMap` iteration order.
-                    dropped_slot_supplied.sort();
-                    log::warn!(
-                        "prebid: dropping slot '{}' bidders [{}] — slot supplied empty or non-object params; slot falls back to its stored request",
-                        slot.id,
-                        dropped_slot_supplied.join(", ")
-                    );
-                }
-                if !dropped_fabricated.is_empty() {
-                    dropped_fabricated.sort();
-                    log::debug!(
-                        "prebid: dropping slot '{}' bidders [{}] — expansion fabricated empty params and no override rule filled them; slot falls back to its stored request",
-                        slot.id,
-                        dropped_fabricated.join(", ")
-                    );
-                }
-
-                // When no eligible PBS bidder params remain, tell PBS to resolve
-                // bidder config from the stored request keyed by this slot ID. This
-                // covers creative-opportunity slots whose PBS params live in stored
-                // requests, and slots whose configured bidders all resolved to
-                // unusable params and were dropped above.
-                //
-                // Note the fallback set is wider than "slots with no inline params":
-                // a slot carrying real inline params for a bidder absent from
-                // `config.bidders` also lands here — that bidder is never expanded,
-                // the configured bidders fabricate empties, the drop clears them, and
-                // the real params are lost. That param loss is pre-existing (see the
-                // debug log in the build loop); it is called out here because it
-                // means an operator with `config.bidders` set but no stored request
-                // provisioned for such a slot gets a no-bid.
-                let storedrequest = if bidder.is_empty() {
-                    Some(ImpStoredRequest {
-                        id: slot.id.clone(),
-                    })
-                } else {
-                    None
-                };
-
                 Some(Imp {
                     id: Some(slot.id.clone()),
                     banner: Some(Banner {
@@ -1872,13 +1800,11 @@ impl PrebidAuctionProvider {
         }
         .to_ext();
 
-        // Extract Referer header for site.ref
-        let referer = context
-            .request
-            .headers()
-            .get(header::REFERER)
-            .and_then(|value| value.to_str().ok())
-            .map(std::string::ToString::to_string);
+        // The browser Referer identifies the current publisher page for the
+        // same-origin `/auction` request, not the page that referred the user to
+        // the publisher. `request.publisher.page_url` is already sanitized and
+        // is carried as `site.page`, so do not duplicate the raw header in
+        // `site.ref`.
 
         // Advertise the effective auction budget, not the raw provider config:
         // the orchestrator caps `context.timeout_ms` to the remaining auction
@@ -1893,7 +1819,7 @@ impl PrebidAuctionProvider {
             site: Some(Site {
                 domain: Some(request.publisher.domain.clone()),
                 page: page_url,
-                r#ref: referer,
+                r#ref: None,
                 publisher: Some(Publisher {
                     domain: Some(request.publisher.domain.clone()),
                     ..Default::default()
@@ -2428,6 +2354,7 @@ impl AuctionProvider for PrebidAuctionProvider {
             &mut pbs_req,
             self.config.consent_forwarding,
             context.services.client_info().client_ip,
+            request.publisher.page_url.as_deref(),
         );
 
         let pbs_body = serde_json::to_vec(&openrtb).change_context(TrustedServerError::Prebid {
@@ -4978,7 +4905,7 @@ external_bundle_sri = "sha384-AAAA"
     }
 
     #[test]
-    fn to_openrtb_sets_site_ref_from_referer_header() {
+    fn to_openrtb_omits_raw_referer_from_site_ref() {
         let provider = PrebidAuctionProvider::new(base_config());
         let auction_request = create_test_auction_request();
 
@@ -4998,10 +4925,14 @@ external_bundle_sri = "sha384-AAAA"
         );
         let site = openrtb.site.as_ref().expect("should have site");
 
+        assert!(
+            site.r#ref.is_none(),
+            "should not forward the raw browser Referer into site.ref"
+        );
         assert_eq!(
-            site.r#ref.as_deref(),
-            Some("https://google.com/search?q=test"),
-            "should set site.ref from Referer header"
+            site.page.as_deref(),
+            auction_request.publisher.page_url.as_deref(),
+            "should retain the sanitized publisher page URL"
         );
     }
 
@@ -6605,26 +6536,23 @@ set = { placementId = "explicit_header" }
     // ========================================================================
 
     #[test]
-    fn to_openrtb_uses_stored_request_when_slot_has_no_pbs_bidder_params() {
-        // Slot only has "aps" provider — not a PBS bidder
-        let slot = make_slot(
-            "atf_sidebar_ad",
-            HashMap::from([("aps".to_string(), json!({"slotID": "aps-slot-atf-sidebar"}))]),
-        );
-        let request = make_auction_request(vec![slot]);
-
-        let ortb = call_to_openrtb(base_config(), &request);
-        let ext = ortb.imp[0].ext.as_ref().expect("should have imp ext");
-        let prebid = ext.get("prebid").expect("should have prebid in ext");
+    fn to_openrtb_drops_aps_only_slots_instead_of_using_stored_requests() {
+        for bidder in ["aps", "APS", "Aps"] {
+            let slot = make_slot(
+                "atf_sidebar_ad",
+                HashMap::from([(
+                    bidder.to_string(),
+                    json!({"slotID": "aps-slot-atf-sidebar"}),
+                )]),
+            );
+            let request = make_auction_request(vec![slot]);
 
-        assert!(
-            prebid.get("bidder").is_none(),
-            "should not send inline bidder params when using stored request"
-        );
-        assert_eq!(
-            prebid["storedrequest"]["id"], "atf_sidebar_ad",
-            "should use slot id as stored request id"
-        );
+            let openrtb = call_to_openrtb(base_config(), &request);
+            assert!(
+                openrtb.imp.is_empty(),
+                "should drop APS-only slot for case variant {bidder}"
+            );
+        }
     }
 
     #[test]
@@ -6669,321 +6597,32 @@ set = { placementId = "explicit_header" }
     }
 
     #[test]
-    fn to_openrtb_drops_fabricated_empty_bidder_params() {
-        // config.bidders lists three, but the slot supplies inline params only
-        // for kargo. Without a matching override, triplelift and criteo would
-        // expand to empty `{}` objects — invalid bidder entries PBS rejects.
-        // They must be dropped; the valid kargo bidder must still ship.
-        let config = parse_prebid_toml(
-            r#"
-[integrations.prebid]
-enabled = true
-server_url = "https://prebid.example"
-bidders = ["kargo", "triplelift", "criteo"]
-"#,
-        );
-
-        let slot = make_ts_slot(
-            "ad-header-0",
-            &json!({ "kargo": { "placementId": "kn1" } }),
-            None,
-        );
-        let request = make_auction_request(vec![slot]);
-
-        let ortb = call_to_openrtb(config, &request);
-        let params = bidder_params(&ortb);
-
-        assert_eq!(
-            params["kargo"]["placementId"], "kn1",
-            "should keep the valid inline bidder"
-        );
-        assert!(
-            !params.contains_key("triplelift"),
-            "should drop a fabricated empty bidder with no inline params or override"
-        );
-        assert!(
-            !params.contains_key("criteo"),
-            "should drop a fabricated empty bidder with no inline params or override"
-        );
-    }
-
-    #[test]
-    fn to_openrtb_prefers_direct_bidder_params_over_fabricated_empty() {
-        // A slot can carry BOTH a direct bidder entry (valid inline params) and a
-        // `trustedServer` entry whose `bidderParams` omits that bidder — the
-        // expansion fabricates an empty `{}` for the omitted bidder. Direct real
-        // params must win over that fabricated empty, and the trustedServer-supplied
-        // params for the other bidder must still ship.
-        //
-        // Looped because `slot.bidders` HashMap iteration order is randomized per
-        // map; the merge must be order-independent every time.
-        let config = parse_prebid_toml(
-            r#"
-[integrations.prebid]
-enabled = true
-server_url = "https://prebid.example"
-bidders = ["kargo", "triplelift"]
-"#,
-        );
-
-        for _ in 0..64 {
-            let slot = make_slot(
-                "ad-header-0",
-                HashMap::from([
-                    ("kargo".to_string(), json!({ "placementId": "direct-1" })),
-                    (
-                        TRUSTED_SERVER_BIDDER.to_string(),
-                        json!({ BIDDER_PARAMS_KEY: { "triplelift": { "inventoryCode": "tl-1" } } }),
-                    ),
-                ]),
-            );
-            let request = make_auction_request(vec![slot]);
-
-            let ortb = call_to_openrtb(config.clone(), &request);
-            let params = bidder_params(&ortb);
-
-            assert_eq!(
-                params["kargo"]["placementId"], "direct-1",
-                "direct bidder params must win over a fabricated empty from trustedServer expansion"
-            );
-            assert_eq!(
-                params["triplelift"]["inventoryCode"], "tl-1",
-                "trustedServer-supplied bidder params must still ship"
-            );
-        }
-    }
-
-    #[test]
-    fn to_openrtb_drops_an_explicitly_empty_bidder() {
-        // PBS cannot distinguish a publisher-supplied empty `{}` from a fabricated
-        // one — they are identical bytes on the wire and PBS rejects both. So an
-        // explicit empty is dropped just like a fabricated one, rather than shipped
-        // as `"bidder": {"kargo": {}}` (which would fail the whole auction). With no
-        // eligible bidder left, the slot falls back to its stored request.
-        let config = parse_prebid_toml(
-            r#"
-[integrations.prebid]
-enabled = true
-server_url = "https://prebid.example"
-bidders = ["kargo"]
-"#,
-        );
-
-        let slot = make_ts_slot("ad-header-0", &json!({ "kargo": {} }), None);
-        let request = make_auction_request(vec![slot]);
-
-        let ortb = call_to_openrtb(config, &request);
-        let ext = ortb.imp[0].ext.as_ref().expect("should have imp ext");
-        let prebid = ext.get("prebid").expect("should have prebid in ext");
-
-        assert!(
-            prebid.get("bidder").is_none(),
-            "should drop an explicitly supplied empty bidder object, not ship it"
-        );
-        assert_eq!(
-            prebid["storedrequest"]["id"], "ad-header-0",
-            "should fall back to the stored request once the empty bidder is dropped"
-        );
-    }
-
-    #[test]
-    fn to_openrtb_direct_empty_does_not_clobber_trusted_server_params() {
-        // A slot can carry BOTH a direct empty entry and a `trustedServer` entry
-        // whose `bidderParams` supplies real params for the same bidder. The direct
-        // empty must NOT overwrite the real params — otherwise the slot ships
-        // `"bidder": {"kargo": {}}`, the exact invalid payload this path removes.
-        // Looped because `slot.bidders` HashMap iteration order is randomized.
-        let config = parse_prebid_toml(
-            r#"
-[integrations.prebid]
-enabled = true
-server_url = "https://prebid.example"
-bidders = ["kargo"]
-"#,
-        );
-
-        for _ in 0..64 {
-            let slot = make_slot(
-                "ad-header-0",
-                HashMap::from([
-                    ("kargo".to_string(), json!({})),
-                    (
-                        TRUSTED_SERVER_BIDDER.to_string(),
-                        json!({ BIDDER_PARAMS_KEY: { "kargo": { "placementId": "ts-1" } } }),
-                    ),
-                ]),
-            );
-            let request = make_auction_request(vec![slot]);
-
-            let ortb = call_to_openrtb(config.clone(), &request);
-            let params = bidder_params(&ortb);
-
-            assert_eq!(
-                params["kargo"]["placementId"], "ts-1",
-                "a direct empty must not clobber real trustedServer-supplied params"
-            );
-        }
-    }
-
-    #[test]
-    fn to_openrtb_drops_non_object_bidder_params() {
-        // Non-object params (e.g. `null`, reachable via a POST that omits `params`
-        // because `BidConfig.params` is `#[serde(default)]`) are as invalid to PBS
-        // as `{}` and must be dropped, not shipped as `"bidder": {"kargo": null}`.
-        let config = parse_prebid_toml(
-            r#"
-[integrations.prebid]
-enabled = true
-server_url = "https://prebid.example"
-bidders = ["kargo"]
-"#,
-        );
-
-        let slot = make_slot(
-            "ad-header-0",
-            HashMap::from([("kargo".to_string(), Json::Null)]),
-        );
-        let request = make_auction_request(vec![slot]);
-
-        let ortb = call_to_openrtb(config, &request);
-        let ext = ortb.imp[0].ext.as_ref().expect("should have imp ext");
-        let prebid = ext.get("prebid").expect("should have prebid in ext");
-
-        assert!(
-            prebid.get("bidder").is_none(),
-            "should drop a null (non-object) bidder params value"
-        );
-        assert_eq!(
-            prebid["storedrequest"]["id"], "ad-header-0",
-            "should fall back to the stored request once the null bidder is dropped"
-        );
-    }
-
-    #[test]
-    fn to_openrtb_falls_back_to_stored_request_for_real_params_of_unconfigured_bidder() {
-        // Real inline params naming a bidder absent from `config.bidders` do NOT
-        // ship: the bidder is never expanded, the configured bidders fabricate
-        // empties, and the drop clears them — so the slot falls back to its stored
-        // request and the real params are lost. Pins the corrected comment that this
-        // fallback can fire even when a slot carries real inline params.
-        let config = parse_prebid_toml(
-            r#"
-[integrations.prebid]
-enabled = true
-server_url = "https://prebid.example"
-bidders = ["appnexus"]
-"#,
-        );
-
-        let slot = make_ts_slot(
-            "ad-header-0",
-            &json!({ "kargo": { "placementId": "kn1" } }),
-            None,
-        );
-        let request = make_auction_request(vec![slot]);
-
-        let ortb = call_to_openrtb(config, &request);
-        let ext = ortb.imp[0].ext.as_ref().expect("should have imp ext");
-        let prebid = ext.get("prebid").expect("should have prebid in ext");
-
-        assert!(
-            prebid.get("bidder").is_none(),
-            "real params for an unconfigured bidder are not shipped"
-        );
-        assert_eq!(
-            prebid["storedrequest"]["id"], "ad-header-0",
-            "slot falls back to its stored request when the only inline params name an unconfigured bidder"
-        );
-    }
-
-    #[test]
-    fn to_openrtb_keeps_a_fabricated_bidder_that_an_override_populates() {
-        // criteo has no inline params (fabricated empty), but an override rule
-        // fills it — so it is valid and must ship, not be dropped.
-        let config = parse_prebid_toml(
-            r#"
-[integrations.prebid]
-enabled = true
-server_url = "https://prebid.example"
-bidders = ["criteo"]
-
-[integrations.prebid.bid_param_overrides.criteo]
-networkId = 99999
-"#,
-        );
-
-        let slot = make_ts_slot("ad-header-0", &json!({}), None);
-        let request = make_auction_request(vec![slot]);
-
-        let ortb = call_to_openrtb(config, &request);
-        let params = bidder_params(&ortb);
-
-        assert_eq!(
-            params["criteo"]["networkId"], 99999,
-            "override should populate the fabricated empty bidder, keeping it"
-        );
-    }
-
-    #[test]
-    fn to_openrtb_falls_back_to_stored_request_when_all_bidders_are_fabricated_empty() {
-        // config.bidders present, but the slot supplies no inline params and no
-        // override matches — every configured bidder resolves to a fabricated
-        // empty and is dropped, leaving PBS to resolve via the stored request.
-        let config = parse_prebid_toml(
-            r#"
-[integrations.prebid]
-enabled = true
-server_url = "https://prebid.example"
-bidders = ["kargo", "triplelift"]
-"#,
-        );
-
-        let slot = make_ts_slot("ad-header-0", &json!({}), None);
-        let request = make_auction_request(vec![slot]);
-
-        let ortb = call_to_openrtb(config, &request);
-        let ext = ortb.imp[0].ext.as_ref().expect("should have imp ext");
-        let prebid = ext.get("prebid").expect("should have prebid in ext");
-
-        assert!(
-            prebid.get("bidder").is_none(),
-            "should drop all fabricated empty bidders"
-        );
-        assert_eq!(
-            prebid["storedrequest"]["id"], "ad-header-0",
-            "should fall back to stored request when no eligible bidders remain"
-        );
-    }
-
-    #[test]
-    fn to_openrtb_skips_aps_key_from_slot_bidders_in_pbs_request() {
+    fn to_openrtb_drops_aps_only_trusted_server_expansion() {
         let mut config = base_config();
-        config.bidders.push("aps".to_string());
-        let slot = make_slot(
+        config.bidders = vec!["APS".to_string()];
+        let slot = make_ts_slot(
             "atf_sidebar_ad",
-            HashMap::from([("aps".to_string(), json!({"slotID": "aps-slot-atf-sidebar"}))]),
+            &json!({"APS": {"slotID": "aps-slot-atf-sidebar"}}),
+            None,
         );
         let request = make_auction_request(vec![slot]);
 
-        let ortb = call_to_openrtb(config, &request);
-        let ext = ortb.imp[0].ext.as_ref().expect("should have imp ext");
-        let prebid = ext.get("prebid").expect("should have prebid in ext");
-
+        let openrtb = call_to_openrtb(config, &request);
         assert!(
-            prebid.get("bidder").is_none(),
-            "should not forward aps key into PBS imp.ext.prebid.bidder"
+            openrtb.imp.is_empty(),
+            "should not fall back to a stored request after excluding APS expansion"
         );
     }
 
     #[test]
     fn trusted_server_expansion_never_enables_aps_through_pbs() {
         let mut config = base_config();
-        config.bidders = vec!["kargo".to_string(), "aps".to_string()];
+        config.bidders = vec!["kargo".to_string(), "APS".to_string()];
         let slot = make_ts_slot(
             "in_content_ad",
             &json!({
                 "kargo": {"placementId": "client_123"},
-                "aps": {"slotID": "legacy-aps-slot"}
+                "APS": {"slotID": "legacy-aps-slot"}
             }),
             None,
         );
@@ -6993,11 +6632,38 @@ bidders = ["kargo", "triplelift"]
         let bidder = &ortb.imp[0].ext.as_ref().expect("should have imp ext")["prebid"]["bidder"];
         assert_eq!(bidder["kargo"]["placementId"], "client_123");
         assert!(
-            bidder.get("aps").is_none(),
+            bidder
+                .as_object()
+                .expect("should serialize bidder map")
+                .keys()
+                .all(|name| !name.eq_ignore_ascii_case("aps")),
             "Trusted Server APS cohorts must not also send APS through PBS"
         );
     }
 
+    #[test]
+    fn config_rejects_aps_in_prebid_bidder_lists_case_insensitively() {
+        for (field, bidder) in [
+            ("bidders", "aps"),
+            ("bidders", "APS"),
+            ("client_side_bidders", "Aps"),
+        ] {
+            let result = parse_prebid_toml_result(&format!(
+                r#"
+[integrations.prebid]
+enabled = true
+server_url = "https://prebid.example"
+{field} = ["{bidder}"]
+"#
+            ));
+            let error = result.expect_err("should reject APS in Prebid bidder lists");
+            assert!(
+                error.to_string().contains("configure APS under"),
+                "should include migration guidance for {field}: {error:?}"
+            );
+        }
+    }
+
     #[test]
     fn register_rejects_invalid_bid_param_override_rule() {
         let toml = format!(
@@ -7292,6 +6958,10 @@ set = { networkId = 42 }
         let from = http::Request::builder()
             .uri("https://publisher.example.com/")
             .header("x-forwarded-for", "6.6.6.6")
+            .header(
+                header::REFERER,
+                "https://publisher.example.com/article?email=private#fragment",
+            )
             .header(header::USER_AGENT, "test-agent")
             .body(EdgeBody::empty())
             .expect("should build inbound request");
@@ -7305,6 +6975,7 @@ set = { networkId = 42 }
             &mut to,
             ConsentForwardingMode::Both,
             Some(std::net::IpAddr::from([203, 0, 113, 7])),
+            Some("https://publisher.example.com/article"),
         );
 
         assert_eq!(
@@ -7321,6 +6992,13 @@ set = { networkId = 42 }
             Some("test-agent"),
             "should still copy the browser User-Agent"
         );
+        assert_eq!(
+            to.headers()
+                .get(header::REFERER)
+                .and_then(|value| value.to_str().ok()),
+            Some("https://publisher.example.com/article"),
+            "should replace the raw browser Referer with the sanitized page URL"
+        );
     }
 
     #[test]
@@ -7335,7 +7013,7 @@ set = { networkId = 42 }
             .body(EdgeBody::empty())
             .expect("should build outbound request");
 
-        copy_request_headers(&from, &mut to, ConsentForwardingMode::Both, None);
+        copy_request_headers(&from, &mut to, ConsentForwardingMode::Both, None, None);
 
         assert!(
             !to.headers().contains_key("x-forwarded-for"),
diff --git a/crates/trusted-server-core/src/publisher.rs b/crates/trusted-server-core/src/publisher.rs
index ebf298efd..942e014f4 100644
--- a/crates/trusted-server-core/src/publisher.rs
+++ b/crates/trusted-server-core/src/publisher.rs
@@ -2097,12 +2097,9 @@ pub(crate) fn build_bid_map(
                     "hb_bidder".to_string(),
                     serde_json::Value::String(bid.bidder.clone()),
                 );
-                // PBS Cache remains highest priority. APS uses the selected bid ID
-                // carried by its typed renderer; other providers retain the ad-ID fallback.
-                let renderer_bid_id = bid
-                    .renderer
-                    .as_ref()
-                    .map(|renderer| renderer.aps().bid_id.as_str());
+                // PBS Cache remains highest priority. Renderer bids use the generic
+                // upstream bid ID; ordinary providers retain the ad-ID fallback.
+                let renderer_bid_id = bid.renderer.as_ref().and(bid.bid_id.as_deref());
                 let hb_adid = bid
                     .cache_id
                     .as_deref()
@@ -2643,7 +2640,10 @@ mod tests {
             height: 250,
             nurl: None,
             burl: None,
+            bid_id: None,
             ad_id: None,
+            creative_id: None,
+            renderer: None,
             cache_id: None,
             cache_host: None,
             cache_path: None,
diff --git a/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts b/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts
index 7a2078625..5424250c8 100644
--- a/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts
+++ b/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts
@@ -16,6 +16,7 @@ function clientAuctionBundlePaths() {
         filename: string;
     };
     return {
+        core: resolve(TSJS_CRATE, "dist/tsjs-core.js"),
         gpt: resolve(TSJS_CRATE, "dist/tsjs-gpt.js"),
         prebid: resolve(TSJS_CRATE, "dist/prebid", manifest.filename),
     };
@@ -197,7 +198,7 @@ test.describe("APS opaque renderer", () => {
             route.fulfill({
                 status: 200,
                 contentType: "text/html",
-                body: '<!doctype html><div id="div-aps"></div>',
+                body: '<!doctype html><div id="div-aps"></div><div id="div-other"></div>',
             }),
         );
         await page.route(runtimeUrl("/auction"), (route) => {
@@ -265,6 +266,37 @@ test.describe("APS opaque renderer", () => {
             if (!acceptedBid)
                 throw new Error("APS bid was not accepted by Prebid");
 
+            const foreignUniversalCreativeResponse = await new Promise<
+                Record<string, unknown> | undefined
+            >((resolveResponse) => {
+                const frame = document.createElement("iframe");
+                const adIdJson = JSON.stringify(acceptedBid.adId);
+                frame.srcdoc = `<script>
+const renderChannel = new MessageChannel();
+renderChannel.port1.onmessage = function(event) {
+  parent.postMessage({ type: 'captured-foreign-prebid-response', payload: event.data }, '*');
+};
+parent.postMessage(JSON.stringify({
+  message: 'Prebid Request',
+  adId: ${adIdJson}
+}), '*', [renderChannel.port2]);
+<\/script>`;
+                let timeout = 0;
+                const receive = (event: MessageEvent) => {
+                    if (event.data?.type !== "captured-foreign-prebid-response")
+                        return;
+                    window.removeEventListener("message", receive);
+                    window.clearTimeout(timeout);
+                    resolveResponse(JSON.parse(String(event.data.payload)));
+                };
+                window.addEventListener("message", receive);
+                document.getElementById("div-other")!.appendChild(frame);
+                timeout = window.setTimeout(() => {
+                    window.removeEventListener("message", receive);
+                    resolveResponse(undefined);
+                }, 200);
+            });
+
             const universalCreativeResponse = await new Promise<
                 Record<string, unknown>
             >((resolveResponse, rejectResponse) => {
@@ -310,6 +342,7 @@ parent.postMessage(JSON.stringify({
                 acceptedAdId: acceptedBid.adId,
                 acceptedStatus: acceptedBid.status,
                 bidWon,
+                foreignUniversalCreativeResponse,
                 renderSucceeded,
                 universalCreativeResponse,
                 winningAdIds: pbjs.getAllWinningBids().map((bid) => bid.adId),
@@ -328,6 +361,9 @@ parent.postMessage(JSON.stringify({
         expect(auctionRequests).toBe(1);
         expect(result.acceptedAd).toBe("");
         expect(result.acceptedAdId).not.toBe(apsRenderer.bidId);
+        expect(result.foreignUniversalCreativeResponse).not.toEqual(
+            expect.objectContaining({ apsRenderer }),
+        );
         expect(result.universalCreativeResponse).toEqual(
             expect.objectContaining({
                 message: "Prebid Response",
@@ -728,16 +764,18 @@ parent.postMessage(JSON.stringify({
         );
     });
 
-    test("rejects same-origin creative URLs during static validation", async ({
+    test("rejects same-origin creative URLs through the TSJS rendering path", async ({
         page,
     }) => {
         const publisherOrigin = "https://publisher.example";
         const rendererUrl = `${publisherOrigin}/integrations/aps/renderer`;
+        const auctionUrl = `${publisherOrigin}/auction`;
         const testUrl = `${publisherOrigin}/aps-same-origin-test`;
         const runtimeRenderer = await page.request.get(
             runtimeUrl("/integrations/aps/renderer"),
         );
         const rendererDocument = await runtimeRenderer.text();
+        let creativeUrl = SCRIPT_CREATIVE_URL;
         let runnerRequests = 0;
 
         await page.route(RUNNER_URL, async (route) => {
@@ -760,45 +798,138 @@ parent.postMessage(JSON.stringify({
                 body: rendererDocument,
             });
         });
+        await page.route(auctionUrl, async (route) => {
+            const renderer = descriptor("script", creativeUrl);
+            await route.fulfill({
+                status: 200,
+                contentType: "application/json",
+                body: JSON.stringify({
+                    id: "fictional-auction",
+                    seatbid: [
+                        {
+                            seat: "aps",
+                            bid: [
+                                {
+                                    id: renderer.bidId,
+                                    impid: "same-origin-slot",
+                                    price: 1.23,
+                                    w: 300,
+                                    h: 250,
+                                    ext: {
+                                        trusted_server: { renderer },
+                                    },
+                                },
+                            ],
+                        },
+                    ],
+                    ext: {},
+                }),
+            });
+        });
         await page.route(testUrl, async (route) => {
             await route.fulfill({
                 status: 200,
                 contentType: "text/html",
                 headers: {
                     "Content-Security-Policy":
-                        "default-src 'none'; script-src 'unsafe-inline'; frame-src 'self'",
+                        "default-src 'none'; script-src 'unsafe-inline'; connect-src 'self'; frame-src 'self'",
                 },
-                body: testPage(rendererUrl),
+                body: '<!doctype html><div id="same-origin-slot"><span class="existing">existing publisher content</span></div>',
             });
         });
 
         await page.goto(testUrl);
-        const nonce = "same-origin-0123456789";
-        await page.evaluate(
-            ({ renderer, nonce }) => {
-                (
-                    window as unknown as {
-                        startApsFrame(options: Record<string, unknown>): void;
-                    }
-                ).startApsFrame({
-                    slotId: "same-origin-slot",
-                    fragmentNonce: nonce,
-                    messageNonce: nonce,
-                    omitSandbox: true,
-                    renderer,
-                });
-            },
-            {
-                renderer: descriptor(
-                    "script",
-                    `${publisherOrigin}/fictional-same-origin.js`,
+        await page.addScriptTag({ path: clientAuctionBundlePaths().core });
+        await page.evaluate(() => {
+            const tsjs = (
+                window as unknown as {
+                    tsjs: {
+                        addAdUnits(units: Array<Record<string, unknown>>): void;
+                        log: {
+                            info(message: string, ...args: unknown[]): void;
+                        };
+                        requestAds(): void;
+                    };
+                    auctionRenderCompletions?: number;
+                }
+            ).tsjs;
+            tsjs.addAdUnits([
+                {
+                    code: "same-origin-slot",
+                    mediaTypes: { banner: { sizes: [[300, 250]] } },
+                    bids: [],
+                },
+            ]);
+            const originalInfo = tsjs.log.info.bind(tsjs.log);
+            tsjs.log.info = (message: string, ...args: unknown[]) => {
+                if (
+                    message === "requestAds: rendered creatives from response"
+                ) {
+                    (
+                        window as unknown as {
+                            auctionRenderCompletions: number;
+                        }
+                    ).auctionRenderCompletions += 1;
+                }
+                originalInfo(message, ...args);
+            };
+            (
+                window as unknown as {
+                    auctionRenderCompletions: number;
+                }
+            ).auctionRenderCompletions = 0;
+            tsjs.requestAds();
+        });
+
+        await expect.poll(() => runnerRequests).toBe(1);
+        await expect
+            .poll(() =>
+                page.evaluate(
+                    () =>
+                        (
+                            window as unknown as {
+                                auctionRenderCompletions: number;
+                            }
+                        ).auctionRenderCompletions,
                 ),
-                nonce,
-            },
+            )
+            .toBe(1);
+        await expect(page.locator("#same-origin-slot .existing")).toHaveCount(
+            0,
         );
+        const productSandbox = await page
+            .locator("#same-origin-slot > iframe")
+            .getAttribute("sandbox");
+        expect(productSandbox).toBe(SANDBOX);
+        expect(productSandbox).not.toContain("allow-same-origin");
+
+        creativeUrl = `${publisherOrigin}/fictional-same-origin.js`;
+        await page.locator("#same-origin-slot").evaluate((slot) => {
+            slot.innerHTML =
+                '<span class="existing">existing publisher content</span>';
+        });
+        await page.evaluate(() => {
+            (
+                window as unknown as {
+                    tsjs: { requestAds(): void };
+                }
+            ).tsjs.requestAds();
+        });
 
-        await page.waitForTimeout(100);
-        expect(runnerRequests).toBe(0);
+        await expect
+            .poll(() =>
+                page.evaluate(
+                    () =>
+                        (
+                            window as unknown as {
+                                auctionRenderCompletions: number;
+                            }
+                        ).auctionRenderCompletions,
+                ),
+            )
+            .toBe(2);
+        expect(runnerRequests).toBe(1);
+        await expect(page.locator("#same-origin-slot iframe")).toHaveCount(0);
         await expect(page.locator("#same-origin-slot .existing")).toHaveCount(
             1,
         );
diff --git a/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml b/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
index 96616e6f5..921bf1959 100644
--- a/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
+++ b/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
@@ -102,7 +102,7 @@ allowed_context_keys = []
 [integrations.aps]
 enabled = true
 account_id = "example-aps-account-id"
-endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
+endpoint = "https://aps.example.com/e/pb/bid"
 timeout_ms = 1000
 allow_script_creatives = false
 
diff --git a/crates/trusted-server-js/lib/src/integrations/aps/render.ts b/crates/trusted-server-js/lib/src/integrations/aps/render.ts
index ff37e2cb4..8df617fac 100644
--- a/crates/trusted-server-js/lib/src/integrations/aps/render.ts
+++ b/crates/trusted-server-js/lib/src/integrations/aps/render.ts
@@ -7,6 +7,7 @@ export const APS_RENDERER_SANDBOX =
 export const APS_UNIVERSAL_CREATIVE_RENDERER_VERSION = 4;
 
 const MAX_ACCOUNT_ID_BYTES = 1024;
+const MAX_CREATIVE_ID_BYTES = 1024;
 const MAX_CREATIVE_URL_BYTES = 4096;
 const MAX_RENDER_ENVELOPE_BYTES = 256 * 1024;
 const MAX_RENDER_ENVELOPE_BASE64_BYTES = 4 * Math.ceil(MAX_RENDER_ENVELOPE_BYTES / 3);
@@ -23,6 +24,7 @@ const DESCRIPTOR_KEYS = [
 ] as const;
 const DESCRIPTOR_KEYS_WITH_CREATIVE_ID = [...DESCRIPTOR_KEYS, 'creativeId'].sort();
 const activeFrames = new WeakMap<HTMLElement, HTMLIFrameElement>();
+const pendingFrameCancels = new WeakMap<HTMLElement, () => void>();
 const RENDERER_READY_MESSAGE = 'trusted-server/aps/renderer-ready';
 const RENDERER_FAILED_MESSAGE = 'trusted-server/aps/renderer-failed';
 const RENDERER_READY_TIMEOUT_MS = 10_000;
@@ -66,7 +68,9 @@ export function parseApsRendererDescriptor(value: unknown): ApsRendererV1 | unde
     typeof value.bidId !== 'string' ||
     value.bidId.length === 0 ||
     (Object.prototype.hasOwnProperty.call(value, 'creativeId') &&
-      (typeof value.creativeId !== 'string' || value.creativeId.length === 0)) ||
+      (typeof value.creativeId !== 'string' ||
+        value.creativeId.length === 0 ||
+        new TextEncoder().encode(value.creativeId).length > MAX_CREATIVE_ID_BYTES)) ||
     (value.tagType !== 'iframe' && value.tagType !== 'script') ||
     typeof value.creativeUrl !== 'string' ||
     typeof value.aaxResponse !== 'string' ||
@@ -93,7 +97,7 @@ function decodeStandardBase64(value: string): Uint8Array | undefined {
 
   try {
     const binary = atob(value);
-    if (binary.length > MAX_RENDER_ENVELOPE_BYTES) return undefined;
+    if (binary.length > MAX_RENDER_ENVELOPE_BYTES || btoa(binary) !== value) return undefined;
     return Uint8Array.from(binary, (character) => character.charCodeAt(0));
   } catch {
     return undefined;
@@ -321,8 +325,9 @@ export function renderApsCreative({ slotId, renderer: input }: RenderApsCreative
   iframe.setAttribute('sandbox', APS_RENDERER_SANDBOX);
   iframe.src = `${rendererUrl}#tsaps=${nonce}`;
 
-  const priorFrame = activeFrames.get(container);
-  if (priorFrame?.style.display === 'none') priorFrame.remove();
+  // A replacement must cancel a pending frame, not merely detach it: its
+  // message listener and ready timeout would otherwise remain live until expiry.
+  pendingFrameCancels.get(container)?.();
   activeFrames.set(container, iframe);
 
   let settled = false;
@@ -330,18 +335,24 @@ export function renderApsCreative({ slotId, renderer: input }: RenderApsCreative
     window.removeEventListener('message', receive);
     window.clearTimeout(timeoutId);
   };
-  const fail = (): void => {
+  const cancel = (): void => {
     if (settled) return;
     settled = true;
     cleanup();
+    if (pendingFrameCancels.get(container) === cancel) pendingFrameCancels.delete(container);
     if (activeFrames.get(container) === iframe) activeFrames.delete(container);
     iframe.remove();
+  };
+  const fail = (): void => {
+    if (settled) return;
+    cancel();
     log.warn('APS renderer: frame load failed');
   };
   const commit = (): void => {
     if (settled || activeFrames.get(container) !== iframe || !iframe.isConnected) return;
     settled = true;
     cleanup();
+    if (pendingFrameCancels.get(container) === cancel) pendingFrameCancels.delete(container);
     for (const child of Array.from(container.children)) {
       if (child !== iframe) child.remove();
     }
@@ -377,6 +388,7 @@ export function renderApsCreative({ slotId, renderer: input }: RenderApsCreative
   iframe.addEventListener('error', fail, { once: true });
 
   const timeoutId = window.setTimeout(fail, RENDERER_READY_TIMEOUT_MS);
+  pendingFrameCancels.set(container, cancel);
   container.appendChild(iframe);
   return true;
 }
@@ -385,21 +397,20 @@ export function renderApsCreative({ slotId, renderer: input }: RenderApsCreative
  * Static source executed by Prebid Universal Creative's dynamic-renderer frame.
  * It reads only the validated descriptor and trusted absolute endpoint URL from data.
  */
-export const APS_UNIVERSAL_CREATIVE_RENDERER =
-  '(function(){window.render=function(d,_h,w){return new Promise(function(resolve,reject){' +
-  'try{var r=d&&d.apsRenderer,u=d&&d.rendererUrl;if(!r||typeof u!=="string")throw new Error("invalid APS renderer data");' +
-  'var p=new URL(u);if((p.protocol!=="https:"&&p.protocol!=="http:")||p.username||p.password||p.pathname!=="/integrations/aps/renderer"||p.search||p.hash)throw new Error("invalid APS renderer URL");' +
-  'var c=w.crypto;if(!c||typeof c.getRandomValues!=="function")throw new Error("APS renderer randomness unavailable");' +
-  'var b=new Uint8Array(16);c.getRandomValues(b);var s="";for(var i=0;i<b.length;i++)s+=String.fromCharCode(b[i]);' +
-  'var n=w.btoa(s).replace(/\\+/g,"-").replace(/\\//g,"_").replace(/=+$/g,"");' +
-  'var f=w.document.createElement("iframe"),done=false,t;' +
-  'function clean(){w.removeEventListener("message",receive);if(t)w.clearTimeout(t);}' +
-  'function fail(){if(done)return;done=true;clean();f.remove();reject(new Error("APS renderer frame failed"));}' +
-  'function receive(e){var m=e.data;if(e.source!==f.contentWindow||!m||m.nonce!==n)return;' +
-  'if(m.message==="trusted-server/aps/renderer-ready"){done=true;clean();resolve();}' +
-  'else if(m.message==="trusted-server/aps/renderer-failed")fail();}' +
-  'f.width=String(r.width);f.height=String(r.height);f.style.border="0";' +
-  'f.setAttribute("sandbox","allow-forms allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-scripts allow-top-navigation-by-user-activation");' +
-  'f.src=p.href+"#tsaps="+n;f.onload=function(){if(!done&&f.contentWindow)f.contentWindow.postMessage({nonce:n,renderer:r},"*");};' +
-  'f.onerror=fail;w.addEventListener("message",receive);t=w.setTimeout(fail,10000);w.document.body.appendChild(f);' +
-  '}catch(e){reject(e);}});};})();';
+export const APS_UNIVERSAL_CREATIVE_RENDERER = String.raw`(function(){window.render=function(d,_h,w){return new Promise(function(resolve,reject){
+try{var r=d&&d.apsRenderer,u=d&&d.rendererUrl;if(!r||typeof u!=="string")throw new Error("invalid APS renderer data");
+var p=new URL(u);if((p.protocol!=="https:"&&p.protocol!=="http:")||p.username||p.password||p.pathname!=="${APS_RENDERER_PATH}"||p.search||p.hash)throw new Error("invalid APS renderer URL");
+var c=w.crypto;if(!c||typeof c.getRandomValues!=="function")throw new Error("APS renderer randomness unavailable");
+var b=new Uint8Array(16);c.getRandomValues(b);var s="";for(var i=0;i<b.length;i++)s+=String.fromCharCode(b[i]);
+var n=w.btoa(s).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"");
+var f=w.document.createElement("iframe"),done=false,t;
+function clean(){w.removeEventListener("message",receive);if(t)w.clearTimeout(t);}
+function fail(){if(done)return;done=true;clean();f.remove();reject(new Error("APS renderer frame failed"));}
+function receive(e){var m=e.data;if(e.source!==f.contentWindow||!m||m.nonce!==n)return;
+if(m.message==="${RENDERER_READY_MESSAGE}"){done=true;clean();resolve();}
+else if(m.message==="${RENDERER_FAILED_MESSAGE}")fail();}
+f.width=String(r.width);f.height=String(r.height);f.style.border="0";
+f.setAttribute("sandbox","${APS_RENDERER_SANDBOX}");
+f.src=p.href+"#tsaps="+n;f.onload=function(){if(!done&&f.contentWindow)f.contentWindow.postMessage({nonce:n,renderer:r},"*");};
+f.onerror=fail;w.addEventListener("message",receive);t=w.setTimeout(fail,${RENDERER_READY_TIMEOUT_MS});w.document.body.appendChild(f);
+}catch(e){reject(e);}});};})();`;
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt/index.ts b/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
index aab9e3094..5fb0c6a69 100644
--- a/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
+++ b/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
@@ -64,10 +64,22 @@ function findSlotElementByDivId(divId: string): HTMLElement | null {
   const exact = document.getElementById(divId);
   if (exact) return exact;
 
+  const configuredDivIds = (window.tsjs?.adSlots ?? [])
+    .map((slot) => slot.div_id)
+    .filter((configured) => configured.length > 0);
+
   return (
-    Array.from(document.querySelectorAll<HTMLElement>('[id]')).find(
-      (el) => el.id.startsWith(divId) && !el.id.endsWith('-container')
-    ) ?? null
+    Array.from(document.querySelectorAll<HTMLElement>('[id]')).find((element) => {
+      if (!element.id.startsWith(divId) || element.id.endsWith('-container')) return false;
+
+      // Generated slot IDs can extend a configured prefix. When configured
+      // prefixes overlap, assign the element to the longest matching prefix so
+      // `div-header` cannot claim an iframe owned by `div-header-mobile`.
+      const owner = configuredDivIds
+        .filter((configured) => element.id.startsWith(configured))
+        .sort((left, right) => right.length - left.length)[0];
+      return owner === undefined || owner === divId;
+    }) ?? null
   );
 }
 
@@ -104,12 +116,7 @@ function messageSourceBelongsToAdUnit(
   adUnitCode: string
 ): boolean {
   if (!source) return false;
-  const roots = [
-    document.getElementById(adUnitCode),
-    document.getElementById(`${adUnitCode}-container`),
-  ].filter((root): root is HTMLElement => root !== null);
-
-  return roots.some((root) =>
+  return candidateSlotRoots(adUnitCode).some((root) =>
     Array.from(root.querySelectorAll('iframe')).some((iframe) => iframe.contentWindow === source)
   );
 }
@@ -992,12 +999,10 @@ export function installTsRenderBridge(): void {
       const rendererUrl = apsRendererUrl();
       if (!renderer || !rendererUrl) return;
 
-      // Ownership and the complete consumed envelope are valid before this
-      // handler claims the message or suppresses another legitimate handler.
+      // Ownership and the complete envelope are valid before this handler
+      // claims the message. APS responses are intentionally repeatable: GAM can
+      // request the same server-rendered Universal Creative more than once.
       e.stopImmediatePropagation();
-      if (renderingAdIds.has(adId)) return;
-      renderingAdIds.add(adId);
-
       try {
         port.postMessage(
           JSON.stringify({
@@ -1013,7 +1018,6 @@ export function installTsRenderBridge(): void {
         );
         log.debug(`[tsjs-gpt] pbRender bridge served '${slotId}' through APS renderer`);
       } catch (err) {
-        renderingAdIds.delete(adId);
         log.warn('[tsjs-gpt] pbRender bridge: APS response failed', err);
       }
       return;
diff --git a/crates/trusted-server-js/lib/src/integrations/prebid/index.ts b/crates/trusted-server-js/lib/src/integrations/prebid/index.ts
index 2975e5f41..826fec4b4 100644
--- a/crates/trusted-server-js/lib/src/integrations/prebid/index.ts
+++ b/crates/trusted-server-js/lib/src/integrations/prebid/index.ts
@@ -29,7 +29,7 @@ import './_adapters.generated';
 
 import { log } from '../../core/log';
 import { buildAdRequest, parseAuctionResponse } from '../../core/auction';
-import { registerApsPrebidRenderer } from '../aps/render';
+import { registerApsPrebidRenderer, validateApsRenderer } from '../aps/render';
 import type { AuctionBid, AuctionEid } from '../../core/auction';
 import type { AuctionSlot } from '../../core/types';
 
@@ -209,24 +209,35 @@ export function auctionBidsToPrebidBids(auctionBids: AuctionBid[], bidRequests:
     }
   }
 
-  return auctionBids.map((bid) => {
+  return auctionBids.flatMap((bid) => {
+    // Prebid admission is the last point before the descriptor becomes a bid
+    // capability. Drop malformed APS bids rather than letting them participate
+    // in the auction without a render path.
+    const renderer = bid.renderer ? validateApsRenderer(bid.renderer) : undefined;
+    if (bid.renderer && !renderer) {
+      log.warn(`[tsjs-prebid] dropped invalid APS renderer bid for '${bid.impid}'`);
+      return [];
+    }
+
     const origReq = requestsByCode.get(bid.impid);
-    return {
-      requestId: origReq?.bidId ?? bid.impid,
-      cpm: bid.price,
-      width: bid.width,
-      height: bid.height,
-      ad: bid.renderer ? '' : bid.adm,
-      ...(bid.renderer ? { [APS_RENDERER_FIELD]: bid.renderer } : {}),
-      ttl: 300,
-      creativeId: bid.creativeId,
-      netRevenue: true,
-      currency: 'USD',
-      bidderCode: bid.seat,
-      meta: {
-        advertiserDomains: bid.adomain,
+    return [
+      {
+        requestId: origReq?.bidId ?? bid.impid,
+        cpm: bid.price,
+        width: bid.width,
+        height: bid.height,
+        ad: renderer ? '' : bid.adm,
+        ...(renderer ? { [APS_RENDERER_FIELD]: renderer } : {}),
+        ttl: 300,
+        creativeId: bid.creativeId,
+        netRevenue: true,
+        currency: 'USD',
+        bidderCode: bid.seat,
+        meta: {
+          advertiserDomains: bid.adomain,
+        },
       },
-    };
+    ];
   });
 }
 
@@ -522,13 +533,23 @@ function installApsBidResponseRegistry(): void {
       return;
     }
 
-    registerApsPrebidRenderer(bid['adId'], bid['adUnitCode'], renderer, bid['ttl'], {
-      markWinner: () => markWinner(rawBid),
-      markRendered: () => markBidAsRendered(rawBid),
-    });
-    // Keep the executable capability only in the bounded, one-time registry. Prebid
-    // still owns the generated ad ID and ordinary GAM targeting on this bid object.
-    delete bid[APS_RENDERER_FIELD];
+    const registered = registerApsPrebidRenderer(
+      bid['adId'],
+      bid['adUnitCode'],
+      renderer,
+      bid['ttl'],
+      {
+        markWinner: () => markWinner(rawBid),
+        markRendered: () => markBidAsRendered(rawBid),
+      }
+    );
+    if (registered) {
+      // Keep the executable capability only in the bounded, one-time registry. Prebid
+      // still owns the generated ad ID and ordinary GAM targeting on this bid object.
+      delete bid[APS_RENDERER_FIELD];
+    } else {
+      log.warn('[tsjs-prebid] rejected APS renderer capability that failed registration');
+    }
   });
   prebid[APS_BID_RESPONSE_LISTENER_SENTINEL] = true;
 }
diff --git a/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts b/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts
index e7978e1cb..f98b6e435 100644
--- a/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts
@@ -1,6 +1,7 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import envelope from '../../fixtures/aps-renderer-v1.json';
 import type { ApsRendererV1 } from '../../../src/core/types';
+import { log } from '../../../src/core/log';
 import {
   APS_RENDERER_PATH,
   APS_RENDERER_SANDBOX,
@@ -14,13 +15,23 @@ import {
   validateApsRenderer,
 } from '../../../src/integrations/aps/render';
 
-function encodeEnvelope(value: unknown): string {
-  const bytes = new TextEncoder().encode(JSON.stringify(value));
+function encodeBytes(bytes: Uint8Array): string {
   let binary = '';
   for (const byte of bytes) binary += String.fromCharCode(byte);
   return btoa(binary);
 }
 
+function encodeEnvelope(value: unknown): string {
+  return encodeBytes(new TextEncoder().encode(JSON.stringify(value)));
+}
+
+function encodeEnvelopeAtSize(size: number): string {
+  const serialized = JSON.stringify(envelope);
+  const padding = size - new TextEncoder().encode(serialized).length;
+  if (padding < 0) throw new Error('requested envelope size is too small');
+  return encodeBytes(new TextEncoder().encode(`${serialized}${' '.repeat(padding)}`));
+}
+
 function descriptor(overrides: Partial<ApsRendererV1> = {}): ApsRendererV1 {
   const bid = envelope.seatbid[0].bid[0];
   return {
@@ -105,12 +116,28 @@ describe('APS renderer validation', () => {
     expect(validateApsRenderer(descriptor(override))).toBeUndefined();
   });
 
-  it.each(['not-base64', 'e30', '====', btoa(String.fromCharCode(0xc3, 0x28)), btoa('{not json}')])(
-    'rejects invalid base64, UTF-8, or JSON',
-    (aaxResponse) => {
-      expect(validateApsRenderer(descriptor({ aaxResponse }))).toBeUndefined();
-    }
-  );
+  it.each([
+    'not-base64',
+    'e30',
+    '====',
+    'Zh==',
+    btoa(String.fromCharCode(0xc3, 0x28)),
+    btoa('{not json}'),
+  ])('rejects invalid base64, UTF-8, JSON, or non-canonical padding', (aaxResponse) => {
+    expect(validateApsRenderer(descriptor({ aaxResponse }))).toBeUndefined();
+  });
+
+  it('rejects non-canonical trailing bits that decode to the valid envelope', () => {
+    const canonical = encodeBytes(new TextEncoder().encode(`${JSON.stringify(envelope)} `));
+    const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+    const finalDataIndex = canonical.length - 3;
+    const canonicalIndex = alphabet.indexOf(canonical[finalDataIndex]);
+    const nonCanonical = `${canonical.slice(0, finalDataIndex)}${alphabet[canonicalIndex + 1]}==`;
+
+    expect(atob(nonCanonical)).toBe(atob(canonical));
+    expect(validateApsRenderer(descriptor({ aaxResponse: canonical }))).toBeDefined();
+    expect(validateApsRenderer(descriptor({ aaxResponse: nonCanonical }))).toBeUndefined();
+  });
 
   it.each([
     'http://creative.example/render',
@@ -130,6 +157,47 @@ describe('APS renderer validation', () => {
     ).toBeUndefined();
     expect(parseApsRendererDescriptor({ ...descriptor(), version: 2 })).toBeUndefined();
   });
+
+  it('enforces account and creative ID UTF-8 byte limits', () => {
+    expect(validateApsRenderer(descriptor({ accountId: 'é'.repeat(512) }))).toBeDefined();
+    expect(validateApsRenderer(descriptor({ accountId: `${'é'.repeat(512)}x` }))).toBeUndefined();
+    expect(validateApsRenderer(descriptor({ creativeId: 'é'.repeat(512) }))).toBeDefined();
+    expect(validateApsRenderer(descriptor({ creativeId: `${'é'.repeat(512)}x` }))).toBeUndefined();
+  });
+
+  it('enforces the creative URL UTF-8 byte limit', () => {
+    const prefix = 'https://creative.example/';
+    const atLimit = `${prefix}${'a'.repeat(4096 - prefix.length)}`;
+    const overLimit = `${atLimit}x`;
+    const atLimitEnvelope = structuredClone(envelope);
+    atLimitEnvelope.seatbid[0].bid[0].ext.creativeurl = atLimit;
+    const overLimitEnvelope = structuredClone(envelope);
+    overLimitEnvelope.seatbid[0].bid[0].ext.creativeurl = overLimit;
+
+    expect(
+      validateApsRenderer(
+        descriptor({ creativeUrl: atLimit, aaxResponse: encodeEnvelope(atLimitEnvelope) })
+      )
+    ).toBeDefined();
+    expect(
+      validateApsRenderer(
+        descriptor({ creativeUrl: overLimit, aaxResponse: encodeEnvelope(overLimitEnvelope) })
+      )
+    ).toBeUndefined();
+  });
+
+  it('accepts the maximum decoded envelope and rejects one byte over', () => {
+    const atLimit = encodeEnvelopeAtSize(256 * 1024);
+    const overLimit = encodeEnvelopeAtSize(256 * 1024 + 1);
+
+    expect(atLimit).toHaveLength(349528);
+    expect(overLimit).toHaveLength(349528);
+    expect(validateApsRenderer(descriptor({ aaxResponse: atLimit }))).toBeDefined();
+    expect(validateApsRenderer(descriptor({ aaxResponse: overLimit }))).toBeUndefined();
+    expect(
+      parseApsRendererDescriptor(descriptor({ aaxResponse: `${atLimit}AAAA` }))
+    ).toBeUndefined();
+  });
 });
 
 describe('Prebid APS renderer registry', () => {
@@ -230,6 +298,38 @@ describe('direct APS rendering', () => {
     expect(iframe.style.display).toBe('');
   });
 
+  it('rejects a ready message with the correct nonce from a foreign window', () => {
+    expect(renderApsCreative({ slotId: 'fictional-slot', renderer: descriptor() })).toBe(true);
+
+    const slot = document.getElementById('fictional-slot')!;
+    const rendererFrame = slot.querySelector('iframe')!;
+    const postMessage = vi.spyOn(rendererFrame.contentWindow!, 'postMessage');
+    rendererFrame.dispatchEvent(new Event('load'));
+    const sent = postMessage.mock.calls[0][0] as { nonce: string };
+    const foreignFrame = document.createElement('iframe');
+    document.body.appendChild(foreignFrame);
+
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        data: { message: 'trusted-server/aps/renderer-ready', nonce: sent.nonce },
+        source: foreignFrame.contentWindow,
+      })
+    );
+
+    expect(slot.querySelector('span')).not.toBeNull();
+    expect(rendererFrame.style.display).toBe('none');
+
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        data: { message: 'trusted-server/aps/renderer-ready', nonce: sent.nonce },
+        source: rendererFrame.contentWindow,
+      })
+    );
+
+    expect(slot.querySelector('span')).toBeNull();
+    expect(rendererFrame.style.display).toBe('');
+  });
+
   it('leaves existing slot content intact when validation or loading fails', () => {
     expect(
       renderApsCreative({
@@ -262,6 +362,50 @@ describe('direct APS rendering', () => {
       vi.useRealTimers();
     }
   });
+
+  it('immediately cancels a superseded pending frame and its timeout', () => {
+    vi.useFakeTimers();
+    const warnSpy = vi.spyOn(log, 'warn').mockImplementation(() => {});
+    try {
+      const baselineTimers = vi.getTimerCount();
+      expect(renderApsCreative({ slotId: 'fictional-slot', renderer: descriptor() })).toBe(true);
+      const firstFrame = document.querySelector('#fictional-slot iframe')!;
+      const firstPostMessage = vi.spyOn(firstFrame.contentWindow!, 'postMessage');
+      firstFrame.dispatchEvent(new Event('load'));
+      const firstSent = firstPostMessage.mock.calls[0][0] as { nonce: string };
+      const timersAfterFirst = vi.getTimerCount();
+      expect(timersAfterFirst).toBeGreaterThan(baselineTimers);
+
+      expect(renderApsCreative({ slotId: 'fictional-slot', renderer: descriptor() })).toBe(true);
+      const secondFrame = document.querySelector('#fictional-slot iframe')!;
+      expect(firstFrame.isConnected).toBe(false);
+      expect(vi.getTimerCount()).toBe(timersAfterFirst);
+      const postMessage = vi.spyOn(secondFrame.contentWindow!, 'postMessage');
+      secondFrame.dispatchEvent(new Event('load'));
+      const sent = postMessage.mock.calls[0][0] as { nonce: string };
+
+      window.dispatchEvent(
+        new MessageEvent('message', {
+          data: { message: 'trusted-server/aps/renderer-ready', nonce: firstSent.nonce },
+          source: firstFrame.contentWindow,
+        })
+      );
+      expect(document.querySelector('#fictional-slot span')).not.toBeNull();
+      expect((secondFrame as HTMLIFrameElement).style.display).toBe('none');
+
+      window.dispatchEvent(
+        new MessageEvent('message', {
+          data: { message: 'trusted-server/aps/renderer-ready', nonce: sent.nonce },
+          source: secondFrame.contentWindow,
+        })
+      );
+
+      vi.advanceTimersByTime(10_000);
+      expect(warnSpy).not.toHaveBeenCalled();
+    } finally {
+      vi.useRealTimers();
+    }
+  });
 });
 
 describe('Universal Creative APS source', () => {
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
index 4ac85e2bb..21f9d2497 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
@@ -1021,9 +1021,9 @@ describe('installTsRenderBridge', () => {
     delete (window as TestWindow).tsjs;
   });
 
-  function createTrustedSlotIframe(): Window {
+  function createTrustedSlotIframe(divId = 'div-header'): Window {
     const slot = document.createElement('div');
-    slot.id = 'div-header';
+    slot.id = divId;
     const iframe = document.createElement('iframe');
     slot.appendChild(iframe);
     document.body.appendChild(slot);
@@ -1082,7 +1082,9 @@ describe('installTsRenderBridge', () => {
     expect(stopSpy).toHaveBeenCalledTimes(2);
     expect(fetchStub).not.toHaveBeenCalled();
     expect(beaconSpy).not.toHaveBeenCalled();
-    expect(portMessages).toHaveLength(1);
+    // Server-rendered APS descriptors are reusable: GAM can issue repeated
+    // Universal Creative requests for the same winning ad ID.
+    expect(portMessages).toHaveLength(2);
     const response = JSON.parse(portMessages[0]) as Record<string, unknown>;
     expect(Object.keys(response).sort()).toEqual(
       [
@@ -1284,6 +1286,64 @@ describe('installTsRenderBridge', () => {
     expect(fetchStub).not.toHaveBeenCalled();
   });
 
+  it('accepts an APS request from a dynamic slot root resolved from its configured prefix', async () => {
+    const renderer = apsRenderer();
+    (window as TestWindow).tsjs.bids.homepage_header = {
+      hb_adid: renderer.bidId,
+      hb_bidder: 'aps',
+      renderer,
+    };
+    (window as TestWindow).tsjs.adSlots[0].div_id = 'div-header-';
+
+    const bridgeListener = await captureBridgeListener();
+    const source = createTrustedSlotIframe('div-header-dynamic');
+    const portMessages: string[] = [];
+    bridgeListener(
+      Object.assign(new Event('message'), {
+        data: JSON.stringify({ message: 'Prebid Request', adId: renderer.bidId }),
+        ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+        source,
+        stopImmediatePropagation: vi.fn(),
+      }) as unknown as MessageEvent
+    );
+
+    expect(portMessages).toHaveLength(1);
+    document.getElementById('div-header-dynamic')?.remove();
+  });
+
+  it('does not let an overlapping slot prefix claim another slot iframe', async () => {
+    const renderer = apsRenderer();
+    (window as TestWindow).tsjs.bids.homepage_header = {
+      hb_adid: renderer.bidId,
+      hb_bidder: 'aps',
+      renderer,
+    };
+    (window as TestWindow).tsjs.adSlots.push({
+      id: 'homepage_header_mobile',
+      formats: [[320, 50]],
+      gam_unit_path: '/a/b/mobile',
+      div_id: 'div-header-mobile',
+      targeting: {},
+    });
+
+    const bridgeListener = await captureBridgeListener();
+    const source = createTrustedSlotIframe('div-header-mobile');
+    const portMessages: string[] = [];
+    const stopSpy = vi.fn();
+    bridgeListener(
+      Object.assign(new Event('message'), {
+        data: JSON.stringify({ message: 'Prebid Request', adId: renderer.bidId }),
+        ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+        source,
+        stopImmediatePropagation: stopSpy,
+      }) as unknown as MessageEvent
+    );
+
+    expect(stopSpy).not.toHaveBeenCalled();
+    expect(portMessages).toEqual([]);
+    document.getElementById('div-header-mobile')?.remove();
+  });
+
   it('ignores an APS ad ID requested by another configured slot', async () => {
     const renderer = apsRenderer();
     (window as TestWindow).tsjs.bids.homepage_header = {
diff --git a/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts b/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts
index 3700744bc..689287850 100644
--- a/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts
@@ -211,6 +211,27 @@ describe('prebid/auctionBidsToPrebidBids', () => {
     );
   });
 
+  it('drops an APS bid whose renderer fails admission validation', () => {
+    const result = auctionBidsToPrebidBids(
+      [
+        {
+          impid: 'div-aps',
+          adm: '',
+          renderer: { ...apsRenderer(), aaxResponse: 'invalid' },
+          price: 1.23,
+          width: 300,
+          height: 250,
+          seat: 'aps',
+          creativeId: 'fictional-creative-id',
+          adomain: [],
+        },
+      ],
+      [{ adUnitCode: 'div-aps', bidId: 'prebid-request-id' }]
+    );
+
+    expect(result).toEqual([]);
+  });
+
   it('falls back to impid when no matching bidRequest found', () => {
     const auctionBids: AuctionBid[] = [
       {
@@ -345,6 +366,7 @@ describe('prebid/installPrebidNpm', () => {
   });
 
   it('does not register malformed or non-trusted APS renderer capabilities', () => {
+    const warnSpy = vi.spyOn(log, 'warn').mockImplementation(() => {});
     installPrebidNpm();
 
     const bidResponseListener = mockOnEvent.mock.calls.find(
@@ -369,7 +391,10 @@ describe('prebid/installPrebidNpm', () => {
 
     expect((window as any).tsjs?.apsPrebidRenderers?.['malformed-ad-id']).toBeUndefined();
     expect((window as any).tsjs?.apsPrebidRenderers?.['foreign-ad-id']).toBeUndefined();
-    expect(malformedBid).not.toHaveProperty('trustedServerRenderer');
+    expect(malformedBid).toHaveProperty('trustedServerRenderer');
+    expect(warnSpy).toHaveBeenCalledWith(
+      '[tsjs-prebid] rejected APS renderer capability that failed registration'
+    );
   });
 
   it('calls setConfig with debug=false by default', () => {
diff --git a/docs/guide/auction-orchestration.md b/docs/guide/auction-orchestration.md
index 0641e73ca..e237bb2e4 100644
--- a/docs/guide/auction-orchestration.md
+++ b/docs/guide/auction-orchestration.md
@@ -360,7 +360,6 @@ Builds an independent banner OpenRTB request for Amazon Publisher Services.
 [integrations.aps]
 enabled = true
 account_id = "example-account"
-endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 800
 debug = false
 allow_script_creatives = false
@@ -540,6 +539,45 @@ Auction results are returned in standard OpenRTB format with an `ext.orchestrato
 }
 ```
 
+APS renderer winners use the same OpenRTB response with a typed renderer extension instead of `adm`:
+
+```json
+{
+  "id": "auction-abc123",
+  "seatbid": [
+    {
+      "seat": "aps",
+      "bid": [
+        {
+          "id": "upstream-aps-bid-id",
+          "impid": "header-banner",
+          "price": 2.5,
+          "w": 728,
+          "h": 90,
+          "ext": {
+            "trusted_server": {
+              "renderer": {
+                "type": "aps",
+                "version": 1,
+                "accountId": "example-account",
+                "bidId": "upstream-aps-bid-id",
+                "tagType": "iframe",
+                "creativeUrl": "https://creative.example/render",
+                "aaxResponse": "fictional-base64-envelope",
+                "width": 728,
+                "height": 90
+              }
+            }
+          }
+        }
+      ]
+    }
+  ]
+}
+```
+
+For these bids, `id` preserves APS's upstream bid ID, `crid` is present only when APS supplies one, and `adm` is absent. TSJS understands this contract; other `/auction` consumers must render `ext.trusted_server.renderer` explicitly.
+
 EC identity is maintained with the `ts-ec` cookie; auction responses do not emit EC ID headers.
 
 ## Creative Processing
@@ -585,7 +623,6 @@ debug = false
 [integrations.aps]
 enabled = true
 account_id = "example-account"
-endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 800
 debug = false
 allow_script_creatives = false
@@ -622,14 +659,16 @@ price_floor = 0.50
 
 #### `[integrations.aps]`
 
-| Field                    | Type   | Default                                            | Description                                                       |
-| ------------------------ | ------ | -------------------------------------------------- | ----------------------------------------------------------------- |
-| `enabled`                | bool   | `false`                                            | Enable APS provider                                               |
-| `account_id`             | string | —                                                  | APS account ID (required; `pub_id` is an alias)                   |
-| `endpoint`               | string | `https://web.ads.aps.amazon-adsystem.com/e/pb/bid` | APS OpenRTB endpoint                                              |
-| `timeout_ms`             | u32    | `800`                                              | Request timeout                                                   |
-| `debug`                  | bool   | `false`                                            | Include the raw APS HTTP exchange in `/auction` provider metadata |
-| `allow_script_creatives` | bool   | `false`                                            | Admit script bids before APS candidate reduction                  |
+| Field                    | Type   | Default                       | Description                                                       |
+| ------------------------ | ------ | ----------------------------- | ----------------------------------------------------------------- |
+| `enabled`                | bool   | `false`                       | Enable APS provider                                               |
+| `account_id`             | string | —                             | APS account ID (required; `pub_id` is an alias)                   |
+| `endpoint`               | string | Built-in APS OpenRTB endpoint | Optional APS OpenRTB endpoint override                            |
+| `timeout_ms`             | u32    | `800`                         | Request timeout                                                   |
+| `debug`                  | bool   | `false`                       | Include the raw APS HTTP exchange in `/auction` provider metadata |
+| `inventory_domain`       | string | —                             | Override `site.domain` for APS-authorized inventory               |
+| `inventory_page_origin`  | string | —                             | HTTPS origin paired with `inventory_domain` for `site.page`       |
+| `allow_script_creatives` | bool   | `false`                       | Admit script bids before APS candidate reduction                  |
 
 #### `[integrations.adserver_mock]`
 
diff --git a/docs/guide/configuration.md b/docs/guide/configuration.md
index b025c67e7..d549612d2 100644
--- a/docs/guide/configuration.md
+++ b/docs/guide/configuration.md
@@ -1222,7 +1222,6 @@ timeout_ms = 2000
 [integrations.aps]
 enabled = true
 account_id = "example-account"
-endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 debug = false
 # Optional pair for deployments hosted away from APS-authorized inventory.
 # inventory_domain = "publisher.example"
diff --git a/docs/guide/integrations/aps.md b/docs/guide/integrations/aps.md
index 4a3479870..24c381cc0 100644
--- a/docs/guide/integrations/aps.md
+++ b/docs/guide/integrations/aps.md
@@ -10,7 +10,7 @@ Trusted Server can request banner bids from Amazon Publisher Services (APS) thro
 The integration supports:
 
 - banner impressions;
-- APS OpenRTB requests to `https://web.ads.aps.amazon-adsystem.com/e/pb/bid`;
+- APS OpenRTB requests to the integration's built-in production endpoint;
 - decoded-CPM winner selection with or without a mediator;
 - direct `/auction` rendering;
 - client-side `trustedServer` Prebid adapter auctions through GAM; and
@@ -29,7 +29,6 @@ The integration does not implement:
 [integrations.aps]
 enabled = true
 account_id = "example-aps-account-id"
-endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 800
 # Include raw APS request/response data in /auction metadata on test sites only.
 debug = false
@@ -94,7 +93,7 @@ Set `debug = true` under `[integrations.aps]` to include the direct APS HTTP exc
             "responsebody": "{...}",
             "responseheaders": { "content-type": ["application/json"] },
             "status": 200,
-            "uri": "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
+            "uri": "https://aps.example.com/e/pb/bid"
           }
         ]
       }
diff --git a/trusted-server.example.toml b/trusted-server.example.toml
index 948d3cf99..7fc412717 100644
--- a/trusted-server.example.toml
+++ b/trusted-server.example.toml
@@ -119,7 +119,6 @@ allowed_context_keys = []
 [integrations.aps]
 enabled = false
 account_id = "example-aps-account-id"
-endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 1000
 # Include raw APS request/response data in /auction metadata on test sites only.
 debug = false

From 221b345e55c22feca46f590dd6cd27058d128d0f Mon Sep 17 00:00:00 2001
From: Christian <christianpavilonis@outlook.com>
Date: Tue, 21 Jul 2026 13:31:17 -0500
Subject: [PATCH 7/9] Update APS OpenRTB design records

---
 .../2026-07-15-aps-openrtb-first-class-integration.md      | 6 +-----
 ...026-07-15-aps-openrtb-first-class-integration-design.md | 7 +------
 2 files changed, 2 insertions(+), 11 deletions(-)

diff --git a/docs/superpowers/plans/2026-07-15-aps-openrtb-first-class-integration.md b/docs/superpowers/plans/2026-07-15-aps-openrtb-first-class-integration.md
index 0f89e6f9f..b90fe5fe8 100644
--- a/docs/superpowers/plans/2026-07-15-aps-openrtb-first-class-integration.md
+++ b/docs/superpowers/plans/2026-07-15-aps-openrtb-first-class-integration.md
@@ -192,11 +192,7 @@ replacing request/response behavior.
       rename the custom deserializer/error text accordingly.
 - [ ] Add `allow_script_creatives: bool` with a serde default of `false`. Treat it as a
       server-side bid-eligibility capability, not a browser-only rendering preference.
-- [ ] Change `default_endpoint()` to:
-
-  ```text
-  https://web.ads.aps.amazon-adsystem.com/e/pb/bid
-  ```
+- [ ] Change `default_endpoint()` to the built-in production APS `/e/pb/bid` endpoint. Use `https://aps.example.com/e/pb/bid` only for documentation and test overrides.
 
 - [ ] Replace generic URL-only endpoint validation with a custom check requiring HTTPS,
       a non-empty host, and no username/password. Do not add a plaintext test exception:
diff --git a/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md b/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md
index 82802970c..2f79577ed 100644
--- a/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md
+++ b/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md
@@ -18,11 +18,7 @@ with the OpenRTB contract used by the official APS Prebid.js adapter, so APS can
 4. preserve Trusted Server's existing privacy, sanitization, bounded-I/O, and
    observability invariants.
 
-The new default endpoint is:
-
-```text
-https://web.ads.aps.amazon-adsystem.com/e/pb/bid
-```
+The integration uses its built-in production OpenRTB endpoint by default. Examples use a fictional override endpoint.
 
 The implementation may proceed against fictional fixtures and a controlled APS test
 account before APS confirms Fastly/edge-originated production support. Lack of that
@@ -130,7 +126,6 @@ The canonical configuration becomes:
 [integrations.aps]
 enabled = false
 account_id = "example-account-id"
-endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 800
 allow_script_creatives = false
 ```

From b00655ef6b2e7f9789d29391d29098d4e2c7bdb9 Mon Sep 17 00:00:00 2001
From: Christian <christianpavilonis@outlook.com>
Date: Mon, 27 Jul 2026 12:20:14 -0500
Subject: [PATCH 8/9] Address APS review feedback

---
 .../src/integrations/aps.rs                   | 17 +++++++--
 .../src/integrations/prebid.rs                | 36 +++++++------------
 .../browser/tests/shared/aps-renderer.spec.ts |  4 +--
 .../lib/src/integrations/prebid/index.ts      |  9 +++--
 .../test/integrations/prebid/index.test.ts    |  2 +-
 5 files changed, 32 insertions(+), 36 deletions(-)

diff --git a/crates/trusted-server-core/src/integrations/aps.rs b/crates/trusted-server-core/src/integrations/aps.rs
index 460160537..fe02a5207 100644
--- a/crates/trusted-server-core/src/integrations/aps.rs
+++ b/crates/trusted-server-core/src/integrations/aps.rs
@@ -8,6 +8,7 @@ use async_trait::async_trait;
 use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64_STANDARD};
 use edgezero_core::body::Body as EdgeBody;
 use error_stack::{Report, ResultExt};
+use http::header::HeaderName;
 use http::{HeaderMap, Method, StatusCode, header};
 use serde::de::{self, Visitor};
 use serde::{Deserialize, Serialize};
@@ -132,6 +133,9 @@ pub struct ApsConfig {
     #[serde(default = "default_timeout_ms")]
     pub timeout_ms: u32,
     /// Whether to include the APS HTTP exchange in auction response metadata.
+    ///
+    /// Only enable this for controlled test sites: the client-visible metadata can
+    /// include raw request and response bodies, including creative markup.
     #[serde(default)]
     pub debug: bool,
     /// Whether APS script creatives are eligible before winner selection.
@@ -580,8 +584,15 @@ impl ApsAuctionProvider {
     }
 
     fn debug_headers(headers: &HeaderMap) -> BTreeMap<String, Vec<String>> {
+        // This metadata is returned to page JavaScript. Keep the list fail-closed so
+        // identity or authentication headers from an upstream response never leak.
+        const ALLOWED_HEADERS: &[HeaderName] = &[header::CONTENT_TYPE];
+
         let mut values = BTreeMap::<String, Vec<String>>::new();
         for (name, value) in headers {
+            if !ALLOWED_HEADERS.contains(name) {
+                continue;
+            }
             let Ok(value) = value.to_str() else {
                 continue;
             };
@@ -1794,9 +1805,9 @@ mod tests {
             call["responseheaders"]["content-type"],
             json!(["application/json"])
         );
-        assert_eq!(
-            call["responseheaders"]["x-example-debug"],
-            json!(["first", "second"])
+        assert!(
+            call["responseheaders"].get("x-example-debug").is_none(),
+            "should omit unapproved debug response headers"
         );
         assert_eq!(call["status"], 200);
         assert_eq!(call["uri"], "https://aps.example/openrtb");
diff --git a/crates/trusted-server-core/src/integrations/prebid.rs b/crates/trusted-server-core/src/integrations/prebid.rs
index dd0ec26ba..12f2bec7b 100644
--- a/crates/trusted-server-core/src/integrations/prebid.rs
+++ b/crates/trusted-server-core/src/integrations/prebid.rs
@@ -201,7 +201,6 @@ fn extract_prebid_error_message(
 const GPC_US_PRIVACY: &str = "1YYN";
 
 #[derive(Debug, Clone, Deserialize, Serialize, Validate)]
-#[validate(schema(function = "validate_prebid_bidder_lists"))]
 pub struct PrebidIntegrationConfig {
     #[serde(default = "default_enabled")]
     pub enabled: bool,
@@ -343,27 +342,19 @@ pub struct PrebidIntegrationConfig {
     pub suppress_nurl_bidders: Vec<String>,
 }
 
-fn validate_prebid_bidder_lists(config: &PrebidIntegrationConfig) -> Result<(), ValidationError> {
+fn remove_aps_bidders(config: &mut PrebidIntegrationConfig) {
     for (field, bidders) in [
-        ("bidders", &config.bidders),
-        ("client_side_bidders", &config.client_side_bidders),
+        ("bidders", &mut config.bidders),
+        ("client_side_bidders", &mut config.client_side_bidders),
     ] {
-        if bidders
-            .iter()
-            .any(|bidder| bidder.eq_ignore_ascii_case("aps"))
-        {
-            let mut error = ValidationError::new("aps_managed_by_dedicated_integration");
-            error.message = Some(
-                format!(
-                    "integrations.prebid.{field} must not include APS; configure APS under [integrations.aps]"
-                )
-                .into(),
+        let original_len = bidders.len();
+        bidders.retain(|bidder| !bidder.eq_ignore_ascii_case("aps"));
+        if bidders.len() != original_len {
+            log::warn!(
+                "prebid: ignoring APS in integrations.prebid.{field}; configure APS under [integrations.aps]"
             );
-            return Err(error);
         }
     }
-
-    Ok(())
 }
 
 impl IntegrationConfig for PrebidIntegrationConfig {
@@ -903,12 +894,13 @@ fn escape_html_attr(value: &str) -> String {
 fn build(
     settings: &Settings,
 ) -> Result<Option<Arc<PrebidIntegration>>, Report<TrustedServerError>> {
-    let Some(config) =
+    let Some(mut config) =
         settings.integration_config::<PrebidIntegrationConfig>(PREBID_INTEGRATION_ID)?
     else {
         return Ok(None);
     };
 
+    remove_aps_bidders(&mut config);
     validate_external_bundle_config(&config, &settings.proxy.allowed_domains)?;
 
     // Warn about bidders that appear in both lists — this is likely a config
@@ -6642,7 +6634,7 @@ set = { placementId = "explicit_header" }
     }
 
     #[test]
-    fn config_rejects_aps_in_prebid_bidder_lists_case_insensitively() {
+    fn config_accepts_aps_in_prebid_bidder_lists_for_upgrade_compatibility() {
         for (field, bidder) in [
             ("bidders", "aps"),
             ("bidders", "APS"),
@@ -6656,11 +6648,7 @@ server_url = "https://prebid.example"
 {field} = ["{bidder}"]
 "#
             ));
-            let error = result.expect_err("should reject APS in Prebid bidder lists");
-            assert!(
-                error.to_string().contains("configure APS under"),
-                "should include migration guidance for {field}: {error:?}"
-            );
+            assert!(result.is_ok(), "should accept legacy APS in {field}");
         }
     }
 
diff --git a/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts b/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts
index 5424250c8..072195219 100644
--- a/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts
+++ b/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts
@@ -361,9 +361,7 @@ parent.postMessage(JSON.stringify({
         expect(auctionRequests).toBe(1);
         expect(result.acceptedAd).toBe("");
         expect(result.acceptedAdId).not.toBe(apsRenderer.bidId);
-        expect(result.foreignUniversalCreativeResponse).not.toEqual(
-            expect.objectContaining({ apsRenderer }),
-        );
+        expect(result.foreignUniversalCreativeResponse).toBeUndefined();
         expect(result.universalCreativeResponse).toEqual(
             expect.objectContaining({
                 message: "Prebid Response",
diff --git a/crates/trusted-server-js/lib/src/integrations/prebid/index.ts b/crates/trusted-server-js/lib/src/integrations/prebid/index.ts
index 826fec4b4..1c780f5ff 100644
--- a/crates/trusted-server-js/lib/src/integrations/prebid/index.ts
+++ b/crates/trusted-server-js/lib/src/integrations/prebid/index.ts
@@ -543,11 +543,10 @@ function installApsBidResponseRegistry(): void {
         markRendered: () => markBidAsRendered(rawBid),
       }
     );
-    if (registered) {
-      // Keep the executable capability only in the bounded, one-time registry. Prebid
-      // still owns the generated ad ID and ordinary GAM targeting on this bid object.
-      delete bid[APS_RENDERER_FIELD];
-    } else {
+    // Keep the executable capability only in the bounded, one-time registry. Prebid
+    // still owns the generated ad ID and ordinary GAM targeting on this bid object.
+    delete bid[APS_RENDERER_FIELD];
+    if (!registered) {
       log.warn('[tsjs-prebid] rejected APS renderer capability that failed registration');
     }
   });
diff --git a/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts b/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts
index 689287850..9e40322bd 100644
--- a/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts
@@ -391,7 +391,7 @@ describe('prebid/installPrebidNpm', () => {
 
     expect((window as any).tsjs?.apsPrebidRenderers?.['malformed-ad-id']).toBeUndefined();
     expect((window as any).tsjs?.apsPrebidRenderers?.['foreign-ad-id']).toBeUndefined();
-    expect(malformedBid).toHaveProperty('trustedServerRenderer');
+    expect(malformedBid).not.toHaveProperty('trustedServerRenderer');
     expect(warnSpy).toHaveBeenCalledWith(
       '[tsjs-prebid] rejected APS renderer capability that failed registration'
     );

From 0cb06efdb81e6c016454c3b28e34f9ef71622b05 Mon Sep 17 00:00:00 2001
From: Christian <christianpavilonis@outlook.com>
Date: Mon, 27 Jul 2026 12:41:20 -0500
Subject: [PATCH 9/9] Fix rebased CI regressions

---
 crates/trusted-server-core/src/publisher.rs   |   1 +
 .../lib/src/integrations/gpt/index.ts         | 368 ++++++++++--------
 2 files changed, 213 insertions(+), 156 deletions(-)

diff --git a/crates/trusted-server-core/src/publisher.rs b/crates/trusted-server-core/src/publisher.rs
index 942e014f4..547c82127 100644
--- a/crates/trusted-server-core/src/publisher.rs
+++ b/crates/trusted-server-core/src/publisher.rs
@@ -1518,6 +1518,7 @@ pub async fn handle_publisher_request(
             certificate_check: settings.proxy.certificate_check,
             first_byte_timeout: DEFAULT_PUBLISHER_FIRST_BYTE_TIMEOUT,
             between_bytes_timeout: DEFAULT_PUBLISHER_FIRST_BYTE_TIMEOUT,
+            discriminator: None,
         })
         .change_context(TrustedServerError::Proxy {
             message: "backend registration failed".to_string(),
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt/index.ts b/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
index 5fb0c6a69..4e733e496 100644
--- a/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
+++ b/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
@@ -64,22 +64,10 @@ function findSlotElementByDivId(divId: string): HTMLElement | null {
   const exact = document.getElementById(divId);
   if (exact) return exact;
 
-  const configuredDivIds = (window.tsjs?.adSlots ?? [])
-    .map((slot) => slot.div_id)
-    .filter((configured) => configured.length > 0);
-
   return (
-    Array.from(document.querySelectorAll<HTMLElement>('[id]')).find((element) => {
-      if (!element.id.startsWith(divId) || element.id.endsWith('-container')) return false;
-
-      // Generated slot IDs can extend a configured prefix. When configured
-      // prefixes overlap, assign the element to the longest matching prefix so
-      // `div-header` cannot claim an iframe owned by `div-header-mobile`.
-      const owner = configuredDivIds
-        .filter((configured) => element.id.startsWith(configured))
-        .sort((left, right) => right.length - left.length)[0];
-      return owner === undefined || owner === divId;
-    }) ?? null
+    Array.from(document.querySelectorAll<HTMLElement>('[id]')).find(
+      (el) => el.id.startsWith(divId) && !el.id.endsWith('-container')
+    ) ?? null
   );
 }
 
@@ -104,10 +92,17 @@ function slotIdForMessageSource(source: MessageEventSource | null): string | und
   if (!source) return undefined;
 
   const slots = window.tsjs?.adSlots ?? [];
-  return slots.find((slot) =>
-    candidateSlotRoots(slot.div_id).some((root) =>
+  const ownsSource = (roots: HTMLElement[]): boolean =>
+    roots.some((root) =>
       Array.from(root.querySelectorAll('iframe')).some((iframe) => iframe.contentWindow === source)
-    )
+    );
+  // Prefer exact configured IDs before prefix/container fallbacks so a nested
+  // dynamic slot cannot be claimed by an overlapping parent slot.
+  return (
+    slots.find((slot) => {
+      const root = document.getElementById(slot.div_id);
+      return root !== null && ownsSource([root]);
+    }) ?? slots.find((slot) => ownsSource(candidateSlotRoots(slot.div_id)))
   )?.id;
 }
 
@@ -311,7 +306,11 @@ export function safeAdmIframeSrc(src: string): string | undefined {
  *
  * Adapted from PR #241 (github.com/IABTechLab/trusted-server/pull/241).
  * Instead of reading from pbjs, reads adm directly from window.tsjs.bids.
- * Only active when inject_adm_for_testing injects adm server-side.
+ *
+ * This is the testing-only direct-replace path that bypasses GAM entirely. The
+ * sanitized `adm` now ships in production for the pbRender bridge, so `adm`
+ * presence no longer gates it; the caller gates on the per-bid `debug_bid`
+ * signal (present only under `inject_adm_for_testing`) instead.
  *
  * Strategy:
  * 1. If adm contains an <iframe src="..."> with a safe http(s) src, set that
@@ -586,8 +585,16 @@ export function installTsAdInit(): void {
           slotsToRefresh.push(gptSlot);
         }
 
-        // Trusted Server APS winners carry their own typed renderer and never
-        // enter the publisher-owned native apstag rendering path.
+        // APS: signal to apstag that bids are ready so Amazon's GAM creative
+        // can render.  apstag must already be initialised on the page (which it
+        // is on production publisher pages).  Safe no-op if apstag is absent.
+        if (
+          (bid.hb_bidder === 'aps' || bid.hb_bidder === 'amazon-aps') &&
+          bid.renderer === undefined
+        ) {
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          (window as any).apstag?.setDisplayBids?.();
+        }
       });
 
       ts.prevGptSlots = newSlots as unknown[];
@@ -618,10 +625,13 @@ export function installTsAdInit(): void {
           // Read ts.bids live (not the snapshot above) so post-navigation bid data is used.
           const bid = (ts.bids ?? {})[slotId] ?? {};
 
-          // GAM interceptor (testing): when adm is present, replace the GAM creative.
-          // Adapted from PR #241 — uses window.tsjs.bids[slotId].adm instead of pbjs.
-          // Only active when inject_adm_for_testing injects adm into bids server-side.
-          if (bid.adm) {
+          // GAM interceptor (testing bypass): directly replace the GAM creative.
+          // `adm` is now always injected in production, so it can no longer gate
+          // this path. `debug_bid` is present only when inject_adm_for_testing is
+          // on, so it is the per-bid signal that the testing bypass is enabled.
+          // In production the render bridge serves the creative and GAM stays in
+          // the loop; this direct replace stays testing-only.
+          if (bid.adm && bid.debug_bid) {
             injectAdmIntoSlot(divId, bid.adm);
           }
         });
@@ -733,16 +743,17 @@ export function installSpaAuctionHook(): void {
   ts.spaHookInstalled = true;
 
   let inflight: AbortController | null = null;
-  // Last path and query an auction was run for. popstate fires for hash-only
-  // changes and pushState/replaceState can be called with the current URL, so
-  // guard every entry point against re-requesting impressions already loaded.
-  let currentPath = `${location.pathname}${location.search}`;
+  // Last path an auction was run for. popstate fires for hash-only and
+  // same-pathname back/forward (scroll restoration), and pushState/replaceState
+  // can be called with the current URL, so guard every entry point against
+  // re-requesting impressions for a path we already loaded.
+  let currentPath = location.pathname;
   // Last path whose slots/bids were actually applied — the initial SSR page
   // counts. A failed navigation rolls `currentPath` back to this rather than to
   // the immediately-previous committed value: on rapid A→B where A was aborted
   // mid-flight and B then fails, rolling back to A (never loaded) would strand
   // it behind the no-op guard, so we roll back to the last applied route instead.
-  let lastAppliedPath = `${location.pathname}${location.search}`;
+  let lastAppliedPath = location.pathname;
 
   async function onNavigate(path: string): Promise<void> {
     if (path === currentPath) return;
@@ -802,9 +813,8 @@ export function installSpaAuctionHook(): void {
     const original = history[method].bind(history);
     history[method] = function (state: unknown, unused: string, url?: string | URL | null): void {
       original(state, unused, url);
-      const locationUrl = url ? new URL(String(url), location.href) : location;
-      const newPath = `${locationUrl.pathname}${locationUrl.search}`;
-      // onNavigate no-ops when newPath equals the last loaded path and query.
+      const newPath = url ? new URL(String(url), location.href).pathname : location.pathname;
+      // onNavigate no-ops when newPath equals the last loaded path.
       void onNavigate(newPath);
     };
   }
@@ -813,7 +823,7 @@ export function installSpaAuctionHook(): void {
   patchHistoryMethod('replaceState');
 
   window.addEventListener('popstate', () => {
-    void onNavigate(`${location.pathname}${location.search}`);
+    void onNavigate(location.pathname);
   });
 }
 
@@ -844,6 +854,79 @@ const TS_DISPLAY_RENDERER =
   'if(d.adUrl&&!d.ad){f.src=d.adUrl;}else{f.srcdoc=d.ad;}' +
   'w.document.body.appendChild(f);};})();';
 
+/** The clear-price auction macro DSPs embed in creative markup and tracking URLs. */
+const AUCTION_PRICE_MACRO = '${AUCTION_PRICE}';
+
+/**
+ * Substitute the `${AUCTION_PRICE}` macro with a clearing price. Mirrors the
+ * server-side `expand_auction_price_macro`: only the exact clear-price token is
+ * replaced, so the encrypted `${AUCTION_PRICE:B64}` variant is left intact.
+ */
+function expandAuctionPriceMacro(markup: string, cpm: number): string {
+  return markup.includes(AUCTION_PRICE_MACRO)
+    ? markup.split(AUCTION_PRICE_MACRO).join(String(cpm))
+    : markup;
+}
+
+/** A decoded PBS Cache bid: the renderable creative plus its render metadata. */
+export interface CachedBid {
+  adm: string;
+  width?: number;
+  height?: number;
+  price?: number;
+}
+
+/**
+ * Decode a PBS Cache GET response into a renderable bid.
+ *
+ * Prebid Cache entries are JSON bid objects (`{ "adm": "<div…>", "w": …, … }`);
+ * the Prebid Universal Creative's own cache path `JSON.parse`s the response and
+ * renders `bidObject.adm`, sizing from the cached dimensions. This mirrors that,
+ * retaining the fields the fallback render needs — creative dimensions (`w`/`h`
+ * or `width`/`height`) and clearing `price` for macro expansion — rather than
+ * reducing the payload to a bare `adm` string that forces the first slot format
+ * and leaves price macros unresolved.
+ *
+ * A non-JSON body is treated as raw creative markup (the `{ adm }`-only variant)
+ * for backward compatibility with caches that store the creative directly.
+ * Returns `undefined` when the JSON payload carries no usable string `adm`, so
+ * the caller can decline to render instead of injecting a serialized object.
+ */
+export function parseCachedBid(body: string): CachedBid | undefined {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    // Not JSON — a cache that returned the creative markup directly. No render
+    // metadata is available, so only the raw markup variant is returned.
+    return body.trim().length > 0 ? { adm: body } : undefined;
+  }
+  if (!parsed || typeof parsed !== 'object') {
+    // A JSON primitive (string/number/bool) is not a valid cached bid object.
+    return undefined;
+  }
+  const obj = parsed as Record<string, unknown>;
+  const adm = obj.adm;
+  if (typeof adm !== 'string' || adm.length === 0) return undefined;
+
+  const num = (v: unknown): number | undefined =>
+    typeof v === 'number' && Number.isFinite(v) ? v : undefined;
+  // A zero (or missing) dimension is not usable render metadata; treat it as
+  // absent so the caller falls back to the slot format rather than sizing to 0.
+  const dim = (v: unknown): number | undefined => {
+    const n = num(v);
+    return n !== undefined && n > 0 ? n : undefined;
+  };
+
+  return {
+    adm,
+    // PBS OpenRTB bids carry w/h; the Prebid.js cache format uses width/height.
+    width: dim(obj.w) ?? dim(obj.width),
+    height: dim(obj.h) ?? dim(obj.height),
+    price: num(obj.price),
+  };
+}
+
 /**
  * Install the TS → pbRender bridge.
  *
@@ -853,7 +936,9 @@ const TS_DISPLAY_RENDERER =
  *
  * When `adId` matches a TS server-side bid in `window.tsjs.bids` AND the bid
  * has renderable markup, the bridge:
- *   1. Uses debug `adm` directly when present, otherwise fetches from PBS Cache.
+ *   1. Uses the inline `adm` directly when present (the sanitized winning
+ *      creative, now shipped in production), otherwise fetches from PBS Cache
+ *      and extracts `adm` from the cached bid JSON (see `extractCachedAdm`).
  *   2. Replies via the MessageChannel port with a `"Prebid Response"`.
  *   3. Calls `stopImmediatePropagation()` so Prebid.js does not also process
  *      the message and log spurious failures.
@@ -864,27 +949,15 @@ const TS_DISPLAY_RENDERER =
 export function installTsRenderBridge(): void {
   if (typeof window === 'undefined') return;
 
-  // adIds whose PBS Cache render is in flight. `fireWinBillingBeacons` only
-  // dedups after the async cache fetch resolves, so two Prebid Request messages
-  // for the same adId arriving before the first fetch settles would both fetch
-  // and both fire the nurl/burl beacons. Tracking in-flight adIds prevents the
-  // concurrent double-fire; the entry is cleared once the fetch settles.
-  const renderingAdIds = new Set<string>();
+  // `slotId|adId` renders whose PBS Cache fetch is in flight. `fireWinBillingBeacons`
+  // only dedups after the async fetch resolves, so two Prebid Request messages for
+  // the same render arriving before the first fetch settles would both fetch and
+  // both fire the nurl/burl beacons. Tracking the in-flight render prevents the
+  // concurrent double-fire; the entry is cleared once the fetch settles. The key
+  // is scoped to the slot, not the bare adId: hb_adid is not unique per bid, so
+  // keying on it alone would let one slot block a distinct slot's render.
+  const renderingKeys = new Set<string>();
   const consumedPrebidApsIds = new Map<string, { adUnitCode: string; expiresAt: number }>();
-  const rememberConsumedPrebidApsId = (
-    adId: string,
-    entry: { adUnitCode: string; expiresAt: number }
-  ): void => {
-    const now = Date.now();
-    for (const [consumedAdId, consumed] of consumedPrebidApsIds) {
-      if (consumed.expiresAt <= now) consumedPrebidApsIds.delete(consumedAdId);
-    }
-    if (!consumedPrebidApsIds.has(adId) && consumedPrebidApsIds.size >= 256) {
-      const oldestAdId = consumedPrebidApsIds.keys().next().value as string | undefined;
-      if (oldestAdId) consumedPrebidApsIds.delete(oldestAdId);
-    }
-    consumedPrebidApsIds.set(adId, entry);
-  };
 
   window.addEventListener('message', (e: MessageEvent) => {
     let data: Record<string, unknown>;
@@ -903,126 +976,86 @@ export function installTsRenderBridge(): void {
 
     const port = e.ports?.[0];
     if (!port) return;
+    const sourceSlotId = slotIdForMessageSource(e.source);
+    if (!sourceSlotId) return;
 
     const consumedPrebidAps = consumedPrebidApsIds.get(adId);
-    if (consumedPrebidAps) {
-      if (consumedPrebidAps.expiresAt <= Date.now()) {
-        consumedPrebidApsIds.delete(adId);
-      } else {
-        if (messageSourceBelongsToAdUnit(e.source, consumedPrebidAps.adUnitCode)) {
-          e.stopImmediatePropagation();
-        }
-        return;
+    if (consumedPrebidAps && consumedPrebidAps.expiresAt > Date.now()) {
+      if (messageSourceBelongsToAdUnit(e.source, consumedPrebidAps.adUnitCode)) {
+        e.stopImmediatePropagation();
       }
+      return;
     }
 
-    // Client-side trustedServer adapter bids receive a new adId from Prebid. Bind
-    // that ID to the server-validated APS descriptor only after confirming the
-    // requesting Universal Creative frame belongs to the same GPT ad unit.
     const prebidRendererEntry = getApsPrebidRenderer(adId);
     if (prebidRendererEntry) {
       if (!messageSourceBelongsToAdUnit(e.source, prebidRendererEntry.adUnitCode)) return;
       const renderer = validateApsRenderer(prebidRendererEntry.renderer);
       const rendererUrl = apsRendererUrl();
-      if (!renderer || !rendererUrl) return;
-      if (!consumeApsPrebidRenderer(adId, prebidRendererEntry)) return;
-      rememberConsumedPrebidApsId(adId, {
+      if (!renderer || !rendererUrl || !consumeApsPrebidRenderer(adId, prebidRendererEntry)) return;
+      e.stopImmediatePropagation();
+      consumedPrebidApsIds.set(adId, {
         adUnitCode: prebidRendererEntry.adUnitCode,
         expiresAt: prebidRendererEntry.expiresAt,
       });
-
-      e.stopImmediatePropagation();
-      try {
-        prebidRendererEntry.markWinner();
-      } catch (err) {
-        log.warn('[tsjs-gpt] pbRender bridge: Prebid APS winner lifecycle failed', err);
-        return;
-      }
-
-      try {
-        port.postMessage(
-          JSON.stringify({
-            message: 'Prebid Response',
-            adId,
-            renderer: APS_UNIVERSAL_CREATIVE_RENDERER,
-            rendererVersion: APS_UNIVERSAL_CREATIVE_RENDERER_VERSION,
-            rendererUrl,
-            apsRenderer: renderer,
-            width: renderer.width,
-            height: renderer.height,
-          })
-        );
-      } catch (err) {
-        log.warn('[tsjs-gpt] pbRender bridge: Prebid APS response failed', err);
-        return;
-      }
-
-      try {
-        prebidRendererEntry.markRendered();
-      } catch (err) {
-        log.warn('[tsjs-gpt] pbRender bridge: Prebid APS rendered lifecycle failed', err);
-      }
-      log.debug(
-        `[tsjs-gpt] pbRender bridge served Prebid APS bid for '${prebidRendererEntry.adUnitCode}'`
+      prebidRendererEntry.markWinner();
+      port.postMessage(
+        JSON.stringify({
+          message: 'Prebid Response',
+          adId,
+          renderer: APS_UNIVERSAL_CREATIVE_RENDERER,
+          rendererVersion: APS_UNIVERSAL_CREATIVE_RENDERER_VERSION,
+          rendererUrl,
+          apsRenderer: renderer,
+          width: renderer.width,
+          height: renderer.height,
+        })
       );
+      prebidRendererEntry.markRendered();
       return;
     }
 
-    const sourceSlotId = slotIdForMessageSource(e.source);
-    if (!sourceSlotId) return;
-
-    // Build reverse map adId → slotId from live window.tsjs.bids.
+    // Resolve the bid by the requesting slot, not by the first bid whose hb_adid
+    // matches. hb_adid is not unique per bid: absent PBS Cache, it falls back to a
+    // creative id a bidder may reuse across slots. A first-match-by-adId lookup
+    // would resolve every duplicate to one slot, so all but that slot render blank.
     const bids = window.tsjs?.bids ?? {};
-    let slotId: string | undefined;
-    let matchedBid: (typeof bids)[string] | undefined;
-    for (const [sid, bid] of Object.entries(bids)) {
-      if (bid.hb_adid === adId) {
-        slotId = sid;
-        matchedBid = bid;
-        break;
-      }
-    }
-
-    // Not a TS bid — let Prebid.js handle it.
-    if (!slotId || !matchedBid) return;
+    const slotId = sourceSlotId;
+    const matchedBid = bids[slotId];
 
-    // The requesting iframe's slot must own the resolved adId. Without this an
-    // iframe under slot A could request slot B's hb_adid and receive slot B's
-    // creative/dimensions while firing slot B's win/billing beacons.
-    if (slotId !== sourceSlotId) return;
-
-    const slot = window.tsjs?.adSlots?.find((s) => s.id === slotId);
-    const [width, height] = slot?.formats?.[0] ?? [728, 90];
+    // Not a TS bid, or the requesting slot's bid does not own this adId — let
+    // Prebid.js handle it. The adId guard also prevents an iframe under slot A from
+    // pulling slot B's creative and firing slot B's win/billing beacons.
+    if (!matchedBid || matchedBid.hb_adid !== adId) return;
 
     if (matchedBid.renderer !== undefined) {
       const renderer = validateApsRenderer(matchedBid.renderer);
       const rendererUrl = apsRendererUrl();
       if (!renderer || !rendererUrl) return;
-
-      // Ownership and the complete envelope are valid before this handler
-      // claims the message. APS responses are intentionally repeatable: GAM can
-      // request the same server-rendered Universal Creative more than once.
       e.stopImmediatePropagation();
-      try {
-        port.postMessage(
-          JSON.stringify({
-            message: 'Prebid Response',
-            adId,
-            renderer: APS_UNIVERSAL_CREATIVE_RENDERER,
-            rendererVersion: APS_UNIVERSAL_CREATIVE_RENDERER_VERSION,
-            rendererUrl,
-            apsRenderer: renderer,
-            width: renderer.width,
-            height: renderer.height,
-          })
-        );
-        log.debug(`[tsjs-gpt] pbRender bridge served '${slotId}' through APS renderer`);
-      } catch (err) {
-        log.warn('[tsjs-gpt] pbRender bridge: APS response failed', err);
-      }
+      port.postMessage(
+        JSON.stringify({
+          message: 'Prebid Response',
+          adId,
+          renderer: APS_UNIVERSAL_CREATIVE_RENDERER,
+          rendererVersion: APS_UNIVERSAL_CREATIVE_RENDERER_VERSION,
+          rendererUrl,
+          apsRenderer: renderer,
+          width: renderer.width,
+          height: renderer.height,
+        })
+      );
       return;
     }
 
+    const slot = window.tsjs?.adSlots?.find((s) => s.id === slotId);
+    // Prefer the winning creative's own dimensions; the first configured slot
+    // format is only a fallback and mis-sizes a multi-size slot whose winner is
+    // not the first format.
+    const [fallbackWidth, fallbackHeight] = slot?.formats?.[0] ?? [728, 90];
+    const width = matchedBid.w ?? fallbackWidth;
+    const height = matchedBid.h ?? fallbackHeight;
+
     if (matchedBid.adm) {
       e.stopImmediatePropagation();
       port.postMessage(
@@ -1036,7 +1069,7 @@ export function installTsRenderBridge(): void {
         })
       );
       fireWinBillingBeacons(slotId, matchedBid);
-      log.debug(`[tsjs-gpt] pbRender bridge served '${slotId}' from debug adm`);
+      log.debug(`[tsjs-gpt] pbRender bridge served '${slotId}' from inline adm`);
       return;
     }
 
@@ -1046,26 +1079,49 @@ export function installTsRenderBridge(): void {
     // TS owns this adId — stop Prebid from also processing it.
     e.stopImmediatePropagation();
 
-    // Skip a concurrent re-render of the same adId so its win/billing beacons
-    // fire at most once even before the first cache fetch resolves.
-    if (renderingAdIds.has(adId)) return;
-    renderingAdIds.add(adId);
+    // Skip a concurrent re-render of the same slot's adId so its win/billing
+    // beacons fire at most once even before the first cache fetch resolves.
+    const renderingKey = `${slotId}|${adId}`;
+    if (renderingKeys.has(renderingKey)) return;
+    renderingKeys.add(renderingKey);
 
     const cacheUrl = `https://${matchedBid.hb_cache_host}${matchedBid.hb_cache_path}?uuid=${encodeURIComponent(adId)}`;
 
     fetch(cacheUrl, { mode: 'cors' })
       .then((res) => (res.ok ? res.text() : Promise.reject(res.status)))
-      .then((ad) => {
+      .then((body) => {
+        // PBS Cache returns the cached bid as a JSON object; decode its creative
+        // and render metadata the same way the Prebid Universal Creative does.
+        const cached = parseCachedBid(body);
+        if (!cached) {
+          // No renderable creative in the cache payload — decline rather than
+          // ship a serialized bid document to PUC. Beacons stay unfired.
+          log.warn(
+            `[tsjs-gpt] pbRender bridge: PBS Cache response for '${slotId}' had no renderable adm`
+          );
+          return;
+        }
+        // Resolve the auction-price macro from the cached clearing price, and
+        // size from the cached bid's own dimensions, falling back to the slot
+        // format only when the cache omits them.
+        const ad =
+          cached.price !== undefined
+            ? expandAuctionPriceMacro(cached.adm, cached.price)
+            : cached.adm;
         port.postMessage(
           JSON.stringify({
             message: 'Prebid Response',
             adId,
             ad,
             renderer: TS_DISPLAY_RENDERER,
-            width,
-            height,
+            width: cached.width ?? width,
+            height: cached.height ?? height,
           })
         );
+        // Beacons carry the server-expanded ${AUCTION_PRICE} from the auction's
+        // clearing price, not `cached.price` — the auction result is the
+        // authoritative clearing price, and the cached copy is only the render
+        // source. Do not re-expand them here.
         fireWinBillingBeacons(slotId, matchedBid);
         log.debug(`[tsjs-gpt] pbRender bridge served '${slotId}' from PBS Cache`);
       })
@@ -1073,7 +1129,7 @@ export function installTsRenderBridge(): void {
         log.warn(`[tsjs-gpt] pbRender bridge: PBS Cache fetch failed for '${slotId}'`, err);
       })
       .finally(() => {
-        renderingAdIds.delete(adId);
+        renderingKeys.delete(renderingKey);
       });
   });
 }